SEBI Imposes ₹1 Crore Fine on CDSL for Multiple Compliance Lapses

CDSL Order Sharpens Focus on Depository Controls and Cyber Resilience

The penalty covers operational, data-security and disaster-recovery gaps identified during a review of CDSL’s FY2023-24 operations.

A broad set of operational gaps under one order

SEBI’s 102-page order says CDSL failed to communicate why certain securities pledge requests were rejected to the depository participants of both the pledgor and pledgee. A pledge allows securities to be marked as collateral, so clear communication around a rejection is important to the intermediaries handling the request and to the parties involved.

The regulator also cited non-compliance with prescribed procedures for Client Unpaid Securities Accounts, inadequate safeguards against unauthorised data transmission and incomplete migration of operations to the disaster recovery site during a drill. These findings relate to different parts of a depository’s operating framework, rather than a single isolated process.

Cybersecurity testing and recovery readiness in focus

SEBI found that CDSL did not patch identified vulnerabilities within the regulator’s prescribed timeline. It also said the company’s Vulnerability Assessment and Penetration Testing exercise did not cover all domains and external applications. Together with the disaster-recovery drill findings, the observations raise questions about how completely vulnerabilities were assessed, addressed and tested against operational disruption.

For investors, these are matters of market infrastructure and process reliability. The order does not state that the cited lapses caused investor losses or that CDSL’s services are currently disrupted. Its significance is that the regulator identified weaknesses across controls intended to support secure data handling, timely remediation and recovery preparedness.

A second ₹1 crore penalty adds regulatory context

The order follows a separate penalty of ₹1 crore imposed on CDSL in July over cybersecurity lapses linked to a malware attack that disrupted its systems in November 2022. The two penalties concern distinct matters: the earlier action was linked to that attack, while the latest order covers multiple compliance findings from the FY2023-24 inspection.

The repeated regulatory scrutiny makes remediation and follow-through important areas to watch. The current order directs CDSL to pay within 45 days; it says recovery proceedings may be initiated if the payment is not made within that period. The supplied information does not detail any response from CDSL or the corrective steps it may have taken.

Key Highlights

• SEBI imposed a ₹1 crore penalty on CDSL following an inspection of FY2023-24 operations.
• The findings include gaps in communicating rejected pledge requests and handling Client Unpaid Securities Accounts.
• The regulator cited inadequate controls against unauthorised data transmission and incomplete migration during a disaster-recovery drill.
• Vulnerabilities were not patched within the prescribed timeline, and VAPT coverage did not include all domains and external applications.
• CDSL has 45 days to pay; a separate ₹1 crore penalty in July related to cybersecurity lapses linked to a November 2022 malware attack.

Investor Note: The penalty is a regulatory and operational-risk signal, not by itself evidence of a current service disruption or a change in CDSL’s financial outlook. Investors may watch for information on payment, remediation and the effectiveness of future control and recovery testing.