On 17 March 2025 Bank Negara Malaysia issued BNM/RH/PD 028-124, its policy document on Climate Risk Management and Scenario Analysis. Paragraph 7.1 says plainly what it does to the previous one: it supersedes the policy document issued on 30 November 2022. If your reference copy is the 2022 edition, you are reading a document that has been replaced.
That is the first thing worth knowing. The second is that the disclosure clock in it started before the document was issued, and it does not start at the same time for everyone.
Who it applies to
The applicability list is broad and named explicitly: licensed banks, licensed investment banks, licensed Islamic banks including international Islamic banks, prescribed development financial institutions, licensed insurers including professional reinsurers, licensed takaful operators including professional retakaful operators, and financial holding companies.
Paragraph 8.1 sets the level of application at both ends at once: entity level, meaning global operations including overseas branch operations, and consolidated level, which takes in all financial and non-financial subsidiaries. Financial holding companies comply on a consolidated basis under 8.2. A group that reads only one of those two levels has read half the requirement.
Table 1: three groups, three start dates
Climate-related disclosures are phased in by group, for annual reporting periods beginning on or after:
| Group | Applicable financial institutions | Effective |
|---|---|---|
| 1 | Main Market-listed FIs with market capitalisation (excluding treasury shares) of RM2 billion and above as of 31 December 2024, or as at the date of listing after 31 December 2024 | 1 January 2025 |
| 2 | Main Market-listed FIs other than those in Group 1 | 1 January 2026 |
| 3 | All other financial institutions | 1 January 2027 |
The disclosures are to be published together with the annual financial report. Note the sequencing: the Group 1 date is earlier than the issuance date of the document itself. For the largest listed institutions, the first reporting period in scope was already running when the policy document was issued.
Paragraph 14.10 covers the interval: institutions continue producing the disclosures required under paragraphs 14.3 to 14.7 until the effective dates under 14.8 and 14.9 arrive. There is no gap year.
Table 2: assurance is a second clock, and it is not fixed yet
Disclosure and assurance are separate timelines. Paragraph 14.9 requires external reasonable assurance on Scope 1 and 2 GHG emissions, in line with Table 2 and with the assurance framework under the NSRF — which the document defines as the framework issued by the Advisory Committee on Sustainability Reporting on 24 September 2024.
Table 2 gives three effective dates for reasonable assurance, for annual reporting periods beginning on or after: 1 January 2027, 1 January 2028 and 1 January 2029.
Two caveats belong with those dates every time they are quoted.
First, the document itself says the framework is subject to further consultation, and that where the dates deviate from the final assurance framework, institutions shall follow the dates in the final framework. These are not settled dates. Anyone presenting them as fixed is adding a certainty the regulator did not.
Second, a limit on our own reading rather than on the document: we extracted this text programmatically, and the group numbers in Table 2 did not come through — only the three dates, in column order. Pairing them one-to-one with Table 1's groups is the obvious reading, but it is an inference from ordering, not something we read off the page. We are flagging it rather than presenting it as read.
What this article does not cover
The plan for this slot was Malaysia and Vietnam. We are publishing Malaysia only.
The reason is the rule we hold for regulatory writing: every rule, figure and date must come from the issuing authority's own document, not from a news summary or a search result. We reached BNM's document and read it. We requested the State Bank of Vietnam's own press release on Circular 61/2024/TT-NHNN and received a page whose title element reads literally Title — a portal shell, not the release text. Not having read it, we are not going to characterise it.
Vietnam follows when we have the document, not when the schedule would like it to.
The reason we read the primary source, in one example
Before locating the 2025 policy document we were working from a file named SD_Climate-Risk-Mgmt-Scenario-Analysis-Nov2022.pdf. It is a genuine BNM publication and it downloads cleanly. Its own paragraph 1.1 states that it is supplemental guidance to the policy document — it carries six case studies and imposes no requirements at all.
An article citing "BNM requires…" from that file would have attributed requirements to a document that has none, while looking properly sourced. Reading a genuine primary source is not sufficient. It has to be the right edition of the right document, and only the document can tell you which one it is.
What this means if you carry the exposure
The Group 1 date has passed, the Group 2 date is months away, and the assurance clock behind both is still in consultation. The practical question is not whether Malaysian climate disclosure is coming — it has started — but which group each entity in a book falls into, and at which of the two levels in paragraph 8.1 the answer changes.
GlobMaps does not advise on compliance and makes no claim to be aligned with, certified by, or endorsed by any regulator. What we publish is measured, dated, sub-national climate data that a risk file can cite and someone can check later. Whether that data is useful to a disclosure programme is a decision for the institution making it.
Source: Bank Negara Malaysia, Climate Risk Management and Scenario Analysis, BNM/RH/PD 028-124, issued 17 March 2025, read directly from bnm.gov.my. Full extraction record and its limits: handoffs/2026-08-29-brand-pr-bnm-crmsa-2025-source-notes.md.