SEBI imposes One Crore Penalty on CDSL for Operational and Cybersecurity Compliance Failures
The Securities and Exchange Board of India (“SEBI”), by an adjudication order dated 30 October 2026, imposed a monetary penalty of one crore on Central Depository Services (India) Limited (“CDSL”) under Section 15HB of the SEBI Act, 1992, for multiple operational and cybersecurity-related compliance failures identified during its inspection for FY 2023-24.
Background
SEBI conducted an inspection of CDSL for FY 2023-24 and communicated its observations to CDSL by email dated 9 January 2024. CDSL submitted its responses by emails dated 13 February 2024 and 20 March 2024. Subsequently, SEBI issued a Show Cause Notice dated 27 August 2024, alleging various non-compliances with the applicable regulatory framework.
After considering CDSL’s submissions and the material on record, the Adjudicating Officer identified six instances of non-compliance.
Key Findings
1. Failure to Communicate Reasons for Rejection of Pledge Requests
CDSL failed to ensure that the reasons for rejecting pledge requests were communicated to the Depository Participants (“DPs”) of both the pledgor and the pledgee. This was found to be inconsistent with Regulation 79(5) of the SEBI (Depositories and Participants) Regulations, 2018, which governs the communication of reasons where a pledge request is rejected.
2. Non-compliance with Requirements Relating to CUSA Operations
CDSL did not fully implement the joint proposal concerning Client Unpaid Securities Account (“CUSA”) operations, as required under SEBI’s circular dated 11 November 2022. The deficiencies included shortcomings in the implementation of controls relating to the unfreezing of ISINs, beneficiary-owner-level controls and freezing of CUSA accounts upon instructions from stock exchanges.
3. Incomplete Implementation of Measures to Prevent Unauthorized Data Transmission
CDSL had not completely implemented the measures prescribed to prevent unauthorized transmission of data. This was held to be in violation of Clause 31 of Annexure A to SEBI’s circular dated 6 July 2015, which sets out requirements relating to information and data security.
4. Deficiencies in Disaster Recovery (DR) Drill
During the DR drill, Security Information and Event Management (“SIEM”) logs continued to be collected at the Primary Data Centre. Consequently, all operations were not being carried out from the Disaster Recovery site during the drill, contrary to Clause 5(c) of SEBI’s circular dated 22 March 2021.
5. Delay in Patching Identified Vulnerabilities
CDSL failed to address identified vulnerabilities within the prescribed period of three months. The Adjudicating Officer held this to be a violation of Clause 2(41) of SEBI’s circular dated 20 May 2022, read with Clause 41 of Annexure A to the circular dated 6 July 2015.
6. Inadequate Scope of Vulnerability Assessment and Penetration Testing (VAPT)
The VAPT exercise undertaken by CDSL was not comprehensive, as it did not cover all domains and external applications. This was held to be contrary to Clause 2(40) of SEBI’s circular dated 20 May 2022, read with Clause 40 of Annexure A to the circular dated 6 July 2015.
Adjudicating Officer’s Observations and Decision
CDSL contended that certain deficiencies were technical or procedural in nature and had not resulted in demonstrable investor loss or undue gain. The Adjudicating Officer did not accept this as a sufficient basis to treat the established non-compliances as inconsequential. The order emphasised the systemic importance of depositories and the need for strict adherence to the applicable operational and information-security requirements.
The Adjudicating Officer also considered the applicability of the penalty provisions. In relation to the deficiencies concerning pledge requests and CUSA operations, the order did not find the conditions for invoking Section 19FA of the Depositories Act, 1996 to be established. The order further avoided imposing separate penalties under overlapping provisions for the same contraventions. Accordingly, the penalty was imposed under Section 15HB of the SEBI Act, 1992.
While the order recorded that no quantifiable gain or investor loss had been established, it also took into account the relevant circumstances, including the previous penalty imposed on CDSL by an order dated 20 July 2026. The Adjudicating Officer ultimately imposed a penalty of ₹1 crore.
CDSL has been directed to pay the penalty within 45 days from receipt of the order. In the event of non-payment, recovery proceedings may be initiated in accordance with Section 28A of the SEBI Act, 1992.
Key Takeaways
- Pledge processing: Depositories must ensure that reasons for rejection of pledge requests are communicated to the DPs of both the pledgor and the pledgee.
- CUSA controls: The prescribed operational controls, including ISIN-level and beneficiary-owner-level controls and action on stock exchange instructions, must be fully implemented.
- Data security: Measures intended to prevent unauthorized data transmission must be implemented completely and not merely maintained as procedural requirements.
- Disaster recovery: DR drills must demonstrate that the required operations, including relevant security-log collection, are functioning from the DR site.
- Vulnerability management: Identified vulnerabilities must be remediated within the prescribed timeline, and VAPT exercises must cover all relevant domains and external applications.
- Regulatory accountability: The absence of quantifiable investor loss or undue gain does not, by itself, make established operational or cybersecurity non-compliances inconsequential.
Source: SEBI Adjudication Order No. Order/JS/RJ/2026-27/32798