On 17 September 2026 Malaysia’s Advisory Committee on Sustainability Reporting, chaired by the Securities Commission, pushed back mandatory external assurance of greenhouse-gas emissions by a year. Its largest listed companies now need reasonable assurance over Scope 1 and Scope 2 for annual reporting periods beginning on or after 1 January 2028. In the same release it named a single standard for that work: ISSA 5000.
For a Thai board, the comparison is useful. Under the SEC’s ISSB roadmap, SET50 companies report under IFRS S1 and S2 from FY2027, and their Scope 1 and 2 figures must be verified by a third party from that first year, with no transition relief. So Thailand’s first assured year now comes before Malaysia’s. That is not the same as saying Thailand is stricter, and the difference is what this post is about.
What Malaysia announced on 17 September
The SC’s release is short, and four points in it matter:
Group 1 (Main Market issuers with market capitalisation of RM2 billion or more) moves from 1 January 2027 to 1 January 2028. Groups 2 and 3 move to 2029 and 2030.
The requirement is reasonable assurance on Scope 1 and 2, the higher level. The policy document goes straight there, with no limited-assurance step first. Scope 3 and other disclosures are left for a later announcement.
Independent assurance must follow ISSA 5000. ISAE 3000 (Revised) and ISO standards are “no longer recommended.” The policy also requires firms to apply ISQM 1 and practitioners to follow IESBA’s sustainability ethics standards (IESSA).
The policy says the framework for assurance providers will be announced after further consultation. A 2025 consultation proposed registering providers with the SC’s Audit Oversight Board. That has not been adopted.
Any independent assurance must now be performed in accordance with the designated recognised assurance standard, i.e. ISSA 5000 only.
Securities Commission Malaysia, media release, 17 September 2026One correction to how this is being reported. The 2027 date was never a rule in force. The 2024 framework said Malaysia would “aim for” reasonable assurance from 2027, and the group-by-group dates came from a June 2025 consultation paper. The policy table itself labels the old dates “as proposed.” Malaysia has deferred a plan, not repealed an obligation.
Why Malaysia gave its issuers another year
The SC says the decision followed a review by the Minority Shareholders Watch Group and Climate Governance Malaysia of the first 91 Group 1 issuers to report under the IFRS standards. According to that report, those issuers averaged a validated disclosure score of 54.6%. Risk management scored best and metrics and targets worst. Almost every issuer identified climate risks, but only about a third disclosed their expected effect on financial performance and cash flows.
The regulator’s reasoning is simple: assuring numbers before the systems behind them are ready produces expensive opinions on weak data. So preparers get a year to strengthen reporting processes, controls and data quality. Malaysian Group 1 companies were in their first ISSB cycle when the review was done. SET50 companies will be in exactly that position in FY2027, except their verification is due in the same year.
The ASEAN assurance ladder, side by side
| Thailand | Malaysia | Singapore | Philippines | |
|---|---|---|---|---|
| First assured year | FY2027 (SET50) | Periods from 1 Jan 2028 (Group 1) | FY2029 (all listed) | Two years after a company’s first PFRS S1/S2 year |
| Level | Third-party verification; “limited assurance” in the 2024 consultation | Reasonable | Limited | Limited |
| Scope | Scope 1 + 2 | Scope 1 + 2 | Scope 1 + 2 | Scope 1 + 2 |
| Standard | “Internationally accepted assurance standards” | ISSA 5000 only | ISSA 5000 (with IESSA ethics) | ISSA 5000 |
| Who may assure | TGO-registered verifiers or other verifiers | To be decided after consultation | ACRA-registered audit firms or SAC-accredited TIC firms | CPAs or qualified non-accountants |
| Status | Principles approved Nov 2025; final rules pending | Policy document issued 17 Sep 2026 | Deferral announced 25 Aug 2025 | SEC MC No. 16, s. 2025 |
Thailand: SEC news release 298/2568 (28 November 2025) and the SEC’s 2024 consultation. Malaysia: SC release and policy document, 17 September 2026. Singapore: ACRA sustainability reporting requirements page and the ACRA/SGX RegCo release of 25 August 2025. Philippines: SEC MC No. 16, s. 2025, as summarised in secondary sources; the SEC’s own site blocked automated reading, so treat that column as less firmly sourced. Indonesia and Vietnam have no binding assurance requirement for listed companies that we could verify.
Thailand goes first. Malaysia goes deeper.
On timing, Thailand is ahead: the first external check on SET50 GHG figures comes for FY2027, a year before Malaysia’s and two years before Singapore’s. But on the other three measures Malaysia asks more:
- Level. Reasonable assurance is roughly an audit-style opinion. Limited assurance, which the Thai consultation described, is a lighter review-style conclusion.
- Standard. Malaysia names one standard. The SEC’s release names none and accepts “internationally accepted” standards. Its 2024 consultation gave ISAE, ISSA 5000 and ISO as examples.
- Providers. Thailand deliberately widened the pool to TGO-registered verifiers “or other verifiers,” because demand is expected to exceed supply. Malaysia and Singapore are narrowing theirs.
That is why “Thailand is stricter” is the wrong conclusion. The better reading: Thailand chose to start early and start light, and Malaysia chose to start later and start high. For a SET50 company, the practical effect is that its first assured inventory comes with less time to fix the data behind it. That is the problem Malaysia’s review describes. Our SET50 climate-disclosure guide sets out the full FY2027 obligation.
Every road now leads to ISSA 5000
Thailand’s regulator has not picked a standard, but its accounting profession has. The Federation of Accounting Professions issued TSSA 5000, the Thai text of ISSA 5000, in Notification 13/2569. It applies to periods beginning on or after 15 December 2026, or to information as at that date or later, and it replaces TSAE 3410. For a calendar-year company, FY2027 is the first year it covers, which is also SET50’s first ISSB year.
The IAASB’s own guidance points the same way. Its ISSA 5000 FAQ says the standard is “designed to be profession agnostic,” so certification bodies can use it as well as audit firms, as long as they meet its quality-management and ethics conditions. It also says ISAE 3410 on GHG statements could be withdrawn once ISSA 5000 takes effect, and that ISAE 3000 (Revised) will no longer be used for assurance on sustainability information.
We read eight assurance statements in recent SET-listed sustainability reports. None cites ISSA 5000, which is expected, since it does not take effect until FY2027 periods. All eight assurers are certification bodies, not audit firms. They use a mix of ISAE 3000 with ISAE 3410, AA1000AS v3, and ISO 14064-3. Companies on the ISAE route will have to move to the new standard. Companies on AA1000AS or ISO 14064-3 are not forced to by the SEC as currently drafted. But as the rest of the region standardises on ISSA 5000, with Malaysia’s decision the latest example, a non-ISSA opinion gets harder to explain to a regional investor. The detail of the Thai changeover is in our TSSA 5000 explainer.
The question no assurance standard answers
None of these rules, in Malaysia, Singapore or Thailand, says which language edition of a report the assurance covers. In Malaysia that hardly matters, because companies file in English. In Thailand the One Report is filed in Thai, and only the Thai text has legal force. The English edition is voluntary, and it is the one foreign investors and rating analysts actually read.
FTSE Russell scores from public disclosure only, with no questionnaire, and Thai is not among the six research languages named in its FAQ (v1.5 §1.8). SET itself recommends English disclosure for that reason. CDP will not score a Thai-language response. If the verified Scope 1 and 2 figures and the verifier’s scope wording appear in the Thai filing, the English edition has to match them exactly. A rounding difference or a loosely translated boundary is exactly what a reader comparing the two will find. We covered how to put this in the engagement letter in which edition did your assurer sign? A clause-mapped bilingual One Report is how you keep the two in step.
Where the evidence runs out
- Thailand’s rule is not final. SEC release 298/2568 approved principles and says the SEC is still amending the regulations. We found no final notification on the SEC site as at this week. The level of assurance, and whether any standard is named, could still change.
- “Limited” is the consultation’s word. The November 2025 release speaks only of verification (ทวนสอบ) to international standards. We say “verification” where the release does.
- Malaysia deferred a proposal, not a rule. Its provider regime, AOB oversight and Scope 3 assurance are all still to come. The release gives no start date for the ISSA-5000-only rule itself.
- Philippine details are secondary-sourced. We could not open the SEC Philippines circular directly.
- No evidence that language moves a score. We know of no primary source showing a Thai-language disclosure is rated lower. The case for the English edition is about who reads it and whether it is accurate, not a penalty.
What a SET50 company should do now
The first assured year is FY2027, and that year starts in about three months. In order:
Verified in Thai, read in English
Othello builds the English sustainability report and One Report under ISO 17100 Translate-Edit-Proofread, clause-mapped to your Thai filing, together with the ESG advisory and TGO CFO carbon inventory behind the assured numbers.
Run the free Gap AuditMalaysia’s delay is not a signal that Thailand will slow down too. The SEC gave no sign of that, and verification is the one duty in its roadmap with no transition relief. The region is converging on ISSA 5000 at different speeds. For SET50, that point comes in FY2027, with a TGO-certified organisational footprint as the most direct route to numbers a verifier will sign. Follow the final Thai rules on our regulatory tracker →
Sources, read 28 September 2026: Securities Commission Malaysia, “ACSR’s Mandatory Sustainability Assurance Requirement to Take Effect in 2028” (17 September 2026) and the Policy Document on Mandatory Sustainability Assurance Requirements; MSWG and Climate Governance Malaysia, Malaysia’s First Wave of NSRF (September 2026), paraphrased; SEC Thailand, news release 298/2025 (28 November 2025) and consultation 50/2567; TFAC Notification 13/2569 (TSSA 5000); IAASB, ISSA 5000 Frequently Asked Questions (January 2025); ACRA, Sustainability reporting and assurance requirements; FTSE Russell ESG Scores FAQ v1.5 §1.8; assurance statements in FY2024–25 sustainability reports of SET-listed companies. Quotations from Thai are our translations.
See where your English edition is losing FTSE points.
A free Gap Audit maps your published English disclosure against FTSE Russell’s 14 themes — and shows exactly which gaps are quietly costing you points, index inclusion and investor attention.
