Markets regulator Sebi on Friday imposed a penalty of Rs 1 crore on Central Depository Services (India) Ltd (CDSL) for multiple compliance lapses, including failure to communicate reasons for rejection of pledge requests to the depository participants (DPs) of both the pledgor and pledgee and shortcomings in disaster recovery drills.
CDSL has been directed to pay the penalty within 45 days, failing which recovery proceedings may be initiated.
In its 102-page order, Sebi said CDSL had violated several regulatory requirements during FY2023-24, following an inspection of its operations.
The violations included failure to communicate reasons for rejection of pledge requests to the depository participants of both the pledgor and pledgee, non-compliance with prescribed procedures for handling Client Unpaid Securities Accounts (CUSA), inadequate measures to prevent unauthorised data transmission and shortcomings in disaster recovery operations.
The regulator also found that CDSL had failed to patch identified vulnerabilities within the timeline prescribed by Sebi. Further, its Vulnerability Assessment and Penetration Testing (VAPT) exercise was not comprehensive as it did not cover all domains and external applications.