Case Overview

This adjudication order pertains to proceedings initiated against Alankit Assignments Limited (the Noticee), a SEBI-registered Registrar to an Issue and Share Transfer Agent (RTA) with Registration No. INR000002532. The proceedings were initiated based on findings from a SEBI inspection conducted from February 24, 2026, to February 27, 2026, and on March 09, 2026, covering the period from September 01, 2024, to December 31, 2025 (the Inspection Period).

A Show Cause Notice (SCN) dated August 13, 2026 (Ref. No. SEBI/HO/EAD-2/JS/VC/21141-42/2026), was issued alleging violations under Section 15HB of the SEBI Act, 1992. The principal allegations involved failures to comply with prescribed timelines for investor services, a lack of due diligence in processing physical transfer deeds, and deficiencies in cybersecurity controls as mandated by various SEBI circulars and the SEBI (Registrars to an Issue and Share Transfer Agents) Regulations, 2025 (RTA Regulations).

The Noticee submitted a detailed reply dated September 02, 2026, and was granted a personal hearing on September 11, 2026, where its authorized representatives reiterated their submissions. The Adjudicating Officer (AO) framed nine specific issues for consideration based on the charges in the SCN and the Noticee's defense.

The key observations and reasoning of the AO for each charge were as follows:

1. Alleged delay in demat request & signature non-capture: The charge of a 2-day delay in 1 of 40 sample demat requests was dismissed as the delay was attributed to a technical rejection in the depository system, not the Noticee's lapse. The allegation of missing signature records in 6 instances was dismissed as signatures were verified from other documents and captured later, with no allegation of fraud or mismatch.

2. Alleged delay in remat request: The charge of a 7-day delay in 1 of 13 sample remat requests was dismissed. The delay was due to the issuer, Jaiprakash Associates Ltd., being under the Insolvency and Bankruptcy Code (IBC), and the Noticee awaited necessary confirmation from the Interim Resolution Professional (IRP), an external dependency beyond its control.

3. Alleged delay in grievance resolution: The charge of a 17-day delay in resolving 1 of 40 sampled items was dismissed. The AO found the item was a court summons related to succession proceedings, not an investor grievance, and its timeline was controlled by the court.

4. Alleged processing of altered transfer deeds: The charge of violating due diligence by processing 9 transfer deeds with correction fluid was dismissed. The AO noted the SCN did not allege the Noticee applied the fluid or acted in collusion. The Noticee demonstrated enhanced verification steps, including seller notices and public notices, and no investor complaints or wrongful transfers occurred.

5. Alleged lack of Two-Factor Authentication (2FA): The charge that "multiple users" lacked 2FA for firewall access was dismissed. The SCN identified only one user (manishk@alankit.com), for whom a temporary, documented exception was granted due to a device failure. No unauthorized access or security incident was alleged.

6. Alleged Data Leakage Prevention failures: The charge related to accessible file-sharing sites, USB access, and the AnyDesk tool was dismissed due to a fundamental legal defect. The SCN cited provisions (PR.AA.S6) related to password controls, not data leakage. On merits, the AO accepted the Noticee's explanation that observations were made during a system rebuild and that no actual data exfiltration occurred.

7. Alleged weak password policy enforcement: The charge that an IT admin used the password '123456' was dismissed due to a fundamental legal defect. The SCN cited provisions (PR.DS.S1, etc.) related to data storage security, not password complexity. On merits, the AO accepted it was an isolated, inadvertent lapse post-system rebuild that was promptly corrected with no resulting compromise.

The AO concluded that the allegations stemmed from isolated instances within samples and did not establish repetitive, systemic, or deliberate non-compliance. The record showed external dependencies in some cases and prompt remedial action in others. Critically, no disproportionate gain to the Noticee or quantified investor loss was demonstrated, and there was no evidence of any security incident or data breach.

Final Outcome

The Adjudicating Officer held that none of the violations alleged in the SCN were established. Consequently, the adjudication proceedings initiated against Alankit Assignments Limited were disposed of without the imposition of any monetary penalty.

Topics: SEBI Adjudication, RTA Compliance, Cybersecurity Governance