Authority: Adjudicating Officer, Securities and Exchange Board of India (Jai Sebastian)

Order Date: October 30, 2026

Order No.: Order/JS/RJ/2026-27/32798

Case Overview

This adjudication order stems from an inspection of Central Depository Services (India) Limited (CDSL) conducted by SEBI for the financial year 2023-24. The inspection identified multiple violations of SEBI regulations and circulars. CDSL, as a Market Infrastructure Institution (MII) and depository, is subject to stringent regulatory requirements. SEBI issued a Show Cause Notice (SCN) dated August 27, 2024, alleging violations across several domains including pledge processes, Basic Services Demat Account (BSDA) conversions, handling of Client Unpaid Securities Pledgee Accounts (CUSPA) and Client Unpaid Securities Accounts (CUSA), and various information technology and cyber security protocols. CDSL submitted detailed replies and was granted multiple hearings. The matter was kept in abeyance pending a settlement application, which was subsequently withdrawn on April 06, 2026, leading to the resumption of adjudication proceedings.

The principal allegations involved:

  • Pledge Creation: Violation of Regulation 79(5) of the SEBI (Depositories and Participants) Regulations, 2018 (DP Regulations) for failing to communicate reasons for pledge rejections to Depository Participants (DPs) of both pledgor and pledgee. In 27 instances, the system provided only a generic note instead of specific reasons.
  • Basic Services Demat Account (BSDA): alleged violation of clauses of SEBI Circulars dated August 27, 2012, July 1, 2014, and December 11, 2015, for failing to ensure DPs converted 1,10,95,451 eligible beneficiary owner accounts (BO A/Cs) to BSDAs, with only 8,321 opt-out confirmations obtained.
  • Client Unpaid Securities Pledgee Account (CUSPA): alleged violation of clauses 3.4, 3.5, and 5 of the SEBI Circular dated November 11, 2022, as Trading Members/Clearing Members (TM/CM) were releasing/disposing of securities on the 6th and 7th trading days post-payout, and CDSL lacked a system to restrict this.
  • Client Unpaid Securities Account (CUSA): Violation of clause 5 of the SEBI Circular dated November 11, 2022. CDSL unfroze entire CUSAs instead of specific ISINs/quantities instructed by stock exchanges, lacked system-level checks to ensure transfers went to intended beneficiaries, and failed to freeze/unfreeze specific accounts (JM Financial and Bajaj Financial) on the dates specified by the exchanges.
  • IT & Cyber Security: Violations included:
  • Clause 31 of Annexure A of SEBI Circular dated July 06, 2015: 24 endpoints were not integrated with the Data Loss Prevention (DLP) solution until October 2023.
  • Clause 5(c) of SEBI Circular dated March 22, 2021: During Disaster Recovery (DR) drills, Security Information and Event Management (SIEM) logs were collected at the Primary Data Centre (PDC), not the DR site, meaning not "all operations" were run from DR.
  • Clause 2(41) of SEBI Circular dated May 20, 2022 read with clause 41 of Annexure A of SEBI Circular dated July 06, 2015: Vulnerabilities, including deprecated TLS v1.1 protocol and using components with known vulnerabilities, were not patched within the stipulated 3-month period.
  • Clause 2(40) of SEBI Circular dated May 20, 2022 read with clause 40 of Annexure A of SEBI Circular dated July 06, 2015: The Vulnerability Assessment and Penetration Testing (VAPT) exercise was not comprehensive as it did not cover all domains and external applications.

CDSL's defense argued that many obligations (like BSDA conversion) rested with DPs, not the depository, and that interpretations of certain circulars (like CUSPA timelines) were ambiguous. CDSL also highlighted subsequent remedial actions taken, such as making the pledge rejection reason field mandatory from July 13, 2024, and implementing stronger CUSA controls from June 14, 2024.

The Adjudicating Officer (AO) analyzed each allegation. Key findings were:

  • Pledge Creation: Violation established. The obligation to communicate reasons is statutory and on CDSL, not DPs. Past inspections not raising the issue is no defense.
  • BSDA: Violation NOT established. The cited circulars place specific BO-account level obligations on DPs, not the depository.
  • CUSPA: Violation NOT established. The SEBI Circular dated November 11, 2022, was ambiguous on whether actions on the 6th/7th trading day were permitted, warranting benefit of doubt.
  • CUSA: Violation established. CDSL's actions (full account unfreeze, lack of system checks, missing exchange deadlines) were not in line with the joint process and represented a failure of its systemic obligations.
  • IT & Cyber Security: Violations established for DLP implementation, SIEM log collection during DR drills, untimely VAPT patching, and non-comprehensive VAPT. Violations for baseline standards (clauses 27 & 28) and RTO/RPO in CCMP (clauses 4(c) & (d)) were NOT established. Violations for exceeding RTO in DR drills (clause 5(h)) and manpower at PDC (clause 3(d)) were also NOT established.

Final Outcome

The AO held CDSL liable for violations of:

1. Regulation 79(5) of the DP Regulations.

2. Clause 5 of SEBI Circular dated November 11, 2022 (CUSA).

3. Clause 31 of Annexure A of SEBI Circular dated July 06, 2015 (DLP).

4. Clause 5(c) of SEBI Circular dated March 22, 2021 (SIEM during DR drill).

5. Clause 2(41) of SEBI Circular dated May 20, 2022 read with clause 41 of Annexure A of SEBI Circular dated July 06, 2015 (VAPT patching).

6. Clause 2(40) of SEBI Circular dated May 20, 2022 read with clause 40 of Annexure A of SEBI Circular dated July 06, 2015 (VAPT comprehensiveness).

Considering the factors under Section 15J of the SEBI Act, including the critical systemic role of CDSL as a depository, the seriousness of the lapses in core functions, and a previous penalty of ₹1 crore imposed on July 20, 2026, a monetary penalty of ₹1,00,00,000 (One Crore Rupees) was imposed under Section 15HB of the SEBI Act. The penalty must be paid within 45 days of receipt of the order, failing which recovery proceedings will be initiated.

Topics: SEBI Enforcement, Depository Regulation, Cyber Security Compliance