Executive Summary:
SEBI issued this circular to revise thresholds and categorization of Regulated Entities (REs) based on discussions following previous circulars on the Cybersecurity and Cyber Resilience Framework (CSCRF). It specifies criteria for categorizing various REs, exemptions from certain requirements, and mandates specific actions. The deadline for compliance, previously communicated, remains June 30, 2025, and cyber audits from FY 2025-26 will follow the guidelines in the August 20, 2024, circular and related clarifications.
Key Points / Main Content:
* **Categorization Revisions:**
* The category of RE is determined at the beginning of the financial year based on the previous year's data and remains fixed for the year.
* The reporting authority validates the category during compliance submission, and criteria/thresholds may be updated.
* **Stock Brokers:**
* Categorized as Qualified, Mid, Small, or Self-certification REs based on the number of registered clients and clientele trading volume.
* Stock Brokers with less than 1,000 clients and less than 1,000 crores clientele trading volume are exempt from CSCRF.
* **Depository Participants (DPs):**
* Categorization is based on the highest threshold if registered in multiple capacities (e.g., as both a stock broker and bank).
* DPs with less than 100 clients are exempt from SOC services or MarketSOC (MSOC) onboarding.
* **Investment Advisors (IAs) and Research Analysts (RAs):**
* IAs and RAs not registered with SEBI in other capacities are exempt from CSCRF.
* Those registered in other capacities must follow the highest category applicable to their other registration(s).
* BSE Ltd. is the reporting authority for IAs and RAs for CSCRF compliance for five years starting July 25, 2024.
* **KYC Registration Agencies (KRAs):**
* Recategorized as Qualified REs.
* **Portfolio Managers:**
* Categorized based on Assets Under Management (AUM).
* Self-certification REs with less than 100 clients are exempt from mandatory MarketSOC (MSOC).
* **Alternative Investment Funds (AIFs) and Venture Capital Funds (VCFs):**
* Categorization is at the manager level, including the corpus of VCF schemes managed.
* Self-certification REs with a client base of less than 100 are exempt from mandatory MarketSOC (MSOC).
* **Merchant Bankers (MBs):**
* MBs engaged in issue management are Midsize REs; all other MBs are Smallsize REs.
* **Registrar to an Issue and Share Transfer Agents (RTAs):**
* RTA having clients less than 100 are exempted from the requirement of employing SOC services or onboarding to MSOC.
* **Cloud Services:**
* Hardware Security Module (HSM) implementation is mandatory for MIIs and Qualified REs.
* Midsize, Smallsize, and Self-certification REs can implement alternatives based on risk assessment approved by their Board/Partners/Proprietor.
Impact Analysis:
Stock Brokers, Depository Participants, KRAs, Portfolio Managers, Investment Advisers, Research Analysts, Merchant Bankers, AIFs, VCFs, and Registrars to an Issue & Share Transfer Agents:
* Impact: Must implement the circular's provisions regarding categorization and cybersecurity framework.
* Action Required: Take necessary steps to implement the circular.
Stock Exchanges and Depositories:
* Impact: Must ensure members and participants are aware of the circular's requirements.
* Action Required: Amend byelaws, rules, and regulations; disseminate the circular to members/participants and on their websites.
BSE Limited:
* Impact: Responsible for compliance and dissemination to IAs and RAs.
* Action Required: Amend byelaws and rules; disseminate the circular to IAs and RAs and on their website.
Stock Portfolio Managers and APMI:
* Impact: Responsible for implementing the provisions of this circular.
* Action Required: Take necessary steps to implement the circular including required processes and systems to ensure compliance.
Key Entities Referenced
Securities and Exchange Board of India SEBI: The regulatory body that issued the circular regarding Cybersecurity and Cyber Resilience Framework CSCRF for SEBI Regulated Entities REs.
Cybersecurity and Cyber Resilience Framework CSCRF: A framework issued by SEBI to regulate cybersecurity and cyber resilience for SEBI Regulated Entities REs.
SEBI Regulated Entities REs: Entities regulated by SEBI and subject to the Cybersecurity and Cyber Resilience Framework CSCRF.
Alternative Investment Funds AIFs: A category of investment funds that are addressed in the circular.
Venture Capital Funds VCFs: A category of investment funds that are addressed in the circular.
BSE Limited: A stock exchange that is directed to take certain actions regarding Investment Advisers IAs and Research Analysts RAs.
Investment Advisers IAs: A type of SEBI regulated entity affected by the circular.
Research Analysts RAs: A type of SEBI regulated entity affected by the circular.
परिपत्र / CIRCULAR
SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2025/60 April 30, 2025
To,
All Alternative Investment Funds (AIFs)
All Depositories
All Depository Participants through Depositories
All Investment Advisors (IAs) / Research Analysts (RAs)
All KYC Registration Agencies (KRAs)
All Merchant Bankers
All Portfolio Managers
All Registrar to an Issue and Share Transfer Agents (RTAs)
All Stock Brokers through Exchanges
All Stock Exchanges
All Venture Capital Funds (VCFs)
Association of Investment Bankers of India
Association of Portfolio Managers in India (APMI)
BSE Limited (Investment Adviser Administration and supervisory body-
IAASB)
BSE Limited (Research Analysts Administration and supervisory body-
RAASB)
Sir / Madam,
Subject: Clarifications to Cybersecurity and Cyber Resilience Framework
(CSCRF) for SEBI Regulated Entities (REs)
1. Securities and Exchange Board of India (SEBI) has issued ‘Cybersecurity and
Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)’ vide
circular SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated August 20, 2024.
Upon receipt of various queries from REs seeking extension and clarification on
Page 1 of 7the aforementioned circular, SEBI has also issued ‘Clarifications to Cybersecurity
and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)’ vide
circular SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2024/184 dated December 31,
2024 and ‘Extension towards Adoption and Implementation of Cybersecurity
and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs)’
vide circular SEBI/HO/ITD-1/ ITD_CSC_EXT/P/ CIR/2025/45 dated March 28,
2025.
2. Based on further discussions with REs, it has been decided to revise the thresholds
and categorization of following REs as contained in this circular. It may be noted
that the category of REs shall be decided at the beginning of the financial year
based on the data of the previous financial year. Once the category of RE is
decided, RE shall remain in the same category throughout the financial year
irrespective of any changes in the parameters during the financial year. The
category shall be validated by the respective reporting authority at the
time of compliance submission. Further, the criteria given and their thresholds
for different categories will continue to be updated as and when required.
2.1. Stock brokers:
2.1.1. Stockbrokers fulfilling any one of the following parameters shall be
classified accordingly (the parameters shall be applied
independently). The higher categorisation shall be made applicable in
case a stockbroker falls into two different categories based on the two
parameters independently.
Table 1: Criteria and thresholds for Stockbroker categorisation
S. Parameters Qualified Mid- Small- Self-
No. REs size size certification
REs REs REs
1. Number of More than More than More than More than
total registered 10 lakhs 1 lakh and 10,000 1,000 and
clients up to 10 and up to up to 10,000
lakhs 1 lakh
Page 2 of 7S. Parameters Qualified Mid- Small- Self-
No. REs size size certification
REs REs REs
2. Clientele More than More than More than More than
trading volume 10, 00,000 1,00,000 10,000 1,000 and
in a year (in and up to and up to up to 10,000
Crores) 10,00,000 1,00,000
2.1.2. Stock Brokers with less than 1,000 crores clientele trading volume (in a
year) and less than 1,000 total registered clients are exempted from
CSCRF.
2.2. Depository Participants (DPs):
It shall be noted that categorisation of DP shall be decided based on the
highest thresholds of below-mentioned classification. For example: if a DP is
registered as both stock broker and Bank, then it will be categorised as
Qualified RE. Further, DPs having clients less than 100 shall be exempted
from the requirement of SOC services or on-boarding to Market-SOC (M-
SOC).
Table 2: Criteria and thresholds for DPs categorisation
S. Regulated DP also Classification for
No Entity registered as CSCRF
1. Stock Broker To be classified as per
the criteria followed for
Depository
stock brokers.
Participant (DP)
2. Other than Stock Qualified RE
Brokers
2.3. Investment Advisers (IAs):
IAs not registered with SEBI in other capacities shall be exempted from
provisions of CSCRF. With respect to IAs registered with SEBI in other
Page 3 of 7capacity, those IAs shall follow the highest among the other category in which
they are registered with SEBI apart from IA.
2.4. Research Analysts (RAs):
RAs not registered with SEBI in any other capacity shall be exempted from
the CSCRF framework. With respect to RAs registered with SEBI in other
capacity, those RAs shall follow the highest among the other category in
which they are registered with SEBI apart from RA.
2.4.1. The reporting authority for IAs and RAs w.r.t. CSCRF compliance shall
be modified from BASL and SEBI respectively to BSE Ltd. for both IAs
and RAs for a period of five years starting from July 25, 2024.
2.5. KYC Registration Agencies (KRAs):
KRAs shall be re-categorised from MIIs to Qualified REs.
2.6. Portfolio Managers:
Categorisation of Portfolio Managers is as per the following table.
Table 3: Criteria and thresholds for Portfolio Managers categorisation
S. Criteria Qualified Mid-size Small- Self-
No. REs REs size REs certification
REs
1. AUM N.A. Above N.A. Rs. 3000
Rs, 3000 Crores and
Crores below
Further, Portfolio Managers who fall under self-certification REs category
and have less than 100 clients shall be exempted from the requirement of
mandatory Market-SOC (M-SOC).
2.7. Alternate Investment Funds (AIFs) and Venture Capital Funds (VCFs):
Categorisation shall be at the manager level instead of AIF level. If the
manager of AIF is also the manager of VCFs, then corpus of VCF schemes
Page 4 of 7managed by the manager shall also be included for determining the
threshold limits. Therefore, criteria and thresholds for AIFs and VCFs
categorisation shall be clubbed together and provided in the single table as
mentioned below:
Table 4: Criteria and thresholds for AIFs and VCFs categorisation
S. Criteria Qualified Mid- Small- Self-
No. REs size size certification
REs REs REs
1. Sum of corpus N.A. Rs. More than Rs. 3000
of all AIFs, 10,000 RS. 3000 Crores and
VCFs, and crores Crores below
their schemes and and less
managed by a above than Rs.
manager 10,000
Crores
Further, managers of AIFs/ VCFs classified as self-certification REs and with
a client base of less than 100 shall be exempted from the mandatory Market-
SOC (M-SOC) requirement.
2.8. Merchant Bankers (MBs):
The Merchant Bankers shall be categorised as per the following table:
Table 5: Criteria and thresholds for MBs categorisation
S. Merchant Banker Category for
No. CSCRF
1. MBs which are engaged in any activity pertaining to issue Mid-size REs
management inter alia Public Issues (IPOs, FPOs, IPOs
by SME), Public Offers by REITs/InvITs, Buy-Back of
Securities, Delisting of Equity Shares, Open Offer under
SEBI (Substantial Acquisition of Shares and Takeovers)
Regulations, 2011
Page 5 of 7S. Merchant Banker Category for
No. CSCRF
2. All other MBs Small-size REs
3. Further, Registrar to an Issue and share Transfer Agents (RTA) having clients less
than 100 shall be exempted from the requirement of employing SOC services or
on-boarding to M-SOC.
4. In case an RE is registered under more than one category of REs, then the
provision of highest category under which such an RE falls shall be applicable to
that RE.
5. W.r.t. ‘Framework for Adoption of Cloud Services by SEBI Regulated Entities
(REs)’ issued vide SEBI circular SEBI/HO/ITD/ITD_VAPT/P/CIR/2023/033 dated
March 06, 2023 (CSCRF: Annexure-J), implementation of a dedicated Hardware
Security Module (HSM) shall be made mandatory for MIIs and Qualified REs (as
per the classification given in CSCRF). However, mid-size REs, small-size REs,
and self-certification REs shall be allowed to implement any alternative of HSM
based on their risk assessment. Such risk assessment shall be approved by the
Board/ Partners/ Proprietor of the RE.
6. Stock Brokers, Depository Participants, KRAs, Portfolio Managers, Investment
Advisers (IAs)/ Research Analysts (RAs), Merchant Bankers (MBs), AIFs/ VCFs
and Registrars to an Issue / Share Transfer Agents shall take necessary action for
implementation of the circular.
7. Stock Portfolio Managers and APMI shall take necessary steps for implementing
the circular, including putting the required processes and systems in place to
ensure compliance with the provisions of this circular.
8. Stock Exchanges/ Depositories are directed to:
8.1. Make necessary amendments to the relevant byelaws, rules and regulations
for the implementation of the above direction and
Page 6 of 78.2. Bring the provisions of this circulars to the notice of their members/ participants
and also disseminate the same on their websites.
9. BSE Limited is directed to:
9.1. Make necessary amendments to the relevant byelaws, rules and regulations
for the implementation of the above direction and
9.2. Bring the provisions of this circulars to the notice of Investment Advisers (IAs)
and Research Analysts (RAs) and disseminate the same on their websites.
10. As already communicated vide SEBI circular SEBI/HO/ITD-1/ ITD_CSC_EXT/P/
CIR/2025/45 dated March 28, 2025, timeline for compliance is June 30, 2025, for
REs covered in the said circular. The cyber audit(s) conducted from the financial
year 2025-26 shall be conducted as per the circular SEBI/HO/ITD-
1/ITD_CSC_EXT/P/CIR/2024/113 dated August 20,2024, read along with the
clarifications issued.
11. This circular is being issued in exercise of powers conferred under Section 11 (1)
of the Securities and Exchange of India Act, 1992, to protect the interests of
investors in securities and to promote the development of, and to regulate the
securities market.
12. This circular is issued with the approval of Competent Authority.
13. This circular is available on SEBI website at www.sebi.gov.in under the category
“Legal” and drop “Circulars”.
भवदीय Yours faithfully,
मृदुस्मिता गोस्वामी Mridusmita Goswami
महाप्रबंधक General Manager
दूिभाष / Phone: 022-26449504
ईमेल / Email: mridusmitag@sebi.gov.in
Page 7 of 7