In short: SEBI has fined CDSL ₹1 crore for multiple regulatory failures discovered during an inspection for the 2023-24 financial year.

What happened?

The Securities and Exchange Board of India (SEBI) conducted an inspection of Central Depository Services (India) Limited (CDSL) for the financial year 2023-24. CDSL is a Market Infrastructure Institution (MII) and a registered depository. Following the inspection, the regulator identified several violations of the Securities and Exchange Board of India Act, 1992 and the Depositories Act, 1996.

On 31 October 2026, SEBI issued an adjudication order imposing a penalty of ₹1 crore on the depository. The regulator noted that as a systemically important institution, CDSL's failures have implications for the integrity and stability of the entire Indian securities market.

Key findings from the inspection

The inspection revealed gaps in how CDSL managed its core depository functions. The major compliance issues included:

  • Pledge Rejections: Under Regulation 79(5) of the DP Regulations, a depository must provide reasons if it does not create a pledge. However, CDSL was found using a generic note for all rejections, stating that the reason was only known to the participant and could be verified during audits.
  • Basic Services Demat Accounts (BSDA): These accounts are designed to offer lower costs to small investors. CDSL was also found to have failed in supervising whether Depository Participants (DPs) were effectively obtaining "opting out" confirmations from these eligible investors.
  • Client Unpaid Securities Accounts (CUSA): The depository failed to adhere to prescribed procedures and joint proposals regarding the operations of these accounts.

Cybersecurity and Disaster Recovery lapses

SEBI's inspection also highlighted significant concerns regarding CDSL's digital infrastructure and its ability to handle emergencies:

  • Vulnerability Management: CDSL did not patch identified software vulnerabilities within the timelines stipulated by SEBI. Furthermore, its Vulnerability Assessment and Penetration Testing (VAPT) was not comprehensive, as it failed to cover all domains and external applications.
  • Data Protection: The regulator found inadequate measures to prevent the unauthorised transmission of data.
  • Disaster Recovery (DR) Drills: During mandatory drills, CDSL failed to achieve a complete migration of its operations to the disaster recovery site. This raised concerns about the depository's readiness to maintain operations during a real system failure.

Legal consequences and next steps

SEBI stated that these violations were serious because a depository provides the critical infrastructure for electronic record-keeping and ownership transfers in the market.

CDSL has been directed to pay the penalty within 45 days. If the depository fails to pay within this timeframe, SEBI may initiate recovery proceedings. While the regulator acknowledged that CDSL has since taken remedial measures to address these gaps, the penalty was deemed necessary to address the seriousness of the initial lapses.

Frequently asked questions

What is a Basic Services Demat Account (BSDA)?

A BSDA is a special type of demat account for individual investors with a small portfolio value (generally up to ₹2 lakhs). It is intended to reduce the cost of maintaining a demat account for small retail investors.

Why is a disaster recovery drill important for CDSL?

As a depository, CDSL holds records of millions of investors' shares. A disaster recovery drill ensures that if the main system fails due to a cyberattack or technical glitch, the depository can quickly switch to a backup site without losing data or stopping market operations.

Sources

Not legal advice. This page explains the law in general terms. Rules, fees and limits change, and your facts matter. Check the official source or consult a qualified advocate before acting. Disclaimer