Sebi proposes shorter DR drills, stronger resilience norms for market infrastructure institutions

Capital markets regulator Sebi on Tuesday proposed shortening disaster recovery (DR) drills for market infrastructure institutions (MIIs) to at least four hours from the existing requirement of a full trading day, while seeking to strengthen operational resilience and data recovery mechanisms.

The proposals are aimed at enhancing the business continuity plan (BCP) and disaster recovery framework of MIIs, comprising stock exchanges, clearing corporations and depositories.

Under the proposed framework, DR drills would be conducted on a non-working day, with operations initially started at the primary data centre (PDC) and subsequently switched over to the disaster recovery site (DRS).

"The overall session time for DR drill should be at least four hours including the switchover time from PDC to DRS," the Securities and Exchange Board of India (Sebi) said in its consultation paper.

The regulator said the move would make DR drills easier for market participants and MIIs, especially in commodity derivatives where trading in certain products continues until 11:55 PM.

At present, the framework requires MIIs to conduct DR drills for one full trading day and demonstrate an intraday shift from the PDC to the DRS.

While shortening the duration, Sebi proposed that MIIs should cover all scenarios of market operations during the drill and simulate real-life load and participation close to actual levels.

The regulator also proposed that MIIs test various disruption scenarios as part of the switchover exercise, with a comprehensive list of such scenarios to be reviewed by their Standing Committee on Technology (SCOT).

"Such a list of comprehensive scenarios should be reviewed by the Standing Committee on Technology (SCOT) of MIIs," Sebi said.

To strengthen resilience at the primary site, Sebi proposed comprehensive stress and mock testing covering not only transaction volumes and orders per second but also various masters, table sizes and other non-transactional components.

MIIs should also be required to regularly test the fault tolerance of their primary and disaster recovery systems to ensure that redundant components automatically take over if a switch, server or other component fails.

The regulator further proposed that MIIs proactively identify, document and monitor boundary conditions and upper limits relating to databases, configurations, table sizes and counter limits to identify potential system bottlenecks before they affect operations.

Sebi also proposed adequate logging of application and component-level errors, along with a ready reckoner for interpreting such errors to speed up troubleshooting during disruptions.

In addition, MIIs should need to conduct periodic tests and maintain alerts for component- and application-level controls and configurations across their PDC, near site (NS) and DRS to ensure there is no configuration drift.

For stock exchanges, Sebi proposed an additional mechanism to recover lost trade data from clearing corporations in case a disruption affects data replication at the near site or disaster recovery site.

"Stock exchanges shall put in place a framework to recover the lost data from the CCs in case of disruption," the regulator said, adding that necessary standard operating procedures would have to be put in place by stock exchanges and clearing corporations.

Sebi said the proposals are based on learnings from practices followed by MIIs in conducting DR drills, testing and data recovery, and are intended to increase operational resilience while easing compliance.

The regulator has invited public comments on the proposals till October 5.