Sebi mulls consolidating tech, cybersecurity norms across mkt infra institutions

Markets regulator Sebi on Monday proposed a comprehensive overhaul and consolidation of information technology-related regulations applicable to market infrastructure institutions aimed at simplifying compliance requirements, removing redundancies and ensuring regulatory consistency across.

In its consultation paper, the regulator proposed merging provisions of the Master Circulars for stock exchanges and clearing corporations with the Master Circular for commodity derivatives, while also creating a consolidated circular covering common IT-related areas such as cyber security, cyber resilience, annual system audits, business continuity planning and disaster recovery (BCPDR), capacity planning and technology advisories.

Sebi said several provisions currently duplicated across different circulars and frameworks could be streamlined to improve regulatory clarity and reduce compliance burden without diluting oversight.

Among the key proposals, Sebi has suggested removing repeated references to the Cyber Security and Cyber Resilience Framework (CSCRF) from various sections of existing circulars, noting that the framework already applies directly to MIIs and intermediaries.

The regulator also proposed harmonising capacity planning requirements across stock exchanges, clearing corporations and depositories.

The proposals are aimed at simplifying regulatory requirements, removal of redundant provisions, discontinuation of duplication, in order to promote ease of doing business and reduce the compliance burden on exchanges, Sebi said.

Under the proposed framework, immediate corrective action would be required if actual utilisation of any IT component exceeds 75 per cent of installed capacity. Such instances would be reviewed by the Standing Committee on Technology (SCOT), while capacity augmentation would be undertaken where repeated breaches of the threshold are observed.

”In general, if actual capacity utilization of any component of stock exchanges and clearing corporations exceeds75 per cent of the installed capacity, immediate action shall be taken by the MII such as fine tuning the applications/systems or enhancing the capacity. SCOT shall oversee such action taken by the MII,” Sebi suggested.

The MII’s Capacity Planning and Real Time Performance Monitoring Policy shall include the framework for handling actual capacity utilization exceeding 75 per cent of installed capacity, including situations necessitating augmentation of installed capacity.

For depositories, if actual capacity utilization of any IT component exceeds 75 per cent of the installed capacity over a period of 15 days on rolling basis, immediate action would be taken to enhance the capacity, Sebi proposed.

The regulator has further proposed merging provisions relating to co-location and co-hosting facilities in the commodity derivatives segment with the broader technology framework applicable to stock exchanges, while retaining segment-specific requirements.

To reduce duplication, the regulator suggested retaining detailed provisions on system clock synchronisation with atomic clocks at a single location within the proposed framework instead of repeating them across multiple chapters.

According to the consultation paper, a unified circular for MIIs would consolidate technology-related provisions currently spread across multiple circulars governing stock exchanges, clearing corporations and depositories.

The Securities and Exchange Board of India (Sebi) has sought public comments until July 13 on the proposals.