| S.No. |
ENTITY |
PERSONS |
REGULATORY CHARGES |
REGULATORY ACTION(S) / DATE OF ORDER |
FURTHER DEVELOPMENTS |
| 1 |
|
CENTRAL DEPOSITORY SERVICES (INDIA) LTD.
(PAN:AAACC6233A)
|
|
|
DID NOT DECLARE ACTIVE DIRECTORY FEDERATION SERVICES (ADFS) SERVER AS A CRITICAL ASSET IN ACCORDANCE WITH SEBI CIRCULAR DATED 06/07/2015 (AS MODIFIED BY SEBI CIRCULAR DATED 20/05/2022)
DID NOT DEPLOY ADEQUATE CYBERSECURITY CONTROLS COMMENSURATE WITH CRITICALITY OF CYBER RISKS VIOLATING PARAGRAPH NOS.3(A) TO 3(B), 11 AND 12 OF ANNEXURE A OFSEBI CIRCULAR DATED 06/07/2015 (AS MODIFIED BY SEBI CIRCULAR DATED 20/05/2022)
DID NOT ADHERE TO ENHANCED SCOPE OF AUDIT IN VULNERABILITY ASSESSMENT AND PENETRATION TESTING (VAPT) EXERCISE VIOLATING PARAGRAPH NO.40 OF SEBI CIRCULAR DATED 06/07/2015 (AS MODIFIED BY SEBI CIRCULAR DATED 20/05/2022)
DID NOT IMPLEMENT ADEQUATE ACCESS CONTROLS TO ITS SYSTEMS INCLUDING NON-ENFORCEMENT OF PASSWORD POLICY, TWO-FACTOR AUTHENTICATION AND ACCOUNT ACCESS LOCKOUT POLICY VIOLATING PARAGRAPHS NOS.15 TO 21 OF ANNEXURE A TO SEBI CIRCULAR DATED 06/07/2015
DID NOT DETECT INTRUSIONS/ SECURITY INCIDENTS IN REAL TIME AND MONITOR, ANALYZE RELEVANT LOGS OF NETWORK DEVICES AND IDENTIFY & BLOCK OPEN PORTS THAT WERE NOT IN USE VIOLATING PARAGRAPH NOS.35, 43, 45 AND 46 OF ANNEXURE A OF SEBI CIRCULAR DATED 06/07/2015 AND PARAGRAPH NOS. 4.1, 4.2, 4.6, 5.1, 5.2 AND 5.3 OF SEBI CIRCULAR DATED 07/12/2018
DID NOT CONDUCT VULNERABILITY SCANNING AND PENETRATION TESTING PRIOR TO COMMISSIONING OF ACTIVE DIRECTORY FEDERATION SERVICES (ADFS) SERVER VIOLATING PARAGRAPH NO.42 OF ANNEXURE A OF SEBI CIRCULAR DATED 06/07/2015 (AS MODIFIED BY SEBI CIRCULAR DATED 20/05/2022)
DID NOT DECLARE DISASTER WITHIN 30 MINUTES OF DISRUPTION OF CRITICAL SYSTEMS AND FAILED TO RESTORE SYSTEMS AFFECTED BY CYBER-ATTACK WITHIN RECOVERY TIME OBJECTIVE (RTO) SPECIFIED BY SEBI VIOLATING PARAGRAPH NOS.4(C) AND 4(E) OF SEBI CIRCULAR DATED 22/03/2021 AND PARAGRAPH NO.47 OF ANNEXURE A TO SEBI CIRCULAR DATED 06/07/2015
DID NOT ADHERE TO CODE OF CONDUCT OF DEPOSITORIES VIOLATING CLAUSES 1, 5 AND 9 OF PART-D OF THIRDSCHEDULE READ WITH REGULATION 17 OF SEBI DEPOSITORIES ACT, 1996
|
IMPOSED PENALTY RS.1,00,00,000
20-JUL-2026
|
|
| 2 |
|
|
CENTRAL DEPOSITORY SERVICES (INDIA) LTD.
(PAN:AAACC6233A)
|
|
|
FACILITATED OPENING OF LARGE NUMBER OF AFFERENT ACCOUNTS
GENERATED AND DISTRIBUTED BENEFICIAL OWNER’S IDS IN ADVANCE WITHOUT PROPER VERIFICATION AND SCRUTINY OF KYC DOCUMENTS
DID NOT VERIFY INFRASTRUCTURE FACILITIES OF DEPOSITORY PARTICIPANTS
DID NOT PUT IN PLACE ADEQUATE MECHANISMS FOR PURPOSE OF REVIEWING, MONITORING AND EVALUATING CONTROLS, SYSTEMS, PROCEDURES AND SAFEGUARDS
|
IMPOSED PENALTY RS.3,00,00,000
27-APR-2007
|
SAT: IMPUGNED ORDER SET ASIDE,PARTIES TO BEAR THEIR OWN COSTS
|
| 3 |
|
|
CENTRAL DEPOSITORY SERVICES (INDIA) LTD.
(PAN:AAACC6233A)
|
|
|
DID NOT COMMUNICATE REASON FOR REJECTION OF PLEDGE TO PARTICIPANTS OF PLEDGER AND PLEDGEE VIOLATING REGULATION 79(5) OF SEBI DEPOSITORIES ACT, 1996
DID NOT MAINTAIN ADEQUATE SYSTEM AND CONTROL QUA CLIENT UNPAID SECURITIES ACCOUNTS VIOLATING CLAUSE 5 OF SEBI CIRCULAR DATED 11/11/2022
DID NOT IMPLEMENT MEASURES TO PREVENT UNAUTHORIZED TRANSMISSION OF DATA DURING IP VIOLATING CLAUSE 31 OF ANNEXURE A OF SEBI CIRCULAR DATED 06/07/2015 FROM PERIOD JULY 2015 TO OCTOBER 2023
COLLECTED SECURITY INFORMATION AND EVENT MANAGEMENT LOGS (SIEM) LOGS FROM PRIMARY DATA CENTRE (PDC) DURING DISASTER RECOVERY DRILL VIOLATING CLAUSE 5(C) OF SEBI CIRCULAR DATED 22/03/2021
DID NOT PATCH VULNERABILITIES WITHIN THREE MONTH’S TIMELINE STIPULATED BY SEBI VIOLATING CLAUSE 2(41) OF SEBI CIRCULAR DATED 20/05/2022 READ WITH CLAUSE 41 OF ANNEXURE A OF SEBI CIRCULAR DATED 06/07/2015
DID NOT CONDUCT COMPREHENSIVE VULNERABILITY ASSESSMENT & PENETRATION TESTING (VAPT) EXERCISE VIOLATING CLAUSE 40 OF SEBI CIRCULAR DATED 06/07/2015 (AS AMENDED BY SEBI CIRCULAR DATED 20/05/2022)
|
IMPOSED PENALTY RS.1,00,00,000
30-OCT-2026
|
|
| 4 |
|
|
NATIONAL SECURITIES DEPOSITORY LTD.
(PAN:AADCN9802F)
|
|
|
FACILITATED OPENING OF LARGE NUMBER OF FICTITIOUS ACCOUNTS
DID NOT VERIFY INFRASTRUCTURE FACILITIES OF DEPOSITORY PARTICIPANTS
DID NOT NOTICE UNAUTHORISED OUTSOURCING BY DEPOSITORY PARTICIPANTS
DID NOT MAINTAIN DATA INTEGRITY
DID NOT PUT IN PLACE ADEQUATE MECHANISMS FOR PURPOSE OF REVIEWING, MONITORING AND EVALUATING CONTROLS, SYSTEMS, PROCEDURES AND SAFEGUARDS
DID NOT TAKE APPROPRIATE ACTION AGAINST DEPOSITORY PARTICIPANTS FOR VARIOUS IRREGULARITIES REPEATEDLY COMMITTED BY THEM
DID NOT ADHERE TO DIRECTIVES ISSUED BY SEBI
|
IMPOSED PENALTY RS.5,00,00,000
27-APR-2007
|
SAT: IMPUGNED ORDER SET ASIDE,PARTIES TO BEAR THEIR OWN COSTS
|
| The regulatory charges/regulatory actions may be fully or partly applicable to the entities/persons mentioned in the second column. |
