**Summary:**
This circular, reference number SEBI/HO/ITD1/ITD/CSC/EXT/P/CIR/2025/45, issued by the Securities and Exchange Board of India (SEBI) on March 28, 2025, addresses the extension of compliance timelines for the adoption and implementation of the Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs).
Building upon the initial framework established in circular SEBI/HO/ITD1/ITD/CSC/EXT/P/CIR/2024/113 dated August 20, 2024, and subsequent clarifications issued via circular SEBI/HO/ITD1/ITD/CSC/EXT/P/CIR/2024/184 dated December 31, 2024, this circular grants a three-month extension, until June 30, 2025, for all REs to comply with the CSCRF. This extension excludes Market Infrastructure Institutions (MIIs), KYC Registration Agencies (KRAs), and Qualified Registrars to an Issue and Share Transfer Agents (QRTAs).
Stock Exchanges and Depositories are directed to notify their members and participants of this circular's provisions and disseminate the information on their websites.
The circular takes effect immediately and is issued under Section 11(1) of the Securities and Exchange Board of India Act, 1992. The complete circular is available on the SEBI website (www.sebi.gov.in) under the "Legal" section, specifically within "Circulars."
For further information, Shweta Banerjee, General Manager, can be contacted at 022-26449509 or via email at shweta.s@sebi.gov.in.
Key Entities Referenced
Association of Portfolio Managers in India APMI: An association of portfolio managers in India
Securities and Exchange Board of India SEBI: The regulatory body issuing the circular.
Cybersecurity and Cyber Resilience Framework CSCRF: A framework established by SEBI for regulated entities.
SEBI Regulated Entities REs: Entities regulated by SEBI that are subject to the CSCRF.
Market Infrastructure Institutions MIIs: Entities that operate critical infrastructure in the securities market and have separate compliance timelines.
KYC Registration Agencies KRAs: Agencies involved in KYC registration with separate compliance timelines.
Qualified Registrars to an Issue and Share Transfer Agents QRTAs: Registrars and share transfer agents who qualify for separate compliance timelines.
Securities and Exchange of India Act, 1992: The act under which the circular is issued, granting SEBI its powers.
परिपत्र / CIRCULAR
SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2025/45 March 28, 2025
To,
All Alternative Investment Funds (AIFs)
All Bankers to an Issue (BTI) and Self-Certified Syndicate Banks (SCSBs)
All Collective Investment Schemes (CIS)
All Credit Rating Agencies (CRAs)
All Custodians
All Debenture Trustees (DTs)
All Depositories
All Designated Depository Participants (DDPs)
All Depository Participants through Depositories
All Investment Advisors (IAs) / Research Analysts (RAs)
All KYC Registration Agencies (KRAs)
All Merchant Bankers (MBs)
All Mutual Funds (MFs)/ Asset Management Companies (AMCs)
All Portfolio Managers
Association of Portfolio Managers in India (APMI)
All Registrar to an Issue and Share Transfer Agents (RTAs)
All Stock Brokers through Exchanges
All Stock Exchanges
All Venture Capital Funds (VCFs)
Page 1 of 3Dear Sir / Madam,
Subject: Extension towards Adoption and Implementation of Cybersecurity
and Cyber Resilience Framework (CSCRF) for SEBI Regulated
Entities (REs)
1. Recognising the need for robust cybersecurity measures and protection of data
and IT infrastructure, Securities and Exchange Board of India (SEBI) has issued
‘Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated
Entities (REs)’ vide circular SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2024/113
dated August 20, 2024. Upon receipt of various queries from REs seeking
clarification on the aforementioned circular, SEBI has also issued ‘Clarifications to
Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated
Entities (REs)’ vide circular SEBI/HO/ ITD-1/ITD_CSC_EXT/P/CIR/2024/184
dated December 31, 2024.
2. SEBI had received multiple requests for CSCRF compliance timelines extension
to ensure ease of compliance for them. Therefore, it has been decided to extend
the compliance timelines by three (3) months, i.e., till June 30, 2025 to all REs,
except Market Infrastructure Institutions (MIIs), KYC Registration Agencies
(KRAs), and Qualified Registrars to an Issue and Share Transfer Agents (QRTAs).
3. Stock Exchanges/ Depositories are directed to:
3.1. Bring the provisions of this circulars to the notice of their members/ participants
and also disseminate the same on their websites.
4. The provisions of this Circular shall come into force with immediate effect.
5. This circular is being issued in exercise of powers conferred under Section 11 (1)
of the Securities and Exchange of India Act, 1992, to protect the interests of
investors in securities and to promote the development of, and to regulate the
securities market.
6. This circular is issued with the approval of Competent Authority.
Page 2 of 37. This circular is available on SEBI website at www.sebi.gov.in under the category
“Legal” and drop “Circulars”.
भवदीय Yours faithfully,
श्वेता बनर्जी Shweta Banerjee
महाप्रबंधक General Manager
दूिभाष्/ Phone: 022-26449509
ईमेल / Email: shwetas@sebi.gov.in
Page 3 of 3