SEBI Eyes Single Rulebook For Tech And Cybersecurity Compliance Across Market Institutions

The Securities and Exchange Board of India (SEBI) has put out a consultation paper proposing changes to the information technology (IT) rules followed by market infrastructure institutions such as stock exchanges, clearing corporations and depositories.

The market regulator wants to simplify the existing framework and cut compliance requirements without diluting supervision.

A major part of the proposal deals with overlapping regulations. SEBI has suggested bringing several technology-related circulars under one umbrella instead of keeping them spread across different frameworks for various market infrastructure institutions.

The regulator has sought public feedback on the proposal. Comments can be submitted until 13 July 2026.

What Is Being Merged And Why

The regulator has proposed combining the master circulars for stock exchanges and clearing corporations with the master circular for commodity derivatives, while creating a consolidated circular covering common technology areas:

• Cyber security and cyber resilience.

• Annual system audits.

• Business continuity planning and disaster recovery.

• Capacity planning.

• Technology advisories.

Several provisions currently appear in multiple places across different circulars, adding compliance work without adding regulatory value. The Cyber Security and Cyber Resilience Framework (CSCRF), for instance, already applies directly to market infrastructure institutions and intermediaries.

SEBI has proposed removing repeated references to it from various sections of existing circulars since the framework's direct applicability makes those references redundant.

The 75% Capacity Threshold

One of the more operationally specific proposals introduces a uniform capacity utilisation threshold across exchanges and clearing corporations. If actual utilisation of any information technology component exceeds 75% of installed capacity, the institution must take immediate corrective action such as fine-tuning applications or expanding capacity.

The Standing Committee on Technology (SCOT) will oversee the action taken, and repeated breaches of the threshold will trigger mandatory capacity augmentation.

For depositories, the threshold works slightly differently. If utilisation of any information technology component exceeds 75% of installed capacity over a rolling 15-day period, immediate capacity enhancement is required.

The policy framework for handling these situations, including the conditions under which augmentation becomes mandatory, must be set out in each market infrastructure institution's Capacity Planning and Real Time Performance Monitoring Policy.

Also Read- DoT Rejects TRAI's 55% Backhaul Spectrum Cost Cut; Airtel, Jio And Vodafone Idea Bear The Burden

Other Proposals

• Co-location and co-hosting provisions for the commodity derivatives segment would be merged into the broader technology framework applicable to stock exchanges, with segment-specific requirements retained where necessary.

• Detailed provisions on system clock synchronisation with atomic clocks would be consolidated into a single location within the new framework rather than repeated across multiple chapters.

• Capacity planning requirements would be harmonised across stock exchanges, clearing corporations and depositories.

Sources:

Business Standard

The Economic Times