Originals · Startup · Startups & Fintech
SEBI fines CDSL Rs 1 Cr for cybersecurity and pledge lapses found in an FY24 inspection
The regulator says the depository left data loss prevention incomplete, patched vulnerabilities late and ran a VAPT that did not cover all its applications. It is CDSL's second Rs 1 Cr penalty this year.
The Securities and Exchange Board of India (SEBI) on October 30 imposed a penalty of Rs 1 crore on Central Depository Services (India) Ltd (CDSL) for a set of compliance lapses found during an inspection of its operations for FY2023-24. The penalty was levied under Section 15HB of the SEBI Act, according to LiveLaw, and CDSL has 45 days to pay it, failing which recovery proceedings may follow, PTI reported in BusinessLine. The order runs to 102 pages.
Most of the findings are about security. SEBI found that CDSL had not fully implemented data loss prevention measures, and Moneycontrol reported that the gap covered 24 endpoints. During a disaster recovery drill, security information and event management (SIEM) logs were still being collected at the primary data centre instead of the disaster recovery site, which SEBI described as an incomplete migration of operations to the DR site. CDSL also failed to patch identified vulnerabilities within the three month window SEBI prescribes, and its vulnerability assessment and penetration testing (VAPT) exercise was not comprehensive because it left out some domains and external applications.
The other lapses concern core depository work. CDSL did not tell the depository participants of both the pledgor and the pledgee why pledge requests had been rejected, and it did not follow the agreed procedure for handling Client Unpaid Securities Accounts (CUSA).
SEBI said a depository provides the system critical physical and digital infrastructure for electronic record keeping, dematerialisation and transfers of ownership, so such deficiencies affect not only individual investors but also the integrity and stability of the securities market. It called the violations serious, while noting that it had taken into account the remedial steps CDSL took afterwards.
This is the second penalty of its kind on CDSL this year. In July, SEBI fined the depository Rs 1 crore for cybersecurity lapses linked to the malware attack that disrupted its systems in November 2022, BusinessLine reported. For regulated market infrastructure, the order is a reminder that SEBI's cybersecurity framework is enforced through routine inspections, down to patch timelines and the scope of penetration tests.
