SEBI Proposes Regulatory Framework to Extend Cyber and IT Norms to Exchange and Depository Subsidiaries — November 1, 2026
The Securities and Exchange Board of India (SEBI) has moved to establish explicit regulatory boundaries for the growing technological footprint of market infrastructure institutions (MIIs). In a consultation paper addressing the governance of subsidiaries run by stock exchanges, clearing corporations, and depositories, the markets regulator outlined conditions under which its IT and cybersecurity framework will apply directly to corporate subsidiaries.
The proposal comes as key market institutions—such as the National Stock Exchange of India (NSE), BSE Limited, Central Depository Services (India) Limited (CDSL), and National Securities Depository Limited (NSDL)—increasingly diversify their operational models. These institutions have expanded beyond traditional trading and settlement into specialized arms delivering data feeds, analytical tools, cloud solutions, and software services.
The Three-Pronged Applicability Test
To ensure regulatory alignment with the evolving market architecture without imposing redundant costs on non-technical arms, SEBI has proposed a clear three-criteria test. Under the framework, an MII’s IT and cybersecurity norms—including the comprehensive Cyber Security and Cyber Resilience Framework (CSCRF)—will extend to a subsidiary if it fulfills any one of the following conditions:
- The subsidiary carries out an activity that directly contributes to the domain or statutory remit of the parent MII.
- The subsidiary handles or processes critical market data that the parent MII is responsible for safeguarding.
- The subsidiary shares IT infrastructure, networks, or server space with the parent institution.
Subsidiaries that meet any of these criteria will be subject to mandatory technology audits, disaster recovery (BCP-DR) mandates, cybersecurity incident reporting, and strict IT governance protocols.
Enabling Expansion While Containing Contagion
Indian bourses and depositories have sought to build scalable software, co-location, and data-analytics offerings. Previously, the lack of an explicitly codified framework for subsidiaries created ambiguity over whether establishing offshoot entities to provide data and technology services would attract regulatory bottlenecks or fall into an oversight blind spot.
By defining the compliance perimeter, the proposal provides legal certainty for MIIs to commercialize tech infrastructure and data products via subsidiaries. Simultaneously, it eliminates the contagion risk where an external cyber incident at an ancillary technology entity compromises the trading or settlement backbone of Dalal Street.
Exemptions for Non-Tech Operations:
- Entities operating strictly in general administration, facility management, HR, or non-technical corporate support will remain outside the ambit.
- Subsidiaries delivering education or investor-awareness programs that possess no access to exchange systems or data stores will be exempt.
- Regulated financial subsidiaries operating under distinct regulatory jurisdictions (such as under the Reserve Bank of India) with segregated infrastructure will not be subjected to dual framework burdens.
Proportionality and Path Ahead
SEBI has incorporated a flexibility mechanism for edge cases. If a subsidiary only meets the shared infrastructure criterion, an MII may seek an exemption provided it demonstrates adequate compensatory cyber controls endorsed by both its Standing Committee on Technology (SCOT) and its governing board.
The tightening of rules comes alongside broader measures by SEBI to modernize market resilience, including capacity planning thresholds and regular disaster recovery mock drills. For market participants and institutional investors, the regulatory roadmap provides assurances that commercial expansion by market utilities will not come at the expense of systemic security.
