Jurisdictions · Malaysia

The NSRF is not what binds you. Your regulator's rulebook is.

Malaysia's National Sustainability Reporting Framework was developed by the Advisory Committee on Sustainability Reporting and endorsed by the Ministry of Finance on 24 September 2024. It sets IFRS S1 and IFRS S2 as the national baseline. What it is not is a law you can be prosecuted under. The NSRF is policy, and it takes legal effect only through the separate rule changes each regulator makes to give it force.

For a listed issuer that means Bursa Malaysia's Listing Requirements, amended on 23 December 2024. For a large private company it will mean the Companies Act. The distinction is not academic: your obligations, your deadlines and the consequences of missing them come from the instrument that applies to you, and the NSRF is the policy those instruments implement.

The timetable

Three groups, and two dates each.

Malaysia is almost always described as a three-group phase-in running 2025, 2026 and 2027. That is half the picture, and it is the half that makes the workload look smaller than it is. Each group has two dates: one when climate reporting under IFRS S2 becomes mandatory, and a second, two to three years later, when the full requirements of both IFRS S1 and IFRS S2 apply. A Group 1 issuer that read only the first date has 2027 to think about, not 2025.

Scroll sideways →

Group	Who is in it	Climate first	Full S1 and S2
Group 1	Main Market listed issuers with market capitalisation of RM2 billion or above, measured at 31 December 2024 or at the date of listing if later. Corporations, REITs and business trusts alike.	Periods beginning on or after 1 Jan 2025	1 Jan 2027
Group 2	Every other Main Market listed issuer, with no size floor. If you are on the Main Market and not in Group 1, you are here.	1 Jan 2026	1 Jan 2028
Group 3	ACE Market listed corporations, and large non-listed companies with annual revenue of RM2 billion or above.	1 Jan 2027	1 Jan 2030

Dates as recorded in the IFRS Foundation's jurisdiction profile for Malaysia, which cites the amended Main Market and ACE Market rules. For what a Group 2 issuer specifically needs in place this cycle, see our FY2026 walkthrough.

The part most coverage skips

Large private companies are in scope, and the test is not this year's revenue.

Almost everything written about Malaysian climate reporting is written for listed issuers, because Bursa moved first and its rules are public. But Group 3 includes large non-listed companies, and for a private group the threshold works differently from the market-capitalisation test that defines Group 1.

The NSRF sets the trigger at consolidated group revenue of RM2 billion or more in each of the two financial years before the year in question, falling back to company-level revenue where there is no group figure. Two things follow. A single exceptional year does not pull you in, and by the same token you cannot drop out by having one quiet one. And because the test looks backwards, a company that crosses RM2 billion this year already knows it will be reporting.

The route into law is also different. Rather than a listing rule, this runs through legislative amendment, including to the Companies Act 2016, alongside a change expanding the Malaysian Accounting Standards Board's remit to cover sustainability standard-setting.

Threshold

Consolidated group revenue of RM2bn or more, in both of the two financial years preceding the reporting year.

Fallback

Where there is no group-level revenue, measured at company level, to match existing financial reporting practice.

Parent
on ISSB

A subsidiary whose holding company already reports under ISSB-aligned standards, or an equivalent such as the ESRS, may rely on the parent's disclosures.

Parent
on other

Where the holding company reports under some other international framework, exemption for up to three reporting periods is possible, but it is a policy decision of the Registrar, not an entitlement.

Reliefs

What you may leave out, and for how long.

Malaysia layers its own transition reliefs on top of the ones already in the ISSB standards. They run from each group's first reporting period, so the clock starts at a different moment for each cohort. Note that the second of these has no international equivalent.

NSRF transition reliefsfrom each group's first period

Climate first Report IFRS S2 only, leaving the rest of IFRS S1 aside Two years for Groups 1 and 2, three years for Group 3, which is where the second date in the table above comes from

Segments Focus climate disclosures on principal business segments A genuinely Malaysian relief with no counterpart in the ISSB text. A diversified group may concentrate on the segments that matter, not covering everything thinly

Scope 3 Omit Scope 3 emissions With an exception that catches people: categories already required by another regulator stay required. The relief is from the standard, not from every obligation you already have

Watch Reliefs are not the same as time Each relief ends on a fixed date, and the disclosure that follows needs a comparative. The year before a relief expires is the year the data has to start being collected properly plan to the second date, not the first

Assurance

Reasonable assurance is mandated from 2028 for Group 1. Plan for it now.

Updated 30 September 2026: the SC's media release of 17 September 2026 confirms the deferral of Group 1 mandatory reasonable assurance to 1 January 2028. Detail below.

You will read, in a great many places, that reasonable assurance over Scope 1 and Scope 2 emissions becomes mandatory for Group 1 entities for periods beginning on or after 1 January 2027. The date has moved. On 17 September 2026 the Securities Commission Malaysia (SC) issued a media release, ACSR's Mandatory Sustainability Assurance Requirement to Take Effect in 2028. It says the Advisory Committee on Sustainability Reporting (ACSR), which the SC chairs, has deferred the commencement of mandatory reasonable assurance on Scope 1 and Scope 2 GHG emissions disclosures for Group 1 applicable entities. The requirement now takes effect for annual reporting periods beginning on or after 1 January 2028, instead of 1 January 2027. Mandatory assurance for Group 2 and Group 3 applicable entities is delayed by one year, to 2029 and 2030 respectively. The release gives as its basis a review by the Minority Shareholders Watch Group and Climate Governance Malaysia of the first cohort of 91 Group 1 listed issuers, which found that further improvements to the quality of disclosures are needed. The dates before and after, and what still applies in the meantime, are set out in what still applies before mandatory assurance.

The date has already moved once, and what the SC has not decided can still move. Its release says the remaining proposals on the assurance framework "will be communicated in due course", and the policy document it links to says mandatory assurance for Scope 3 GHG emissions and other sustainability disclosures "will be determined and announced at a later stage". What is decided is not a suggestion: the date, the level (reasonable), the scope (Scope 1 and Scope 2) and the standard, ISSA 5000 only. The extra year was granted for a specific reason. The release says it "aims to support preparers in strengthening reporting processes, controls and data quality ahead of mandatory assurance". That is a controls problem, not a measurement one.

One design choice is worth noting, because it would differ from Australia, but it is an intention and not yet a decision. The SC's FAQ of 14 January 2026 says the ACSR intends to allow both audit and non-audit practitioners to provide sustainability assurance, provided they register with the Audit Oversight Board. The 17 September 2026 release and policy document do not address who may provide assurance. Australia routes everything through the entity's auditor. If you are choosing a provider, that may be a wider field than a finance team assumes, and the standard applied matters more than the letterhead.

Going straight to reasonable is unusual

Most jurisdictions phase from limited to reasonable assurance over several years. Australia takes six. The Malaysian requirement goes to reasonable assurance on Scope 1 and Scope 2 directly. A reasonable assurance engagement means your controls are tested, not discussed, so the preparation it implies is closer to a financial statement audit than to a review. We have written on what changes for the preparer between the two levels.

Securities
Commission

Chairs the ACSR. Owns the framework and the capital market rules behind it.

Bursa
Malaysia

The instrument that binds a listed issuer: the Main Market and ACE Market Listing Requirements, amended 23 December 2024.

Companies
Commission

The route for non-listed companies, via amendment to the Companies Act 2016. The Registrar also holds the discretion over parent-company exemptions.

Audit
Oversight Board

Regulates auditors of public interest entities, and sits on the committee designing the assurance regime.

Bank Negara

The central bank. Financial institutions answer to its expectations as well as to the rules above.

MASB

Being given an expanded remit as the national sustainability standard-setter.

Who is asking

Six bodies, one framework, and different instruments depending on what you are.

The ACSR is an inter-agency committee rather than a regulator in its own right, which is why the NSRF reads as a policy document and why implementation is spread across several rulebooks. For a preparer the practical question is not what the ACSR decided but which of these bodies can compel you, and through which instrument.

A listed issuer has a clear answer today. A large private group has a date and a direction but is waiting on legislative amendment for the detail, and should be building on the published policy instead of waiting for the gazette.

Check your group and first period →

Or see what IFRS S2 actually requires, compare with how Australia legislated the same standard, or take the readiness diagnostic.

This is maintained reference material, not a statement of product configuration. Auditably records the jurisdiction you select on a reporting cycle as a label. It does not change the disclosure templates or apply jurisdiction-specific validation. What the product does is set out on the coverage page.