The Securities and Exchange Board of India (SEBI) has imposed a monetary penalty of Rs 1 crore on Central Depository Services (India) Ltd (CDSL) after identifying multiple regulatory compliance lapses during an inspection covering the financial year 2023-24. The deficiencies primarily related to pledge management systems, cybersecurity infrastructure, data protection mechanisms and disaster recovery arrangements.

According to SEBI's adjudication order, one of the key violations involved the rejection of pledge requests. The regulator found that CDSL had failed to communicate the reasons for rejecting pledge requests to the depository participants (DPs) of the pledgor and pledgee in 92 instances. During the inspection period, CDSL rejected a total of 23,272 pledge requests. The company explained that its earlier system did not mandate the recording of rejection reasons and subsequently introduced changes to make this process compulsory.

SEBI also identified deficiencies in the management of Client Unpaid Securities Pledgee Accounts (CUSPA). CDSL had not fully complied with the joint framework established by stock exchanges and depositories for freezing and unfreezing such accounts. The shortcomings included unfreezing entire accounts instead of restricting operations to specified securities and quantities, inadequate system-level controls and delays in freezing certain accounts as instructed by exchanges.

Cybersecurity and data protection practices were another major area of concern. SEBI found that data loss prevention (DLP) measures had not been implemented across 24 endpoints, potentially exposing sensitive information to unauthorised access or transmission. The regulator also observed that during a disaster recovery drill, security information and event management (SIEM) logs were being collected at CDSL's primary data centre instead of its designated disaster recovery site.

Further deficiencies were identified in software vulnerability management. CDSL had failed to address certain identified software vulnerabilities within the prescribed three-month period. Its vulnerability assessment and penetration testing (VAPT) exercise was also found to be inadequate, as it did not cover all domains and external applications.

The regulator additionally examined CDSL's monitoring of Basic Services Demat Accounts (BSDA) conversion. Of the eligible accounts, 71.89 lakh had been converted, while 1.10 crore remained unconverted, with only 8,321 opt-out confirmations recorded. However, the adjudicating officer concluded that the relevant regulatory circulars did not specifically assign this monitoring responsibility to CDSL. Consequently, this particular allegation was not established.

SEBI acknowledged that CDSL had subsequently undertaken remedial measures to address the identified deficiencies. However, the regulator maintained that such compliance failures could have implications for market integrity, operational resilience and investor confidence.

The penalty highlights the increasing regulatory emphasis on cybersecurity, operational risk management and compliance standards among market infrastructure institutions. As a key depository in India's capital markets, CDSL plays an important role in maintaining securities ownership records and facilitating dematerialised transactions, making the reliability of its systems critical to market functioning.