SEBI Fines CDSL 10 Million Rupees After Depository Services Violations
Key Facts
The Securities and Exchange Board of India, known as SEBI, fined Central Depository Services (CDSL) 10 million rupees after an inspection of its performance during fiscal 2023-2024. The regulator issued the adjudication order on October 30, 2026, as part of proceedings related to the inspection report. It found that the company had committed multiple violations in carrying out its depository functions. The findings matter because those functions include handling securities pledge requests and unpaid securities accounts, as well as protecting data and maintaining operational continuity. SEBI said the shortcomings could affect market integrity and investor confidence, while acknowledging that the company later took remedial measures.
Among the violations was a failure to inform the relevant participants of the reasons for rejecting pledge requests. Moneycontrol reported that the regulator found 92 cases in which rejection reasons were not communicated, out of 23,272 pledge requests rejected during the inspection period. The finding concerns informing participants on both sides of a pledge—the applicant and the beneficiary—of the reasons for the decision. CDSL said it had modified its system to make recording rejection reasons mandatory. SEBI's findings also included non-compliance with prescribed procedures for handling clients' unpaid securities accounts, which are subject to specific rules when unsettled securities are processed.
On data protection, SEBI found that data loss prevention measures were not in place on 24 endpoints, potentially exposing sensitive information to unauthorized access or transfer. The regulator also cited shortcomings in preventing unauthorized data transfers. According to its order, as reported by Business Standard, CDSL did not address the identified vulnerabilities within the regulatory deadline. Vulnerability assessment and penetration testing was also not comprehensive, as it did not cover all external domains and applications. Together, these findings point to gaps in testing coverage and delays in addressing the vulnerabilities identified.
The findings also extended to disaster recovery plans, with SEBI saying that the transfer of operations to the recovery site was not completed during a test of the plan. Such tests are intended to verify a company's ability to continue operations if its primary site is disrupted. The regulator found shortcomings in carrying out recovery procedures, as well as an incomplete transfer of operations during the exercise. This finding adds to the security testing and data protection gaps in a decision addressing several operational and technical depository functions. The available information did not specify the duration of the outage the test was designed to address.
CDSL said in a market disclosure that the fine related to operational and technical observations. It added that no material impact was expected on its financial position, operations or other activities, apart from payment of the fine. The disclosure, according to the available information, gave no additional financial estimate of the impact. Data from the closing auction session on the NSE showed the stock closing at 1,263 rupees on October 30, 2026, up 3.40 rupees, or 0.27%. The session data snapshot was recorded at 15:28:14 India time; these figures do not establish that the share-price movement was a response to the order, which was issued later.
The adjudication order was listed on SEBI's schedule of proceedings for October 30 as relating to CDSL's fiscal 2023-2024 inspection report. The decision centers accountability on depository operating procedures, communication of reasons for pledge rejections, information protection and service continuity. The regulator noted that the company had taken remedial action after the shortcomings, but said they could affect market integrity and investor confidence. This deadline sets out the immediate next step following the order, while the available information gives no later date for reviewing implementation of the remedial measures.