On 17 September 2026 the Securities Commission Malaysia (SC) announced that the Advisory Committee on Sustainability Reporting (ACSR) has deferred the start of mandatory reasonable assurance on Scope 1 and Scope 2 greenhouse gas emissions disclosures under the National Sustainability Reporting Framework (NSRF). The requirement for Group 1 will now apply to annual reporting periods beginning on or after 1 January 2028, instead of 1 January 2027. Group 2 and Group 3 move by a year as well, to 2029 and 2030.
The ACSR, which the SC chairs, published the decision as a one-page Policy Document on Mandatory Sustainability Assurance Requirements. If your finance team has been working to the dates in the June 2025 consultation paper, this is the document to replace them with. The same announcement makes three other changes: the assurance is reasonable assurance, not limited; only one assurance standard is now recognised for independent assurance of a sustainability report; and the existing disclosure duty under the Bursa Malaysia listing requirements continues while you wait.
If the scope labels are unfamiliar: they come from IFRS S2, the climate standard that Bursa Malaysia’s Practice Note 9 requires the Sustainability Statement to follow. Scope 1 is the direct emissions from sources the company owns or controls. Scope 2 is the indirect emissions from the electricity, steam, heating or cooling the company buys and consumes. Scope 3 is the other indirect emissions in the company’s value chain, upstream and downstream. The mandate covers the first two, which are the ones a company can measure from its own fuel and utility records.
The timetable, proposed and mandated
Paragraph 2.0 of the policy sets out the timeline in a table that puts the 25 June 2025 consultation proposal beside what has now been mandated. The dates are the start of the annual reporting period, not a date by which an assurance report must be filed.
| Group | Who | As proposed, 25 June 2025 | As mandated |
|---|---|---|---|
| Group 1 | Main Market listed issuers with market capitalisation (excluding treasury shares) of RM2 billion and above as at 31 December 2024, or as at the date of their listing after 31 December 2024 | Annual reporting periods beginning on or after 1 January 2027 | Annual reporting periods beginning on or after 1 January 2028 |
| Group 2 | Main Market listed issuers other than those in Group 1 | 1 January 2028 | 1 January 2029 |
| Group 3 | ACE Market listed issuers and large non-listed companies with annual revenue of RM2 billion and above | 1 January 2029 | 1 January 2030 |
For a Group 1 issuer with a December year end, the first period requiring assured Scope 1 and Scope 2 figures is the year ending 31 December 2028, reported in 2029. A Group 1 issuer with a June year end starts with the period beginning 1 July 2028. The same arithmetic applies a year later for Group 2 and two years later for Group 3.
Two things the group tests do not say. The Group 1 market capitalisation test is fixed at 31 December 2024, or at the listing date for a company listed after that. The policy does not restate the test at later dates. For Group 3, the policy describes large non-listed companies by a single measure, annual revenue of RM2 billion and above, and says nothing about the year of measurement or whether revenue is measured at company or group level. A non-listed group near that line should not assume either answer.
Reasonable assurance, on Scope 1 and 2 only
The policy mandates “external reasonable assurance on Scope 1 and Scope 2 GHG emissions”. The policy does not say limited assurance, and the consultation paper it replaces did not either. Expect the provider to ask for the evidence behind every figure: emissions factors and where they came from, the activity data, the boundary decisions, the calculation methods and the controls around each.
Scope 3 is not in the mandate. Paragraph 5.0 says mandatory external assurance for Scope 3 GHG emissions and other sustainability disclosures “will be determined and announced at a later stage”. Until then, assurance on that information falls under the interim arrangement in paragraph 3.0, described below. Nothing in the policy changes what has to be reported.
Why the year was added
The SC’s release gives the reason. The Minority Shareholders Watch Group (MSWG) and Climate Governance Malaysia (CGM) reviewed the first cohort of 91 Group 1 listed issuers reporting under the IFRS Sustainability Disclosure Standards and found that further improvements to the quality of disclosures are needed. The additional year is intended to let preparers strengthen reporting processes, controls and data quality before assurance becomes mandatory.
The extra year was given for preparers’ processes, controls and data, and those are the parts a finance team controls.
The interim duty does not pause
Paragraph 3.0 of the policy says that until mandatory external assurance takes effect, all Main Market and ACE Market listed issuers “shall continue to disclose in their sustainability reports whether the sustainability disclosures have been subjected to” either internal review by the listed issuer’s internal auditor, or independent assurance by a sustainability assurance provider performed in accordance with ISSA 5000.
The Bursa Malaysia rule behind that is paragraph 6.2(e) of Practice Note 9 of the Main Market Listing Requirements, most recently revised on 31 December 2025. It requires a statement on whether the listed issuer has subjected the Sustainability Statement to internal review by its internal auditor or independent assurance performed in accordance with recognised assurance standards, and if so, the subject matter and scope covered. For independent assurance, the conclusions must also be disclosed. The SC’s release confirms that this continues under the extension.
So every listed issuer, whichever group it falls in, keeps making that statement in every sustainability report between now and its mandatory date. A Group 3 ACE Market company has until reporting periods beginning in 2030 before assurance is compulsory, but it discloses each year until then whether it chose to obtain any.
One standard now: ISSA 5000
Bursa’s Chapter 9 FAQ on the Main Market Listing Requirements, as at 4 June 2025, answered the question of what counts as a recognised assurance standard for paragraph 6.2(e)(ii) with three: the International Standard on Sustainability Assurance (ISSA) 5000, the International Standard on Assurance Engagements (ISAE) 3000, or the International Organization for Standardization (ISO).
The SC’s 17 September release states that any independent assurance “must now be performed in accordance with the designated recognised assurance standard, i.e. ISSA 5000 only”, and that ISAE 3000 (Revised) and ISO “will no longer be recommended”. The policy document itself refers only to ISSA 5000, in both paragraph 3.0 and paragraph 4.0.
If your current assurance engagement is scoped under ISAE 3000, the engagement letter for the next reporting period is the place to deal with this. An ISO-based verification is not the standard paragraph 3.0 names.
Who may perform it
Paragraph 4.0 sets two conditions on the practitioner. Engagements under ISSA 5000 must be performed by practitioners operating within a system of quality management that complies with International Standard on Quality Management (ISQM) 1. The practitioners must also comply with the International Ethics Standards Board for Accountants’ International Ethics Standards for Sustainability Assurance, including International Independence Standards (IESSA).
The policy does not say that the provider must be an audit firm, and it does not say that it need not be. What it requires is a quality management system to ISQM 1 and compliance with IESSA. A company choosing a provider should ask for evidence of both, in writing, before the engagement is signed. The release adds that the ACSR will issue a Sustainability Assurance Guide to support providers and to make the application of the requirements consistent, and that the remaining proposals on the assurance framework will be communicated in due course.
What the policy does not say
The one-page policy sets the assurance scope, the groups and the period starts. It does not set a fee, prescribe a form or filing channel, state a penalty, or provide for extensions. Any of those, if they come, will come through the listing requirements or a later ACSR document, and this article will be out of date on that point when they do.
What to do now, by group
Group 1, first assured period begins 1 January 2028 or later. You have at least two reporting cycles of unassured Scope 1 and 2 disclosure left, and they are the dry runs. Use the current cycle to have internal audit review the emissions data end to end: source documents for fuel and electricity, the emissions factors used and where they came from, the organisational boundary and how it reconciles to the consolidated group, and who signs off each number. If you already use an external provider under ISAE 3000, move the next engagement to ISSA 5000 and ask the provider to confirm ISQM 1 and IESSA in the engagement letter. A voluntary engagement in the 2026 or 2027 cycle, scoped to Scope 1 and 2 under ISSA 5000, is a practical way to find out what reasonable assurance will demand before it is compulsory.
Group 2, first assured period begins 1 January 2029 or later. Three cycles. The decision this year is whether the emissions data is owned by finance or by a sustainability function that finance does not control. Reasonable assurance is an evidence exercise, and the evidence lives in the ledger, the utility invoices and the fleet records. Bring the data into the same close process as the financial statements before you spend money on assurance.
Group 3, first assured period begins 1 January 2030 or later. ACE Market issuers already make the paragraph 6.2(e) statement each year and should treat the next two as preparation. Large non-listed companies have the least to go on: they are not on Bursa, they do not make the interim disclosure, and the policy gives them one number, RM2 billion in annual revenue, without saying how it is measured. If your group is anywhere near that figure, establish now how your board would answer the question, and watch for the ACSR’s remaining proposals to close the gap.
Everyone. Read the policy document itself. It is one page, and it is the only document that carries the mandated dates.
If you would like help working out which group your company falls in, or setting up the emissions data so that it can be assured, we can work through it with you.
Sources: Securities Commission Malaysia, media release “ACSR’s Mandatory Sustainability Assurance Requirement to Take Effect in 2028”, 17 September 2026; Advisory Committee on Sustainability Reporting, Policy Document on Mandatory Sustainability Assurance Requirements, paragraphs 1.0 to 5.0, published on the SC’s NSRF policy documents page; Bursa Malaysia Securities Berhad, Main Market Listing Requirements, Practice Note 9, paragraph 6.2(e), revision date 31 December 2025; Bursa Malaysia, Questions and Answers in relation to the Main Market Listing Requirements, Chapter 9, as at 4 June 2025, question 9.51F. All retrieved 22 September 2026. This article is general information current as at 22 September 2026 and is not legal, accounting or assurance advice. The ACSR has said that further proposals on the assurance framework and a Sustainability Assurance Guide are to follow, so confirm the live position on sc.com.my before acting.