SEBI mulls consolidating tech, cybersecurity norms
Markets regulator SEBI on Monday proposed a comprehensive overhaul and consolidation of information technology-related regulations applicable to market infrastructure institutions aimed at simplifying compliance requirements, removing redundancies and ensuring regulatory consistency across.
In its consultation paper, the regulator proposed merging provisions of the Master Circulars for stock exchanges and clearing corporations with the Master Circular for commodity derivatives, while also creating a consolidated circular covering common IT-related areas such as cyber security, cyber resilience, annual system audits, business continuity planning and disaster recovery (BCPDR), capacity planning and technology advisories.
SEBI said several provisions currently duplicated across different circulars and frameworks could be streamlined to improve regulatory clarity and reduce compliance burden without diluting oversight.
Among the key proposals, SEBI has suggested removing repeated references to the Cyber Security and Cyber Resilience Framework (CSCRF) from various sections of existing circulars, noting that the framework already applies directly to MIIs and intermediaries.
The regulator also proposed harmonising capacity planning requirements across stock exchanges, clearing corporations and depositories. The proposals are aimed at simplifying regulatory requirements, removal of redundant provisions, discontinuation of duplication in order to promote ease of doing business and reduce the compliance burden on exchanges, SEBI said.
Under the proposed framework, immediate corrective action would be required if actual utilisation of any IT component exceeds 75 per cent of installed capacity. Such instances would be reviewed by the Standing Committee on Technology (SCOT), while capacity augmentation would be undertaken where repeated breaches of the threshold are observed.
“In general, if actual capacity utilization of any component of stock exchanges and clearing corporations exceeds 75 per cent of the installed capacity, immediate action shall be taken by the MII, such as fine-tuning the applications/systems or enhancing the capacity. SCOT shall oversee such action taken by the MII,” SEBI suggested.
The MII’s Capacity Planning and Real Time Performance Monitoring Policy shall include the framework for handling actual capacity utilization exceeding 75 per cent of installed capacity, including situations necessitating augmentation of installed capacity.
