SEBI Fines CDSL ₹1 Crore Over Multiple Compliance Lapses and Cybersecurity Weaknesses

The Securities and Exchange Board of India (SEBI) has imposed a monetary penalty of ₹1 crore on Central Depository Services (India) Limited (CDSL) for multiple regulatory infractions and operational shortcomings uncovered during an inspection of the depository's operations for FY2023-24.

In a 102-page adjudication order, SEBI directed India's largest depository by active demat accounts to remit the fine within 45 days, warning that failure to do so could trigger recovery proceedings under Section 28A of the SEBI Act. The penalty was levied under Section 15HB of the SEBI Act, 1992, which covers non-compliance where no specific penalty is explicitly provided.

Key Compliance and Procedural Deficiencies

SEBI’s inspection highlighted systemic lapses across CDSL’s operational core, impacting transaction handling, account maintenance, and stakeholder reporting.

Major operational violations detailed in the order include:

• Pledge Request Notifications: CDSL failed to communicate the reasons for rejecting pledge requests to the depository participants (DPs) representing both pledgors and pledgees, hindering transparency in collateral processing.
• Client Unpaid Securities Accounts (CUSA): The regulator identified non-compliance in the execution of CUSA procedures, including shortcomings in system-level validation checks as well as the freezing and unfreezing of securities.
• Data Protection Measures: The inspection noted inadequate controls to restrict unauthorised data transmission and gaps in the full implementation of Data Loss Prevention (DLP) frameworks.

Cybersecurity and IT Infrastructure Gaps

Alongside procedural lapses, SEBI flagged vulnerabilities in CDSL’s cyber resilience and technology frameworks. The order highlighted that the depository failed to remediate and patch identified technical vulnerabilities within the regulator's prescribed timelines.

Furthermore, CDSL's Vulnerability Assessment and Penetration Testing (VAPT) exercise was determined to be incomplete, as it did not adequately encompass all network domains and internet-facing applications. SEBI also scrutinised business continuity preparedness, noting that during a scheduled disaster recovery drill, CDSL failed to complete the live migration of operations to its disaster recovery site.

Systemic Relevance and Market Impact

Emphasising the systemic importance of depository institutions in India's financial ecosystem, SEBI noted that depositories hold crucial fiduciary responsibilities in electronic record-keeping, dematerialisation, and the legal transfer of securities ownership. Deficiencies in these foundational processes can elevate risks across the broader capital market architecture.

SEBI noted that it factored in the subsequent remedial actions undertaken by the depository before deciding on the final quantum of the ₹1 crore fine. For CDSL, this marks the second major fine inside six months; the regulator had earlier slapped a separate ₹1 crore penalty in July over cybersecurity lapses linked to a November 2022 malware attack that previously compromised internal systems and delayed market settlements.

Addressing the regulatory order, CDSL stated that the financial penalty would not have any material adverse impact on its day-to-day operations or balance sheet beyond the payment of the fine itself.