New Delhi, October 31, 2026: The Securities and Exchange Board of India (SEBI) has imposed a penalty of ₹1 crore on Central Depository Services (India) Ltd (CDSL) for multiple regulatory violations, including cybersecurity deficiencies, shortcomings in disaster recovery operations and failures in handling pledge requests.
The market regulator has directed CDSL to pay the penalty within 45 days, warning that recovery proceedings could follow if the company fails to comply.
SEBI Flags Violations
In its 102-page order, SEBI identified several compliance lapses during FY2023-24 following an inspection of CDSL’s operations.
The regulator found that CDSL failed to communicate reasons for rejecting pledge requests to the depository participants (DPs) of both the pledgor and pledgee.
It also highlighted non-compliance with prescribed procedures for handling Client Unpaid Securities Accounts (CUSA).
SEBI observed that these deficiencies reflected shortcomings in the depository’s regulatory responsibilities.
Cybersecurity Gaps Identified
The regulator also raised concerns over CDSL’s cybersecurity framework, particularly inadequate safeguards against unauthorised data transmission.
According to the order, CDSL failed to address identified security vulnerabilities within SEBI’s prescribed timelines.
Its Vulnerability Assessment and Penetration Testing (VAPT) exercise was also found inadequate, as it did not cover all domains and external applications.
Also read: SEBI Freezes ₹28.12 Crore, Cracks Down On F&O Manipulation
These shortcomings raised concerns about the effectiveness of the depository’s cybersecurity controls.
Disaster Recovery Shortcomings
SEBI further identified deficiencies in CDSL’s disaster recovery arrangements.
The inspection revealed that the company had not completely migrated its operations to the disaster recovery site during a scheduled drill.
The regulator stressed that such failures could affect operational resilience and the stability of critical market infrastructure.
Investor Protection Concerns
SEBI said the violations directly affected CDSL’s core responsibilities, including electronic record-keeping, dematerialisation and securities ownership transfers.
Given the systemic importance of depositories, the regulator warned that such deficiencies could have wider implications for investors and market integrity.
While imposing the ₹1 crore penalty, SEBI acknowledged the corrective measures subsequently undertaken by CDSL.
The latest action follows another ₹1 crore penalty imposed in July over cybersecurity lapses linked to a malware attack that disrupted CDSL’s systems in November 2022.
