Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)

X X   X X   Extracts   X X   X X

Full Text of the Document

X X   X X   Extracts   X X   X X

....ociation of Investment Bankers of India Association of Portfolio Managers in India (APMI) BSE Limited (Investment Adviser Administration and supervisory body- IAASB) BSE Limited (Research Analysts Administration and supervisory body- RAASB) Sir / Madam, Subject: Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs) 1. Securities and Exchange Board of India (SEBI) has issued 'Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)' vide circular SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated August 20, 2024. Upon receipt of various queries from REs seeking extension and clarification on the aforementioned circular, SEBI has also issued 'Clari....

X X   X X   Extracts   X X   X X

Full Text of the Document

X X   X X   Extracts   X X   X X

....ation S. No. Parameters Qualified REs Mid-size REs Small-size REs Self-certification REs 1. Number of total registered clients More than 10 lakhs More than 1 lakh and up to 10 lakhs More than 10,000 and up to 1 lakh More than 1,000 and up to 10,000 2. Clientele trading volume in a year (in Crores) More than 10, 00,000 More than 1,00,000 and up to 10,00,000 More than 10,000 and up to 1,00,000 More than 1,000 and up to 10,000 2.1.2. Stock Brokers with less than 1,000 crores clientele trading volume (in a year) and less than 1,000 total registered clients are exempted from CSCRF. 2.2. Depository Participants (DPs): It shall be noted that categorisation of DP shall be decided based ....

X X   X X   Extracts   X X   X X

Full Text of the Document

X X   X X   Extracts   X X   X X

....s shall be re-categorised from MIIs to Qualified REs. 2.6. Portfolio Managers: Categorisation of Portfolio Managers is as per the following table. Table 3: Criteria and thresholds for Portfolio Managers categorisation S. No. Criteria Qualified REs Mid-size REs Small-size REs Self-certification REs 1. AUM N.A. Above Rs, 3000 Crores N.A. Rs. 3000 Crores and below Further, Portfolio Managers who fall under self-certification REs category and have less than 100 clients shall be exempted from the requirement of mandatory Market-SOC (M-SOC). 2.7. Alternate Investment Funds (AIFs) and Venture Capital Funds (VCFs): Categorisation shall be at the manager level instead of AIF level. If the manager....

X X   X X   Extracts   X X   X X

Full Text of the Document

X X   X X   Extracts   X X   X X

....ving clients less than 100 shall be exempted from the requirement of employing SOC services or on-boarding to M-SOC. 4. In case an RE is registered under more than one category of REs, then the provision of highest category under which such an RE falls shall be applicable to that RE. 5. W.r.t. 'Framework for Adoption of Cloud Services by SEBI Regulated Entities (REs)' issued vide SEBI circular SEBI/HO/ITD/ITD_VAPT/P/CIR/2023/033 dated March 06, 2023 (CSCRF: Annexure-J), implementation of a dedicated Hardware Security Module (HSM) shall be made mandatory for MIIs and Qualified REs (as per the classification given in CSCRF). However, mid-size REs, small-size REs, and self-certification REs shall be allowed to implement any alternative o....