Address by Shri KVR Murty, WTM, SEBI at Institute of Directors (IOD) National Convention

IOD National Convention on 'Boards' Saturday, September 05, 2026: Mumbai

Theme: Board Leadership for an Emerging Global Order “Regulatory Expectations, Corporate Governance & Board Accountability: Strengthening Governance in India’s Financial Capital” Good afternoon, everyone.

It is a pleasure to be part of this conversation on regulatory expectations, corporate governance and Board accountability. We meet at an important juncture for India’s capital markets. Markets are becoming larger and more diverse; more households are participating and more companies are accessing public capital. As public participation deepens, so does the responsibility of those entrusted with that capital.

When a company raises money from the public, it receives something more valuable than capital. It receives trust.

That trust brings expectations of transparency, fairness, stewardship and accountability, and the Board sits at the centre of that responsibility. So, what does the market and the regulator really expect from a Board? Not that it should know everything, predict every risk or ensure that every commercial decision succeeds. Businesses must innovate, compete and take informed risks.

The real test is different: Did the Board have the right information? Did it understand the risk? Did it recognise the conflict? Did it challenge the assumptions? And when the facts changed- did it act? There is a powerful analogy in the Ramayana. Ravana was not an ordinary ruler. He was extraordinarily learned, strategically capable and immensely powerful. He had knowledge, resources and authority. His downfall was not a failure of intellect; it was a failure of conduct. His knowledge was not guided by right judgement.

Importantly, Ravana did not lack wise counsel. Vibhishana, his own brother, repeatedly urged him to change course and choose the path of dharma. This counsel came from within; from someone who understood both; the strength of Lanka and the consequences of the course being pursued. Ravana not only refused to listen; he exiled Vibhishana. Vibhishana, thereafter approached Shri Rama. War followed, with devastating consequences for Ravana, who ultimately lost both his kingdom and his life.

Page 1 of 6The lesson for a modern Boardroom is not that every dissenting voice is necessarily right. It is that silencing internal dissent leaves an organisation profoundly vulnerable, precisely when it really needs to hear the truth.

A Board should therefore ask: Do we merely have independent voices in the room, or have we created a culture in which those voices can actually be heard? There is a profound difference between having a Vibhishana in the room and being willing to listen to him.

Competence tells us whether a director can understand a difficult decision. Character determines what the director does after understanding it.

From compliance to governance to accountability:

This brings me to the central evolution in Board accountability. The movement from: ‘form to substance’. A listed entity may have the required Board composition, committees, policies, meetings and disclosures. These are undoubtedly the foundation of governance, but they are not by themselves proof that governance is working.

An Audit Committee can meet without truly scrutinising the financial reporting. A Risk Management Committee can discuss risks without ensuring that anyone is managing them. An Independent Director can be present without exercising independent judgement.

Perhaps, Board responsibility can be viewed through three simple stages:

Compliance. Governance. Accountability.

Compliance asks: Did we follow the requirement? Governance asks: Did the mechanism work in substance? Accountability asks: When something went wrong or there was indication that it might go wrong- what did we do? Boards today also receive enormous volumes of material. But volume can create an illusion of information. A Board can receive 500 pages and still not receive the one fact it needed to know. The question is not how much information management supplied; it is whether the Board received the information necessary to exercise judgement.

The value of information lies in the quality of deliberation and action it produces.

Page 2 of 6Independent judgement and financial reporting oversight:

An Indian industrial-sector listed entity’s case illustrates this point. The formal architecture a Board, committees and established processes, was present. Yet, regulatory proceedings later examined unusual transactions involving movement of funds towards promoter-linked entities and concerns around understatement of liabilities. The useful governance question is not merely what happened, but what the governance architecture did while it was happening. Were unusual transactions challenged? Were conflicts examined? Did committees follow through? Did anyone look beyond information curated by management and ask whether the underlying commercial reality made sense? Independence is not a designation. It is not a seat on the Board. It is a behaviour. And independent judgement is not demonstrated merely by casting an independent vote. The judgement has to come before the vote.

This same principle applies to the relationship between statutory auditors, the Audit Committee and the Board. Each has a distinct and important role. The auditor brings independent assurance; the Audit Committee provides focused oversight of financial reporting; and the Board carries the broader responsibility for the governance.

What matters, therefore, is not only how these responsibilities are defined, but also how effectively they work together in practice. The functioning of specialized committees and assurance mechanisms, should therefore strengthen the Board’s oversight.

Significant audit observations, unusual accounting matters, recurring concerns or emerging financial- reporting risks, should reach the appropriate level in a timely manner and receive the due attention they deserve.

Hence; clarity of roles, effective communication, and appropriate escalation are not merely procedural matters. They are essential to ensure that the governance framework works effectively in substance.

Disclosure, enforcement and the governance value of red flags:

Disclosure is another area where form and substance can diverge. For a listed entity, disclosure is not simply a regulatory filing. It is part of the continuing relationship between the listed entity and the market. The prescribed timeline should be treated as an outer limit; material information should reach investors promptly, accurately and with enough context to make it meaningful.

Page 3 of 6Information can be technically correct and still leave investors with the wrong picture if material context is missing. And where a situation continues to evolve, responsibility may not end with the first disclosure.

The same mindset should apply to compliance failures and enforcement actions. Rectification, payment of a penalty or closure of the immediate issue should not be the end of Board scrutiny. The

Board should ask: Why did this happen? Was it isolated or systemic? Could the same weakness exist elsewhere? Enforcement action is therefore not merely legal information. It can be governance information.

A red flag does not establish misconduct, but it does provide a reason for the Board to look more closely. The crucial question is not whether a warning signal appeared. It is what the Board did once it had reason to be concerned.

Culture, Board evaluation and ethical leadership:

Culture is perhaps the most powerful part of governance that regulations cannot create by itself.

Regulations can prescribe committees, policies, approvals and meetings. Culture determines how those mechanisms behave when the difficult situation arrives.

Culture is not what the policy says. Culture is what the organisation rewards, tolerates and repeatedly allows.

A technology-sector listed entity’s case provides another useful lesson. The company had a sophisticated governance structure and a Board with a very high proportion of Independent Directors.

Yet serious differences involving founders, management and the Board became public, raising questions of trust, transparency and alignment. Good Boards need not avoid disagreement, in fact constructive disagreement can improve decisions. The distinction is between constructive disagreement and institutional dysfunction.

A meaningful Board evaluation should be capable of detecting that distinction early. If evaluation records attendance and skills but misses a breakdown of trust and alignment, it has measured what is easy rather than what is important.

Ethical leadership also requires Boards to ask questions beyond the text of a rule: Is it fair? Is it consistent with our stated values? Does it create an avoidable conflict? Could it damage investor trust even if permissible? Page 4 of 6Continuous capability-building and institutional collaboration:

The Board agenda is becoming more complex. Directors confront cybersecurity, data governance, AI, complex financial structures, geopolitical developments, climate-related risks, sanctions, supply- chain vulnerabilities and an evolving regulatory framework. It is unrealistic to expect every director to possess deep expertise in all of these, and one induction programme cannot prepare a director for risks that continuously evolve.

Continuous, structured capacity-building therefore becomes part of governance itself. Regulators, market infrastructure institutions, industry bodies, professional institutes and academic institutions can complement each other through thematic programmes, peer learning, Boardroom case studies, emerging-risk briefings and practical governance simulations. Evidence-based consultation is equally important here. It helps regulators understand how regulatory requirements operate in practice and helps the framework remain effective and proportionate.

Robust regulatory framework and capable Boards reinforce each other.

Cybersecurity, data and AI: accountability cannot be outsourced:

Cybersecurity demonstrates why continuous learning is essential. Cyber risk has moved from the technology department to the Board agenda because an incident can simultaneously affect operations, customers, finances, reputation, disclosure and regulatory compliance. The Board should understand

critical digital assets and ask practical questions: Which systems are critical? How long can they be unavailable? How quickly can they be restored? Which third parties do we depend upon? A dashboard showing attempted attacks may be interesting. Resilience is a different question: If systems fail, can we continue, respond and recover? Data governance presents the same accountability challenge. AI makes this even more significant.

Boards should understand material AI use cases, the data on which they depend, access to sensitive information, third-party model dependence, the need for human intervention and, ultimately, who takes responsibility when automated decisions cause harm.

Page 5 of 6Let me close this by returning to the idea with which I began- trust. The strength of corporate governance in India’s capital markets will depend not only on the regulatory framework and market infrastructure, but whether governance structures inside listed entities work in substance.

The objective is not to create Boards so fearful of liability that they stop taking legitimate commercial risks. We need Boards that are informed enough to take difficult decisions, independent enough to challenge assumptions and responsible enough to act when investor interests, financial integrity or market confidence are at stake.

And that brings us back to the analogy of the Ramayana. The tragedy was not that wisdom was unavailable. Wisdom was present, but it was unheard and rejected. For a Board, the challenge is therefore not merely to appoint capable and independent directors. It is to create an institution in which an uncomfortable voice is heard before the cost of ignoring it becomes irreversible.

Wisdom in the room has value only when the institution is willing to hear it.

Attendance is not governance. Approval is not governance. Even dissent, by itself, is not evidence of governance. The real evidence lies in the quality of engagement.

The regulatory framework will continue to evolve. Technology will evolve. Risks will evolve.

Governance must also evolve within the Boardroom as well. An effective Board should be able to say

with credibility: we had the right information; we asked the right questions; we understood the risks; we exercised independent judgement; and when the situation required it, we acted.

That is how governance earns trust. That is how strong Boards build strong institutions. And that is how strong institutions build stronger capital markets.

Thank you.

Page 6 of 6