ESG reporting in Malaysia is mandatory for Bursa-listed companies and for non-listed companies with consolidated revenue of RM2 billion or more, under the National Sustainability Reporting Framework (NSRF) and Bursa Malaysia's listing requirements. For most other companies, including the majority of SMEs, it is voluntary in law, although customer, lender and investor requests increasingly make it a commercial expectation.

The line between the two is less clear than it first appears. A company outside the NSRF may still receive a detailed supplier questionnaire, while a company inside it may find that some parts of the framework, such as assurance and full Scope 3 reporting, are not yet required. Understanding which obligations are legal, which are phased and which are market-driven helps companies avoid both over-reporting and under-reporting.

This article explains where the boundary sits, how it is shifting, and how different stakeholders view the balance.

What Is the Difference Between Voluntary and Mandatory ESG Reporting?

Mandatory ESG reporting is disclosure that a law, regulation or listing rule requires, with defined content and timelines. Voluntary ESG reporting is disclosure a company chooses to make, using frameworks and formats it selects, usually to meet stakeholder expectations.

In Malaysia, mandatory reporting rests on the NSRF, published on 24 September 2024 by the Advisory Committee on Sustainability Reporting (ACSR), chaired by the Securities Commission Malaysia. Bursa Malaysia amended its Main Market and ACE Market Listing Requirements in December 2024 to align the Sustainability Statement with the framework. Voluntary reporting includes anything beyond those requirements, such as a GRI-based stakeholder report or a customer-specific questionnaire response.

What Makes Reporting Mandatory?

Reporting becomes mandatory when a company falls within the scope of the NSRF and its listing rules. The content must follow IFRS S1 and IFRS S2, and the timeline depends on the company's group. The consequence of non-compliance flows through listing-rule enforcement, and regulators have signalled that more formal tools will follow.

What Makes Reporting Voluntary?

Reporting is voluntary when no law or listing rule requires it. A company may still choose to report to win customers, access finance, improve risk management or prepare for future requirements. Because the choice is the company's, the format, depth and frequency are flexible, but credibility still depends on data quality.

Which Companies Must Report ESG Information in Malaysia?

Companies listed on Bursa Malaysia's Main Market and ACE Market, and non-listed companies with consolidated revenue of RM2 billion or more for two consecutive years, must report under the NSRF. Everyone else is outside the mandatory perimeter for now.

What Are the Three Reporting Groups?

Group 1 covers Main Market issuers with a market capitalisation of RM2 billion or above, about 130 companies representing more than 80% of Bursa's market value, starting for financial years from 1 January 2025. Group 2 covers the remaining Main Market issuers from 1 January 2026. Group 3 covers ACE Market issuers and large non-listed companies from 1 January 2027.

Do Banks and Insurers Have Separate Rules?

They follow the NSRF, with sector guidance. Bank Negara Malaysia clarified in March 2025 how the framework applies to the institutions it regulates, and the Joint Committee on Climate Change issued guidance for banks and for insurers and takaful operators after its meeting in August 2026, with capacity-building programmes from October 2026.

Are SMEs Covered?

Most SMEs are not directly covered unless they are ACE Market issuers or meet the RM2 billion revenue threshold for non-listed companies. Local reporting attributes to the Department of Statistics Malaysia the finding that SMEs make up 97% of businesses and 38% of GDP, so the supply chain effect of the NSRF reaches far beyond the companies it formally covers.

Which Parts of ESG Reporting Are Still Voluntary Inside the NSRF?

Several elements remain optional or phased even for in-scope companies, including full Scope 3 reporting, independent assurance and wider frameworks beyond IFRS S1 and S2. Knowing these helps companies plan realistically.

Is Scope 3 Reporting Mandatory?

Not immediately in most cases. Group 1 and Group 2 companies may postpone Scope 3 emissions, except for categories a regulator already requires. Bursa Main Market issuers, for example, already report Scope 3 emissions from business travel and employee commuting. The relief is temporary, so Scope 3 is best seen as a deferred obligation rather than a voluntary one.

Is the Climate-First Approach Optional?

It is a relief that companies may use. Group 1 and Group 2 companies may focus on climate-related risks and opportunities under IFRS S2 in their first two reporting periods, with wider IFRS S1 coverage following. Group 3 companies receive additional time.

Is Assurance Mandatory?

Not yet. The NSRF plans mandatory reasonable assurance of Scope 1 and Scope 2 emissions for Group 1 entities, and in September 2026 the ACSR deferred the start to annual periods beginning on or after 1 January 2028, after a review of the first reporting cohort found that disclosure quality needed to improve. Any independent assurance must follow ISSA 5000. Until then, listed issuers must state whether their disclosures were internally reviewed or independently assured, so assurance is voluntary but disclosed.

Can Companies Still Use GRI?

Yes. GRI remains a voluntary complement for wider stakeholder reporting. It does not replace the NSRF baseline for in-scope companies. Practitioners also mention a possible interoperability approach that maps GRI disclosures to IFRS S1 and S2, but readers should confirm the current position with official sources.

When Does Voluntary Reporting Become a Commercial Necessity?

Voluntary reporting becomes a commercial necessity when customers, lenders or investors ask for the data as a condition of doing business. In practice, a company can be legally free of an obligation and still be expected to deliver.

How Do Supply Chains Create De Facto Requirements?

Large companies that report under the NSRF need data from suppliers to complete their own disclosures, especially for Scope 3. The Securities Commission's chairman has said regulators are looking at the SME sector to help listed companies obtain Scope 3 data, and that Malaysia, as a major player in global supply chains, must meet the sustainability demands of international purchasers.

What Help Exists for Voluntary Reporters?

Support includes the Simplified ESG Disclosure Guide for SMEs in Supply Chains, launched in 2023 by Capital Markets Malaysia, the Securities Commission's PACE initiative and Bursa Malaysia's Centralised Sustainability Intelligence platform. Bursa says the platform is used by listed companies, mid-tier companies and SMEs, although free modules are stated for listed companies, so access terms should be checked.

How Is Enforcement of Mandatory ESG Reporting Developing?

Enforcement is developing gradually, starting with listing-rule obligations and moving toward statutory tools. Bursa Malaysia's chief regulatory officer has said that specific penalties are expected to be introduced progressively through amendments to the Financial Reporting Act 1997, the Companies Act 2016 and the listing requirements.

What Does This Mean for Companies Today?

It means companies should treat the requirements as binding on listed issuers now and expect harder enforcement later. Accuracy and consistency matter, since the combination of assurance plans and future penalties raises the cost of weak disclosure.

What Are the Different Views on Voluntary vs Mandatory ESG Reporting?

Stakeholders agree that standardised disclosure is valuable, but they differ on how far mandatory rules should extend and how fast. The debate has intensified since the 2026 assurance deferral.

What Do Supporters of Mandatory Reporting Say?

Supporters argue that mandatory rules create comparability, protect investors and prevent selective disclosure. They point out that voluntary reporting can lead to inconsistent quality and greenwashing, and that a common baseline lets Malaysian companies compete in international capital markets.

What Do Supporters of Voluntary Reporting Say?

Supporters argue that voluntary approaches let companies focus on what matters for their business, avoid heavy compliance costs and innovate in how they communicate. They note that smaller firms in particular may struggle with detailed mandatory requirements and that proportionality matters.

What Do Companies and SMEs Say?

Companies cite cost, skills shortages and the difficulty of collecting supplier data. SMEs worry about being asked for emissions data they have never tracked, even though they have no direct legal duty. Both groups ask for standard templates, practical training and clear guidance on what is required versus optional.

What Do Critics Say?

Some critics argue that a financially focused mandatory baseline can overlook significant impacts on people and the environment, which voluntary frameworks such as GRI can capture. Others argue that the deferral shows mandatory timelines may have outpaced readiness, while a different camp says the postponement protects data quality and trust.

How Should Companies Decide What to Report?

Companies should decide by separating legal obligations, phased obligations and stakeholder expectations, then building one data foundation that serves all three. This avoids duplicated effort and inconsistent numbers.

What Is a Practical Decision Process?

Confirm your NSRF group and any reliefs, list customer and lender requests, identify voluntary frameworks that add real value, and map the overlaps. Prioritise mandatory items first, then high-value voluntary ones. Keep documentation of how each choice was made.

FAQ: Common Questions About Voluntary vs Mandatory ESG Reporting in Malaysia

Is ESG Reporting Mandatory in Malaysia?

Yes, for Main Market issuers, ACE Market issuers and non-listed companies with consolidated revenue of RM2 billion or more, on the NSRF timeline for their group.

Is ESG Reporting Voluntary for SMEs?

Generally yes in law, unless they are in scope, but larger customers may still request ESG data.

Is Assurance Mandatory?

Not yet. Mandatory reasonable assurance of Scope 1 and Scope 2 emissions for Group 1 entities now applies to annual periods beginning on or after 1 January 2028.

Is Scope 3 Reporting Mandatory?

Not immediately in most cases. It can be postponed, except for categories a regulator already requires.

Can a Company Report Voluntarily Under GRI?

Yes. GRI is a voluntary complement and does not replace the NSRF baseline for in-scope companies.

Will There Be Penalties?

Bursa's chief regulatory officer has said penalties are expected to be introduced gradually through amendments to the Financial Reporting Act 1997, the Companies Act 2016 and the listing requirements.

Conclusion

The mandatory perimeter is clear, the voluntary edges are shifting, and the commercial pull of supply chains blurs the two. In-scope companies must follow the NSRF, while others should expect growing requests even without a legal duty.

Companies that separate legal, phased and market-driven obligations, and serve them from one reliable data set, will navigate the change with less friction. Whether reporting is required or chosen, its value depends on the same thing: numbers that can be traced and explained.