New Delhi: The Securities and Exchange Board of India (SEBI) has imposed a penalty of ₹1 crore — yaani ₹10 million — on Central Depository Services (India) Ltd (CDSL) for multiple compliance lapses, including failure to communicate the reasons for rejecting pledge requests and shortcomings in disaster recovery drills, the regulator said in an adjudication order dated October 30.

Source: The Hindu BusinessLine

In its 102-page order, SEBI said CDSL had violated several regulatory requirements during 2023-24, following an inspection of its operations. The lapses included not telling the depository participants of both the pledgor and the pledgee why pledge requests were rejected, non-compliance with the prescribed procedures for handling Client Unpaid Securities Accounts (CUSA), inadequate measures to prevent unauthorised data transmission, and shortcomings in disaster recovery operations, including incomplete migration of operations to the disaster-recovery site during a drill.

Source: Live Law Biz

The regulator also found that CDSL had failed to patch identified vulnerabilities within the timeline it prescribed, and that its Vulnerability Assessment and Penetration Testing (VAPT) exercise was not comprehensive because it did not cover all domains and external applications. Adjudicating Officer Jai Sebastian imposed the penalty under Section 15HB of the SEBI Act, holding that it was commensurate with the violations, Live Law reported.

₹1 crorePenalty imposed on CDSL
102 pagesLength of SEBI's adjudication order
45 daysTime given to pay the penalty
2023-24Period covered by SEBI's inspection

SEBI observed that the lapses impinged on CDSL's core obligations as a depository — the system-critical infrastructure that keeps electronic records of shares and ownership transfers — and had implications for individual investors and for the integrity and stability of the Indian securities market. CDSL has been directed to pay within 45 days, failing which recovery proceedings may be initiated. The regulator said the remedial measures CDSL subsequently undertook were duly considered.

This is the second ₹1 crore penalty on CDSL in recent months: in July, SEBI had imposed a penalty of the same amount on the depository for cybersecurity lapses linked to the malware attack that disrupted its systems in November 2022, BusinessLine reported.