SEBI Issues New Comprehensive Guidelines For Custodians, Mandates Segregation Of Activities

The Securities and Exchange Board of India (SEBI) on Wednesday issued a circular setting out comprehensive guidelines for custodians, pursuant to amendments to the SEBI (Custodian) Regulations, 1996 notified on 18 September 2025.

The circular prescribes detailed norms on the segregation of activities, permitting custodians to carry out other financial services through Strategic Business Units, subject to safeguards such as maintaining separate accounts and compliance with net-worth criteria. Custodians providing unregulated financial services are required to make appropriate disclosures to clients.

SEBI has also clarified that while non-core activities may be outsourced, core business and compliance functions cannot be outsourced. Custodians holding physical securities must comply with the requirement of maintaining a vault, while those that do not hold such securities are not required to do so.

SEBI has also clarified that while non-core activities may be outsourced, core business and compliance functions cannot be outsourced. Custodians holding physical securities must comply with the requirement of maintaining a vault, while those that do not hold such securities are not required to do so.

Significantly, the circular introduces enhanced governance and compliance requirements, including the constitution of board committees such as the Audit Committee, Nomination and Remuneration Committee, and Risk Management Committee; the formulation of a well-documented risk management policy; the designation of a senior-level officer for overall risk management; and the maintenance of scalable infrastructure capable of handling increased transaction loads.

As per the circular, custodians are also required to put in place a framework for the orderly winding down of their business. They must further implement a comprehensive Business Continuity Plan (BCP) and Disaster Recovery (DR) mechanism. To reduce the compliance burden, SEBI has discontinued certain periodic reporting requirements.

The provisions, except for specific clauses relating to the wind-down framework and Disaster Recovery Site infrastructure, will come into force on 24 March 2026.