ESG disclosure, NSRF and sustainability reporting

What ESG disclosure and sustainability reporting mean

Environmental, social and governance (ESG) disclosure means sharing information about your business's resources and environmental effects, its people and relationships, and how it is governed. That might include electricity use, employee safety, supplier practices or oversight of business risks.

Sustainability reporting brings relevant information together for a defined period and business scope. A useful report explains the risks and opportunities, what the business is doing about them, and the evidence behind its performance. It includes difficulties and gaps as well as achievements.

Different frameworks serve different readers. Malaysia's National Sustainability Reporting Framework (NSRF) uses the IFRS Sustainability Disclosure Standards as its baseline. IFRS stands for International Financial Reporting Standards. These sustainability standards focus on information useful to investors, lenders and other creditors. Other reporting can address a business's effects on people and the environment more broadly. See the Securities Commission Malaysia's (SC) NSRF overview.

Start by identifying why you need to report

Put the request or rule in front of you before choosing a template.

Scroll sideways to read the table ↔

For listed businesses, Bursa Malaysia's Main Market rules and ACE Market rules are the main rules to check. The NSRF also recognises that regulators can impose additional expectations on the entities they supervise.

For a small or medium enterprise (SME), Capital Markets Malaysia (CMM) publishes the Simplified ESG Disclosure Guide (SEDG) as voluntary guidance. Using it does not by itself settle a separate regulatory or contractual obligation. Our SEDG guide for SMEs explains the guide and its tools in detail.

How the NSRF and IFRS S1/S2 fit together

The SC chairs the Advisory Committee on Sustainability Reporting (ACSR), which developed the NSRF. The framework sets Malaysia's phased approach to using standards issued by the International Sustainability Standards Board (ISSB) within the IFRS Foundation. The sustainability standards are distinct from financial accounting standards.

The two baseline standards work together:

• IFRS S1 — General Requirements for Disclosure of Sustainability-related Financial Information: explains the overall reporting requirements for sustainability risks and opportunities that could affect cash flow, access to finance or the cost of capital.
• IFRS S2 — Climate-related Disclosures: applies that approach to climate risks and opportunities, including physical risks such as flooding and risks from changes in technology, policy or markets.

The IFRS Foundation explains IFRS S1 and IFRS S2 on its official standard pages.

Both organise disclosures around four areas: governance, strategy, risk management, and metrics and targets. In everyday terms: who oversees the issues, how they affect your business plan, how you assess and manage them, and how you measure progress.

Under these standards, material information is information whose omission, misstatement or concealment could reasonably affect the decisions of investors, lenders or other creditors. Start with your business's circumstances. A flood-prone warehouse or an energy-intensive production line may deserve close attention because of its implications for operations and finances. The examples are illustrative; paragraphs 17–19 of the IFRS S1 text explain the test.

Which groups are covered, and when does reporting begin?

The table below sets out the published NSRF adoption timetable. Dates refer to annual reporting periods beginning on or after the stated date, not the date on which a report is submitted.

Scroll sideways to read the table ↔

Check whether the legal requirements for non-listed companies are in force. For a large non-listed company, the legal duty to report and file documents depends on implementing legislation, its effective date and directions from the Companies Commission of Malaysia (SSM). This review did not find final requirements. Use the implementation check below before treating the framework timetable as an enacted Companies Act duty.

For a large non-listed company, the test is consolidated group revenue of RM2 billion or more for two consecutive financial years preceding the current financial year. Where consolidated accounts are not required, the test applies at company level. This is a revenue test, whereas Group 1's threshold is market capitalisation. See the NSRF, sections IV–V.

Listed companies: apply Bursa's financial-year-end wording

Bursa's operative provisions apply the IFRS-based Sustainability Statement requirements to annual reports for financial years ending on or after 31 December 2025 for Group 1, 31 December 2026 for Group 2, and 31 December 2027 for ACE Market issuers. Check Main Market Practice Note 9A, paragraph 1.1 and ACE Market Guidance Note 11A, paragraph 1.1.

For example, a Group 2 company with a normal January–December financial year starts with its 2026 period. A Group 2 company with a normal July–June year reaches the Bursa threshold at 30 June 2027. Ask your company secretary to confirm the applicable period if you have changed your year-end or have an unusual reporting period.

Listed companies must include a Sustainability Statement in their annual report. Both markets ordinarily require the annual report within four months of the financial year-end. For a December-year-end Group 2 company, that means the 2026 annual report is ordinarily due by 30 April 2027. See paragraph/rule 9.23(1) in the Main Market and ACE Market rules.

An issuer that releases its annual audited financial statements early must release its Sustainability Statement at the same time and include both in the annual report. The NSRF does not adopt IFRS S1's first-year relief allowing later sustainability reporting. See the ACSR FAQ, questions 2.6, 2.8 and 2.8A.

Earlier sustainability duties still matter

The IFRS-based start date is not necessarily your first sustainability-reporting obligation. For example, ACE Market issuers must already provide the narrative statement required under the earlier sustainability-reporting rules. Paragraphs 3 and 4 of Guidance Note 11A phase in the additional governance, scope, material-topic, performance-data and review-status disclosures for financial years ending on or after 31 December 2025 and 31 December 2026, respectively. Main Market issuers also have earlier reporting requirements that continue to apply before the IFRS-based requirements begin.

Non-listed businesses: check implementation as well as the framework

The NSRF places qualifying large non-listed companies in Group 3. Their precise legal reporting and filing obligations depend on the implementing legislation and SSM directions. SSM published revised proposed Companies Act amendments in May 2026. A consultation document does not itself create an operative duty. Confirm the final instruments, commencement and filing arrangements with your company secretary before treating a proposed provision as law.

An SME or a company on Bursa's LEAP Market — its Leading Entrepreneur Accelerator Platform — is not automatically within these three NSRF groups. Other regulatory requirements can still apply, and participation in a larger reporting group's supply chain can generate data requests. See the ACSR FAQ, question 2.2.

What transition relief can you use?

The NSRF permits three additional reliefs during the first two reporting periods for Groups 1 and 2, and the first three for Group 3:

1. Report climate risks and opportunities first, using IFRS S2 and the parts of IFRS S1 relevant to climate.
2. Focus climate disclosures on principal business segments, meaning the company's main lines of business.
3. Defer Scope 3 greenhouse gas emissions disclosures—other indirect emissions across the value chain, including the supply chain and use of products—except categories already required by your regulator.

These periods already include the one-year relief allowed by IFRS, so do not add another year. Explain the reliefs used in your report. The NSRF, section VI, and Bursa's Practice Note 9A and Guidance Note 11A set out the provisions.

For entities entering at the published start dates and using the full relief period, the timetable is:

Scroll sideways to read the table ↔

The years above follow the NSRF's reporting-period convention. Map them to your actual financial year and applicable Bursa provisions. The IFRS Foundation's Malaysia profile also records the phased broader-reporting dates.

There are also narrower first-year concessions. Check whether the rules let you omit the previous year's figures for information you are reporting for the first time, or continue an existing greenhouse-gas measurement method. Listed issuers must still provide the required historical figures for measures they already reported; first-time IFRS reporting does not erase that history. Confirm the conditions in the ACSR FAQ, questions 2.6–2.7.

For qualifying large non-listed companies, the NSRF also describes using a holding company's ISSB-aligned or equivalent disclosures, including European Sustainability Reporting Standards. A possible three-period exemption where a holding company uses other international frameworks depends on the Registrar's policy decision. Do not assume a parent company's report automatically exempts your business. Check NSRF paragraphs 5.2–5.3 and the applicable SSM implementation.

Reporting and external assurance are separate jobs

Reporting is your business preparing and issuing the information. External assurance is an independent practitioner's assessment of specified information against the relevant criteria. Check the information covered and the level of assurance: a review of selected figures does not cover the whole report.

For emissions, greenhouse gases (GHG) are gases that contribute to climate change. Scope 1 covers direct emissions from operations you own or control; Scope 2 covers emissions from purchased energy; Scope 3 covers other indirect emissions upstream and downstream in your value chain. The NSRF glossary explains these categories.

The ACSR's September 2026 policy mandates external reasonable assurance on Scope 1 and Scope 2 emissions on this separate schedule:

Scroll sideways to read the table ↔

Reasonable assurance involves more extensive work than limited assurance, but does not mean absolute certainty. The Policy Document on Mandatory Sustainability Assurance Requirements, paragraph 2.0 supplies the dates. Its paragraph 5.0 leaves mandatory assurance for Scope 3 and other sustainability disclosures to a later announcement.

Do not change your reporting calendar. The 17 September 2026 announcement moves assurance one year later than the earlier schedule. It does not give Group 1 permission to postpone broader reporting or relevant Scope 3 disclosure from 2027 to 2028.

Before mandatory external assurance begins, listed issuers must continue to state whether their disclosures underwent internal-auditor review or independent assurance. Bursa also requires the subject matter and scope, and the conclusions for independent assurance. See Main Market Practice Note 9, paragraph 6.2(e) and ACE Market Guidance Note 11, paragraph 6.2(b).

The September policy designates International Standard on Sustainability Assurance (ISSA) 5000 for independent sustainability assurance and specifies provider quality-management, ethics and independence requirements. Ask a prospective provider how the engagement will meet paragraphs 3.0–4.0 of the policy. The announcement no longer endorses the alternatives recommended earlier. A bank or customer may also have its own verification terms; check the agreement separately.

If you're an SME receiving a data request

A customer's need for your information does not automatically make your SME an NSRF reporting entity. Your data may help the customer describe its supply chain or calculate its Scope 3 emissions. The same information can help a bank understand your operations.

Before answering, confirm the reporting period, business or product scope, units, method, deadline and supporting evidence requested. If the customer asks for product-level emissions, a company-wide electricity total may supply only part of the answer.

Use records you can support. Label estimates and missing data, and agree a plan for outstanding answers. Missing information is different from zero. Keep a reusable core record, then match each response to the request.

For the detailed disclosure list, templates, emissions tools and guidance on assigning the work, follow our SEDG guide for SMEs. It uses CMM's national SEDG Version 2, July 2025.