Malaysia NSRF in 2026: How Companies Should Prepare for ISSB-Based Sustainability Reporting

Two different Malaysian companies are facing two different problems this year, and both are urgent.

For the remaining Main Market issuers, financial year 2026 is the first year the National Sustainability Reporting Framework applies at all. The measurement year is running now, and the first report lands in 2027.

For the roughly 130 large-cap issuers that started in 2025, the position is less obvious but arguably tighter. Financial year 2026 is their second reporting period, and the climate-first relief that let them disclose against IFRS S2 alone was designed to cover the first two periods. When it lapses, the full breadth of IFRS S1 and Scope 3 emissions arrive together.

So one group is starting, and the other is approaching the end of its runway. Here is how the framework works and what each should be doing.

What The NSRF Actually Is

The Securities Commission Malaysia launched the National Sustainability Reporting Framework on 24 September 2024. It was developed by the Advisory Committee on Sustainability Reporting, an inter-agency body bringing together the Securities Commission, its Audit Oversight Board, Bank Negara Malaysia, the Companies Commission of Malaysia, Bursa Malaysia and the Financial Reporting Foundation.

The framework adopts the ISSB standards, IFRS S1 on general sustainability-related financial information and IFRS S2 on climate, as Malaysia's baseline disclosure standards. It is a national adoption rather than a domestic standard inspired by international practice, which matters because it means disclosures produced under the NSRF should be recognisable to investors anywhere the ISSB standards apply. The IFRS Foundation has published a jurisdictional profile confirming Malaysia's approach and its transition reliefs.

For listed issuers, the requirement is delivered through amendments to the Bursa Malaysia Main Market and ACE Market Listing Requirements finalised on 23 December 2024, with Practice Note 9A expressing the effective dates through the annual report. The sustainability statement is published alongside the annual financial statements rather than as a separate document on its own timetable.

Alongside the framework, the Advisory Committee runs a national capacity-building programme known as PACE, covering policy, assumptions, calculators and education, providing guidance, emissions calculators and training rather than leaving companies to buy capability entirely from advisers.

The Phasing

Three groups, three start dates.

Group 1 covers Main Market listed issuers with market capitalisation of RM2 billion or above, using annual reporting periods commencing on or after 1 January 2025. In Practice Note 9A terms, this applies through annual reports for financial years ending on or after 31 December 2025.

Group 2 covers the remaining Main Market listed issuers, for annual reporting periods commencing on or after 1 January 2026, applying through annual reports for financial years ending on or after 31 December 2026.

Group 3 covers ACE Market listed issuers and large non-listed companies with consolidated revenue of RM2 billion or above, from annual reporting periods commencing on or after 1 January 2027.

The inclusion of large non-listed companies is worth noting, because it takes the framework beyond the listed market. A privately held Malaysian group above the revenue threshold is in scope on the same footing as an ACE Market issuer.

The Transition Reliefs, And When They Run Out

Malaysia layered its own transition reliefs on top of the proportionality mechanisms already built into IFRS S1 and S2. They are the most practically significant feature of the framework, and understanding when they expire matters more than understanding what they permit.

Climate first. Group 1 and Group 2 companies may disclose information on climate-related risks and opportunities only, in accordance with IFRS S2, for their first two annual reporting periods. Broader sustainability topics under IFRS S1 come afterwards.

Principal business segments. During that period, companies may focus their climate disclosures on the operating activities that contribute most to performance, rather than covering every segment from the outset.

Scope 3 postponement. Disclosure of Scope 3 emissions may be deferred, unless the company is already required to report them by its own regulator. That carve-out matters for financial institutions and others sitting under sector-specific supervision.

One point deserves care, because published guidance is not entirely consistent. Some descriptions frame the climate-first relief as covering reporting periods 2025 and 2026 specifically. Others describe it as each company's own first two annual reporting periods. For Group 1 the two readings coincide, giving relief across financial years 2025 and 2026. For Group 2 they diverge, and the difference determines whether the relief covers only financial year 2026 or extends into 2027. Group 2 issuers should confirm their position rather than assume the more generous reading.

For Group 1, the practical implication is clear either way. Financial year 2027 is when the full framework arrives, meaning IFRS S1 sustainability topics beyond climate, coverage extending past principal segments, and Scope 3 emissions. That is a substantial expansion, and the work has to begin during the current year to be ready.

What Must Be Disclosed

The disclosure architecture follows the four pillars that IFRS S1 and S2 share with the TCFD framework before them: governance, strategy, risk management, and metrics and targets.

Under the climate-first sequence, the initial focus is IFRS S2. That means climate-related risks and opportunities that could reasonably affect the company's prospects, the effects on business model and strategy, scenario analysis to assess resilience, and greenhouse gas emissions measured on the Greenhouse Gas Protocol basis.

As the reliefs lapse, IFRS S1 requirements come into play. These extend the same four-pillar structure to other material sustainability-related risks and opportunities, identified through the company's own materiality assessment. IFRS S1 also carries the conceptual foundations, including connectivity with the financial statements and the requirement that information be useful to investors in assessing enterprise value.

Scope 3 is the single largest expansion. Deferred initially, it eventually requires emissions across the value chain, assembled largely from supplier and customer data the company does not control.

Assurance Is On The Roadmap

There is a disclosure requirement now and a substantive requirement coming.

The immediate obligation is transparency about verification. Listed issuers must state whether the sustainability statement underwent internal review by an internal auditor or independent assurance under a recognised standard such as ISAE 3000 (Revised) or ISSA 5000, and must disclose the conclusions of any independent assurance obtained. External assurance itself remains voluntary.

The substantive requirement is more demanding than most jurisdictions have attempted at first application. Malaysia has set out reasonable assurance on Scope 1 and Scope 2 greenhouse gas emissions, arriving two years after initial adoption of the ISSB standards: Group 1 for annual reporting periods beginning on or after 1 January 2027, Group 2 from 1 January 2028, and Group 3 from 1 January 2029. Most jurisdictions introducing assurance begin with limited assurance and escalate later, so this is a notably steep entry point.

One important qualification. That timeline is a proposal and has been described as subject to further consultation, with the full assurance framework to be issued by a Sustainability Assurance Working Group. Plan against reasonable assurance, since that is the stated intention, but confirm the position before committing budget, because both the level and the dates could still move.

Provider eligibility is also being formalised. Assurance engagements are expected to follow ISAE 3000 (Revised) or ISSA 5000, with providers subject to Audit Oversight Board registration and competency requirements.

What is not in doubt is the timing pressure. For Group 1, assurance and the expiry of the climate-first relief land in the same year. Financial year 2027 brings broader IFRS S1 topics, Scope 3, and assured Scope 1 and 2 figures simultaneously. That convergence is the single most important planning fact in the Malaysian framework, and it is one year away.

The Mechanics People Overlook

Two operational requirements catch companies out because they are not disclosure content.

Structured submission. Bursa Malaysia operates the Centralised Sustainability Intelligence platform as the designated submission channel for listed issuers, with disclosures uploaded for investor access and benchmarking, and structured filing requirements applying to the underlying data. Structured submission is a different exercise from drafting a narrative statement, and it requires data to be tagged consistently. Companies that treat the sustainability statement as a design and copywriting task discover this late.

Board-level sign-off and audit-ready documentation. The framework expects documentation that can withstand examination and formal board approval. That is a governance process which has to exist before it can be described, and it cannot be assembled in the weeks before publication.

Readiness Priorities

Group 2 companies should treat the current year as measurement, not preparation. Financial year 2026 is your reporting year. The emissions data being generated now is what you will disclose, and Scope 1 and 2 figures cannot be reconstructed convincingly after the fact from incomplete records.

Group 1 companies should be building for 2027 now. The expansion from climate-only to full IFRS S1, from principal segments to full coverage, and from deferred Scope 3 to disclosed Scope 3 is not incremental. Value chain data collection alone typically takes twelve to eighteen months to establish, which means starting during the current year rather than after the financial year 2026 report is published.

Everyone should build Scope 1 and 2 to reasonable assurance standard immediately. Reasonable assurance requires testing of controls and underlying data sufficient for a positive opinion, which is a materially higher bar than the limited assurance most jurisdictions start with. Figures need traceability to source documents, documented methodology, and estimates labelled as estimates. Retrofitting that discipline onto two years of accumulated practice is considerably harder than applying it from the start.

The baseline is not encouraging. A study by KPMG and the Pacific Basin Economic Council found that only around a fifth of Malaysia's publicly listed companies disclosed the mandatory Scope 3 indicators in the 2023 reporting cycle, which suggests the distance many companies have to travel is substantial.

Run the materiality assessment before you need it. IFRS S1 disclosures are driven by the company's own assessment of material sustainability topics. That assessment takes time, involves stakeholders, and determines the scope of everything that follows. Group 1 companies deferring it until 2027 will be doing scoping work in their reporting year.

Start supplier engagement for Scope 3. The postponement relief is preparation time, not a holiday. Suppliers need lead time, a standard template and a clear specification, and the response quality in year one is usually poor regardless of how well the request is framed.

Check whether a sector regulator already requires Scope 3. The postponement carve-out does not apply where another regulator has already imposed the requirement. Financial institutions in particular should confirm their position under Bank Negara expectations rather than relying on the NSRF relief.

Test the XBRL pipeline early. Filing mechanics are the kind of problem that surfaces at the worst possible moment. Run the tagging process on draft data well before the reporting deadline.

The broader read is that Malaysia designed a genuinely proportionate framework, adopting the international standards wholesale while giving companies a climate-first sequence and meaningful reliefs to build capability. The risk is that the reliefs are read as a deferral of effort rather than a structured runway. For Group 1 issuers in particular, everything the reliefs postponed arrives at once in financial year 2027, alongside assurance. The companies that treated 2025 and 2026 as a build will be ready. Those that treated the reliefs as breathing space will not.

Preparation Checklist

Confirm your group: Group 1 for Main Market issuers at RM2 billion or above market capitalisation from reporting periods commencing on or after 1 January 2025, Group 2 for remaining Main Market issuers from 1 January 2026, Group 3 for ACE Market issuers and large non-listed companies with RM2 billion or above revenue from 1 January 2027.
If you are a large non-listed company above the revenue threshold, note that you are in scope from 2027 despite having no listing.
Check the Bursa Practice Note 9A framing, which expresses effective dates through the financial year end of the annual report.
Confirm how the climate-first relief applies to you, since guidance varies on whether it is anchored to reporting periods 2025 and 2026 or to each company's own first two periods.
Group 1 companies should plan for financial year 2027 to bring full IFRS S1 topics, coverage beyond principal segments, and Scope 3 together.
Build Scope 1 and Scope 2 data to assurance standard now, with traceability to source, documented methodology and labelled estimates.
Plan for reasonable assurance on Scope 1 and Scope 2 from reporting periods beginning 1 January 2027 for Group 1, 2028 for Group 2 and 2029 for Group 3, while noting the timeline is proposed and subject to further consultation.
Note the current obligation to state whether the sustainability statement was internally reviewed or independently assured under ISAE 3000 (Revised) or ISSA 5000, and to disclose any assurance conclusions.
Complete a materiality assessment ahead of IFRS S1 application, since it determines the scope of everything that follows.
Begin supplier engagement for Scope 3 during the postponement period rather than after it.
Check whether a sector regulator already requires Scope 3, which removes the benefit of the postponement relief.
Confirm any assurance provider meets Audit Oversight Board registration and competency requirements.
Prepare for submission through the Bursa Centralised Sustainability Intelligence platform, and test structured filing on draft data.
Establish board-level oversight and audit-ready documentation before the reporting cycle, not during it.

Position as of August 2026. The NSRF is being implemented in phases and some details, including the required assurance level and the precise application of transition reliefs, are described inconsistently across published guidance. Confirm current requirements against the Securities Commission Malaysia, Bursa Malaysia and the Advisory Committee on Sustainability Reporting, and take professional advice for your circumstances.

Sources

Securities Commission Malaysia, Advisory Committee on Sustainability Reporting, Bursa Malaysia, IFRS Foundation, Bank Negara Malaysia, Companies Commission of Malaysia, Audit Oversight Board of the Securities Commission Malaysia, Financial Reporting Foundation, Sustainability Assurance Working Group, ISAE 3000 (Revised) and ISSA 5000, Grant Thornton Malaysia, KPMG and Pacific Basin Economic Council, Greenplaces, Greenhouse Gas Protocol Corporate Standard, CMS, Terrascope, Keslio, Oren, Presgo

This article is intended for general professional information and does not constitute legal, financial, or investment advice.