The Securities and Exchange Board of India (SEBI) on Friday imposed a penalty of ₹1 crore on Central Depository Services (India) Limited (CDSL) for multiple regulatory lapses, including failures in handling pledge requests and deficiencies in cybersecurity compliance.
In an adjudication order dated October 30, SEBI Adjudicating Officer Jai Sebastian held that the violations affected CDSL's core obligations as a depository and had implications for the integrity and stability of the Indian securities market.
“These lapses directly impinge upon the Noticee's core obligations as a depository where it provides the foundational, system critical physical and digital infrastructure for electronic record keeping, dematerialization and ownership transfer, etc. Given the systemic importance of a depository, such deficiencies have implications not only for individual investors but also for the integrity and stability of Indian securities market,” the adjudicating officer observed.
SEBI inspected CDSL for the financial year 2023–24 and communicated its observations to the company. After receiving CDSL's responses, the regulator issued a show-cause notice alleging multiple regulatory violations.
The allegations concerned the failure to communicate reasons for rejecting pledge requests to the concerned Depository Participants (DPs), deficiencies in handling Client Unpaid Securities Accounts (CUSA), and violations of cybersecurity and disaster recovery requirements.
SEBI also examined CDSL's data loss prevention measures, the delayed remediation of identified vulnerabilities and the scope of its Vulnerability Assessment and Penetration Testing (VAPT) exercise.
On the issue of pledge rejection, SEBI held that Regulation 79(5) of the Securities and Exchange Board of India (Depositories and Participants) Regulations, 2018, required CDSL to communicate the reasons for rejecting pledge requests to the DPs of both the pledgor and the pledgee.
“I note that the obligation under regulation 79(5) of the DP Regulations is a statutory obligation. Noticee, being an MII, was expected to comply with the said regulatory requirement in letter and spirit,” the adjudicating officer observed.
SEBI found that CDSL had violated requirements governing CUSA operations under its November 11, 2022 circular. CDSL had unfrozen an entire CUSA instead of restricting the operation to the specified securities and quantities. The regulator also found inadequate system-level checks and failures to freeze CUSA on the relevant date on two occasions.
On cybersecurity, SEBI found that CDSL had not completely implemented its Data Loss Prevention measures. Security logs were also being collected at the Primary Data Centre during a disaster recovery drill, contrary to the applicable requirements.
CDSL had further failed to patch identified vulnerabilities within the prescribed three-month period. SEBI also held that its Vulnerability Assessment and Penetration Testing exercise was inadequate because it did not cover all relevant domains and external applications.
SEBI rejected some allegations against CDSL, including the allegation concerning its obligations relating to Basic Services Demat Accounts. It also rejected certain CUSA-related allegations, while finding violations in other aspects of the company's CUSA operations.
SEBI imposed a penalty of ₹1 crore on CDSL under Section 15HB of the SEBI Act, 1992, holding that the penalty was commensurate with the violations.