Sebi Proposes Consolidating IT and Cybersecurity Regulations for Market Infrastructure Institutions

The Securities and Exchange Board of India (Sebi) has proposed a comprehensive overhaul of information technology and cybersecurity regulations for market infrastructure institutions (MIIs), including stock exchanges, clearing corporations, and depositories. The regulator aims to simplify compliance requirements, eliminate redundancies, and ensure regulatory consistency by merging provisions from multiple existing Master Circulars into a unified framework covering common IT-related areas such as cybersecurity, cyber resilience, system audits, business continuity planning, disaster recovery, capacity planning, and technology advisories.

Key proposals include removing duplicated references to the Cyber Security and Cyber Resilience Framework (CSCRF) that already apply directly to MIIs, harmonising capacity planning requirements across different institutions, and consolidating provisions on co-location and co-hosting facilities in the commodity derivatives segment with the broader technology framework. The regulator suggested implementing a 75 per cent installed capacity threshold for IT components, with immediate corrective action required if actual utilisation exceeds this level. For depositories, the threshold would be monitored on a 15-day rolling basis.

Sebi emphasized that the consolidation would improve regulatory clarity and reduce compliance burden without diluting oversight. The Standing Committee on Technology (SCOT) would oversee corrective actions taken by MIIs when capacity thresholds are breached, and capacity augmentation would be undertaken where repeated breaches occur. The regulator has also proposed retaining detailed provisions on system clock synchronisation with atomic clocks at a single location within the framework to avoid repetition across multiple chapters.

Sebi has sought public comments on the consultation paper until July 13, 2026, to gather stakeholder feedback before finalising the new regulatory framework.