KYC validation requirement: KRAs must begin validating Aadhaar-based and all KYC records from an August commencement, with revised timelines.
SEBI requires KRAs to validate KYC records where Aadhaar was used as an OVD within a limited period from the August 2022 commencement date and directs that validation of all KYC records, both new and existing, commence from that start date; the circular revises timelines in response to KRA requests and is issued under SEBI's powers to protect investors and regulate the securities market.

Listing timeline reduction for privately placed InvIT units to six working days for listing and trading commencement.
Listing of units issued on private placement by Infrastructure Investment Trusts must be completed within six working days from issue closure, with a staged schedule: sponsor transfer of HoldCo/SPV interests by T+3, demat credit and applicable lock-in confirmation by T+4, listing application by T+5, and stock exchange notice and ISIN activation leading to trading commencement by T+6; stock exchanges and depositories must coordinate and depositories shall activate ISINs only after exchanges grant listing approval.

UPI blocking mechanism enables retail investors to apply in REIT public issues with validated mandates and prescribed timelines.
An additional Unified Payments Interface (UPI) mechanism allows retail investors to apply in REIT public issues by blocking funds via a bank-account-linked UPI ID: stock exchanges validate PAN and Demat details with depositories in near real time, sponsor banks initiate UPI mandate requests which investors authorize in their UPI apps to block funds, and sponsor banks relay block-status to stock exchanges and the Registrar for reconciliation; registrars undertake allotment, trigger debits and unblocking post-allotment, and issuers, intermediaries and collecting banks have specified operational, disclosure and coordination obligations to meet prescribed timelines for listing and trading.

Unified Payments Interface enables UPI based blocking of application funds for InvIT public issues, with mandate and reconciliation processes.
Introduction of a UPI mechanism for public issues of InvIT units allows investors to block funds via a bank linked UPI ID as an alternative to ASBA for eligible applications. Stock Exchanges and Depositories must validate PAN and Demat details in near real time; validated bids and UPI IDs are sent to a Sponsor Bank which raises one time UPI mandates to block funds. Sponsor Banks, Exchanges and Registrars exchange mandate and block status files for reconciliation, allotment processing, debit/collect requests on allotment, and automatic unblocking or refund where applicable.

Large value fund for accredited investors: placement memorandum filing relief and mandatory compliance officer designation enforced.
The circular permits Large Value Fund for Accredited Investors to launch schemes under intimation rather than merchant-banker-filed placement memoranda, subject to a prescribed CEO-and-Compliance-Officer signed undertaking. Fund documents must set terms for any tenure extension beyond the normal limit and obtain prior approval from the fund's governance body for extensions; failure to meet prescribed extension conditions requires liquidation. Managers must designate a Compliance Officer distinct from the CEO to monitor adherence to the SEBI Act, AIF Regulations and related circulars, and the undertaking must confirm due diligence, fitness and properness, adequacy of disclosures, and investor accreditation acknowledgements.

Payment remittance account update for foreign SEBI fee transfers: new designated bank account for electronic remittances.
Bank account details in Annexure D of the Operational Guidelines are amended to designate a specific account for foreign inward remittances of regulatory fees in US dollars, including bank name and branch, account number, IFSC, MICR and SWIFT codes, to facilitate faster confirmation of remittances by intermediaries; all other provisions remain unchanged and the circular is issued under the authority's regulatory powers.

Demat account tagging required; untagged broker accounts face prohibition on securities credits and debits until properly tagged.
Stock brokers must tag all demat accounts into prescribed categories-proprietary, pool, client unpaid securities, client securities margin pledge, and client securities under margin funding-and untagged accounts must be tagged by the deadline. Credits into untagged accounts will be disallowed except for corporate actions, with debits barred after a later enforcement date. Brokers must seek exchange approval for tagging where required; exchanges shall grant approval within two working days after imposing penalties and must coordinate compliance, amend bye laws, and report to the regulator. Bank exclusive demat accounts are excluded.

Mutual fund nomination rules standardise investor choice, online e-sign submission, and folio freeze for non-compliance.
Uniform nomination requirements were prescribed for eligible mutual fund unit holders, allowing investors to either appoint a nominee in the prescribed form or opt out through a signed declaration. AMCs must provide physical or online submission, with wet signatures for physical forms and e-Sign for online forms, and maintain systems for confidentiality and safety of client records. Existing individual unit holders were advised to complete nomination or opt out by 31 March 2023, failing which folios would be frozen for debits.

Cybersecurity obligations require mutual funds/AMCs to report incidents promptly and undertake periodic VAPT and cyber audits.
Mutual Funds and AMCs must identify and classify critical assets and maintain an up-to-date inventory approved by Boards/Trustees. They are required to conduct periodic VAPT using CERT-In empanelled organisations, submit final VAPT reports to SEBI after Technology Committee approval within one month, remediate vulnerabilities immediately and file closure compliance within three months. VAPT or scanning is required before commissioning new critical systems. All cyber incidents must be reported to SEBI within six hours and quarterly reports submitted within fifteen days of quarter-end; entities must perform two cyber audits per year and provide an MD/CEO compliance declaration.

Cyber security requirements mandate annual VAPT by certified vendors and timely remediation, plus annual cyber audit and executive certification.
Stock Brokers and Depository Participants must classify and inventory critical assets, including ancillary systems, obtain board-level approval of critical systems, and perform annual VAPT and comprehensive annual cyber audit. VAPT must be done by CERT In empanelled organisations, with the final report submitted to Exchanges/Depositories within one month after Technology Committee approval; vulnerabilities must be remediated promptly and closure compliance submitted within three months. Vulnerability scanning and penetration testing are required before commissioning new critical systems. Entities must submit an MD/CEO/partner/proprietor declaration of compliance and report implementation status to Exchanges/Depositories within ten days; Exchanges/Depositories must amend bylaws and notify members.

Arbitration mechanism: stock exchange arbitration must be pursued after IGRC recommendations, with limitation governed by law.
Complaints of a civil nature between a member and a client must be referred first to the IGRC and/or the stock exchange arbitration mechanism; arbitrators appointed thereunder are competent to decide jurisdiction. A party dissatisfied with an IGRC recommendation must seek stock exchange arbitration within the prescribed challenge period from the IGRC recommendation. That challenge period applies only to IGRC challenged cases; if arbitration is initiated without using the IGRC, the limitation for filing is governed by the general law of limitation. Stock Exchanges and Depositories must amend bye laws and notify constituents accordingly.

Virtual meetings for REITs and InvITs extended, requiring compliance with prescribed VC/OAVM procedures until year-end.
Permission to conduct annual and other unitholders' meetings of REITs and InvITs via video conferencing or other audio-visual means is extended until December 31, 2022. The extension is granted under the applicable regulations and requires REITs/InvITs to comply with the procedure set out in Annexure-I of SEBI's June 22, 2020 circular when using VC/OAVM for meetings.

Change in control of portfolio managers requires SEBI prior approval, six month validity, and investor exit rights without exit load.
Change in control of portfolio managers requires prior approval via the SEBI Intermediary Portal; such approval is valid for six months and fresh registration following the change must be completed within that period. The portfolio manager must inform existing investors and offer an exit without exit load for at least 30 calendar days. For schemes requiring NCLT sanction, SEBI approval must be sought before NCLT filing, SEBI may grant a three month in principle approval, and after NCLT order the manager must file specified documents within 15 days for final approval.

Stock exchange arbitration mechanism established SOP for disputes between listed companies/RTAs and shareholders, setting procedures, timelines and fee allocation.
The circular prescribes a Standard Operating Procedure for stock exchange arbitration of disputes between listed companies/RTAs and shareholders, making RTAs subject to arbitration, requiring listed companies to be joined where RTAs are involved, and directing arbitration only after exhaustion of complaint remedies including SCORES. It prescribes arbitrator composition, appointment timelines, hearing modalities, award and appellate timelines with limited extensions, fee and cost-allocation rules including refunds and subsidisation for small investor claims, record retention and public disclosure obligations, and enforcement/penalty frameworks for non-compliance.

Cybersecurity obligations for KYC Registration Agencies updated; enhanced VAPT and biannual cyber audit requirements imposed.
KRAs must identify, classify and board approve critical assets, maintain inventories of hardware, software and network resources, and subject new or critical systems to vulnerability scanning and penetration testing prior to commissioning. Periodic VAPT covering critical infrastructure must be conducted at least annually, by CERT In empaneled organisations, with final reports approved by the Technology Committee and submitted to the regulator. Vulnerabilities must be remediated immediately and closure certified within three months. KRAs must undertake comprehensive cyber audits twice per financial year and submit an MD/CEO compliance declaration with audit reports.

ASBA funds blocking ensures applications processed only after amounts are blocked, requiring intermediaries and exchanges to confirm.
The circular mandates that ASBA applications in public issues be processed only after application monies are blocked in the investor's bank account, requiring mandatory confirmation of blocked funds for acceptance on stock exchanges' electronic book-building platforms. All intermediaries, market infrastructure institutions, SCSBs and registrars must implement necessary systemic and procedural arrangements within the prescribed implementation period, with merchant bankers coordinating stakeholders. The requirement applies to all investor categories and modes of processing and is effective for public issues opening on or after the stated effective date.

Cyber security obligations require registrars to classify critical systems, conduct VAPT and biannual cyber audits, and report compliance.
QRTAs must identify and classify critical assets-including systems with sensitive or PII data-and maintain an approved inventory; conduct VAPT (covering servers, networking and security devices) at least annually (or biannually for designated protected systems) using CERT In empaneled organisations; submit Technology Committee approved VAPT reports to SEBI within one month; remediate vulnerabilities immediately and report closure within three months; perform pre commissioning testing of critical systems; carry out biannual cyber audits and furnish an MD/CEO compliance declaration with audit reports; implement measures and report status to SEBI within ten days, effective immediately.

Equitable distribution of client funds: priority full payment to smaller balances, remaining credits paid pro rata under supervised settlement.
The SOP amendment requires supervised settlement of client credit balances by using available member funds and market infrastructure unencumbered deposits, after dues and buffer maintenance. Payments begin with the smallest balances: amounts below a specified threshold paid in full where funds permit, amounts above that threshold paid pro rata from remaining funds. Market infrastructures may invoke bank guarantees, encash FDRs, net client balances across exchanges and settle in tranches. Members must provide proof of payment, exclude related parties by undertaking, indemnify market infrastructures against shortfalls, and allow client withdrawals by unconditional letter; implementation is required within a set timeline.

Issuance of duplicate securities certificates: procedures simplified, documentation standardised, and dematerialisation made mandatory within 120 days.
Simplified, standardized procedure requires claimants to submit FIR/evidence and Board-prescribed Affidavit and Indemnity (no surety); exemptions apply where value Rs.5 Lakhs using prior-day closing price. Overseas holders may provide notarised/apostilled self-declaration with passport and address proof. RTAs/issuers must use prescribed forms, issue a Letter of Confirmation within 30 days, retain and deface physical certificates, and the claimant must dematerialise within 120 days or securities move to Suspense Escrow Demat Account. Duplicate securities must be issued only in dematerialized mode.

Passive fund regulation updates strengthen ETF/index replication, exposure, market making, iNAV and disclosure requirements across products.
The circular prescribes a regulatory framework for passive funds requiring debt index constituents to be investment grade with defined ratings and maturities, issuer aggregated exposure limits and sector/group caps, replication tests and minimum issuer counts for ETF/index portfolios, duration deviation tolerances including for target maturity products, rebalancing and segregation on downgrades, and detailed disclosure, market making, iNAV, tracking error/difference and investor liquidity provisions.