NSRF: Who Has to Report Sustainability Information, and From When

Sustainability reporting arrived in Malaysia as a communications topic and is becoming an accounting one. The National Sustainability Reporting Framework does not ask for a glossy report. It adopts IFRS S1 and IFRS S2 as baseline disclosure standards, sets an adoption timeline by reporting period, and targets reasonable assurance — the same level as an audit opinion — on Scope 1 and Scope 2 emissions.

That last word is the tell. Once a number carries reasonable assurance, it needs a control environment, an audit trail and a person who owns it. It has become finance’s problem.

The other reason to treat this precisely: the published commentary is a mess. The most common error puts large non-listed companies in 2026. A second confuses the Securities Commission’s NSRF with a separate SSM proposal that has completely different thresholds. Both are dealt with below, from the primary documents.

The three groups

Table 1 of the NSRF, verbatim in structure:

Group	Applicable entities	Annual reporting periods beginning on or after
Group 1	Main Market listed issuers with market capitalisation, excluding treasury shares, of RM2 billion and above as of 31 December 2024, or as at the date of listing after that date	1 January 2025
Group 2	Main Market listed issuers other than those in Group 1	1 January 2026
Group 3	ACE Market listed issuers, and large non-listed companies	1 January 2027

The framework adds a note worth quoting because it removes a common ambiguity: an annual report for a period beginning 1 January 2025 is the same thing as an annual report for the financial year ending 31 December 2025.

Large non-listed companies are in Group 3, from 2027. Not 2026. Where you see 2026 attached to non-listed companies, the two rows have been merged.

The RM2 billion test, exactly as written

Paragraph 4.1(c) applies the framework to non-listed companies “if they meet the prescribed threshold of consolidated group revenue of RM2 billion and above for two consecutive financial years preceding the current financial year”.

Three features of that wording do real work:

Revenue only. No asset test, no headcount test. This is unlike the audit exemption criteria under Practice Directive 10/2024, which run on any two of revenue, assets and employees.

Two consecutive preceding years. Not the current year. A company that crosses RM2 billion for the first time this year is not in scope this year.

Consolidated, unless there is no consolidation. Where there is no requirement to prepare consolidated accounts, the threshold applies at company level — which the framework says is intended to align with the entity’s existing financial reporting practices.

Paragraph 4.2 explains the policy: economically or environmentally significant companies are not limited to listed entities, and non-listed companies are integral to the broader supply chain. Paragraph 4.3 encourages voluntary adoption, and specifically names hard-to-abate sectors and CBAM sectors — cement, iron, steel, aluminium, chemicals, fertilisers, electricity, hydrogen and petroleum.

Group relief for subsidiaries of foreign parents

Two provisions matter to any Malaysian company inside a multinational group.

Paragraph 5.2: a large non-listed company whose holding company already reports using ISSB-aligned standards or equivalent standards such as the European Sustainability Reporting Standards may leverage the holding company’s sustainability- and climate-related disclosures.

Paragraph 5.3: where the holding company reports using other international standards and frameworks — GRI and TCFD are the named examples — the subsidiary may be given exemption from reporting for three reporting periods, but this is subject to the policy decision of the Registrar. The framework footnotes “Registrar” as the Chief Executive Officer of SSM under s.20A(1) of the Companies Commission of Malaysia Act 2001. After that, the standard applies for annual periods beginning on or after 1 January 2030.

The difference between the two paragraphs is the difference between a self-assessed leverage and a discretionary exemption you have to ask for.

Transition reliefs

The NSRF layers three additional transition reliefs (ATR) on top of the ISSB’s own proportionality mechanisms. They run for two years for Groups 1 and 2, and three years for Group 3, measured from the first annual reporting period.

• ATR 1 — disclose only climate-related risks and opportunities under IFRS S2, applying IFRS S1 only so far as it relates to climate. Using this relief also removes the requirement to disclose comparative information in the first annual reporting period.
• ATR 2 — focus climate-related disclosures on principal business segments.
• ATR 3 — do not disclose Scope 3 GHG emissions, except for categories already required by the entity’s own regulator.

The stated year count is inclusive of the ISSB’s existing one-year relief, so do not add them together. And the comparative-information reliefs remain subject to each regulator’s own requirements.

At the end of ATR 3, Scope 3 must be disclosed in accordance with the categories in the GHG Protocol Corporate Value Chain standard.

Assurance

This is the part with a date attached and a caveat attached to the date.

Paragraph 7.2: external assurance is currently voluntary. The aim is to mandate reasonable assurance on Scope 1 and Scope 2 GHG emissions on this timeline:

Group	Reasonable assurance for annual reporting periods beginning on or after
Group 1	1 January 2027
Group 2	1 January 2028
Group 3	1 January 2029

Two qualifications sit in the document itself. The table is footnoted as subject to further consultations. And paragraph 7.4 says the framework for assurance, including the assurance providers, will be announced after further consultation — so the question of who may sign a sustainability assurance report is open. Paragraph 7.3 does say engagements are expected to be performed in accordance with assurance standards adopted by the Malaysian Institute of Accountants.

Plan for it. Do not budget it as settled.

Where the conflicting sources come from

Most of the contradiction in circulation traces to a single conflation, and it is worth naming because both documents are real.

The NSRF is the Securities Commission and ACSR framework described above: RM2 billion, three groups, 2025 to 2027, ISSB standards.

SSM’s Consultative Document on the Proposed Amendments to the Companies Act 2016 on Sustainability Reporting, issued for comment closing 2 June 2026, is a different instrument aimed at a different population — non-listed companies below the NSRF threshold. It proposes a comply-or-explain regime, with the Registrar empowered to determine the requirements, and it proposes qualifying thresholds beginning at RM15 million of revenue or 100 employees, phased between 2028 and 2033, starting with Scope 1 and Scope 2 emissions before simplified sustainability disclosures and, for the largest tier only, IFRS S2.

Those proposed numbers get quoted as if they were NSRF thresholds. They are not. They are consultation proposals under a different statute, aimed at companies the NSRF does not reach, and at the date of this page the outcome of that consultation has not been published. Nothing in it should be treated as a current obligation.

What this means for a finance function

The NSRF is a reporting framework, and its legal force for a listed issuer runs through Bursa’s listing requirements rather than through the Companies Act. Section IX contemplates consequential amendments to the Financial Reporting Act 1997, the Companies Act 2016, the Securities Commission Malaysia Act 1993, the Capital Markets and Services Act 2007, the listing requirements and Bank Negara standards — and an expanded MASB mandate to set Malaysian sustainability disclosure standards, expected around early 2027.

Until those amendments are in place, a large non-listed company’s obligation is a framework expectation supported by the Registrar’s role in paragraph 5.3, rather than a section you can cite. That is an honest description of the position and a reason to start early, not a reason to wait.

Common mistakes

• Putting large non-listed companies in 2026. Group 3 begins with annual reporting periods beginning on or after 1 January 2027.
• Testing the RM2 billion threshold on the current year. It is two consecutive financial years preceding the current one.
• Applying an asset or employee test. The NSRF threshold is revenue only.
• Quoting SSM’s proposed RM15 million revenue or 100-employee tiers as NSRF thresholds. Different regime, different statute, still a consultation.
• Treating mandatory assurance as fixed. The timeline is footnoted as subject to further consultation and the provider framework is unannounced.
• Adding the ISSB relief to the NSRF relief. The two and three-year durations are stated as inclusive of the existing one-year ISSB relief.
• Assuming a foreign parent’s GRI report is an automatic pass. Paragraph 5.2 covers ISSB-aligned reporting; paragraph 5.3 makes other frameworks a discretionary three-period exemption decided by the Registrar.

What’s next

If your group revenue is anywhere near RM2 billion, run the two-preceding-years test now against your last two sets of consolidated accounts. If it is met, the first reporting period begins on or after 1 January 2027 and the practical deadline is the emissions data, not the report — Scope 1 and Scope 2 measurement has to be running for a full period before it can be reported, and running under control before it can be assured.