NSRF Malaysia: Who Must Report, and What It Means for Suppliers
The threshold is RM2 billion, so most factories are nowhere near it — but something related is coming, and it helps to know which is which.
Sustainability · 8 min read
The National Sustainability Reporting Framework (NSRF) was launched by the Securities Commission Malaysia in September 2024. It applies to companies listed on Bursa Malaysia's Main Market and ACE Market, and to non-listed companies with annual revenue of RM2 billion or more.
That threshold is measured on consolidated group revenue across two consecutive financial years preceding the current one. Where there is no group-level revenue, it is measured at company level.
If you run a manufacturing operation of thirty to three hundred people, you are not close to that number. The NSRF does not apply to you. So why does it keep coming up in conversations with your customers? Because it applies to them, and one part of it eventually lands on their suppliers.
Who must report, and when
The framework phases in across three groups. Dates refer to annual reporting periods beginning on or after 1 January of the year shown.
- Group 1 — from 2025. Main Market listed issuers with market capitalisation of RM2 billion and above. Full adoption of IFRS S1 and S2, including Scope 3 emissions disclosure, from 2027.
- Group 2 — from 2026. All remaining Main Market listed issuers. Full adoption including Scope 3 from 2028.
- Group 3 — from 2027. ACE Market listed issuers, and non-listed companies with annual revenue of RM2 billion and above. Full adoption including Scope 3 from 2030.
Each group also receives transition reliefs from its first reporting period — two years for Groups 1 and 2, three years for Group 3. During that window they may report on climate-related risks and opportunities only, focus climate disclosures on principal business segments, and omit Scope 3 emissions entirely, except for categories their regulator already requires.
Why you are hearing about it anyway
Scope 3 is the reason. A company's emissions are grouped into three scopes:
- Scope 1 — what it burns directly: diesel for forklifts and generators, LPG for boilers, refrigerant losses.
- Scope 2 — purchased energy, in practice mostly grid electricity.
- Scope 3 — everything else across the value chain, including purchased goods and services.
Your Scope 1 and Scope 2 are part of your customer's Scope 3. When a Bursa-listed manufacturer has to disclose Scope 3, it cannot calculate that number without asking its suppliers what their energy consumption looks like. The request arrives as a spreadsheet, usually with a deadline and rarely with much explanation.
When it actually arrives
Later than the noise suggests. Scope 3 disclosure only begins at full adoption — 2027 for Group 1, 2028 for Group 2, 2030 for Group 3 — and during the relief period beforehand, those companies may skip it entirely.
The practical consequence is that the largest Bursa companies start needing supplier data for reporting periods beginning in 2027. Internal preparation runs ahead of the reporting deadline, so the first questionnaires reach suppliers earlier than the dates imply. If your major customer is a large listed Malaysian manufacturer, a Singapore-listed parent, or a Japanese or European group, expect it sooner rather than later.
None of this creates a legal obligation for you. It creates a commercial one, which for most suppliers is the more pressing of the two.
What a factory should do now
Start recording consumption. Monthly grid electricity in kWh, diesel and LPG in litres or kilograms, refrigerant top-ups by type and quantity. Any credible emissions figure needs twelve months of history behind it, which means the binding constraint is calendar time, not effort. Begin now and you have a usable baseline before anyone asks.
Find out whether your customers are in scope. If your major customer is listed on Bursa's Main Market, a request is coming. If they are all privately held SMEs, it probably is not.
Recognise the data you already hold. Your JKKP 8 register carries incident, severity and frequency rates. Those are standard social metrics in any sustainability disclosure — you are already producing ESG data without calling it that. The same is true of your scheduled waste records and DOE licensing documentation.
Do not buy a carbon accounting platform yet. A single-site factory with three energy sources needs a spreadsheet, not a subscription. Software solves a data-volume problem you do not have.
Be careful what you claim. An estimated figure presented as a measured one is worse than saying you do not have it yet. Customers increasingly ask how numbers were derived, and a supplier who cannot answer that is in a weaker position than one who was honest about the gap.
Check whether your parent company covers you. A large non-listed company whose holding company already reports under ISSB-aligned or equivalent standards, such as the European Sustainability Reporting Standards, may be able to rely on the parent's disclosures.
What is not yet settled
Two parts of the framework remain open. The assurance framework is expressly subject to further consultation — the stated aim is reasonable assurance over Scope 1 and Scope 2 emissions from 2027, provided by accounting and non-accounting practitioners, but the detail is not fixed. Further guidance may also be issued on which international standards qualify for the holding-company exemption. Anyone presenting those as settled today is guessing.
This article also does not cover obligations originating outside Malaysia. A supplier to a European group may encounter requirements on a different timetable entirely, and that sits outside the NSRF.
Source: Securities Commission Malaysia, National Sustainability Reporting Framework implementation timeline. Figures are taken from the SC's published implementation chart and are current as at August 2026.
How ProSafe helps
If a customer has sent you an ESG or carbon data request and you are not sure what it is asking for, we will read it and tell you what is genuinely required and what is boilerplate. Much of the underlying data — energy consumption, waste records, safety statistics — comes from the same systems we already help factories build and maintain.
NSRF questions, answered
Does the NSRF apply to my company?
Only if you are listed on Bursa Malaysia's Main Market or ACE Market, or you are a non-listed company with annual revenue of RM2 billion or more, measured on consolidated group revenue across two consecutive financial years preceding the current one. Most Malaysian manufacturers fall well outside it.
Our customer is asking for carbon data. Is that the NSRF?
Not directly. It means your customer is subject to the framework and is preparing for Scope 3 disclosure, which covers emissions in their supply chain — including yours. The reporting obligation is theirs. The data request is yours to answer, and there is no legal penalty for not answering, only a commercial one.
When will this actually reach suppliers?
Scope 3 disclosure begins at full adoption: reporting periods beginning in 2027 for the largest Main Market issuers, 2028 for the rest of the Main Market, and 2030 for ACE Market issuers and large non-listed companies. Before those dates, transition reliefs permit these companies not to disclose Scope 3 at all. Internal preparation runs ahead of the deadline, so questionnaires arrive earlier than the dates suggest.
What are Scope 1, Scope 2 and Scope 3 emissions?
Scope 1 is what you burn directly — diesel for forklifts and generators, LPG for boilers, refrigerant losses. Scope 2 is purchased energy, mostly grid electricity. Scope 3 is everything else across the value chain, including purchased goods and services. Your Scope 1 and 2 become part of your customer's Scope 3, which is the entire reason they are asking.
Will emissions data need to be audited?
For companies inside the NSRF, the framework aims for reasonable assurance over Scope 1 and Scope 2 emissions starting in 2027, and contemplates both accounting and non-accounting practitioners providing it. The assurance framework itself remains subject to further consultation. Suppliers outside the framework face no assurance requirement, though individual customers may set their own expectations.
What should we do first?
Start recording consumption data. Monthly electricity in kWh, fuel in litres, refrigerant top-ups by type and quantity. Any credible emissions figure needs twelve months of history behind it, so the binding constraint is calendar time rather than effort. It costs almost nothing and everything else depends on it.
Received a questionnaire you cannot answer?
Send it over. We will tell you what is genuinely required, what is boilerplate, and which data you already have.