Sustainability assurance Malaysia has been pushed back a year: mandatory independent assurance now starts in 2028, 2029 and 2030 for Groups 1, 2 and 3 respectively, instead of 2027, 2028 and 2029. The Securities Commission announced the deferral in September 2026 after a review by the Minority Shareholders Watch Group and Climate Governance Malaysia of the first 91 Group 1 reports, which found disclosure quality needed further improvement.
What the sustainability assurance Malaysia timeline now is
Group 1 covers Main Market listed companies with market capitalisation of RM2 billion and above. Group 2 covers other Main Market listed companies. Group 3 covers ACE Market listed companies and large non-listed companies with annual revenue of RM2 billion and above. Reasonable assurance uses ISSA 5000 as the recognised standard.
| Malaysia’s assurance timetable after the deferral | Detail | Source |
|---|---|---|
| Group 1 (Main Market, RM2b+) | 2028 (was 2027) | Securities Commission, via The Edge, 2 Oct 2026 |
| Group 2 (other Main Market) | 2029 (was 2028) | Securities Commission, via The Edge, 2 Oct 2026 |
| Group 3 (ACE Market and large non-listed) | 2030 (was 2029) | Securities Commission, via The Edge, 2 Oct 2026 |
| Assurance standard | ISSA 5000 | Securities Commission |
| First scope covered | Scope 1 and 2 GHG emissions | Securities Commission |
| Trigger for the review | MSWG and Climate Governance Malaysia review of 91 Group 1 reports | via The Edge, 2 Oct 2026 |
| Framework | National Sustainability Reporting Framework (NSRF) | Securities Commission |
What is actually in scope on day one
The first mandatory requirement is narrow: reasonable assurance over Scope 1 and Scope 2 greenhouse gas emissions. Labour practices, community impacts, governance processes and climate risk strategies sit outside it. That creates what one accounting professor calls a hierarchy of trust within a single annual report – some figures externally tested, the rest not.
The part SMEs keep forgetting
Most Malaysian SMEs are not directly captured by the NSRF. It does not matter. Listed companies and large non-listed companies with annual revenue of RM2 billion and above must report Scope 3 emissions, which are the emissions of their supply chains. In practice an SME supplying a Group 1 corporate will be asked for emissions data regardless of its own size, and the ask lands on procurement timelines, not regulatory ones. There is no deferral for the vendor whose customer needs a number for its own report.
Why a narrow first scope is the right call
The scoping decision deserves defence rather than criticism. Assuring an entire sustainability report is not feasible at scale yet, and climate data is the part with an internationally agreed methodology – the GHG Protocol underpins ISSB climate metrics – which makes it the only part where an assurance provider can say something defensible. Starting with Scope 1 and 2 emissions, which a company controls directly, is the textbook way to build an assurance market before extending it.
The risk sits on the other side of the choice. A report where some figures are assured and others are not invites readers to treat the distinction as a quality ranking, when it may only reflect which data was easiest to verify. That is the hierarchy-of-trust problem, and the answer is disclosure discipline: stating plainly which sections were independently tested.
What to watch next
Watch for the nature and biodiversity standard, an exposure draft expected by October 2026, which would bring a second topic into the same mandatory architecture. And watch the supply-chain effect, because Scope 3 reporting by large corporates is what turns an SME’s emissions data into a commercial requirement – no SME will be asked nicely for a number their customer is legally obliged to report.
The assurance provider market has to be built too
One reason for a cautious start is that Malaysia needs a supply of qualified assurance providers before a broad mandate means anything. The Association of Sustainability Professionals, announced at the JC3 Journey to Zero Conference in September and incubated by the Securities Commission, exists precisely to address that skills gap – professionalising a field that has grown faster than its standards. A mandate that outruns the pool of qualified providers produces cheap sign-offs and expensive cynicism, which is the failure mode the deferral is designed to avoid.
The assurance timetable therefore has two sides. Companies need systems and data. The market needs people and methodology. Moving both at the same pace is slower than a headline-grabbing mandate, and considerably more likely to produce disclosures that survive scrutiny.
Sources
- Securities Commission Malaysia – official website, NSRF
- Bursa Malaysia – official website
- The Edge Malaysia, “Opinion: Building trust in sustainability reporting”, 2 October 2026
