Sebi imposes ₹1 crore fine on CDSL for multiple compliance lapses

Regulator flags shortcomings in pledge-rejection communication, cybersecurity controls, vulnerability patching and disaster recovery drills

Markets regulator Sebi on Friday imposed a penalty of Rs 1 crore on Central Depository Services (India) Ltd (CDSL) for multiple compliance lapses, including failure to communicate reasons for rejection of pledge requests to the depository participants (DPs) of both the pledgor and pledgee and shortcomings in disaster recovery drills.

CDSL has been directed to pay the penalty within 45 days, failing which recovery proceedings may be initiated.

In its 102-page order, Sebi said CDSL had violated several regulatory requirements during FY2023-24, following an inspection of its operations.

The violations included failure to communicate reasons for rejection of pledge requests to the depository participants of both the pledgor and pledgee, non-compliance with prescribed procedures for handling Client Unpaid Securities Accounts (CUSA), inadequate measures to prevent unauthorised data transmission and shortcomings in disaster recovery operations.

The regulator also found that CDSL had failed to patch identified vulnerabilities within the timeline prescribed by Sebi. Further, its Vulnerability Assessment and Penetration Testing (VAPT) exercise was not comprehensive as it did not cover all domains and external applications.

"Noticee has been found to have committed multiple compliance lapses in the discharge of its depository functions. These include failure to communicate the reasons for rejection of pledge requests to the DPs of the pledgor and pledgee, non-adherence to the joint proposal framed ...in relation to CUSA operations, inadequate measures to prevent unauthorised transmission of data, incomplete migration of operations to the DR site during the DR drill, failure to patch vulnerabilities within the timeline stipulated by Sebi, and conducting a VAPT exercise that was not comprehensive," Sebi said.