Sebi slaps ₹1 cr fine on CDSL for compliance and cybersecurity lapses
ADVERTISEMENT
Market regulator Sebi on Friday imposed a penalty of ₹1 crore on Central Depository Services (India) Ltd (CDSL) for multiple compliance lapses, including failure to communicate reasons for rejection of pledge requests to the depository participants (DPs) of both the pledgor and pledgee and shortcomings in disaster recovery drills.
CDSL has been directed to pay the penalty within 45 days, failing which recovery proceedings may be initiated.
In its 102-page order, Sebi said CDSL had violated several regulatory requirements during FY2023-24, following an inspection of its operations.
Sebi flags cybersecurity, disaster recovery and pledge-related lapses
The violations included failure to communicate reasons for rejection of pledge requests to the depository participants of both the pledgor and pledgee, non-compliance with prescribed procedures for handling Client Unpaid Securities Accounts (CUSA), inadequate measures to prevent unauthorised data transmission and shortcomings in disaster recovery operations.
The regulator also found that CDSL had failed to patch identified vulnerabilities within the timeline prescribed by Sebi.
Further, its Vulnerability Assessment and Penetration Testing (VAPT) exercise was not comprehensive as it did not cover all domains and external applications.
"Noticee (CDSL) has been found to have committed multiple compliance lapses in the discharge of its depository functions. These include failure to communicate the reasons for rejection of pledge requests to the DPs of the pledgor and pledgee, non-adherence to the joint proposal framed ...in relation to CUSA operations, inadequate measures to prevent unauthorised transmission of data, incomplete migration of operations to the DR site during the DR drill, failure to patch vulnerabilities within the timeline stipulated by Sebi, and conducting a VAPT exercise that was not comprehensive," Sebi said.
Sebi observed that the lapses directly impinged upon CDSL's core obligations as a depository, which provides the foundational, system-critical physical and digital infrastructure for electronic record-keeping, dematerialisation and ownership transfers.
"Given the systemic importance of a depository, such deficiencies have implications not only for individual investors but also for the integrity and stability of the Indian securities market," Sebi said, adding that the violations were serious in nature and warranted appropriate regulatory action.
Consequently, the Securities and Exchange Board of India (Sebi) has imposed a penalty of ₹1 crore on the depository.
The regulator, however, said the remedial measures subsequently undertaken by CDSL had been duly considered.
In July, the regulator imposed a penalty of ₹1 crore on CDSL for cybersecurity lapses linked to the malware attack that disrupted its systems in November 2022.