SEBI Imposes ₹5.05 Crore Penalty on ICCL for Cybersecurity and Audit Norm Violations

The Securities and Exchange Board of India (SEBI) has imposed a total penalty of ₹5.05 crore on Indian Clearing Corporation (ICCL), a wholly owned subsidiary of BSE, for alleged violations related to cybersecurity and system audit norms.

The penalty follows an inspection conducted by the market regulator between December 2022 and July 2023.

Inspection and Show-Cause Notice

Following its inspection, SEBI issued a show-cause notice to ICCL in October 2024, highlighting multiple compliance lapses. One of the key findings was that ICCL had submitted a network auditor report to SEBI without incorporating management or board comments.

As per regulatory norms, audit reports, along with management’s observations, must be reviewed by the governing board of market infrastructure institutions. The final report, including the board’s comments, must then be submitted to Sebi within one month of the audit’s completion.

Cybersecurity and Compliance Lapses

SEBI’s investigation further revealed that ICCL did not maintain an up-to-date inventory, as required under regulatory guidelines. While ICCL conducted cyber audits biannually, the regulator observed that issues flagged in these reports were not addressed promptly.

Additionally, the regulator found that ICCL failed to establish a one-to-one correspondence between its disaster recovery site (DRS), near site (NS), and Primary Data Centre (PDC), which is a mandatory requirement under cybersecurity regulations.

Conclusion

The penalty underscores SEBI’s strict stance on cybersecurity compliance and risk management within financial institutions.

The market regulator has reiterated that clearing corporations must adhere to prescribed norms, ensuring robust cybersecurity frameworks and timely resolution of audit observations.

Disclaimer: This blog has been written exclusively for educational purposes. The securities mentioned are only examples and not recommendations. This does not constitute a personal recommendation/investment advice. It does not aim to influence any individual or entity to make investment decisions. Recipients should conduct their research and assessments to form an independent opinion about investment decisions.

Investments in the securities market are subject to market risks, read all the related documents carefully before investing.