Market regulator Securities and Exchange Board of India (SEBI) has imposed a penalty of Rs 1 crore on Central Depository Services (India) Ltd (CDSL) for multiple compliance lapses, including shortcomings in its pledge management system, cybersecurity measures and disaster recovery arrangements.
In an adjudication order issued on Friday, SEBI said its inspection of CDSL for FY2023-24 had identified several instances of non-compliance with regulatory requirements. The violations included failure to communicate reasons for rejecting pledge requests to depository participants (DPs), inadequate safeguards against unauthorised data transmission and deficiencies in vulnerability assessment and penetration testing (VAPT).
One of the key findings related to pledge rejections. SEBI found that CDSL had failed to communicate the reasons for rejecting pledge requests to the DPs of the pledgor and pledgee in 92 instances. The depository had rejected 23,272 pledges during the inspection period. CDSL submitted that its earlier system did not make it mandatory to capture rejection reasons. It subsequently introduced system changes to make this mandatory.
The regulator also flagged shortcomings in CDSL's handling of Client Unpaid Securities Pledgee Accounts (CUSPA). It found that the depository had not fully followed the joint proposal put in place by stock exchanges and depositories for freezing and unfreezing such accounts. The lapses included unfreezing entire accounts instead of specified securities and quantities, the absence of system-level checks, and failure to freeze certain accounts on the dates instructed by exchanges.
On the cybersecurity front, SEBI found that data loss prevention (DLP) measures had not been implemented across 24 endpoints, potentially exposing sensitive information to unauthorised access or transmission.