What is the NSRF? Malaysia's National Sustainability Reporting Framework explained (2026 guide)

The NSRF sets out which sustainability disclosure standards companies in Malaysia should use, who must apply them, and when. It was launched on 24 September 2024 at the Securities Commission Malaysia (SC).

The NSRF was developed by the Advisory Committee on Sustainability Reporting (ACSR), a national inter-agency committee chaired by the SC and endorsed by the Ministry of Finance. According to the SC's NSRF page, ACSR members are the SC, the Audit Oversight Board, Bank Negara Malaysia, the Companies Commission of Malaysia (SSM), Bursa Malaysia and the Financial Reporting Foundation.

The aim is consistent, comparable and reliable sustainability information that investors can use. With the NSRF, Malaysia joined more than 20 jurisdictions that have decided to use, or are moving towards, the ISSB Standards.

IFRS S1 and IFRS S2 are global sustainability disclosure standards issued by the International Sustainability Standards Board (ISSB). Together they are often called the ISSB Standards.

IFRS S1 and IFRS S2 are both organised around four pillars carried over from the TCFD recommendations: governance, strategy, risk management, and metrics and targets. Companies already reporting in line with TCFD will find the structure familiar.

The NSRF applies to companies listed on Bursa Malaysia and to large non-listed companies (NLCos). They are divided into three groups by size.

Group 1: Main Market listed issuers with market capitalisation of RM2 billion and above

Group 2: All other Main Market listed issuers

Group 3: ACE Market listed issuers, and non-listed companies with annual revenue of RM2 billion and above

For non-listed companies, the RM2 billion threshold is based on consolidated group revenue for the two consecutive financial years before the current one. Where there is no group-level revenue, it is measured at company level.

Most SMEs are not directly within scope. However, many are asked for ESG data by customers who do report under the NSRF.

Each group starts with annual reporting periods beginning on or after 1 January of its start year. For example, "2025" refers to the annual report covering 1 January to 31 December 2025. Full adoption, including Scope 3 emissions, follows after the transition relief period.

For listed issuers, Bursa Malaysia's amended Listing Requirements apply to Group 1 for financial years ending on or after 31 December 2025, and to Group 2 for financial years ending on or after 31 December 2026 (Bursa Malaysia, 23 December 2024). Source for the timeline table: ACSR, NSRF summary.

The NSRF keeps the reliefs built into the ISSB Standards and adds further reliefs from each company's first reporting year. According to the ACSR's NSRF summary, these last two years for Groups 1 and 2, and three years for Group 3.

Climate first. Companies may disclose only climate-related risks and opportunities under IFRS S2, before extending to all sustainability topics under IFRS S1.

Principal business segments. Climate-related disclosures may focus on the company's principal business segments.

Scope 3 emissions. Companies may omit Scope 3 emissions, except for categories their regulator already requires.

There is a separate route for large non-listed companies. Where the holding company already reports under ISSB-aligned or equivalent standards, such as the European Sustainability Reporting Standards (ESRS), the Malaysian entity may leverage those disclosures. Where the holding company uses other international frameworks, an exemption for three reporting periods may be granted, subject to the Registrar's decision.

Reliefs reduce what must be disclosed in the early years. They do not remove the need to build the data and processes behind full disclosure.

For listed companies, the NSRF is applied through Bursa Malaysia's Listing Requirements. On 23 December 2024, Bursa Malaysia announced amendments requiring listed issuers to prepare their Sustainability Statements using IFRS S1 and IFRS S2, in line with the NSRF.

In practice, listed issuers report under the ISSB Standards within the Sustainability Statement in their annual report. The NSRF states that each company follows its own regulator's rules on where and when disclosures are made. Bursa therefore governs location and timing for listed issuers, while non-listed companies follow their respective regulator.

Reasonable assurance on Scope 1 and Scope 2 GHG emissions will become mandatory in phases, starting with Group 1 in 2028. On 17 September 2026, the ACSR deferred the original 2027 start by one year for every group (SC media release).

Group 1: Annual reporting periods beginning on or after 1 January 2028

Group 2: From 2029

Group 3: From 2030

The deferral followed a review of 91 Group 1 listed issuers' first filings under the IFRS Sustainability Disclosure Standards, carried out by the Minority Shareholders Watch Group and Climate Governance Malaysia. The review found that the quality of disclosures needed further improvement.

Independent assurance must now be performed under ISSA 5000 (International Standard on Sustainability Assurance 5000). ISAE 3000 (Revised) and ISO standards are no longer recommended. The ACSR will also issue a Sustainability Assurance Guide to support assurance providers.

Under Bursa Malaysia's Listing Requirements, listed issuers must already state whether their Sustainability Statement was subject to internal review by the internal auditor, or to independent assurance under recognised assurance standards.

Reasonable assurance is a higher level of assurance than the limited assurance many companies obtain today. It depends on complete, well-documented emissions data with clear controls. The extra year is intended to give companies time to strengthen reporting processes, controls and data quality, so preparation should start now rather than in the year assurance begins.

Companies preparing their first NSRF report can work through six phases that follow the four pillars of IFRS S2. The earlier they start, the more use they can make of the transition reliefs.

Set the boundary and assess gaps. Confirm the reporting entity, consolidation boundary and principal business segments. Compare current climate practices and disclosures against IFRS S2, then agree a work plan and data owners.

Review governance. Check how the board and its committees oversee climate-related risks and opportunities, and how management reports to them. Update terms of reference where oversight is not documented.

Assess strategy and scenarios. Identify climate-related risks and opportunities over the short, medium and long term, and describe their current and anticipated effects, including financial effects. Use scenario analysis, for example one lower-warming and one higher-warming scenario, to assess climate resilience.

Integrate climate into risk management. Map how climate-related risks are identified, assessed, prioritised and monitored. Bring them into the existing enterprise risk register and reporting cycle.

Build metrics and targets. Review Scope 1 and 2 calculations against the GHG Protocol Corporate Standard, covering boundaries, emission sources, activity data, emission factors and global warming potentials. Prepare the IFRS S2 cross-industry metrics, consider industry-based metrics for principal segments, and document any climate targets.

Prepare the report. Draft disclosures under the four IFRS S2 pillars, stating any transition reliefs applied. Check consistency with the financial statements and, for listed issuers, the Sustainability Statement before board approval.

The data work in phase 5 also builds the evidence trail needed for mandatory reasonable assurance, which starts with Group 1 in 2028.

What does NSRF stand for? NSRF stands for National Sustainability Reporting Framework. It is Malaysia's framework for adopting the ISSB Standards in corporate sustainability reporting.

Is the NSRF mandatory? Yes, for companies in scope. Bursa Malaysia has aligned its Listing Requirements with the NSRF, so listed issuers must report according to their group's timeline.

Does the NSRF apply to SMEs? Most SMEs are not directly in scope. Non-listed companies are included only if their annual revenue is RM2 billion or more. SMEs in the supply chains of reporting companies are, however, increasingly asked for emissions and ESG data.

What is the difference between IFRS S1 and IFRS S2? IFRS S1 covers all sustainability-related risks and opportunities. IFRS S2 covers climate-related risks and opportunities specifically, including GHG emissions.

When must Scope 3 emissions be reported under the NSRF? Scope 3 relief ends with each group's transition period. Full adoption including Scope 3 begins in 2027 for Group 1, 2028 for Group 2 and 2030 for Group 3, except for categories a regulator already requires.

Is the NSRF the same as the ISSB Standards? No. The ISSB Standards (IFRS S1 and IFRS S2) are global disclosure standards. The NSRF is Malaysia's framework for adopting them, setting out which companies apply them, from when, and with which transition reliefs.

Who developed the NSRF? The NSRF was developed by the Advisory Committee on Sustainability Reporting (ACSR), chaired by the Securities Commission Malaysia and endorsed by the Ministry of Finance.

When does the NSRF apply to Group 2 companies? Group 2 applies the NSRF from annual reporting periods beginning on or after 1 January 2026. Under Bursa Malaysia's Listing Requirements, this means financial years ending on or after 31 December 2026.

How is the RM2 billion threshold measured for non-listed companies? The threshold uses consolidated group revenue of RM2 billion or more for two consecutive financial years before the current financial year. Without group-level revenue, it is measured at company level.

When does reasonable assurance become mandatory under the NSRF? Reasonable assurance on Scope 1 and Scope 2 emissions becomes mandatory for Group 1 from annual reporting periods beginning on or after 1 January 2028, Group 2 from 2029 and Group 3 from 2030. The ACSR announced this one-year deferral on 17 September 2026.

Which assurance standard applies under the NSRF? Independent sustainability assurance must be performed under ISSA 5000. ISAE 3000 (Revised) and ISO standards are no longer recommended by the ACSR.