Malaysia Plans Reasonable Assurance on Scope 1 and 2 From 2027

Almost every jurisdiction that has mandated sustainability assurance has started in the same place: limited assurance, with a vague promise to move to reasonable assurance later. The EU wrote that escalation into the CSRD and then removed it in the Omnibus, so limited assurance stays. New Zealand deferred its Scope 3 assurance to 2027 while leaving Scope 1 and 2 where they were.

Malaysia is proposing to skip that step.

Under the National Sustainability Reporting Framework, the plan is reasonable assurance on Scope 1 and Scope 2 greenhouse gas emissions, starting two years after each group’s initial adoption of the ISSB standards. Grant Thornton Malaysia’s published summary gives the dates by group: annual reporting periods beginning on or after 1 January 2027 for Group 1, 1 January 2028 for Group 2, and 1 January 2029 for Group 3.

If that holds, a Malaysian large-cap issuer will be giving its auditor a reasonable-assurance engagement on Scope 1 and 2 for FY2027, while its European counterpart of similar size is still on limited.

Two caveats, stated up front

This is a proposal, not a rule in force. The Securities Commission Malaysia’s own NSRF page says external assurance is currently voluntary under the framework, and that its Sustainability Assurance Working Group is still working towards issuing a Sustainability Assurance Framework. Grant Thornton’s summary says the mandatory timeline is subject to further consultation.

So nothing below should be read as a filing obligation that exists today. It should be read as the direction a serious regulator has published, with dates attached, at a point where the data practices that would satisfy it have to start.

Reasonable assurance on FY2027 emissions means the FY2027 data has to be collectable, documented and controlled as it is generated, during 2027. There is no version of this that is solved in 2029.

Who is in which group

The NSRF phases in by three groups, and the definitions are market-cap and revenue based rather than sector based.

Group 1 is companies listed on Bursa Malaysia’s Main Market with a market capitalisation of RM2 billion and above, about 130 companies, reporting from January 2025. Group 2 is the remaining Main Market issuers, from January 2026. Group 3 is ACE Market issuers plus large non-listed companies, defined as consolidated group revenue of at least RM2 billion for two consecutive preceding financial years, from January 2027.

The inclusion of large non-listed companies is the part overseas finance teams tend to miss. A private group with Malaysian revenue at that scale is in the framework on the same clock as a listed ACE Market issuer, without the investor-relations function that usually carries this work.

The reliefs are generous, and they expire

The framework is explicitly climate-first. Every company starts with climate disclosure and picks up the wider sustainability topics later.

Groups 1 and 2 may disclose only climate-related risks and opportunities under IFRS S2 in their early reporting periods. They may concentrate those climate disclosures on principal business segments. And they may postpone Scope 3 emissions, unless their own regulator already requires them to report those. Group 3 gets the same reliefs for one additional year, to 2027. The Securities Commission describes this as a phased and developmental approach, giving additional time for the more complex reporting such as Scope 3 emissions.

Taken together, the reliefs narrow what has to be reported while the assurance plan raises what the reported part has to survive. A Group 1 company may omit Scope 3 and confine its climate disclosure to principal segments, and is then expected to carry a reasonable-assurance opinion on Scope 1 and 2 from FY2027, earlier than anywhere comparable. An investor can underwrite against a number held to that standard.

What reasonable assurance actually demands

The gap between limited and reasonable is not a matter of degree in the way the names suggest.

Limited assurance is a negative-form conclusion. The practitioner performs enough work to say that nothing has come to their attention suggesting the information is materially misstated. It leans on analytical procedures and inquiry.

Reasonable assurance is a positive opinion, the same form of conclusion an auditor gives on financial statements. Getting there requires the practitioner to understand and test the controls over the data, not merely to interrogate the output. For emissions that means the meter readings, the invoices, the conversion factors, the organisational boundary, the treatment of acquisitions and disposals mid-period, and a documented trail showing who computed what from which source and when.

Most sustainability data in most companies is not produced that way today. It is assembled once a year, by a small team, from spreadsheets that were never designed to be evidence. That process survives limited assurance. It does not survive a controls-based opinion.

So the work Malaysia’s proposal creates sits in data systems, and the group that has to do it first has until the start of its FY2027.

Why this is not only a Malaysian question

Any group with Asian operations has three reasons to put this on the agenda.

First, consolidation. If a Malaysian subsidiary sits inside your group, its emissions data is also your data. A subsidiary being driven to reasonable-assurance quality by its local regulator is a fact about your group’s data architecture, not just about your Malaysian filing.

Second, direction of travel. Malaysia is not an outlier for the sake of it. It has built its framework on IFRS S1 and S2 as the baseline, the same baseline Japan’s SSBJ, Australia’s AASB and a growing list of others are using. When one jurisdiction on a shared baseline shows that reasonable assurance on Scope 1 and 2 is considered achievable on a two-year lead, that becomes a reference point in everyone else’s consultation.

Third, the data is the same data. The emissions figure that goes into an IFRS S2 disclosure in Kuala Lumpur is the same measurement an SSBJ filing or an ESRS E1 disclosure draws on, because all of them describe one set of physical facts. Jurisdictions differ on presentation, on thresholds and on the assurance level they attach.

What changes under a reasonable-assurance regime is that the measurement has to be defensible at source. Without that, each filing becomes its own reconstruction of the same year, and the versions get their own chances to disagree with each other.

What to do with this before 2027

If you are in Group 1, the FY2027 clock is the one that matters, and the work is in 2026: get the Scope 1 and 2 data flowing from systems rather than from spreadsheets, with the controls and the audit trail attached as it is captured.

If you are in Group 2 or Group 3, you have a year or two more, and the honest advice is to not use it. The companies that do this calmly will be the ones that started before the deadline made it urgent.

And if you are outside Malaysia entirely, treat this as the early reading on where assurance is going on an ISSB baseline. Limited assurance was always described as a starting point. Malaysia has published what the next point looks like, and attached dates to it.

Socious Report is built on this premise: one dataset, assembled once with its evidence attached, filed into CSRD, SSBJ and ISSB formats, with an independent Socious Verify credential on top. If you want to see where your current emissions data would fail a controls-based review, our free CSRD readiness check is the fastest way to find out.