SEBI imposes Rs 1 crore penalty on CDSL for multiple compliance lapses found during inspection in FY24

Market Mastery

Webinar by Vishal Malkan

Find the weak links

in your portfolio by Vishal Malkan

Market regulator Securities and Exchange Board of India (SEBI) has imposed a penalty of Rs 1 crore on Central Depository Services (India) Ltd (CDSL) for multiple compliance lapses, including shortcomings in its pledge management system, cybersecurity measures and disaster recovery arrangements.

In an adjudication order issued on Friday, SEBI said its inspection of CDSL for FY2023-24 had identified several instances of non-compliance with regulatory requirements. The violations included failure to communicate reasons for rejecting pledge requests to depository participants (DPs), inadequate safeguards against unauthorised data transmission and deficiencies in vulnerability assessment and penetration testing (VAPT).

One of the key findings related to pledge rejections. SEBI found that CDSL had failed to communicate the reasons for rejecting pledge requests to the DPs of the pledgor and pledgee in 92 instances. The depository had rejected 23,272 pledges during the inspection period. CDSL submitted that its earlier system did not make it mandatory to capture rejection reasons. It subsequently introduced system changes to make this mandatory.

The regulator also flagged shortcomings in CDSL's handling of Client Unpaid Securities Pledgee Accounts (CUSPA). It found that the depository had not fully followed the joint proposal put in place by stock exchanges and depositories for freezing and unfreezing such accounts. The lapses included unfreezing entire accounts instead of specified securities and quantities, the absence of system-level checks, and failure to freeze certain accounts on the dates instructed by exchanges.

On the cybersecurity front, SEBI found that data loss prevention (DLP) measures had not been implemented across 24 endpoints, potentially exposing sensitive information to unauthorised access or transmission.

The regulator also found that during a disaster recovery drill, security information and event management (SIEM) logs were being collected at CDSL's primary data centre instead of the disaster recovery site. It further flagged delays in patching identified software vulnerabilities beyond the stipulated three-month period.

Noting that CDSL had subsequently taken remedial measures, SEBI said in its order that the deficiencies could affect market integrity and investor confidence.

SEBI also examined CDSL's monitoring of Basic Services Demat Accounts (BSDA) conversion, noting that 71.89 lakh eligible accounts had been converted, while 1.10 crore remained unconverted. Only 8,321 opt-out confirmations were recorded. However, the adjudicating officer held that the relevant circulars did not specifically place this responsibility on CDSL. The allegation was therefore not established.