Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)
Summary
This circular provides clarifications to the Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities. It grants regulatory forbearance until March 31, 2025, for compliance requirements effective from January 1, 2025. Additionally, it extends compliance deadlines for KYC Registration Agencies and Depository Participants to April 1, 2025, while keeping Data Localisation provisions in abeyance.
Text
With regard to the compliance requirements, which are effective from January 01, 2025 under the CSCRF, regulatory forbearance is provided till March 31, 2025. For any non-compliance during this period that comes to the notice of the regulator, no regulatory action shall be taken provided the REs are able to demonstrate meaningful steps taken / progress made in implementation of CSCRF.
KYC Registration Agencies (KRAs): Compliance timeline is extended from January 01, 2025 to April 01, 2025.
Depository Participants (DPs): Compliance timeline is extended from January 01, 2025 to April 01, 2025.
Based on the feedback received on the provisions of Data Localisation, a need is felt for further consultations. Accordingly, the guidelines and provisions with regard to Data Localisation [Data Security standard (PR.DS.S2)] has been kept in abeyance until further notification.
Source: SecMarx — Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs). Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.