Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)
Summary
This circular revises the thresholds and categorization criteria for various SEBI Regulated Entities under the Cybersecurity and Cyber Resilience Framework. It introduces specific classification tables for stock brokers, depository participants, portfolio managers, and AIFs/VCFs based on parameters like client numbers and assets under management. The document also grants exemptions from certain SOC requirements for smaller entities and mandates implementation by June 30, 2025.
Text
SEBI has issued ‘Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)’ vide circular SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated August 20, 2024.
The category of RE shall be decided at the beginning of the financial year based on the data of the previous financial year and remain unchanged throughout that year.
Stockbrokers fulfilling any one of the following parameters shall be classified accordingly: Number of total registered clients or Clientele trading volume in a year.
Stock Brokers with less than 1,000 crores clientele trading volume (in a year) and less than 1,000 total registered clients are exempted from CSCRF.
Categorisation of DP shall be decided based on the highest thresholds of below-mentioned classification. DPs having clients less than 100 shall be exempted from the requirement of SOC services or on-boarding to Market-SOC.
IAs not registered with SEBI in other capacities shall be exempted from provisions of CSCRF.
RAs not registered with SEBI in any other capacity shall be exempted from the CSCRF framework.
The reporting authority for IAs and RAs w.r.t. CSCRF compliance shall be modified from BASL and SEBI respectively to BSE Ltd. for both IAs and RAs for a period of five years starting from July 25, 2024.
KRAs shall be re-categorised from MIIs to Qualified REs.
Categorisation of Portfolio Managers is as per the table based on AUM. PMs in self-certification category with less than 100 clients are exempted from mandatory Market-SOC.
Categorisation shall be at the manager level. Sum of corpus of all AIFs, VCFs, and their schemes managed by a manager determines the threshold. Managers with less than 100 clients are exempted from mandatory Market-SOC.
MBs engaged in issue management activities are Mid-size REs. All other MBs are Small-size REs.
You have read the preview. Create a free account to read the full document and see every order that applied it.
Free accounts include 10 searches/day with full text access.
Source: SecMarx — Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs). Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.