SEBI Imposes Rs 1 Crore Penalty on CDSL for Multiple Regulatory and IT Compliance Lapses
The Securities and Exchange Board of India (SEBI) has imposed a monetary penalty of Rs 1 crore on Central Depository Services (India) Limited (CDSL) for multiple regulatory, operational, and information technology lapses identified during an inspection of its operations for the financial year 2023–24.
In a 102-page adjudication order, SEBI Adjudicating Officer Jai Sebastian directed the depository to pay the penalty within 45 days. The fine was levied under Section 15HB of the SEBI Act, 1992.
The regulator underlined the systemic importance of depositories in the Indian financial ecosystem, stating that the deficiencies impinged upon CDSL's core responsibilities as an institution providing system-critical digital and physical infrastructure for securities record-keeping, dematerialisation, and ownership transfers.
Key Violations Identified by SEBI:
- Pledge Rejections: CDSL failed to communicate the specific reasons for rejecting pledge requests to the Depository Participants (DPs) of both the pledgor and the pledgee, in breach of Regulation 79(5) of the SEBI (Depositories and Participants) Regulations, 2018.
- Disaster Recovery Deficiencies: During disaster recovery (DR) drills, the depository exhibited incomplete migration of its operations to the DR site, falling short of mandated business continuity standards.
- CUSA Operations: Non-adherence to the joint proposal and standard operating procedures governing Client Unpaid Securities Accounts (CUSA).
- Cybersecurity and Patch Management: Failure to patch identified software vulnerabilities within regulatory timelines stipulated by SEBI, alongside inadequate measures to curb unauthorised data transmission.
- Incomplete VAPT: Vulnerability Assessment and Penetration Testing (VAPT) exercises were not comprehensive and omitted several relevant domains and external-facing applications.
While SEBI dismissed certain allegations concerning Basic Services Demat Accounts (BSDA) and select CUSA processes, it concluded that the remaining lapses were serious enough to warrant a financial penalty.
Company Response and Market Context
In a regulatory filing under Regulation 30 of the SEBI Listing Regulations, CDSL confirmed receipt of the order and stated that apart from the payment of the penalty amount, there is no material impact on the company’s financials, operations, or broader business activities.
This marks the second Rs 1 crore fine imposed by the market watchdog on CDSL in recent months. Earlier, SEBI had penalised the depository over cybersecurity and oversight lapses linked to a November 2022 malware attack that temporarily disrupted market settlements and depository functions.
For Indian retail and institutional investors, the regulatory action highlights heightened vigilance over market infrastructure institutions (MIIs) to ensure data security, operational resilience, and robust compliance across trading and settlement ecosystems.
