Executive Summary:
This SEBI circular, effective April 1, 2023, outlines a framework for addressing technical glitches in stock brokers' electronic trading systems. It mandates reporting requirements, capacity planning, software testing protocols, monitoring mechanisms, and business continuity planning. Stock exchanges must implement the provisions and issue compliance guidelines.
Key Points / Main Content:
* **Definition of Technical Glitch:** Any malfunction in a stock broker's systems (hardware, software, networks, etc.) lasting five minutes or more, leading to stoppage, slowing, or variance in normal operations.
* **Reporting Requirements:**
* Stock brokers must immediately inform stock exchanges of any technical glitch, but no later than 1 hour after it occurs.
* A Preliminary Incident Report must be submitted to the exchange within T+1 day (T being the incident date), detailing the incident, its effect, and immediate actions taken.
* A Root Cause Analysis (RCA) Report (as per Annexure I) must be submitted to the stock exchange within 14 days of the incident.
* All reports must be emailed to a common email address.
* Stock exchanges will examine reported glitches and take appropriate action.
* **Capacity Planning:**
* Stock brokers must conduct capacity planning for their entire trading infrastructure.
* Installed capacity must be at least 1.5 times the observed peak load during a calendar quarter.
* Monitoring mechanisms must be deployed to alert when capacity utilization exceeds 70%.
* Specified stock brokers should strive for full redundancy in IT systems related to trading.
* **Software Testing and Change Management:**
* Stock brokers must create test-driven environments for all software and include regression, security, and unit testing.
* Specified stock brokers must conduct software testing in automated environments.
* A traceability matrix between functionalities and unit tests is required.
* A change management process must be implemented for all information security assets.
* Periodic updates of all assets (servers, OS, databases, etc.) are required.
* **Monitoring Mechanism:**
* Stock exchanges shall build API based Logging and Monitoring Mechanism (LAMA).
* Stock exchanges will identify key parameters in consultation with stock brokers to be monitored in real-time or near real-time.
* Stock exchanges shall maintain a dedicated cell for monitoring the key parameters and the technical glitches.
* Logs of key parameters must be preserved for 30 days (2 years if a glitch occurs).
* **Business Continuity Planning (BCP) and Disaster Recovery Site (DRS):**
* Stock brokers with a minimum client base must establish BCP/DR setup.
* A comprehensive BCP/DR policy document is required, with periodic reviews.
* The DRS should preferably be in a different seismic zone or at least 250 km from the Primary Data Centre (PDC).
* Specified stock brokers shall conduct DR drills live trading from DR site for at least 1 full trading day.
* Hardware and software at DRS and PDC should have one-to-one correspondence.
* Recovery Time Objective (RTO) and Recovery Point Objective (RPO) must be defined.
* Specified stock brokers shall obtain ISO certification.
* System Auditors must check BCP/DR preparedness during annual audits.
* **Financial Disincentives:** Stock exchanges will implement financial disincentives for technical glitches and non-compliance.
* **Disclosure:** Stock exchanges will disseminate instances of technical glitches and RCA on their websites.
Impact Analysis:
* **Stock Exchanges:**
* Impact: Must build systems for implementing the circular's provisions, issue compliance guidelines, monitor glitches, implement financial disincentives, and disseminate glitch information.
* Action Required: Develop and implement necessary systems, issue guidelines, and monitor compliance.
* **Stock Brokers:**
* Impact: Must comply with reporting requirements, capacity planning, software testing, change management, monitoring mechanisms, and BCP/DR provisions.
* Action Required: Implement the framework, conduct necessary planning and testing, and report incidents as required.
* **Investors:**
* Impact: Aims to protect their interests by improving the reliability and stability of trading systems.
* Action Required: Be aware of the measures being taken to address technical glitches.
Key Entities Referenced
Securities and Exchange Board of India (SEBI): Regulatory body for the securities market in India, responsible for investor protection and market regulation. The circular is issued under the powers conferred by the SEBI Act, 1992.
Stock Exchanges: Recognized stock exchanges in India that are addressed in the circular and are responsible for implementing the provisions of the circular and issuing guidelines to stock brokers.
Stock Brokers: Registered stock brokers who are members of recognized stock exchanges and are subject to the requirements outlined in the circular regarding technical glitches in their trading systems.
Technical Glitch: Any malfunction in the systems of a stock broker that leads to stoppage, slowing down, or variance in normal functions for a contiguous period of five minutes or more, as defined in the circular.
Root Cause Analysis (RCA) Report: A detailed report required to be submitted by stock brokers to the stock exchange within 14 days of a technical glitch, outlining the cause, impact, and corrective/preventive measures.
Business Continuity Planning (BCP): A plan to ensure that a business can continue operating in the event of a disaster. The circular mandates stock brokers to establish a BCP/DR setup.
Disaster Recovery Site (DRS): A secondary site where a stock broker can shift operations in the event of a disaster affecting the primary data center. The circular outlines requirements for the DRS setup and testing.
API based Logging and Monitoring Mechanism (LAMA): A mechanism to be operated between stock exchanges and specified stock brokers trading systems for monitoring key systems functional parameters to ensure that their trading systems function in a smooth manner.
CIRCULAR
SEBI/HO/MIRSD/TPD-1/P/CIR/2022/160 November 25, 2022
To
All recognized Stock Exchanges
All Registered Stock Brokers through Recognized Stock Exchanges
Dear Sir/ Madam,
Sub:- Framework to address the ‘technical glitches’ in Stock Brokers’ Electronic
Trading Systems
1. Rapid technological developments have increased the ease of electronic
trading in securities markets. Technology related interruptions and glitches
(technical glitches) and their impact on the investors’ opportunity to trade
constitutes major technology related risk. Considering the growing number of
such incidents, SEBI constituted a working group to recommend suitable
measures to address the issue. Based on the recommendations of working
group and views obtained from stakeholders & industry experts, it has been
decided to put in place the following framework to deal with technical glitches
occurring in the trading systems of stock brokers.
2. Definition of Technical Glitch:
2.1 Technical glitch shall mean any malfunction in the systems of stock broker
including malfunction in its hardware, software, networks, processes or any
products or services provided by the stock broker in the electronic form. The
malfunction can be on account of inadequate Infrastructure / systems, cyber-
attacks / incidents, procedural errors and omissions, or process failures or
otherwise, in their own systems or the one outsourced from any third parties,
which may lead to either stoppage, slowing down or variance in the normal
functions / operations / services of systems of the stock broker for a
contiguous period of five minutes or more.
Page 1 of 83. Reporting Requirements:
3.1 Stock brokers shall inform about the technical glitch to the stock exchanges
immediately but not later than 1 hour from the time of occurrence of the
glitch.
3.2 Stock brokers shall submit a Preliminary Incident Report to the Exchange
within T+1 day of the incident (T being the date of the incident). The report
shall include the date and time of the incident, the details of the incident,
effect of the incident and the immediate action taken to rectify the problem.
3.3 Stock brokers shall submit a Root Cause Analysis (RCA) Report (as per
Annexure I) of the technical glitch to stock exchange, within 14 days from
the date of the incident.
3.4 RCA report submitted by the stock brokers shall, inter-alia, include time of
incident, cause of the technical glitch (including root cause from vendor(s),
if applicable), duration, chronology of events, impact analysis and details of
corrective/ preventive measures taken (or to be taken), restoration of
operations etc.
3.5 Stock brokers shall submit information stated in para 3.1, 3.2 and 3.3 above,
by e-mail at infotechglitch@nse.co.in, a common email address for reporting
across all stock exchanges.
3.6 All technical glitches reported by stock brokers as well as independently
monitored by stock exchanges, shall be examined collectively by the stock
exchanges along with the report/RCA and appropriate action shall be taken.
4. Capacity Planning:
4.1 Increasing number of investors may create additional burden on the trading
system of the stock broker and hence, adequate capacity planning is
prerequisite for stock brokers to provide continuity of services to their clients.
Stock brokers shall do capacity planning for entire trading infrastructure i.e.
Page 2 of 8server capacities, network availability, and the serving capacity of trading
applications.
4.2 Stock brokers shall monitor peak load in their trading applications, servers
and network architecture. The Peak load shall be determined on the basis of
highest peak load observed by the stock broker during a calendar quarter.
The installed capacity shall be at least 1.5 times (1.5x) of the observed peak
load.
4.3 Stock brokers shall deploy adequate monitoring mechanisms within their
networks and systems to get timely alerts on current utilization of capacity
going beyond permissible limit of 70% of its installed capacity.
4.4 To ensure the continuity of services at the primary data center, stock brokers
as may be specified from time to time by stock exchange (hereafter referred
to as specified stock brokers) shall strive to achieve full redundancy in their
IT systems that are related to trading applications and trading related
services.
4.5 Stock exchanges shall issue detailed guidelines with regard to frequency of
capacity planning to review available capacity, peak load, and new capacity
required to tackle future load on the system.
5. Software testing and change management
5.1 Software applications are prone to updates/changes and hence, it is
imperative for the stock brokers to ensure that all software changes that are
taking place in their applications are rigorously tested before they are used
in production systems. Software changes could impact the functioning of the
software if adequate testing is not carried out. In view of this, stock brokers
shall adopt the following framework for carrying out software related changes
/ testing in their systems:
5.2 Stock brokers shall create test driven environments for all types of software
developed by them or their vendors. Regression testing, security testing and
Page 3 of 8unit testing shall be included in the software development, deployment and
operations practices.
5.3 Specified stock brokers shall do their software testing in automated
environments.
5.4 Stock Brokers shall prepare a traceability matrix between functionalities and
unit tests, while developing any software that is used in trading activities.
5.5 Stock brokers shall implement a change management process to avoid any
risk arising due to unplanned and unauthorized changes for all its information
security assets (hardware, software, network, etc.).
5.6 Stock brokers shall periodically update all their assets including Servers, OS,
databases, middleware, network devices, firewalls, IDS /IPS desktops etc.
with latest applicable versions and patches.
5.7 Stock exchanges shall issue detailed guidelines with regard to testing of
software, testing in automated environments, traceability matrix, change
management process and periodic updation of assets etc.
6. Monitoring mechanism:
6.1 Proactively and independently monitoring technical glitches shall be one of
the approaches in mitigating the impact of such glitches. In this context, the
stock exchange shall build API based Logging and Monitoring Mechanism
(LAMA) to be operated between stock exchanges and specified stock
brokers’ trading systems. Under this mechanism, specified stock brokers
shall monitor key systems & functional parameters to ensure that their
trading systems function in a smooth manner. Stock exchanges shall,
through the API gateway, independently monitor these key parameters to
gauge the health of the trading systems of the specified stock brokers.
Page 4 of 86.2 Stock Exchanges shall identify the key parameters in consultation with stock
brokers. These key parameters shall be monitored by specified stock brokers
and by stock exchanges, on a real time or on a near real time basis.
6.3 Stock exchanges shall maintain a dedicated cell for monitoring the key
parameters and the technical glitches occurring in stock brokers’ trading
systems. The cell also shall intimate the specified stock broker concerned
immediately about the breach of the key parameters monitored under LAMA.
6.4 Stock brokers and stock exchanges shall preserve the logs of the key
parameters for a period of 30 days in normal course. However, if a technical
glitch takes place, the data related to the glitch, shall be maintained for a
period of 2 years.
7. Business Continuity Planning (BCP) and Disaster Recovery Site (DRS):
7.1 Stock brokers with a minimum client base across the exchanges, as may be
specified by stock exchanges from time to time, shall mandatorily establish
business continuity/DR set up.
7.2 Stock brokers shall put in place a comprehensive BCP-DR policy document
outlining standard operating procedures to be followed in the event of any
disaster. A suitable framework shall be put in place to constantly monitor
health and performance of critical systems in the normal course of business.
The BCP-DR policy document shall be periodically reviewed to minimize
incidents affecting the business continuity.
7.3 The DRS shall preferably be set up in different seismic zones. In case, due
to any reasons like operational constraints, such a geographic separation is
not possible, then the Primary Data Centre (PDC) and DRS shall be
separated from each other by a distance of at least 250 kilometers to ensure
that both of them do not get affected by the same natural disaster. The DR
site shall be made accessible from primary data center to ensure syncing of
data across two sites.
Page 5 of 87.4 Specified stock brokers shall conduct DR drills / live trading from DR site.
DR drills / live trading shall include running all operations from DRS for at
least 1 full trading day. Stock exchanges in consultation with specified stock
brokers shall decide the frequency of DR drill / live trading from DR site.
7.5 Stock brokers, shall constitute responsible teams for taking decisions about
shifting of operations from primary site to DR site, putting adequate
resources at DR site, and setting up mechanism to make DR site operational
from primary data center etc.
7.6 Hardware, system software, application environment, network and security
devices and associated application environments of DRS and PDC shall
have one-to-one correspondence between them. Adequate resources shall
be made available at all times to handle operations at PDC or DRS.
7.7 Stock exchanges in consultation with stock brokers shall decide upon
Recovery Time Objective (RTO) i.e. the maximum time taken to restore
operations from DRS after declaration of Disaster and, Recovery Point
Objective (RPO) i.e. the maximum tolerable period for which data might be
lost due to a major incident.
7.8 Replication architecture, bandwidth and load consideration between the DRS
and PDC shall be within stipulated RTO and the whole system shall ensure
high availability, right sizing, and no single point of failure. Any updates made
at the PDC shall be reflected at DRS immediately.
7.9 Specified stock brokers shall obtain ISO certification as may be specified by
stock exchanges from time to time in the area of IT and IT enabled
infrastructure/processes of the stock brokers.
7.10 The System Auditor, while covering the BCP – DR as a part of mandated
annual System Audit, shall check the preparedness of the stock broker to
shift its operations from PDC to DRS and also comment on documented
results and observations on DR drills conducted by the stock brokers.
Page 6 of 87.11 Stock exchanges shall define the term ‘critical systems’, ‘disaster’ and
issue detailed guidelines with regard to review of BCP document, DR drill/live
trading, operating DR site from PDC, timeline for obtaining ISO certification
etc.
8. Stock exchanges shall put in place a structure of financial disincentives
applicable to stock brokers for technical glitches occurring in their trading
systems and non-compliance of the provisions made in this regard.
9. Stock exchanges shall disseminate on their websites the instances of Technical
glitches occurred in the trading system of stock brokers along with Root Cause
Analysis (RCA) on such glitches.
10. Stock exchanges shall build necessary systems for implementation of the
provisions of this circular and issue appropriate guidelines to the stock brokers
for compliance with the provisions of this circular.
11. This circular is being issued in exercise of powers conferred under Section 11
(1) of the Securities and Exchange Board of India Act, 1992 to protect the
interests of investors in securities and to promote the development of, and to
regulate the securities market.
12. This circular is available on SEBI website at www.sebi.gov.in under the
categories “Legal Framework” and “Circulars”.
13. This circular shall come into effect from April 01, 2023.
Yours faithfully,
Vishal M Padole
Deputy General Manager
MIRSD
Tel. No: 022 26449247
Email ID: vishalp@sebi.gov.in
Page 7 of 8Annexure I
Root Cause Analysis Form/ RCA
1. Letter / Report Subject :-
Name of the stock Broker:
Exchange Name and Code:
SEBI Registration number:
2. Designated Officer and/or Reporting Officer details
Name: E-mail:
Mobile:
Date:
3. Date & Time of Incident & Duration of the
Incident Time:
Duration:
4. Incident Description & chronology of
events (please use additional sheets if Brief information on the incident
required) observed
5. Business Impact
6. Immediate action taken (please give full
details) (Please use additional sheets if
required)
Date:
7. Date & Time of Recovery
Time:
8. Root Cause Summary (Pl attach the
detailed Report separately)
9. Details of corrective measures taken
10. Details of long-term preventive
measures taken (please give full details)
(please use additional sheets if required)
Page 8 of 8