On 30 October 2026, the Securities and Exchange Board of India (SEBI) imposed a ₹1 crore penalty on Central Depository Services (India) Ltd (CDSL) after an inspection of its operations for 2023–24 found multiple compliance lapses. CDSL must pay within 45 days of the order; recovery proceedings may follow if it does not.
Violations identified
SEBI found that CDSL failed to tell the depository participants of both pledgers and pledgees why pledge requests were rejected. It also found non-compliance with procedures for Client Unpaid Securities Accounts, including deficiencies in freezing and unfreezing securities and system-level checks.
Other findings covered inadequate safeguards against unauthorised data transmission, incomplete Data Loss Prevention measures, delayed patching of identified vulnerabilities and a non-comprehensive Vulnerability Assessment and Penetration Testing exercise that did not cover all domains and external applications. During a disaster recovery drill, CDSL did not complete the migration of operations to its disaster recovery site.
CDSL said the penalty would not materially affect its financial position or operations beyond payment. The fine is separate from a ₹1 crore penalty imposed in July 2026 for cybersecurity lapses linked to a November 2022 malware attack. SEBI said it considered CDSL’s subsequent remedial measures.
Important Facts for Exams
- DLP data states: Data loss prevention can cover sensitive data in motion across networks, at rest in storage and in use on endpoints.
- Content-aware detection: Content-aware DLP systems can use exact data matching, structured-data fingerprinting, statistical methods, rules and contextual analysis.
- SEBI penalty recovery: Section 28A of the SEBI Act allows the Board to recover unpaid amounts as arrears of land revenue, alongside specified attachment and sale procedures.
- Depository regulatory framework: India's depositories are governed by the Depositories Act, 1996 and SEBI (Depositories and Participants) Regulations, 2018, which also regulate their participants.
