SEBI Imposes ₹1 Crore Fine on CDSL for Compliance Lapses

The Securities and Exchange Board of India (SEBI) has imposed a penalty of ₹1 crore on Central Depository Services (India) Ltd (CDSL) for multiple compliance lapses. According to the regulatory order, CDSL has been directed to pay the penalty within 45 days, failing which recovery proceedings may be initiated against the depository.

The penalty follows an inspection of CDSL's operations that revealed violations of several regulatory requirements during the financial year 2023-24. SEBI's 102-page order detailed shortcomings across multiple operational areas, including electronic record-keeping, dematerialization, and ownership transfers.

Among the specific violations noted by the regulator was the failure to communicate reasons for the rejection of pledge requests to the depository participants (DPs) of both the pledgor and the pledgee. SEBI also cited non-compliance with prescribed procedures for handling Client Unpaid Securities Accounts (CUSA), inadequate measures to prevent unauthorized data transmission, and shortcomings in disaster recovery operations.

Furthermore, the regulatory inspection found that CDSL had failed to patch identified vulnerabilities within the timelines prescribed by SEBI. The regulator observed that the company's Vulnerability Assessment and Penetration Testing (VAPT) exercise was not comprehensive, as it failed to cover all domains and external applications.

In its order, SEBI stated that the noticee committed multiple compliance lapses in discharging its depository functions. The regulator noted that incomplete migration of operations to the disaster recovery site during drills and inadequate VAPT exercises further compounded the compliance failures.

SEBI emphasized that these deficiencies directly impinge upon CDSL's core obligations as a depository providing foundational, system-critical physical and digital infrastructure. Given the systemic importance of a depository, the regulator noted that such deficiencies have implications not only for individual investors but also for the overall integrity and stability of the Indian securities market. Consequently, the violations were deemed serious in nature, warranting appropriate regulatory action.

However, the market regulator noted that the remedial measures subsequently undertaken by CDSL were duly considered before finalizing the order. This development follows an earlier penalty of ₹1 crore imposed on CDSL in July for cybersecurity lapses linked to a malware attack that disrupted its systems in November 2022.

"Financial market infrastructure providers operate under strict regulatory frameworks due to their systemic importance to the broader economy. Compliance lapses, particularly regarding cybersecurity, disaster recovery, and data protection, carry significant regulatory risks. This development highlights the importance of maintaining robust internal controls and adhering strictly to compliance timelines for all entities operating within the Indian securities market." — Dr. Shishir Gupta, Founder & CEO, StartupLanes