Malaysia deferred mandatory sustainability assurance to 2028: what still applies

Mandatory reasonable assurance on Scope 1 and Scope 2 GHG emissions now takes effect for Group 1 for annual reporting periods beginning on or after 1 January 2028, not 1 January 2027, as announced by the Securities Commission Malaysia on 17 September 2026. Group 2 and Group 3 follow in 2029 and 2030. The Group 1 reporting date is unaffected and stays 1 January 2027. Until the assurance dates, listed issuers will continue to be required to state whether their disclosures were internally reviewed or independently assured, and any independent assurance must follow ISSA 5000 only.

What did the Securities Commission Malaysia announce on 17 September 2026?

The SC published a media release, ACSR’s Mandatory Sustainability Assurance Requirement to Take Effect in 2028, datelined Kuala Lumpur, 17 September 2026. It says the Advisory Committee on Sustainability Reporting (ACSR), which the SC chairs, “has deferred the commencement of mandatory reasonable assurance requirements on Scope 1 and Scope 2 GHG emissions disclosures for Group 1 applicable entities under the National Sustainability Reporting Framework (NSRF)”. The release gives no decision date, so this page says only that the SC announced the deferral on 17 September 2026.

“Before” is the SC’s FAQ of 14 January 2026; “after” is the release. Who is in each group is on the Malaysia NSRF page.

Each date is for annual reporting periods beginning on or after that day. Before: FAQ item 3.1. After: the release gives the years (Group 1 “1 January 2028, instead of 1 January 2027”; Groups 2 and 3 “delayed by one year to 2029 and 2030 respectively”). The days for Groups 2 and 3, and the “As mandated” and “shall apply” wording, are from the table and paragraph 2.0 of the policy document the release links to.

The SC’s stated basis is a review by the Minority Shareholders Watch Group (MSWG) and Climate Governance Malaysia (CGM) of “the first cohort of 91 Group 1 listed issuers” that “found further improvements to the quality of disclosures are needed”. That is all the release says the review found. It names no strongest or weakest area, so this page attributes none.

What did the rule say before the deferral?

The SC’s FAQ on the National Sustainability Reporting Framework, issued 14 January 2026, answered issuers’ questions on assurance before the deferral. It is an answer to issuers, not the listing requirement. Item 3.1 worded the Group 1 date as an aim: “The aim is to mandate reasonable assurance on Scope 1 and Scope 2 GHG emissions for Group 1 starting from annual reporting periods beginning on or after 1 January 2027.” It called the timing for the other groups “proposed”, and said the timeline was “subject to further consultation by the ACSR through the Sustainability Assurance Working Group led by the AOB”.

The policy document the release links to words the position differently. Its paragraph 2.0 says “mandatory external reasonable assurance on Scope 1 and Scope 2 GHG emissions shall apply to the applicable entities on a phased approach”, and its table sets “As proposed in Public Consultation Paper dated 25 June 2025” (1 January 2027, 2028 and 2029) beside “As mandated” (1 January 2028, 2029 and 2030). The release adds that “A public consultation period was held earlier”. A board paper, engagement letter or guide that gives 1 January 2027 for Group 1, or calls the date an aim or a proposal, was written against that earlier position.

What must a listed issuer still state about assurance today?

The deferral does not suspend a statement listed issuers already make. The release says so in terms, quoted in the table below. The policy document the release links to words the duty in paragraph 3.0: “Until the effective date of mandatory external assurance”, all Main Market and ACE Market listed issuers “shall continue to disclose in their sustainability reports whether the sustainability disclosures have been subjected to” either (a) “internal review by the listed issuer’s internal auditor” or (b) “independent assurance by sustainability assurance provider performed in accordance with” ISSA 5000. The Bursa Malaysia listing requirement text was not read, so the duty is attributed to the release and that policy document, not to a Bursa paragraph.

Which assurance standard does Malaysia point to now?

ISSA 5000 only. The release: “Any independent assurance must now be performed in accordance with the designated recognised assurance standard, i.e. ISSA 5000 only.” Its footnote 1 gives the full title: International Standard on Sustainability Assurance (ISSA) 5000, General Requirements for Sustainability Assurance Engagements.

The release uses two verbs: independent assurance “must now be performed” under ISSA 5000 only, while the other two standards “will no longer be recommended”. This page does not turn the second into a prohibition. Both documents name “the International Organization for Standardization (ISO)” without a standard number, so this page cannot say which ISO standard is meant.

Paragraph 4.0 of the policy document the release links to adds a condition on who performs an ISSA 5000 engagement. Such engagements “shall be performed by practitioners operating within a system of quality management that complies with International Standard on Quality Management (ISQM) 1”, and those practitioners “shall also comply with” the International Ethics Standards for Sustainability Assurance (including International Independence Standards) of the International Ethics Standards Board for Accountants. A provider should be able to show you both.

The designation is newer than two earlier statements: the FAQ of 14 January 2026 (table above), and an April 2026 consultative document on Companies Act amendments in which the Companies Commission of Malaysia (SSM) said, in a footnote to its table of proposed assurance timelines, that the ACSR “is currently assessing the feasibility of adopting the International Standard on Sustainability Assurance 5000 (ISSA 5000) in Malaysia”. The release does not say when the designation was made. For what the standard changes for the company being assured, see ISSA 5000: what changes for the company being assured.

When is the first assured period?

The SC’s dates are for “annual reporting periods beginning on or after” a given day. The table below is derived by this page from those dates. It is not quoted from the SC. It assumes a 31 December year-end, and FY2028 means the year ending 31 December 2028.

Derived by this page, as is everything in the table. For any other year-end, the first assured period is the first period that begins on or after the date. A Group 1 issuer with a 30 June year-end, whose periods begin on 1 July, is first assured for the year beginning 1 July 2028 and ending 30 June 2029.

Two readings, both this page’s own. For a calendar-year Group 1 issuer, the first fully applied year and the first assured year used to be the same, FY2027; they are now a year apart. The full-application date is in the IFRS Foundation’s jurisdictional profile for Malaysia (updated 12 June 2025), and neither the release nor the policy document mentions a change to it. And the FY2026 and FY2027 reports both fall before the first assured period, so on this page’s reading of the interim duty both still carry the statement of whether.

For what else changes for Group 1 on 1 January 2027, see Bursa NSRF Group 1: what changes before 1 January 2027. For Group 2, see what FY2026 reporters need in place.

What did the SC say the extra year is for?

The release states the purpose in one sentence: “The additional year aims to support preparers in strengthening reporting processes, controls and data quality ahead of mandatory assurance.” It does not define “controls”. One press version of the sentence adds the word “internal” before it. The release does not.

What a year spent on controls looks like is this page’s reading, not the SC’s. For a finance function it is the things an assurance provider asks for first, held for each Scope 1 and Scope 2 figure:

• Who prepared it. A named preparer for each figure, not a team name, and the date.
• Who reviewed it. A reviewer who is not the preparer, with the review recorded at the time rather than reconstructed from an email thread.
• The evidence held. The source document behind each input (invoice, meter reading or fuel record), where it is stored, and that it is the version used.
• The method note. The emission factor source and version, the Scope 2 method, the boundary, and any change from last year with the reason.
• The sign-off record. Who approved the figure for publication, and when.
• Reproducibility. Whether someone who was not in the room can regenerate the figure eighteen months later from what is held. Could you reproduce this figure in eighteen months?

Reasonable assurance is a higher level than limited assurance. For the difference, see Limited versus reasonable assurance: what changes for the preparer. For what is asked for, in order, see what auditors check in a first-cycle IFRS S2 review.

What is not settled?

Open by the SC’s own words:

Not verified by this page:

• The day the ACSR took the decision. The release is dated 17 September 2026 and says the ACSR “has deferred” the requirement. It gives no decision date.
• The policy document’s issuer, date and legal basis. The one-page document, titled “Policy Document on Mandatory Sustainability Assurance Requirements”, prints none of the three. Cite it by title and paragraph, and say where you obtained it.
• The Bursa Malaysia listing requirement text behind the interim duty. It was not read.
• The MSWG and CGM review report. It is not one of the documents this page was built from.
• The Malaysian instrument that adopts ISSA 5000. The IAASB’s adoption list shows Malaysia as “ISSA 5000, issued by the Malaysian Institute of Accountants (MIA)”. The SC’s release does not name MIA, and the MIA instrument was not read.
• When the interim duty ends for a given report. Policy document paragraph 3.0 says “Until the effective date of mandatory external assurance”. Neither document says whether that covers the report for a period beginning 1 January 2027, which a calendar-year Group 1 issuer publishes after 1 January 2028. The first-assured-period section gives this page’s reading, not the SC’s.
• How “must now” applies before ISSA 5000’s own effective date. The IAASB says ISSA 5000 “is effective for periods beginning on or after December 15, 2026”, with early application permitted unless a jurisdiction states otherwise. The release says independent assurance “must now” follow ISSA 5000. Neither the release nor the policy document says how that applies to an engagement on a period beginning before the IAASB’s date, such as a calendar-year issuer’s period beginning 1 January 2026. This page records the question and does not answer it.

Common questions

Does the deferral change my reporting date?

No. Only the assurance dates moved. Group 1’s full IFRS S1 and IFRS S2 date remains annual reporting periods beginning on or after 1 January 2027, and neither the Securities Commission Malaysia’s release of 17 September 2026 nor the policy document it links to mentions a change to reporting dates.

Do I need assurance for FY2026?

Not under the mandatory requirement. For Group 1 it applies to annual reporting periods beginning on or after 1 January 2028 (Group 2 from 2029, Group 3 from 2030), as announced by the Securities Commission Malaysia on 17 September 2026, so for a 31 December year-end the first assured period is FY2028, a date derived by this page and not stated by the SC. Until then, listed issuers still state whether their disclosures were internally reviewed or independently assured.

Which standard should my assurance provider use?

ISSA 5000 only, according to the SC’s release of 17 September 2026. ISAE 3000 (Revised) and ISO “will no longer be recommended”. Paragraph 4.0 of the policy document the release links to adds conditions on the practitioner: a system of quality management that complies with ISQM 1, and the International Ethics Standards for Sustainability Assurance.

Who can provide the assurance?

The 17 September 2026 documents do not settle it. The SC’s FAQ of 14 January 2026 said the ACSR “intends to adopt a profession-agnostic approach” allowing both audit and non-audit assurance providers, subject to them registering with AOB, and called the approach “subject to further consultation”. The release says the remaining proposals “will be communicated in due course”.

Next: find your cohort and first period in the deadline checker, then get started with the six-minute readiness diagnostic. It scores your readiness against IFRS S2 and sends a gap report naming what is missing.