What ESG disclosure and sustainability reporting mean
Environmental, social and governance (ESG) disclosure means sharing information about your business's resources and environmental effects, its people and relationships, and how it is governed. That might include electricity use, employee safety, supplier practices or oversight of business risks.
Sustainability reporting brings relevant information together for a defined period and business scope. A useful report explains the risks and opportunities, what the business is doing about them, and the evidence behind its performance. It includes difficulties and gaps as well as achievements.
Different frameworks serve different readers. Malaysia's National Sustainability Reporting Framework (NSRF) uses the IFRS Sustainability Disclosure Standards as its baseline. IFRS stands for International Financial Reporting Standards. These sustainability standards focus on information useful to investors, lenders and other creditors. Other reporting can address a business's effects on people and the environment more broadly. See the SC's NSRF overview.
Start by identifying why you need to report
Put the request or rule in front of you before choosing a template.
Scroll sideways to read the table ↔
| Source of the requirement | What it means for your business | What to establish first |
|---|---|---|
| Listing or other regulatory requirements | An applicable rule determines the report you must prepare | Your entity category, effective period, content, reporting location and deadline |
| A bank or financing agreement | The bank may ask for information during assessment or require ongoing reports under the agreement | The questionnaire, facility terms, measures, frequency and any verification requirement |
| A customer or parent company | Information may support supplier assessment or the wider group's reporting | The entities, sites, products and period covered, definitions, method and submission date |
| Voluntary guidance | A guide can help organise information and improve your reporting | Its intended users, edition and how it matches the actual request |
For listed businesses, Bursa Malaysia's Main Market rules and ACE Market rules are the operative starting points. The NSRF also recognises that regulators can impose additional expectations on the entities they supervise.
For a small or medium enterprise (SME), Capital Markets Malaysia (CMM) publishes the Simplified ESG Disclosure Guide (SEDG) as voluntary guidance. Using it does not by itself settle a separate regulatory or contractual obligation. Our SEDG guide for SMEs explains the guide and its tools in detail.
How the NSRF and IFRS S1/S2 fit together
The Securities Commission Malaysia (SC) chairs the Advisory Committee on Sustainability Reporting (ACSR), which developed the NSRF. The framework sets Malaysia's phased approach to using standards issued by the International Sustainability Standards Board (ISSB) within the IFRS Foundation. The sustainability standards are distinct from financial accounting standards.
The two baseline standards work together:
- IFRS S1 — General Requirements for Disclosure of Sustainability-related Financial Information: explains the overall reporting requirements for sustainability risks and opportunities that could affect cash flow, access to finance or the cost of capital.
- IFRS S2 — Climate-related Disclosures: applies that approach to climate risks and opportunities, including physical risks such as flooding and risks from changes in technology, policy or markets.
The IFRS Foundation explains IFRS S1 and IFRS S2 on its official standard pages.
Both organise disclosures around four areas: governance, strategy, risk management, and metrics and targets. In everyday terms: who oversees the issues, how they affect your business plan, how you assess and manage them, and how you measure progress.
Under these standards, material information is information whose omission, misstatement or concealment could reasonably affect investors', lenders' or other creditors' decisions. Start with your business's circumstances. A flood-prone warehouse or an energy-intensive production line may deserve close attention because of its implications for operations and finances. The examples are illustrative; the IFRS S1 text, paragraphs 17–19, explains the test.
Which groups are covered, and when does reporting begin?
The table below sets out the published NSRF adoption timetable. Dates refer to annual reporting periods beginning on or after the stated date, not the date on which a report is submitted.
Scroll sideways to read the table ↔
| Group | Entities covered | NSRF reporting begins |
|---|---|---|
| Group 1 | Main Market listed issuers with market capitalisation, excluding treasury shares, of RM2 billion or more at 31 December 2024, or at admission to listing after that date | 1 January 2025 |
| Group 2 | Other Main Market listed issuers | 1 January 2026 |
| Group 3 | ACE Market listed issuers and large non-listed companies meeting the revenue test below | 1 January 2027 |
Non-listed-company boundary: Group 3 is the published NSRF adoption position. For a large non-listed company, the operative legal reporting/filing duty also depends on implementing legislation, commencement and SSM directions; these were not established as final in this review. Use the implementation check below before treating the framework timetable as an enacted Companies Act duty.
For a large non-listed company, the test is consolidated group revenue of RM2 billion or more for two consecutive financial years preceding the current financial year. Where consolidated accounts are not required, the test applies at company level. This is a revenue test, whereas Group 1's threshold is market capitalisation. See the NSRF, sections IV–V.
Listed companies: apply Bursa's financial-year-end wording
Bursa's operative provisions apply the IFRS-based Sustainability Statement requirements to annual reports for financial years ending on or after 31 December 2025 for Group 1, 31 December 2026 for Group 2, and 31 December 2027 for ACE Market issuers. Check Main Market Practice Note 9A, paragraph 1.1 and ACE Market Guidance Note 11A, paragraph 1.1.
For example, a Group 2 company with a normal January–December financial year starts with its 2026 period. A Group 2 company with a normal July–June year reaches the Bursa threshold at 30 June 2027. Ask your company secretary to confirm the applicable period if you have changed your year-end or have an unusual reporting period.
Listed companies must include a Sustainability Statement in their annual report. Both markets ordinarily require the annual report within four months of the financial year-end. For a December-year-end Group 2 company, that means the 2026 annual report is ordinarily due by 30 April 2027. See paragraph/rule 9.23(1) in the Main Market and ACE Market rules.
An issuer that releases its annual audited financial statements earlier must concurrently release its Sustainability Statement and incorporate both into the annual report. The NSRF does not adopt IFRS S1's first-year relief allowing later sustainability reporting. See the ACSR FAQ, questions 2.6, 2.8 and 2.8A.
Earlier sustainability duties still matter
The IFRS-based start date is not necessarily your first sustainability-reporting obligation. For example, ACE Market issuers must already provide the narrative statement and, for financial years ending on or after 31 December 2025 and 2026, the additional governance, scope, material-topic, performance-data and review-status disclosures in Guidance Note 11A, paragraphs 3–4. Main Market issuers also have saved requirements before their IFRS-based phase.
Non-listed businesses: check implementation as well as the framework
The NSRF places qualifying large non-listed companies in Group 3. Their precise legal reporting and filing obligations also require the implementing legislation and SSM directions. The Companies Commission of Malaysia (SSM) published revised proposed Companies Act amendments in May 2026. A consultation document does not itself create an operative duty. Confirm the final instruments, commencement and filing arrangements with your company secretary before treating a proposed provision as law.
An SME or a company on Bursa's LEAP Market — its Leading Entrepreneur Accelerator Platform — is not automatically within these three NSRF groups. Other regulatory requirements can still apply, and participation in a larger reporting group's supply chain can generate data requests. See the ACSR FAQ, question 2.2.
What transition relief can you use?
The NSRF permits three additional reliefs during the first two reporting periods for Groups 1 and 2, and the first three for Group 3:
- Report climate risks and opportunities first, using IFRS S2 and the parts of IFRS S1 relevant to climate.
- Focus climate disclosures on principal business segments.
- Defer Scope 3 greenhouse gas emissions disclosures, except categories already required by your regulator.
These periods include the underlying one-year IFRS relief; you do not add another year. Explain the reliefs used in your report. The NSRF, section VI, and Bursa's Practice Note 9A and Guidance Note 11A set out the provisions.
For entities entering at the published start dates and using the full relief period, the timetable is:
Scroll sideways to read the table ↔
| Group | Initial climate-first reporting periods | Broader IFRS S1/S2 reporting and relevant Scope 3 disclosures begin |
|---|---|---|
| Group 1 | 2025–2026 | 2027 |
| Group 2 | 2026–2027 | 2028 |
| Group 3 | 2027–2029 | 2030 |
The years above follow the NSRF's reporting-period convention. Map them to your actual financial year and applicable Bursa provisions. The IFRS Foundation's Malaysia profile also records the phased broader-reporting dates.
There are narrower first-year reliefs for new comparative disclosures and continuing an existing greenhouse-gas measurement method. Listed issuers must keep providing the required rolling data for metrics they already reported; first-time IFRS reporting does not erase that history. Confirm the conditions in the ACSR FAQ, questions 2.6–2.7.
For qualifying large non-listed companies, the NSRF also describes using a holding company's ISSB-aligned or equivalent disclosures, including European Sustainability Reporting Standards. A possible three-period exemption where a holding company uses other international frameworks depends on the Registrar's policy decision. Do not assume a parent company's report automatically exempts your business. Check NSRF paragraphs 5.2–5.3 and the applicable SSM implementation.
Reporting and external assurance are separate jobs
Reporting is your business preparing and issuing the information. External assurance is an independent practitioner's assessment of specified information against the relevant criteria. Check the information covered and the level of assurance: a review of selected figures does not cover the whole report.
For emissions, greenhouse gases (GHG) are gases that contribute to climate change. Scope 1 covers direct emissions from operations you own or control; Scope 2 covers emissions from purchased energy; Scope 3 covers other indirect emissions upstream and downstream in your value chain. The NSRF glossary explains these categories.
The ACSR's September 2026 policy mandates external reasonable assurance on Scope 1 and Scope 2 emissions on this separate schedule:
Scroll sideways to read the table ↔
| Group | Annual reporting periods beginning on or after |
|---|---|
| Group 1 | 1 January 2028 |
| Group 2 | 1 January 2029 |
| Group 3 | 1 January 2030 |
Reasonable assurance involves more extensive work than limited assurance, but does not mean absolute certainty. The Policy Document on Mandatory Sustainability Assurance Requirements, paragraph 2.0, supplies the dates. Its paragraph 5.0 leaves mandatory assurance for Scope 3 and other sustainability disclosures to a later announcement.
Keep your reporting calendar. The 17 September 2026 announcement moves assurance one year later than the earlier schedule. It does not give Group 1 permission to postpone broader reporting or relevant Scope 3 disclosure from 2027 to 2028.
Before mandatory external assurance begins, listed issuers must continue to state whether their disclosures underwent internal-auditor review or independent assurance. Bursa also requires the subject matter and scope, and the conclusions for independent assurance. See Main Market Practice Note 9, paragraph 6.2(e) and ACE Market Guidance Note 11, paragraph 6.2(b).
The September policy designates International Standard on Sustainability Assurance (ISSA) 5000 for independent sustainability assurance and specifies provider quality-management, ethics and independence requirements. Ask a prospective provider how the engagement will meet paragraphs 3.0–4.0 of the policy. The announcement says the previously recommended alternatives are no longer recommended. A bank or customer may also have its own verification terms; check the agreement separately.
If you're an SME receiving a data request
A customer's need for your information does not automatically make your SME an NSRF reporting entity. Your data may help the customer describe its supply chain or calculate its Scope 3 emissions. The same information can help a bank understand your operations.
Before answering, establish the reporting period, business or product scope, units, method, deadline and supporting evidence requested. If the customer asks for product-level emissions, a company-wide electricity total may supply only part of the answer.
Use records you can support. Label estimates and missing data, and agree a plan for outstanding answers. Missing information is different from zero. Keep a reusable core record, then match each response to the request.
For the detailed disclosure list, templates, emissions tools and allocation of work, follow our SEDG guide for SMEs. It uses CMM's national SEDG Version 2, July 2025.
