Sebi fines Rs 2 lakh on CDSL Ventures over delay in audit reporting

Capital markets regulator Sebi on Wednesday imposed a penalty of Rs 2 lakh on CDSL Ventures Ltd, a KYC registration agency, over delay in submission of the audit report.

In addition, the entity failed to maintain segregation between cyber security services and infrastructure of itself and depository CDSL, which hit its KYC operations, according to an order passed by the regulator.

The Securities and Exchange Board of India (Sebi) inspected CDSL Ventures Ltd to examine its compliance with the KYC Registration Agency (KRA) regulations.

The period covered in the inspection was from January 2021 to December 2022.

Based on the findings of the inspection, Sebi found certain non-compliances with KRA Regulations.

In its order, Sebi found that CDSL Ventures did not submit the system audit report to it within the stipulated time period.

Sebi has mandated that the system audit should be conducted once in a "financial year" instead of a "calendar year".

The entity had submitted the system audit report for the audit period 2021-2022 (January 2021 to March 2022) on October 28, 2022, four months after the deadline of June 30, 2022.

"The noticee had failed to maintain segregation between cyber security services and infrastructure of CVL and CDSL due to which noticee's KYC operations were severely impacted and there was a permanent loss of data from its systems," Sebi said in its order.

CDSL came under malware attack on November 18, 2022, as per the order.

Noting the violation of KRA rules, Sebi imposed a penalty of Rs 2 lakh on CDSL Ventures Ltd and directed it to pay the amount within 45 days.