Master Circular for recognised Stock Exchanges and recognised Clearing Corporations

MASTER CIRCULAR IFSCA/CMD/MIIT/MCSECC/2026-27 June 05, 2026 To, All the recognised Stock Exchanges in the International Financial Services Centres (IFSC) All the recognised Clearing Corporations in the IFSC All the recognised Depositories in IFSC All Broker Dealers and Clearing Members in the IFSC Madam/Sir,

Subject: Master Circular for recognised Stock Exchanges and recognised Clearing Corporations

1. Reference may be drawn to the International Financial Services Centres Authority (Market Infrastructure Institutions) Regulations, 2021 [hereinafter called as “MII Regulations”] amended subsequently vide International Financial Services Centres Authority (Market Infrastructure Institutions) (Amendment) Regulation, 2024, which provides for a unified framework for the regulation and supervision of the Market Infrastructure Institutions in the IFSC.

2. Attention may further be drawn to regulation 73 (5) of the MII Regulations, which

states as under:– “The circulars and guidelines issued by SEBI and applicable to a market infrastructure institution in an IFSC shall continue to be in force unless and until they are superseded by any regulations or circulars or guidelines by the Authority.” IFSCA - Master circular on Stock Exchanges & Clearing Corporations 1 | Page3. The International Financial Services Centres Authority (‘Authority’/‘IFSCA’), being satisfied that it is necessary and expedient for ease of doing business and for overall development of the IFSC ecosystem, hereby consolidates all the circulars pertaining to recognised Stock Exchange (Stock Exchange) and recognised Clearing Corporation (Clearing Corporation) and issues this Master Circular.

4. (i) On and from the date of commencement of this Master Circular, the following circulars, to the extent they pertain to recognised Stock Exchanges and recognised Clearing Corporations (hereinafter collectively referred to as “MIIs”) issued by the Authority, shall stand superseded:

Sr.

Date Circular No. Subject No.

Fee structure for Market April 13, F. No. 286/IFSCA/Policy 1 Infrastructure Institutions 2021 Matters (CMD-DMIIT)/2021

(MIIs) and Participants F. No. 286/IFSCA/PM (CMD- Introduction of Negotiated June 22, 2 DMIIT)/2021 /2 Large Trade facility on Stock 2021 Exchanges Status of transactions executed June 22, F. No. 257/IFSCA/CMD- 3 at Disaster Recovery site of 2021 DMIIT/BCP-DR/2021/1 MIIs F. No. 286/IFSCA/CMD-DMIIT/ Code of Conduct and Code of September 4 PM/ 2021 Ethics for Directors and KMPs 13, 2021 of MIIs Application form for September F. No. 286/IFSCA/CMD- 5 recognition and renewal of 20, 2021 DMIIT/PM-MII/2021/1 MIIs Clarification regarding disclosure of dealing in November 286/IFSCA/ CMD- securities by Directors and Key 6 30, 2021 DMIIT/PM/2021/001 Management Personnel of the all recognized MIIs in GIFT- IFSC March 11, F. No. 286/IFSCA/PM(CMD- Negotiated large trade facility 7 2022 DMIIT)/2 on Stock Exchanges F. No. 286/IFSCA/PM (CMD Guidelines for Liquidity March 31, 8 - DMIIT)/2021/4 Enhancement Scheme on 2022 Stock Exchanges June 28, IFSCA/CMD/DMIIT/MII/CG/2 9 Committees at MIIs in IFSC 2022 022-23/1 Amendment to guidelines for September IFSCA/CMD- 10 Liquidity Enhancement 09, 2022 DMIIT/LES/2022/005 Scheme Guidelines for Business November IFSCA/CMD- 11 Continuity Plan and Disaster 16, 2022 DMIIT/DR/774/2022/01 Recovery for MIIs IFSCA - Master circular on Stock Exchanges & Clearing Corporations 2 | PageSr.

Date Circular No. Subject No.

IFSCA/CMD- June 21, 12 DMIIT/EXCHTRD/2023- Direct Market Access facility 2023 24/001 IFSCA/CMD- June 23, Co-location facility offered by 13 DMIIT/EXCHTRD/2023- 2023 the Stock Exchanges 24/002 March 07, IFSCA/CMD-MIIT/RTP/2024- Contribution to Settlement 14 2025 25/001 Guarantee Fund (SGF) Governing Board of the Market October 13, IFSCA/CMD-DMIIT/PID- 15 Infrastructure Institutions 2025 MII/2025-26/001

(MIIs)

(ii) On and from the commencement of this Master Circular, all the circulars and guidelines issued by Securities and Exchange Board of India (“SEBI”) prior to October 01, 2020, in respect of recognised Stock Exchanges and recognised Clearing Corporations, shall stand superseded.

(iii) Notwithstanding such supersession specified in clause(s) (i) and (ii) above: a) anything done or any action taken or purported to have been done or taken under the superseded circulars, prior to such supersession, shall be deemed to have been done or taken under the corresponding provisions of this Master Circular; and b) any application made to the Authority under the any of the superseded

circular(s), prior to such supersession, shall be deemed to have been made under the corresponding provisions of this Master Circular;

5. This Master Circular is being issued in exercise of powers conferred by Sections 12 and 13 of the International Financial Services Centres Authority Act, 2019, read with regulation 72 of the MII Regulations and regulation 45 of the IFSCA (Capital Market Intermediaries) Regulations, 2025, and shall come into force from the date of its issuance.

6. The Stock Exchanges and Clearing Corporations shall ensure that its Key Management Personnel, other officers responsible for compliance and the relevant committees including the Regulatory Oversight Committee acclimatise themselves with the provisions of this circular.

7. This master circular is primarily applicable to Stock Exchanges and Clearing Corporations. However, all Broker Dealers, Clearing Members and Depository are also required to ensure compliance with the respective directions and obligations IFSCA - Master circular on Stock Exchanges & Clearing Corporations 3 | Page(as applicable) contained herein. Broker Dealers, Clearing Members and Depository may also refer to specific master circulars/circulars issued or to be issued, for additional regulatory compliance/guidance.

A copy of this circular is available on the website of the International Financial Services Centres Authority at www.ifsca.gov.in Yours faithfully, Praveen Kamat Chief General Manager Division of Market Infrastructure Institutions & Technology Capital Markets Department

Email : praveen.kamat@ifsca.gov.in

Tel: +91-079-61809820 IFSCA - Master circular on Stock Exchanges & Clearing Corporations 4 | PageTable of Contents MASTER CIRCULAR ............................................................................................................... 1

CHAPTER - I: RECOGNITION PROCESS .................................................................................. 7

1. APPLICATION FOR RECOGNITION ......................................................................... 7

2. PAYMENT OF FEES ................................................................................................. 7

3. VALIDITY OF REGISTRATION ................................................................................ 7

CHAPTER - II: TRADING ........................................................................................................ 8

4. NEGOTIATED LARGE TRADE (NLT) ....................................................................... 8

5. SEGREGATED NOMINEE ACCOUNT STRUCTURE ................................................... 9

6. ELIGIBLE FOREIGN INVESTORS (EFIs) ................................................................ 11

7. CIRCUIT BREAKER/ PRICE BANDS ...................................................................... 11

8. MARGIN TRADING ............................................................................................... 12

9. MARKET MAKER / LIQUIDITY ENHANCER ......................................................... 12

10. LIQUIDITY ENHANCEMENT SCHEME .................................................................. 13

11. PROPRIETARY TRADING ..................................................................................... 13

12. TIME STAMPING OF ORDERS .............................................................................. 13

13. UNIQUE CLIENT CODE ......................................................................................... 14

14. TRANSACTION CHARGES BY THE STOCK EXCHANGES ........................................ 16

15. CALL AUCTION IN PRE-OPEN SESSION AND PRE-CLOSE SESSION ....................... 17

16. POLICY FOR ANNULMENT OF TRADES UNDERTAKEN ON STOCK EXCHANGES ... 17

CHAPTER - III: TRADING SOFTWARE AND TECHNOLOGY .................................................. 18

17. INTERNET BASED TRADING ............................................................................... 18

18. Direct Market Access .......................................................................................... 21

19. TRADING TERMINALS ......................................................................................... 26

20. SYSTEM AUDIT .................................................................................................... 31

21. BUSINESS CONTINUITY PLAN AND DISASTER RECOVERY .................................. 32

22. STANDARD OPERATING PROCEDURE FOR HANDLING OF TECHNICAL GLITCHES 36

23. CO-LOCATION / PROXIMITY HOSTING ................................................................ 37

24. CAPACITY PLANNING .......................................................................................... 41

25. DATA FEED .......................................................................................................... 41

26. ELECTRONIC CONTRACT NOTE ........................................................................... 42

CHAPTER-IV – SETTLEMENT .............................................................................................. 43

27. ACTIVITY SCHEDULE .......................................................................................... 43 IFSCA - Master circular on Stock Exchanges & Clearing Corporations 5 | Page28. CLOSE-OUT AND AUCTION .................................................................................. 44

29. SETTLEMENT GUARANTEE FUND (SGF) ............................................................. 44

CHAPTER – V: PRODUCT SPECIFICATIONS AND RISK MANAGEMENT FRAMEWORK ......... 46

30. DERIVATIVE CONTRACTS ON STOCK EXCHANGES IN GIFT-IFSC .......................... 46

31. TRADING HOURS................................................................................................. 46

32. RISK MANAGEMENT ............................................................................................ 46

33. SURVEILLANCE AND DISCLOSURES ..................................................................... 47

CHAPTER – VI: ADMINISTRATION OF STOCK EXCHANGES AND CLEARING CORPORATIONS ........................................................................................................................................... 50

34. GOVERNANCE ...................................................................................................... 50

35. PROCEDURE FOR APPOINTMENT OF DIRECTORS .............................................. 50

36. APPOINTMENT PROCESS OF A PID ..................................................................... 51

37. REAPPOINTMENT OF A PID ................................................................................ 52

38. PERFORMANCE REVIEW OF PIDS ....................................................................... 53

39. KNOWLEDGE UPGRADATION OF PIDs ................................................................ 53

40. APPOINTMENT OF MANAGING DIRECTOR .......................................................... 53

41. STATUTORY COMMITTEES .................................................................................. 54

CHAPTER - VII: PERIODIC REPORTING............................................................................... 67

42. MONTHLY ACTIVITY REPORTS / MONTHLY DEVELOPMENT REPORTS .............. 67

43. REPORTING REQUIREMENTS SPECIFIED IN THE MII REGULATIONS .................. 67

44. SYSTEM AUDIT REPORT ...................................................................................... 67 IFSCA - Master circular on Stock Exchanges & Clearing Corporations 6 | PageCHAPTER - I: RECOGNITION PROCESS

1. APPLICATION FOR RECOGNITION

1.1. An application seeking recognition or renewal of recognition as a recognised Stock Exchange shall be submitted to the Authority in Form A as prescribed in

rule 3 of the Securities Contracts (Regulation Rules) 1957 (SCRR) and an application for recognition of renewal of recognition as recognised Clearing Corporation shall be submitted to the Authority as per the format specified in the Annexure-I of this master circular.

2. PAYMENT OF FEES

2.1. An applicant desirous of obtaining recognition/renewal of recognition as a recognised Stock Exchange shall pay the application and recognition / renewal of recognition fee as prescribed in the rule in the 4 and 7 of the SCRR.

2.2. An applicant desirous of obtaining recognition/renewal of recognition as a recognised Clearing Corporation shall pay the application fee and recognition / renewal fee in form and manner as specified in the circular on “Fee structure for the entities undertaking or intending to undertake permissible activities in IFSC or persons seeking guidance under the Informal Guidance Scheme” (“IFSCA Fee Circular”) dated March 02, 2026, read with circular titled “Corrigendum to the Fee Circular dated March 02, 2026”” dated March 13, 2026, at the time of making an application to the Authority.

3. VALIDITY OF REGISTRATION

3.1. The period of recognition granted to an MII shall be permanent or for such period not less than one year as may be specified by the Authority. The MII shall apply for renewal of recognition, in advance, at least three months prior to the expiry of the recognition.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 7 | PageCHAPTER - II: TRADING

4. NEGOTIATED LARGE TRADE (NLT)

4.1. The NLT Window shall remain open throughout the normal trading hours of the Stock Exchanges.

4.2. In respect of derivative products made available for trading through a Connect arrangement with international exchange(s), the price limits may be aligned with those prevailing on such international exchange(s). For all other derivate products, the Stock Exchange shall determine appropriate price limits, ensuring that such limits are fair, reasonable and consistent with market integrity.

4.3. The minimum order size for execution of trades, expressed in notional value, shall be USD 1 million.

Provided that in the case of single stock derivatives, the minimum order size shall be not less than ten times the notional value of the specified market lot.

4.4. Transactions executed in the NLT window shall be excluded from the computation of the daily Open, High, Low, Close, Volume-Weighted Average Price (VWAP) or Daily Settlement Price or the Final Settlement Price of the relevant derivatives contract.

4.5. NLT trades executed on behalf of clients shall not be matched against the proprietary account of the Broker Dealer. Broker Dealers shall execute such trades only upon obtaining prior explicit written consent from their respective clients.

4.6. The position limits applicable to the normal market segment shall apply mutatis mutandis to positions undertaken in the NLT window.

4.7. The Stock Exchange shall ensure that all applicable trading, clearing, settlement, surveillance and risk containment frameworks governing the normal market segment are duly extended to and effectively implemented for the NLT window.

4.8. The Stock Exchange shall disseminate details of the NLT trades to the public on the same day, after the close of market hours.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 8 | Page5. SEGREGATED NOMINEE ACCOUNT STRUCTURE

5.1. With a view to facilitating ease of market access for foreign investors in IFSC, a Segregated Nominee Account Structure is permitted, whereby orders of foreign investors may be routed through eligible Segregated Nominee Account Providers (hereinafter referred to as “Providers”), for trading on the Stock Exchanges in IFSC, subject to compliance with regulatory requirements, including, inter alia, identification of end-client, Unique Client Code, client level order placement, client level margining and adherence to position limits.

5.2. The Stock Exchanges, Broker Dealers and Providers shall furnish to the Authority, as and when required, such information as may be specified, including, inter alia, details of trades executed on Stock Exchanges in the IFSC originating from or routed through Providers, along with the KYC details of their end-clients.

5.3. Stock Exchanges in IFSC shall ensure that the provisions of Prevention of Money Laundering Act, 2002 (PMLA), Prevention of Money-Laundering (Maintenance of Records) Rules, 2005, IFSCA (Anti Money Laundering, Counter-Terrorist Financing and Know Your Customer) Guidelines, 2022, including those relating to capturing the KYC information for sharing with the Central KYC Registry (CKYCR) or KYC Registration Agency (as applicable) are adhered to by Providers for their end-clients.

5.4. The broad features of the Segregated Nominee Account Structure are as

under:

5.4.1. Entities eligible to offer Segregated Nominee Account Structure

5.4.1.1. IFSCA registered Broker Dealers in the IFSC;

5.4.1.2. FPIs registered in India with SEBI;

5.4.1.3. Regulated Broker Dealers / Clearing Members from a Financial Action Task Force (FATF) member country

Explanation. - Such eligible entities shall be called Segregated Nominee Account Providers.

5.4.2. Registration of a Provider

5.4.2.1. The Providers shall be registered with the MII for providing Segregated Nominee Account services to their end-clients.

5.4.3. Eligibility criteria/norms for Providers IFSCA - Master circular on Stock Exchanges & Clearing Corporations 9 | Page5.4.3.1. The Stock Exchanges shall specify the eligibility criteria and norms for Providers, including a minimum net worth, which shall not be lower than that specified by other leading Stock Exchanges offering comparable structures. The conditions for registration shall, inter alia, include provisions enabling the Stock Exchange to obtain information relating to the end-clients of Providers, as and when required.

5.4.4. KYC of end-clients

5.4.4.1. The Providers shall undertake appropriate due diligence of end- clients in accordance with globally accepted standards including applicable KYC and AML requirements before onboarding clients for the purpose of offering Segregated Nominee Accounts.

5.4.4.2. An end-client shall maintain a Segregated Nominee Account with only one Provider. The Legal Entity Identifier (LEI) may be utilized to ensure that the end-client does not maintain multiple such accounts across Providers and that all trades of an end-client are cleared and settled through a single clearing member.

5.4.4.3. Each end-client shall be assigned a Unique Client Code (UCC), by MII in IFSC, which shall be unique across all end-clients of all Providers.

5.4.5. Order Entry

5.4.5.1. Unique Client Code shall be used at the time of order entry by the Providers for their end-clients.

5.4.6. Margin Computation

5.4.6.1. Margins shall be computed at the end-client level of Provider.

5.4.6.2. Margins shall be grossed up at and collected from Provider.

5.4.6.3. Margin reporting shall be at the level of the Provider.

5.4.7. Margin Collection

5.4.7.1. Margin shall be payable by the end-client to the Provider.

However, the margins may be funded by the Provider based on clearly defined bilateral agreement between Provider and the end- client.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 10 | Page5.4.7.2. The Stock Exchanges shall ensure that commercial terms and documentation / agreement entered into between Provider and the end-client contains the clause regarding the aforesaid arrangement.

5.4.8. Monitoring of Position Limits

5.4.8.1. The Position limits shall be monitored at end-client level by the Stock Exchanges/ Clearing Corporations.

5.4.9. Other Risk Management Framework

5.4.9.1. All other risk management provisions applicable in the IFSC shall apply mutatis mutandis to the end-clients of Providers, unless otherwise specified.

6. ELIGIBLE FOREIGN INVESTORS (EFIs)

6.1. Non-residents/foreign investors (including Remote Trading Participants) onboarded by Broker Dealers / Clearing Members and eligible for trading on Stock Exchanges in IFSC, shall be considered as Eligible Foreign Investors.1

6.2. All Broker Dealers registered with IFSCA shall adhere to the provisions of the IFSCA (Anti Money Laundering, Counter-Terrorist Financing and Know Your Customer) Guidelines, 2022 regarding KYC and Customer Due-Diligence.

6.3. Stock Exchanges in IFSC shall maintain, at all times, the necessary details of EFIs which may be called upon by the Authority.

7. CIRCUIT BREAKER/ PRICE BANDS

7.1. The Stock Exchanges shall have the operational flexibility to specify guidelines governing circuit breakers and price bands.

7.2. Such guidelines shall, inter-alia specify the trigger mechanisms for circuit breakers, duration of trading halts and the conditions and procedures for resumption of trading following such halts.

1 This Master Circular supersedes the SEBI circular dated January 04, 2017, pertaining to Eligible Foreign Investors. Therefore, any reference to this superseded circular in any notification (including the CBDT’s

notification no. 1057 (E) dated March 13, 2020), regulation or guidelines, shall be construed as a reference to this Master Circular.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 11 | Page8. MARGIN TRADING

8.1. The Broker Dealers may provide margin trading facility to their clients.

8.2. Broker Dealers shall adhere to framework for margin trading as specified by the Stock Exchange.

8.3. Such framework shall be developed by the Stock Exchange in coordination with other Stock Exchanges and the framework for margin trading shall inter alia

include the following: a) Securities eligible for margin trading; b) Margin requirement for availing margin trading facility; c) Eligibility requirement for Broker Dealers to provide margin trading facility to its clients;

d) Sources of funds for the Broker Dealers to provide margin trading facility; e) Leverage and exposure limits for Broker Dealers; f) Disclosure requirements; g) Rights and obligations of the Broker Dealer and client;

h) Record maintenance requirements by the Broker Dealers with respect to Margin Trading.

9. MARKET MAKER / LIQUIDITY ENHANCER

9.1. The Stock Exchange shall specify the guidelines for the purposes of monitoring and effective operations of the market makers (liquidity enhancers, liquidity providers, maker-taker or by whatever name called). Such Guidelines shall inter

alia include the following: i. Criterion for selection of scrips for market making; ii. Number of market makers for each share; iii. Number of shares for market maker; iv. Eligibility criteria for an entity to be market maker;

v. Rights, Obligations and responsibilities of market marker; vi. De-registration of market makers (Voluntarily or Compulsory); vii. Capital adequacy requirements for market makers.

9.2. All market maker / liquidity enhancer orders / trades should be identifiable by the Stock Exchange.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 12 | Page10. LIQUIDITY ENHANCEMENT SCHEME The Stock Exchange may introduce liquidity enhancement schemes in any security/ listed products subject to the policy approved by their Governing Board.

11. PROPRIETARY TRADING

11.1. Disclosure of Proprietary trading by Broker Dealer to Client

11.1.1. The Broker-Dealer shall furnish each prospective client with a mandatory written disclosure explicitly stating whether the firm engages in proprietary trading activities. Such disclosure shall be provided and duly acknowledged by the client prior to the opening of any account, with the objective of ensuring transparency and mitigating potential conflicts of interest.

11.1.2. In those cases where a Broker Dealer is not indulging in proprietary trading, but plans to transition to proprietary trading, a formal written

notification by email shall be communicated to all existing clients prior to commencement of proprietary trading.

11.2. Proprietary account trading terminal

11.2.1. Under no circumstances shall a trade executed under a proprietary account be transferred, re-allocated or assigned to a client account, post execution.

12. TIME STAMPING OF ORDERS

12.1. Broker Dealers shall maintain an immutable electronic audit trail of all client orders. Every Contract Note issued shall, inter alia, contain the

following:

12.1.1. a synchronized timestamp for the precise moment of order receipt

12.1.2. the exact timestamp of order execution IFSCA - Master circular on Stock Exchanges & Clearing Corporations 13 | Page13. UNIQUE CLIENT CODE

13.1. Unique Client Code

13.1.1. It shall be mandatory for the Broker Dealers to use unique client code for all clients. Such unique client code can be assigned based on the

following:

13.1.1.1. Legal Identity Identifier;

13.1.1.2. Permanent Account Number (PAN);

13.1.1.3. Passport number; or

13.1.1.4. any other documents as may be specified by the Authority.

13.1.2. Broker Dealers shall verify the documents with respect to the unique client code and retain a copy of the document.

13.1.3. The Broker Dealers shall also furnish the above particulars of their clients to the Stock Exchange(s)/ Clearing Corporation(s) as and when requested.

13.2. Modification of client codes

13.2.1. The Stock Exchanges may permit modification of client codes solely for the purpose of rectifying genuine error in the entry of the client code at the time of placing or modifying the corresponding order.

13.2.2. The following shall be classified as genuine errors for the purpose of

client code modification:

13.2.2.1. Errors arising from communication and/or punching or typing mistakes, where the original client code or client name and the modified client code or client name bear a close resemblance to each other.

13.2.3. Where a Stock Exchange permits Broker Dealers to modify client codes for non-institutional trades, it shall:

13.2.3.1. establish appropriate mechanisms to ensure that such modifications are carried out solely for the purpose of rectifying genuine errors.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 14 | Page13.2.3.2. Ensure that client code modifications are subject to review as part of the annual compliance audit of the Broker Dealer.

13.3. Penalty Structure

13.3.1. The Stock Exchanges shall levy a penalty on the Broker Dealers and

credit the same to its Investor Protection Fund as under: ‘a’ as % of ‘b’ Penalty as % of ‘a’ ≤ 5 1 > 5 2 Where, a = Value (turnover)* of trades where client codes have been modified by a Broker Dealer during a month.

b = Value (turnover) of trades of the Broker Dealer during the month. *"Turnover" shall mean the aggregate value of all transactions. It is clarified that in case of options contracts, the premium turnover shall be considered for calculation of turnover.

13.3.2. The Stock Exchange shall conduct a special inspection of the Broker Dealers to ascertain whether the modifications of client codes are being carried out only to rectify genuine errors as mentioned above, if ‘a’ as a % of ‘b’, as defined above, exceeds 1% during a month and take appropriate disciplinary action, if any deficiency is observed.

13.4. Error Account

13.4.1. The transfer of trades to the error account of a Broker Dealer shall not be treated as a modification of client code, provided that such trades are subsequently liquidated in the market and are not reassigned to any other client code.

13.4.2. Broker Dealers shall disclose to the Stock Exchanges the details of accounts designated as “error accounts”.

13.4.3. Each Broker Dealer shall maintain a well-documented error account policy, duly approved by its management. The Stock Exchanges shall periodically review trades routed to such error accounts.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 15 | Page13.5. Waiver of Penalty

13.5.1. Stock Exchanges, may, at their discretion, waive penalties in respect of client code modification where the Broker Dealer demonstrates, to the satisfaction of the Stock Exchange, that such modification arose from a bona fide error, supported by adequate documentary evidence.

13.5.2. Not more than one such waiver for client code modification shall be granted to a Broker Dealer in any given quarter.

Explanation.- If penalty waiver has been given with regard to a genuine client code modification from client code AB to client code BA, no more penalty waivers shall be allowed to the Broker Dealer in the quarter for modifications related to client codes AB and BA.

13.5.3. Proprietary trades shall not be allowed to be modified as client trade and vice versa.

13.5.4. The Stock Exchanges shall submit to Authority, on a quarterly basis, a report detailing all instances of client code modifications where penalties have been waived. Such reporting shall be required only in quarters where any waiver of penalty has been granted. No report shall be required where no such waiver has occurred.

13.5.5. The Stock Exchanges shall institute stringent disciplinary measures against Broker Dealers engaging in frequent client code modifications, in accordance with the applicable regulatory framework.

14. TRANSACTION CHARGES BY THE STOCK EXCHANGES

14.1. The Stock Exchange(s) may levy transaction charges on trades executed on their trading platform.

14.2. While levying or revising such transaction charges, the Stock Exchange(s)shall, inter alia, ensure the following:

14.2.1. The infrastructure at the Stock Exchange is adequately stress-tested and capable of handling any induced surge in message traffic and trading volumes.

14.2.2. The proposed charges do not adversely impact the integrity or effectiveness of the existing risk management framework.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 16 | Page14.2.3. Charges are applied in a uniform and non-discriminatory manner to all trades of a similar nature and the fee structure does not provide preferential treatment to any class of trades or category of investors.

14.2.4. The fee structure does not incentivize the creation of artificial demand including through practices such as wash trades, synchronized trades or similar activities.

14.2.5. The fee structure does not result in market fragmentation or give rise to structural distortions.

14.2.6. All levies or revisions of transaction charges are disclosed in a clear, transparent and timely manner, ensuring a level playing field for all market participants.

15. CALL AUCTION IN PRE-OPEN SESSION AND PRE-CLOSE SESSION

15.1. The Stock Exchanges operating in GIFT IFSC shall have the operational flexibility for specifying the guidelines for call auction.

16. POLICY FOR ANNULMENT OF TRADES UNDERTAKEN ON STOCK EXCHANGES

16.1. The Stock Exchanges shall formulate and specify a comprehensive policy governing the annulment of trades, which shall, inter alia, specify

aspects such as :

16.1.1. modalities of submission of requests by Broker Dealer to the Stock Exchange,

16.1.2. the criteria and process for evaluation and disposal of such requests

16.1.3. charges to be levied by the Stock Exchanges etc.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 17 | PageCHAPTER - III: TRADING SOFTWARE AND TECHNOLOGY

17. INTERNET BASED TRADING

17.1. Conditions to be met by Broker Dealer for providing Internet Based Trading (IBT) Service and Securities Trading using Wireless Technology

(STWT)

17.1.1. The Broker Dealer shall make an application to the Stock Exchange for launching IBT services. The Stock Exchange shall process and communicate its decision on all such applications within seven calendar days of receipt of such applications from the Broker Dealer.

17.1.2. However, before giving permission to a Broker Dealer to start internet- based services, Stock Exchange shall ensure that the Broker Dealer meets the minimum conditions/ criteria as specified by the Stock Exchange or the Authority.

17.1.3. Broker Dealers who provide Internet Based Trading shall be eligible to provide securities trading using wireless technology. All relevant requirements applicable to IBT shall also be applicable to securities trading using wireless technology. Securities Trading using Wireless technology shall include devices such as mobile phone, laptop with data card, etc, that use Internet Protocol (IP).

17.1.4. The Stock Exchange shall have the operational flexibility to put in place the necessary measures, procedures and guidelines for approval of IBT

and STWT services of the Broker Dealer including following:

17.1.4.1. Risk management and risk mitigation with respect to IBT trading activity;

17.1.4.2. Operational and system requirements;

17.1.4.3. Network security protocols and interface standards;

17.1.4.4. Technology and systems audit policy of the IBT systems;

17.1.4.5. Cybersecurity, cyber resilience, access control and incident response.

17.1.5. Responsibilities of the Broker Dealer

17.1.5.1. A Broker Dealer providing IBT facility to its clients shall ensure

compliance with the following :

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 18 | Page17.1.5.1.1. Execution of a formal agreement with clients clearly setting out the respective rights and obligations of the parties. Such agreement shall, inter alia, incorporate the minimum service standards specified by IFSCA and/or the Stock Exchange(s) from time to time for IBT services. The Stock Exchange may stipulate additional terms and conditions to be included in the agreement with the clients. The agreement shall not contain any provision that is inconsistent with or in contravention of the applicable regulations, circulars or guidelines issued by IFSCA or the Stock Exchange(s).

17.1.5.1.2. The Broker Dealer’s website providing IBT facilities shall prominently display information relevant to investor protection, including applicable rules and regulations governing the client– broker relationship, arbitration mechanisms and investor protection frameworks. The website shall also provide clear and accessible hyperlinks to the relevant sections of the Stock Exchange(s)’ website(s) containing applicable rules, regulations and circulars.

17.1.5.1.3. Display ticker, quotes and order book information along with the corresponding time stamp and source of such information.

17.1.6. The Broker Dealer shall:

17.1.6.1. Ensure that the trading limits, exposure limits and position limits are specified for all clients based on an appropriate assessment of risk, creditworthiness and available margins.

17.1.6.2. Ensure that all IBT/STWT orders are routed through electronic or automated risk management systems, which shall perform requisite validations of risk parameters including quantity limits, price range checks, order value and credit checks prior to release of orders to the Stock Exchange.

17.1.6.3. Maintain sound audit trail for all IBT/STWT orders and trades, with the capability to identify the actual user ID associated with each order and trade at all times. Such audit trail records shall be preserved for a minimum period of eight years from the date of execution of the trades.

17.1.6.4. Comply with network security guidelines as specified by the Stock Exchange from time to time.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 19 | Page17.1.6.5. Adhere to the same order handling logic and prioritization principles as adopted by the Stock Exchange in processing client orders.

17.1.6.6. Maintain comprehensive logs of all system activities and alerts, supported by an audit trail facility.

17.1.6.7. Generate and maintain unique identifiers for all client orders and trades.

17.1.6.8. Ensure secure access, encryption and integrity of communications for internet-based and wireless securities trading. The level of encryption shall be governed by the applicable policies and regulations of the Department of Telecommunications (DOT).

17.1.7. The Broker Dealer’s server used for routing orders to the Stock Exchange trading system shall be located in GIFT IFSC.

17.1.8. The Broker Dealer shall be fully responsible and liable for all orders originating through its IBT/STWT systems.

17.1.9. All IBT/STWT orders must be offered to the market for matching. The Broker Dealers using IBT/STWT facility shall not undertake cross trades between their clients.

17.1.10. The Stock Exchanges shall have the operational flexibility to specify such additional safeguards and conditions as may be considered necessary for permitting IBT facilities to Broker Dealers.

17.1.11. The Stock Exchanges shall arrange for periodic systems audits of Broker Dealer’s systems to ensure compliance with the requirements specified in applicable regulations, circulars and guidelines.

17.1.12. The Stock Exchanges shall put in place appropriate systems to identify and distinguish IBT/STWT orders and trades from other orders and trades.

17.1.13. The Stock Exchanges shall maintain statistical data relating IBT/STWT trades and furnish such information to the Authority as and when required.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 20 | Page18. Direct Market Access

18.1. Direct Market Access (DMA) is a facility which allows Broker Dealers to offer their clients direct access to the trading system of the Stock Exchange, through the Broker Dealer’s trading systems, without any manual intervention by the Broker Dealer. The Broker Dealer retains the ability to monitor internally and, if necessary, stop an order prior to it being executed.

18.2. The Broker Dealer shall maintain sound audit trail for all DMA orders and trades and should at all times have the capability to provide identification of actual user-id for all such orders and trades. The audit trail data should be available for at least 8 years, from the date of execution of trades.

18.3. The Broker Dealers shall follow the similar logic/priorities used by the Stock Exchange to treat DMA client orders. In this regard, the Broker Dealers are required to maintain all activities/ alerts log with audit trail facility. The DMA Server shall have internally generated unique identifier for all such client

order/trades.

18.4. The Stock Exchange shall have the operational flexibility to put in place the necessary measures, procedures and guidelines for DMA orders and trades

with respect to:

18.4.1. Risk management and risk mitigation with respect to DMA trading activity

18.4.2. Technology and systems audit policy of the DMA systems based on the risk profile of the Broker Dealer / client.

18.4.3. Eligible institutional investors which are permitted to avail the DMA facility

18.4.4. Cybersecurity, cyber resilience, access control and incident response

18.5. Responsibilities of the Broker Dealer & due diligence of prospective clients

18.5.1. The Broker Dealers shall specifically authorize prospective clients for

providing DMA facility subject to the following:

18.5.1.1. fulfilment of the KYC/AML requirements as specified by IFSCA from time to time;

18.5.1.2. due diligence of the prospective client with respect to the credit worthiness, risk taking ability and track record of compliance;

18.5.1.3. the governance and ownership structure of the prospective client;

18.5.1.4. the ability of the prospective client to meet its financial obligations;

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 21 | Page18.5.1.5. any additional measures that the Stock Exchange considers appropriate to ensure that the clients are deemed fit and proper for permitting access to the DMA facility.

18.5.2. The Broker Dealers are required to maintain proper records of such due diligence. Individual users at the client end shall also be authorized by the Broker Dealer based on minimum criteria. The records of user details, user-id and such authorization shall be maintained by the Broker Dealer.

Details of all user-ids activated for DMA shall be provided by the Broker Dealer to the Stock Exchange.

18.5.3. The Broker Dealer shall enter into a specific agreement with the clients for whom they permit DMA facility, the nature and detail of which should be appropriate to the nature of the service provided. This agreement shall, inter alia, include the following safeguards:

18.5.3.1. The DMA facility shall be used by the client only to execute its own trades and shall not be used for transactions on behalf of any other person/entity.

18.5.3.2. The necessary systems and controls with respect to Electronic/Automated Risk Management shall be in place at the Broker Dealer’s level before the release of order to the Exchange trading system. The client shall agree to be bound by the various limits that the Broker Dealer shall impose for the usage of the DMA facility.

18.5.3.3. Right to withdraw DMA facility if the predefined thresholds are breached or for any other such concerns

18.5.3.4. Withdrawal of DMA facility on account of any misuse or on instructions from the Authority or the Stock Exchange.

18.5.4. The Stock Exchange may put any other terms and conditions to be included in the agreement with the clients. The Broker Dealer’s agreement with its clients shall not have any clause that is in contravention to the regulations/circulars/guidelines issued by IFSCA and the Stock Exchange from time to time.

18.5.5. The Broker Dealer shall:

18.5.5.1. ensure that the trading limits, exposure limits and position limits are set for all its DMA clients based on risk assessment, credit quality and available margins of the client.

18.5.5.2. Have appropriate authority levels to ensure that these limits are established only by Principal Officer or Compliance Officer or any IFSCA - Master circular on Stock Exchanges & Clearing Corporations 22 | Pageother person authorized by the Principal Officer or Compliance Officer.

18.5.5.3. Ensure that all DMA orders are routed through electronic/automated risk management systems of the Broker Dealer to carry out appropriate validations of all risk parameters including Quantity Limits, Price Range Checks, Order Value and Credit checks before the orders are released to the Stock Exchange.

18.5.5.4. The Broker Dealer may provide for additional risk management parameters as they may deem appropriate.

18.6. Sponsored Access

18.6.1. Broker Dealers are permitted to offer the facility of Sponsored Access

(SA) to its clients, for trading on the Stock Exchange.

18.6.2. Sponsored Access is a form of Direct Market Access in which the Broker Dealer permits its client to transmit orders directly to the Exchange trading system without routing it through the Broker Dealer’s trading system. Such an arrangement may facilitate low latency trading and assist in preserving the confidentiality of sophisticated, proprietary trading strategies of the clients.

18.6.3. The Broker Dealer shall sign a SA agreement or provide a SA undertaking to the Stock Exchange.

18.6.4. The orders routed through the client’s trading application via SA should pass through the controls / pre-trade risk management layer provided by the Stock Exchange with the parameters being determined and configured by the Broker Dealer.

18.6.5. The Broker Dealer shall enter into an agreement with the clients desirous of availing the SA facility. The due diligence by the Broker Dealer for providing SA to such clients shall, inter alia, include:

18.6.5.1. the governance and ownership structure of the client

18.6.5.2. the responsibilities within the client for dealing with actions and errors

18.6.5.3. the historical trading pattern and behaviour of the prospective client

18.6.5.4. the level of expected trading and order volume of the prospective client

18.6.5.5. the ability of the prospective client to meet its financial obligations IFSCA - Master circular on Stock Exchanges & Clearing Corporations 23 | Page18.6.5.6. the disciplinary history of the prospective DMA client, where available

18.6.6. The Stock Exchange shall ensure that the agreement between the Broker Dealer and its client are in place prior to approving the facility of SA.

18.7. Sub-delegation of DMA/SA

18.7.1. A client of a Broker Dealer may sub-delegate its DMA/SA facility to its own client (sub-delegatee), subject to the condition that the client sub- delegating the DMA/SA facility is an entity, regulated in any capacity, by a securities market regulator which is a signatory to the International Organization of Securities Commission’s Multilateral Memorandum of Understanding (IOSCO-MMoU).

18.7.2. The Broker Dealer permitting a DMA/SA client to sub-delegate its DMA/SA facility, should be able to identify the different order flows from such sub-delegation.

18.7.3. Only one level of sub-delegation of DMA/SA facility shall be permitted i.e., sub-delegation shall be permitted only up to a client’s client (sub- delegatee). The sub-delegatee shall not be permitted to in turn sub- delegate the DMA/SA facility to its client.

18.8. Other requirements for DMA/SA

18.8.1. A Broker Dealer desirous of providing DMA/SA facility to its clients is required to obtain prior approval of the Stock Exchange. The Stock Exchange shall put in place the necessary Standard Operating Procedures for providing such an approval.

18.8.2. The clients (including sub-delegatees) desirous of availing the facility of DMA/SA shall fulfil the following criteria:

18.8.2.1. The client is a resident of a country whose securities market regulator is a signatory to the IOSCO-MMoU or a signatory to the bilateral Memorandum of Understanding with the Authority.

18.8.2.2. The client is not a resident of a country identified in the public statement of the Financial Action Task Force (FATF) as – IFSCA - Master circular on Stock Exchanges & Clearing Corporations 24 | Pagea) a jurisdiction having a strategic Anti-Money Laundering or Combating the Financing of Terrorism deficiencies to which counter measures apply; or b) a jurisdiction that has not made sufficient progress in addressing the deficiencies or has not committed to an action plan developed with the Financial Action Task Force to address the deficiencies.

18.9. All DMA orders shall be routed to the exchange trading system through the Broker Dealer’s trading system. The Broker Dealer’s server routing the DMA orders to the exchange trading system and the SA client’s servers (including those of the sub-delegatee) transmitting orders directly to the exchange trading system, shall be located in IFSC. Depending on the operational convenience, the Broker Dealers/ SA clients (including sub-delegatees) may

implement their systems in any of the following ways:

18.9.1. The Co-location data centre of the Stock Exchange

18.9.2. Broker Dealer’s/ SA client’s own data centre in IFSC

18.9.3. A third-party data centre in IFSC as approved by the Stock Exchange

18.9.4. Independent software vendors with infrastructure in IFSC

18.10. The Stock Exchanges shall specify the operational and technical requirements and procedures for DMA/SA connectivity to the exchange trading system.

18.11. The Broker Dealer shall be fully responsible and liable for all orders emanating through their DMA systems and the SA systems of its clients. It shall be the responsibility of the Broker Dealer to ensure that only clients (including sub-delegatees) who fulfil the eligibility criteria are permitted to use the DMA/SA facility.

18.12. All DMA/SA orders must be offered to the market for matching. The Broker Dealers using DMA facility for routing client orders shall not be permitted to cross trades of their clients with each other. The clients using and sub- delegating the SA facility, shall not be permitted to cross trades of the sub- delegatees with each other.

18.13. The Stock Exchanges shall have the operational flexibility to specify additional safeguards and conditions as they may deem fit for permitting DMA/SA facilities to their Broker Dealers.

18.14. The Stock Exchanges shall put in place the necessary systems to identify and distinguish DMA/SA orders and trades from other orders and trades.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 25 | Page18.15. The Stock Exchanges shall maintain statistical data on DMA/SA trades and provide information on the same to IFSCA on a need basis.

18.16. The Broker Dealer providing DMA/SA facility shall review its due diligence processes periodically.

18.17. The Broker Dealer shall carry out periodic risk-based reassessment of the adequacy of its clients’ systems and controls, in particular, taking into account

the following:

18.17.1. Changes to the scale, nature or complexity of their trading activities or strategies

18.17.2. Changes to their staffing

18.17.3. Ownership structure

18.17.4. Regulatory status

18.17.5. Financial position

18.17.6. Whether its DMA/SA client has expressed its intention to sub-delegate its DMA/SA

18.17.7. Identify order flows emanating from DMA/SA

19. TRADING TERMINALS

19.1. Testing of software used in or related to Trading and Risk Management

19.1.1. Definition For the purpose of this section, the term 'Software’ shall mean electronic systems or applications used by Broker Dealers / trading members for connecting to the Stock Exchanges and for the purposes of trading and real- time risk management, including software used for IBT”, “DMA”, STWT, Smart

Order Routing (“SOR”), Algorithmic Trading (“AT”), etc.

19.1.2. Testing of Software The Stock Exchanges shall frame appropriate testing policies for functional as well as technical testing of the software. Such framework shall at the minimum

include the following:

19.1.2.1. Testing in an Exchange provided test environment Stock Exchanges shall provide appropriate testing facilities to market participants and software vendors for new software and for existing software that has undergone modifications. It shall be IFSCA - Master circular on Stock Exchanges & Clearing Corporations 26 | Pagemandatory for market participants to subject such software to the specified testing prior to deployment in the live trading environment.

19.1.3. Mock Testing

19.1.3.1. The Stock Exchanges shall organize mock trading sessions at least once in each calendar month to facilitate testing of new software and of existing software that has undergone functional changes, in a near real-time trading environment. Stock Exchanges shall suitably design and schedule such sessions to ensure broad participation and adequate trading volumes for effective testing.

19.1.3.2. The Stock Exchanges shall specify a minimum duration for testing to be undertaken during such mock trading sessions.

19.1.3.3. To enhance the effectiveness of mock trading sessions, all Broker Dealers authorized for algorithmic trading shall be required to participate in the scheduled sessions.

19.1.3.4. The Broker Dealers shall undertake (User Acceptance Test) UAT of the software to ensure that the newly developed or modified software meets their operational and regulatory requirements prior to deployment.

19.1.3.5. The requirement of mandatory mock trading sessions for testing new software or existing software that has undergone functional changes may be dispensed with, provided that the Stock Exchange offers a suitable testing environment and ensures compliance with

the following:

19.1.3.5.1. The test environment is made available to all the members on a non-discriminatory basis.

19.1.3.5.2. The Stock Exchange provides, for testing purposes, data from at least one trading day, which shall not be older than one month from the date of availability of the testing environment.

19.1.3.5.3. All Broker Dealers (excluding those using only Exchange

provided front-end and/or ASP services) with approved algorithms, irrespective of whether such algorithms have undergone changes, shall participate in the simulated environment for at least one trading day in each calendar IFSCA - Master circular on Stock Exchanges & Clearing Corporations 27 | Pagemonth across all the Stock Exchanges of which they are members. Compliance with this requirement shall be subject to audit and shall be reported in the system auditor’s report.

19.1.3.6. In respect to testing of software relating to:

(a) bug fixes,

(b) modifications undertaken by Broker Dealers pursuant to changes in any Stock Exchange’s trading system, and

(c) software procured from a vendor that has already been tested in the mock environment by a specified number of Broker Dealers, the Stock Exchanges may specify an expedited approval process to facilitate timely deployment.

19.1.3.7. Broker Dealers shall engage system auditor(s) to review the reports of mock testing and UAT and to certify that such testing has been satisfactorily conducted.

19.1.3.8. Stock Exchanges shall monitor compliance of Broker Dealers, who use trading algorithm, with regard to the requirement of participation in mock trading session as mandated in this circular.

19.1.3.9. Stock Exchanges shall also ensure that the system auditors examine the compliance of Broker Dealer, who use trading algorithms, with regard to the requirement of participation in mock trading session, as mandated with this circular, and provide suitable comments in the periodic system audit report.

19.1.3.10. For pre-approval / periodic system audit of API, IBT, DMA, STWT, SOR and AT, Broker Dealers shall engage a system auditor with any of the

certifications as specified under: a) CISA (Certified Information System Auditors) from ISACA; b) DISA (Post Qualification Certification in Information Systems Audit) from Institute of Chartered Accountants of India (ICAI);

c) CISM (Certified Information Securities Manager) from ISACA d) CISSP (Certified Information Systems Security Professional) from International Information Systems Security Certification Consortium, commonly known as

(ISC) IFSCA - Master circular on Stock Exchanges & Clearing Corporations 28 | Page19.1.3.11. While finalizing the system auditor, Broker Dealers shall ensure the system auditor does not have any conflict of interest with the Broker Dealer and the directors/promoters of the system auditor are not directly or indirectly related to the current directors or promoters of Broker Dealer.

19.1.4. Approval of Software of Broker Dealer

19.1.4.1. Broker Dealers shall seek approval of the respective Stock Exchanges for deployment of the software in the securities market by submitting necessary details required by Stock Exchange including details of software, tests undertaken and certificate / report provided by the system auditor.

The Stock Exchange may seek additional details as deemed necessary for evaluating the application of the Broker Dealer / trading member.

19.1.4.2. The Stock Exchanges shall grant approval or reject the application of the Broker Dealer as the case may be, and communicate the decision to the Broker Dealer within fifteen working days from the date of receipt of completed application (or within any other such time period specified vide IFSCA circulars on DMA, IBT, STWT, SOR, AT, etc.). In case of rejection of the application, the Stock Exchange shall also communicate reasons of rejection to the Broker Dealer within such time period.

19.1.4.3. Before granting approval to use software in securities market, the Stock Exchange shall ensure that the requirements specified by IFSCA / Stock Exchange with regard to the software are met by the Broker Dealer.

19.1.4.4. The Stock Exchanges may suitably schedule the requirements of mock testing, certification of test reports by system auditor(s) and the software approval process, so as to facilitate a speedy approval and a smooth transition of the Broker Dealers to the new / upgraded software.

19.1.5. In order to ensure that the Broker Dealers are not using software without requisite approvals, the Stock Exchanges are advised to put in place suitable mechanism to prevent any unauthorized change to the approved software.

19.1.6. Undertaking to be provided by Broker Dealers Broker Dealers shall submit an undertaking to the respective Stock

Exchanges stating the following at the minimum:

19.1.6.1.1. M/s (name of the Broker Dealer) will take all necessary steps to ensure that every new software and any change thereupon to the IFSCA - Master circular on Stock Exchanges & Clearing Corporations 29 | Pagetrading and/or risk management functionalities of the software will be tested as per the framework specified by the Authority/Stock Exchange before deployment of such new / modified software in securities market.

19.1.6.1.2. M/s (name of the Broker Dealer / trading member) will ensure that approval of the Stock Exchange is sought for all new / modified software and will comply with various requirements specified by the Authority or the Stock Exchange from time to time with regard to usage, testing and audit of the software.

19.1.6.2. The absolute liability arising from failure to comply with the above provisions shall lie entirely with M/s (name of the Broker Dealer).

19.1.6.3. The Stock Exchanges may include additional clauses as deemed necessary in the undertaking.

19.1.7. Sharing of Application Programming Interface (API) specifications by the Stock Exchange with Broker Dealers

19.1.7.1. API is an interface that enables interaction of software with other software and typically includes language and message format that is used by an application program to communicate with the operating system or other application program. Broker Dealers and software vendors require relevant API specifications to facilitate interaction of the developed software with the systems of the Stock Exchanges.

19.1.7.2. The Stock Exchanges shall provide relevant API specifications to all Broker Dealers and software vendors who are desirous of developing software for the securities market, after establishing their respective credentials.

19.1.7.3. In case of refusal to share APIs, the Stock Exchanges shall provide reasons in writing to the desirous Broker Dealers or software vendors within a period of fifteen working days from the date of receipt of such request for sharing of API.

19.1.7.4. Further, Stock Exchanges shall not selectively release updates / modifications, if any, of the existing API specifications to a few Broker Dealers or software vendors ahead of others and shall provide such updated / modified API specifications to all Broker Dealers and software vendors with whom the earlier API specifications were shared.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 30 | Page20. SYSTEM AUDIT

20.1. MIIs are required to conduct System and Network Audit as per the framework mentioned in the Annexure-II and Terms of Reference (ToR) mentioned at Annexure-III. The Auditor shall also check for compliance with the extant IFSCA guidelines/circulars related to technology as specified from time to time and shall report Non-Compliances (NCs) to the Authority as per the format specified at Annexure-IV.

20.2. The MIIs are required to submit information with regard to exceptional major NCs/ minor NCs observed in the System and Network Audit as per the format placed at Annexure-V and are required to categorically highlight those observations/NCs/suggestions pointed out in the System and Network Audit (current and previous) which remain open.

20.3. The Systems and Network Audit Report shall be subject to a formal review by the Standing Committee on Technology (SCOT) and the Governing Board of the MII. A

complete filing comprising of the following:

20.3.1. the findings and observations of the audit,

20.3.2. compliance status of previous observations, and

20.3.3. the specific comments of the SCOT and the Governing Board shall be submitted to the Authority, no later than two months after the completion of the audit.

20.4. Along with the Audit report, MIIs are required to submit a joint declaration from the Managing Director (MD)/Chief Executive Officer (CEO) and Chief Technology Officer

(CTO) certifying: a) the security and integrity of their IT Systems; b) correctness and completeness of data provided to the Auditor; c) entire network architecture, connectivity (including co-lo facility) and its linkage to the trading infrastructure are in conformity with IFSCA’s regulatory framework to provide fair equitable, transparent and non-discriminatory treatment to all the market participants;

d) internal review of critical systems was carried out during the Audit period, including the Failure Modes and Effects Analysis (FMEA).

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 31 | Page21. BUSINESS CONTINUITY PLAN AND DISASTER RECOVERY

21.1. IFSCA, as a member of IOSCO, has adopted the Principles for Financial Market Infrastructures (PFMIs) laid down by CPMI-IOSCO.

21.2. Principle 17 of PFMI that relates to management and mitigation of ‘Operational risk’ requires that systemically important market infrastructure institutions “should identify the plausible sources of operational risk, both internal and external, and mitigate their impact through the use of appropriate systems, policies, procedures, and controls. Systems should be designed to ensure a high degree of security and operational reliability and should have adequate, scalable capacity. Business continuity management should aim for timely recovery of operations and fulfilment of the FMI’s obligations, including in the event of a wide-scale or major disruption.”

21.3. Considering the advancement in technology and improved automation of various processes, a framework for Business Continuity Plan (BCP) and Disaster Recovery Site

(DRS) for the MIIs in the IFSC is specified hereunder:

21.3.1. The MIIs shall have in place BCP and DRS to maintain data and transaction integrity.

21.3.2. It is recommended that apart from DRS, MIIs have a Near Site (NS) to ensure zero data loss.

21.3.3. The DRS should preferably be set up in different seismic zones and in case due to certain reasons such as operational constraints, change of seismic zones, etc., a minimum distance of 500 kilometres shall be ensured between the Primary Data Centre (PDC) and the DRS so that both DRS and PDC are not affected by the same disaster.

Explanation. -Trades executed from the DR site (site located outside GIFT-IFSC) of the Stock Exchanges in GIFT-IFSC, due to the aforementioned regulatory requirement, shall be deemed to have been executed at GIFT-IFSC.

21.4. The business, operations and technology manpower resources of PDC site can operate from home/travel to DRS, if required.

21.4.1. The MII shall constitute an Incident and Response Team (IRT)/ Crisis Management Team (CMT), which shall be chaired by the Managing Director

(MD) of the MII or by the Chief Technology Officer (CTO), in case of non- availability of MD. The IRT/ CMT shall be responsible for the actual declaration of disaster, invoking the BCP and shifting of operations from PDC to DRS IFSCA - Master circular on Stock Exchanges & Clearing Corporations 32 | Pagewhenever required. Details of roles, responsibilities and actions to be performed by employees, IRT/ CMT and support/outsourced staff in the event of any Disaster shall be defined and documented by the MII as part of BCP-DR Policy Document.

21.4.2. The Standing Committee on Technology (SCOT) shall review the implementation of the BCP- DR policy approved by the Governing Board of the MII, on a quarterly basis.

21.4.3. The MII shall conduct periodic training programs to enhance the preparedness and awareness level among their employees and outsourced staff, vendors, etc. so as to discharge their duties as per the BCP policy.

21.5. Configuration of DRS/NS with PDC

21.5.1. The following guidelines shall apply with respect to the configuration of DRS/NS with PDC:

21.5.2. Hardware, system software, application environment, network and security devices and associated application environments of DRS / NS and PDC shall have one to one correspondence between them.

21.5.3. The MII shall develop the necessary systems in a manner that does not require system configuration changes at the intermediary level (Broker- Dealers/ Clearing Members) for switchover from the PDC to the DRS. The MIIs shall test such a switchover functionality by conducting unannounced live operations on periodic basis as specified by the Authority. Unannounced commencement of live operations from the DRS of the MIIs shall be done at a short notice of 45 minutes.

21.5.4. The ‘Critical Systems’ for an MII shall include Trading, Risk Management, Collateral Management, Clearing and Settlement and Index computation.

21.5.5. In the event of a disruption of any one or more of the ‘Critical Systems’, the MII shall, within 30 minutes of the incident, declare that incident as a ‘Disaster’ and take necessary measures to restore operations, including from the DRS, within 45 minutes of declaration of a ‘Disaster’. Accordingly, the Recovery Time Objective (RTO) i.e., the maximum time taken to restore operations of ‘Critical Systems’ from DRS after declaration of Disaster- shall be 45 minutes.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 33 | Page21.5.6. The MII shall ensure that the Recovery Point Objective (RPO) i.e., the maximum tolerable period for which data loss is experienced, due to a major incident, shall be 15 minutes.

21.5.7. The solution architecture of PDC and DRS / NS shall ensure: i. high availability, ii. fault tolerance, iii. no single point of failure, iv. zero data loss, and v. data and transaction integrity

21.5.8. Any updates made at the PDC should be reflected at DRS/ NS immediately (before end of day) with head room flexibility without compromising any of the performance metrics.

21.5.9. The replication architecture, bandwidth, and load consideration between the DRS / NS and PDC shall be within the stipulated RTO and shall ensure high availability, right sizing, and no single point of failure.

21.5.10. The replication between PDC and NS shall be synchronous so as to ensure zero data loss whereas, the one between PDC and DRS and between NS and DRS may be asynchronous.

21.5.11. Adequate resources (with appropriate training and experience) should be available at all times to handle operations at PDC, NS or DRS, as the case may be, on a regular basis as well as during disasters.

21.6. DR Drills/Testing

21.6.1. The following guidelines with respect to the DR drills/ testing shall apply:

21.6.1.1. DR drills should be conducted on a quarterly basis.

21.6.1.2. The drill shall include the execution of all operations from DRS for at least 1 full trading day.

21.6.1.3. The results and observations of these drills shall be documented and placed before the Governing Board of the MIIs. Subsequently, the same along with the comments of the Governing Board should be forwarded to IFSCA within two months of the DR drill.

21.6.1.4. The Systems Auditor, while covering the BCP – DR aspect, as a part of the mandated annual Systems Audit, shall scrutinize the preparedness of the MII to switch its operations from the PDC to the DRS, IFSCA - Master circular on Stock Exchanges & Clearing Corporations 34 | Pageunannounced, and also comment on the documented results and observations of the DR drills.

21.6.1.5. In the case of Stock Exchanges, the ‘live’ trading sessions from the DR site shall be scheduled for at least two consecutive days in every six months. Such live trading sessions from the DRS shall be organized on normal working days (i.e. not on weekends / trading holidays).

21.6.1.6. The Stock Exchanges shall include a scenario of intraday switchover from the PDC to DRS during the mock trading sessions in order to demonstrate its preparedness to meet RTO/RPO as stipulated above.

21.6.1.7. The MII shall undertake and document Root Cause Analysis (RCA) of their technical/ system related problems in order to identify the causes and to prevent recurrence of similar problems.

21.6.1.8. In addition to the above, the following shall also apply:

21.6.1.8.1. The MIIs shall study the feasibility of intra-day switchover from the Primary Site to the DR site with a notice of 45 minutes from IFSCA.

21.6.1.8.2. The MIIs shall prepare comprehensive testing plan and build sufficient redundancy in their systems in order to mitigate impact of any unforeseen technical glitch and to ensure failure of any subsystem of MIIs would not impact other critical systems of MIIs and continuous functioning of securities market.

21.6.1.8.3. MIIs shall constantly monitor the health/performance of various communication links and take corrective measures, as required.

21.7. BCP-DR Policy Document

21.7.1. The BCP – DR policy document shall be prepared by the MIIs as per the

following:

21.7.1.1. The MIIs shall put in place a comprehensive BCP-DR policy document

outlining the following: a) Broad scenarios that would be defined as a Disaster for an MII b) Standard Operating Procedure to be followed in the event of Disaster. c) Escalation hierarchy within the MII to handle the Disaster.

d) Clear and comprehensive Communication Protocols and procedures for both internal and external communications from the time of incident till resumption of operations of the MII. e) Documentation policy on record keeping pertaining to DR drills.

f) Scenarios demonstrating the preparedness of MII to handle issues in Critical Systems that may arise as a result of Disaster.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 35 | Pageg) Preparedness of Depositories to handle any issue which may arise due to trading halts in Stock Exchanges. h) Framework to constantly monitor health and performance of Critical Systems in normal course of business.

21.7.1.2. The BCP-DR policy document of the MII should be approved by the Governing Board after being vetted by the Standing Committee on Technology (SCOT) and thereafter communicated to IFSCA. The BCP- DR policy document should be periodically reviewed at least once in six months and after every occurrence of a disaster.

21.7.1.3. In case an MII desires to lease its premises at the DRS to other entities, including to its subsidiaries or entities in which it has stake, the MII should ensure that such arrangements do not compromise the confidentiality, integrity, availability, targeted performance and service levels of the systems of MII at the DRS. The right of first use of all the resources at DRS including network resources should be with the MII.

Further, the MII should deploy necessary access controls to restrict access (including physical access) of such entities to its critical systems and networks.

22. STANDARD OPERATING PROCEDURE FOR HANDLING OF TECHNICAL GLITCHES

22.1. Considering the criticality of smooth functioning of systems of MIIs (as any disruption adversely impacts all classes of investors / market participants as well as the credibility of the securities market), specifying a pre-defined threshold for downtime of systems of MIIs becomes desirable. For any downtime or unavailability of services, beyond such pre-defined time, there is a need to ensure that “Financial Disincentive” is paid by the MIIs. This will encourage MIIs to constantly monitor the performance and efficiency of their systems and upgrade/ enhance their systems etc. to avoid any possibility of technical glitches/disruption/disaster and restart their operations expeditiously in the event of glitch/disruption/disaster.

22.2. The MIIs shall:

22.2.1. Follow the Standard Operating Procedure (SOP) for handling technical glitches as detailed at Annexure VI, and,

22.2.2. Comply with the “Financial Disincentive” structure as detailed at Annexure VII.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 36 | Page23. CO-LOCATION / PROXIMITY HOSTING

23.1. The term “Co-location” also synonymously referred to as “proximity hosting” is defined as the facility offered by the Stock Exchanges to eligible market participants such as Broker Dealers and data vendors, whereby their trading or data-vending systems are allowed to be located within or at close proximity to the premises of the Stock Exchanges and are allowed to connect to the trading platform of the Stock Exchanges through direct and private network.

23.2. Fair and equitable co-location services

23.2.1. The Stock Exchanges providing co-location services shall, within the limits of the space, power, cooling and similar facilities available, ensure that such services are provided in a fair, transparent and equitable manner with

respect to the following:

23.2.1.1. data centres that are owned and managed by the Stock Exchange

23.2.1.2. data centres that are owned by the Stock Exchange and which are managed by a third party selected by the Stock Exchange

23.2.1.3. data centres that are owned and managed by a third party with which the Stock Exchange has an outsourcing/contractual arrangement

23.2.2. The Stock Exchanges, while facilitating co-location, shall:

23.2.2.1. ensure that all eligible market participants who avail co-location facility have fair, transparent and equitable access to facilities and data feeds

provided by the Stock Exchange.

23.2.2.2. ensure that all eligible market participants availing co-location facility experience similar latencies for the class of co-location service

provided by the Stock Exchange.

23.2.2.3. ensure that the size of the co-located hosting space is sufficient to accommodate all the eligible market participants who are desirous of availing the facility.

23.2.2.4. provide the flexibility to avail rack space in the co-location environment so as to meet the requirements of all eligible market participants desirous of availing such facility.

23.2.2.5. expeditiously decide on the request of the desirous eligible market participants for availing co-location facility and communicate the IFSCA - Master circular on Stock Exchanges & Clearing Corporations 37 | Pagedecision within fifteen working days from the receipt of the request from such eligible market participants. In case of a rejection, the Stock Exchange shall also provide reasons in writing to the eligible market participant.

23.3. Connectivity at co-location facility

23.3.1. The Stock Exchange shall:

23.3.1.1. Permit eligible market participants to receive data feeds from other recognised Stock Exchanges at the co-location facilities and allow routing of orders to other recognised Stock Exchanges in IFSC or overseas, from the co-location facilities.

23.3.1.2. Permit direct connectivity between the co-location facility of a recognised Stock Exchange in IFSC and the co-location facility of other recognized Stock Exchange in IFSC, India or overseas.

23.3.1.3. Permit direct connectivity between servers of an eligible market participant placed in co-location facility of a recognized Stock Exchange and servers of the participant placed (or its group company) in the co- location facility of another recognized Stock Exchange in IFSC, India or overseas.

23.3.1.4. Permit eligible market participants based in overseas jurisdictions to connect to the co-location facility of the Stock Exchange.

23.3.1.5. Permit third party data centres/ service providers chosen by eligible market participants (or its group company) to connect to the co- location facility of the Stock Exchange. The third-party data centres/ service providers shall, inter alia, include advanced, managed Infrastructure as a Service (IaaS) co-location solutions and cloud-based co-location services.

23.4. Disclosure of information pertaining to co-location services

23.4.1. The Stock Exchanges shall publish the following information on their co-

location services on their websites:

23.4.1.1. information about services pertaining to space, power, cooling, access to data, market connectivity, technology, technical support, message types, telecommunications and related products and services

23.4.1.2. the fee structure for each service

23.4.1.3. the terms and conditions for accessing the service IFSCA - Master circular on Stock Exchanges & Clearing Corporations 38 | Page23.4.1.4. the different types of latency of access available

23.4.1.5. the procedure to allocate co-location space

23.4.1.6. the requirements on third party providers of co-location services, wherever applicable

23.4.2. The Stock Exchanges shall ensure that their fee structure is transparent and detailed so that the eligible market participants availing or desirous of availing co-location facility, can arrive at an approximate estimate of their expenditure in the form of fees payable, on the basis of the following aspects:

23.4.2.1. chargeable services, including the activity which will trigger the fee;

23.4.2.2. whether each service offered has a fixed or variable fee;

23.4.2.3. financial incentives or disincentives, if any, offered by the Stock Exchange

23.5. Third party co-location services

23.5.1. Co-location services provided by a third party or outsourced from a third party shall be deemed to be provided by the Stock Exchange. The Stock Exchange shall ensure complete control and jurisdiction over the matters related to its co-location facility. Further, the Stock Exchange will remain responsible and accountable for all actions of such outsourced entity with respect to co-location services.

23.5.2. The Stock Exchange shall submit a quarterly compliance report to IFSCA regarding the outsourcing services after placing it before its Governing Board.

23.6. Integrity and security of Co-Location services

23.6.1. In order to ensure that the facility of co-location does not compromise the integrity and security of the data and trading systems, the Stock Exchange

shall:

23.6.1.1. implement suitable mechanisms for access control to protect their systems and the systems of the market participants at the co-location facility from unauthorized access.

23.6.1.2. frame guidelines on access and conduct of the personnel of the market participants in the premises of the Stock Exchange, including in the co- located space.

23.6.1.3. not provide access in any form to the personnel of market participants to the Stock Exchange’s trading platform and databases.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 39 | Page23.7. Measurement of Latency

23.7.1. The Latency is measured by the Stock Exchange as the time taken to complete the round trip from the Core Router/ Switch to the matching engine and back. It is clarified that the Core Router/ Switch is the point within the Stock Exchange infrastructure, where orders generated from the co-location facility and otherwise meet.

23.7.2. The Stock Exchanges shall publish on their websites suitable quarterly reports on latencies observed at the Stock Exchange which inter alia shall include minimum, maximum and mean latencies and latencies at 50th and 99th percentile.

23.7.3. The Stock Exchanges shall also publish reference latency, which is the time taken for an order message to travel between a reference rack in the Co- location facility and the Core Router/ Switch.

23.7.4. The Stock Exchanges shall take all reasonable steps to ensure equitable treatment of all market participants availing co-location services that have the same class of latency access.

23.7.5. The Stock Exchanges shall make available individual co-location services, without any requirement to purchase bundled services.

23.8. Managed Co-location Services

23.8.1. Small and medium sized Broker Dealers, may find it difficult to avail co- location facility, due to various reasons including but not limited to high cost, lack of expertise in maintenance and troubleshooting, etc. With a view to facilitate Broker Dealers and other eligible participants to avail co-location facility, the Stock Exchange may introduce ‘Managed Co-location Services’.

Under this scheme, the space/rack in the co-location facility may be allotted to eligible vendors, clearing members or Broker Dealers desirous of offering Managed Co-location Services by the Stock Exchange along with provision for receiving market data for further dissemination of the same to their client members and the facility to place orders (algorithmic / non- algorithmic) by the client members from such facility.

23.8.2. The policy shall be laid down by the Risk Management Committee to address the risk management aspects in related to the managed co-location services.

23.8.3. Managed Co-location Service Providers shall provide the technical knowhow, hardware, software and other associated expertise as services to Broker Dealers and other eligible participants and shall be responsible for upkeep and maintenance of all infrastructure in the racks provided to them.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 40 | Page24. CAPACITY PLANNING

24.1. Capacity planning framework of MIIs

24.1.1. Being critical infrastructure of the securities market, it is imperative for the MIIs to continuously assess and monitor their system capacities.

24.1.2. MIIs are advised to ensure the following requirements while planning capacities of their trading, clearing and settlement and risk management

related infrastructure:

24.1.2.1. The installed capacity shall be at least 1.5 times (1.5x) of the projected peak load.

24.1.2.2. The projected peak load shall be calculated for the next 60 days based on the per-second peak load trend of the past 180 days.

24.1.2.3. All systems in trading, clearing and settlement ecosystem shall be considered in this process including all technical components such as network, hardware, software, etc., and shall be adequately sized to meet the capacity requirements.

24.1.2.4. In case the actual capacity utilisation exceeds 75% of the installed capacity, immediate action shall be taken to enhance the capacity.

24.1.3. MIIs shall implement suitable mechanisms, including generation of appropriate alerts, to monitor capacity utilisation on a real-time basis and shall proactively address issues pertaining to their capacity needs.

25. DATA FEED

25.1. Fair and transparent access to data feeds of the Stock Exchanges

25.1.1. The Stock Exchanges shall formulate a comprehensive policy document for providing stock market related data to the market participants in a fair and transparent manner, irrespective of the type of mechanism used by the Stock Exchanges for broadcasting of data.

25.1.2. In this context, Stock Exchanges shall ensure that:

25.1.2.1. Appropriate tools are deployed so as to monitor service quality of data feeds;

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 41 | Page25.1.2.2. Appropriate mechanism (viz. load balancers, randomizers, etc.) to manage load across systems disseminating data in order to ensure consistent response time to all market participants;

25.1.2.3. All communication to the market participants, especially on all technology related matters such as Monitoring Tool, Load Balancer, Randomisation etc., are abundantly clear and precise providing all necessary details related to the concerned facility / service, including information on features, benefits, risks, etc. of the concerned facility / service, particularly for participants who have opted for colocation facility.

25.1.3. The Stock Exchanges shall synchronize their system clocks with the atomic clock before the start of market such that their clocks have precision of at least one microsecond and accuracy of at least +/-one millisecond. In this regard, the Stock Exchange should ensure that all clocks of the servers and other related systems are synchronized. Stock Exchanges may adopt suitable mechanism to ensure such synchronization of system clocks.

26. ELECTRONIC CONTRACT NOTE

26.1. Use of Digital Signature on Contract Notes

26.1.1. Broker Dealer(s) are allowed to issue contract notes authenticated by means of digital signatures provided that the broker dealer has obtained digital signature certificate from Certifying Authority under the IT Act, 2000. Mode of confirmation by the client may be as specified in the agreement between the broker and the client.

26.2. Issuance of Contract Notes in electronic form

26.2.1. The contract notes can be issued by the brokers in electronic form authenticated by means of digital signatures.

26.3. Format for issuance of Electronic Contract Note

26.3.1. In order to streamline the issuance of electronic contract notes as a legal document, the Stock Exchanges would specify a standard format for the electronic contract note in its bye-laws, rules and regulations.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 42 | PageCHAPTER-IV – SETTLEMENT

27. ACTIVITY SCHEDULE

27.1. Rolling Settlement

27.1.1. Clearing Corporations in IFSC may offer, T+0 or T+1 or T+2 settlement cycle1 for the products traded in IFSC. Clearing Corporation shall specify and inform settlement schedule, to the market participants, for each of the products cleared and / or settled by them.

27.2. Systems for effecting settlement

27.2.1. The MIIs shall also put in place the following systems for effecting settlement of trades in IFSC.

27.2.1.1. A facility of confirmation of trades by the clearing member shall be

provided. However, the time limit for confirmation shall be fixed in a manner that the download of the final obligation files to brokers dealers and clearing members is not delayed.

27.2.1.2. The Clearing Corporations would levy an additional charge to discourage late confirmations by the clearing members.

27.2.1.3. The Clearing Corporations would provide a system for handling shortages of funds and securities in an expeditious manner to adhere to the time schedule for pay-out.

27.2.1.4. The Stock Exchanges would also amend their byelaws to mandate the pay out of funds and securities to the clients by the broker within 24 hours of the payout.

27.2.1.5. The Stock Exchanges shall not normally permit changes in the Client ID and shall keep a strict vigil on cases of client code modification and shall implement a monetary penalty structure that would escalate with the number of such incidences. Besides, the Stock Exchanges may take necessary action against members making repeated changes. However, genuine mistakes may be allowed to be rectified.

27.2.1.6. Clearing Corporations would encourage members to adopt automatic downloading of pay-in files for securities and funds. The members would also be encouraged to adopt direct transfer of securities/ funds to clients’ account on pay-out.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 43 | Page27.2.1.7. The Clearing Corporations may also provide the following facilities

desirable for further smoothing clearing and settlement process:

27.3. Clearing Corporations shall specify the process for settlement in case of scheduled and unscheduled holidays and inform all market participants well in advance.

28. CLOSE-OUT AND AUCTION

28.1. Close-Out Procedure

28.1.1. The Clearing Corporation shall define and specify the close-out procedure and / or auction procedures to handle shortages in securities pay-in.

29. SETTLEMENT GUARANTEE FUND (SGF)

29.1. Objective of SGF

29.1.1. Clearing Corporations shall maintain a Settlement Guarantee Fund to ensure the settlement of trades executed on the Stock Exchanges. In the event of a clearing member failing to meet its settlement obligations, the SGF shall be utilized to fulfil such obligations and to ensure completion of settlement without disruption to the normal settlement process.

29.1.2. With a view to enhancing clarity, ensuring uniformity, aligning with international best practices and strengthening the risk management framework of the Clearing Corporations, the following norms relating to SGF

and stress testing shall be complied with:

29.1.2.1. No exposure shall be permitted against the SGF and the SGF shall be maintained in a manner that ensures it is readily and unconditionally available to meet settlement obligations in the event of a clearing member default.

Clearing Corporations shall align their stress testing frameworks with the Principles for Financial Market Infrastructures (PFMI), including requirements relating to credit risk stress testing, liquidity risk stress testing and reverse stress testing, covering, inter alia, the design of scenarios and the frequency of such testing.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 44 | Page29.2. Corpus of SGF

29.2.1. The corpus of the SGF and contributions thereto shall maintained in accordance with the provisions specified under the IFSCA (Market Infrastructure Institutions) Regulations, 2021.

29.2.2. It is clarified that the contribution of a Clearing Corporation to its SGF shall form part of its net worth. Further, any interest earned on cash contribution to the SGF shall accrue to the SGF and be attributed to the contributors on a pro rata basis, in proportion to their respective contributions.

29.3. Management of SGF

29.3.1. The Clearing Corporations shall adhere to prudential norms in respect of the SGF corpus. The Clearing Corporations shall establish and implement policies and procedures to ensure that the SGF corpus is invested in highly liquid financial instruments with minimal market and credit risk and is capable of being liquidated expeditiously with minimal adverse price impact.

29.4. Default Waterfall

29.4.1. The default waterfall for Clearing Corporations shall generally follow the

following order: a. Monies of defaulting member (including defaulting member’s primary contribution to SGF(s) b. Insurance, if any. c. SGF in the following order: i. Penalties ii. Contribution of Clearing Corporation to the extent of at least 25% of SGF iii. Remaining SGF: Contribution of Clearing Corporation, Contribution of Stock Exchange and non- defaulting members’ primary contribution to SGF on pro- rata basis.

d. Resources of the Clearing Corporation (excluding USD 3 million or the capital requirement towards orderly winding down of critical operations and services) e. Capped additional contribution by non-defaulting members* f. Any remaining loss to be covered by way of pro-rata haircut to payouts** *Capped additional contribution shall be called by the Clearing Corporation from its members Subject to the approval of the Authority **In case loss allocation is effected through haircut to payouts, any subsequent usage of funds shall be with prior approval of the Authority.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 45 | PageCHAPTER – V: PRODUCT SPECIFICATIONS AND RISK MANAGEMENT FRAMEWORK

30. DERIVATIVE CONTRACTS ON STOCK EXCHANGES IN GIFT-IFSC

30.1. The Stock Exchange(s) in IFSC shall obtain prior approval of IFSCA before introducing any derivative product for trading. The application for such approval shall, inter alia, include the following details:

30.1.1. the specifications and features of the proposed derivative contract

30.1.2. the economic purpose and intended use of the proposed contract

30.1.3. the expected contribution of the product to market development

30.1.4. the safeguards and risk management measures proposed to ensure market integrity, investor protection and orderly trading

30.1.5. details of the infrastructure of the Stock Exchange and surveillance systems for effective monitoring of trading in such contracts

30.1.6. the proposed clearing and settlement procedures and systems.

31. TRADING HOURS

31.1. The trading hours for all product categories shall be determined by the Stock Exchanges based on a cost-benefit analysis. However, such trading shall not exceed 23 hours and 30 minutes in a day and settlement shall be done at least once on a daily basis.

Provided that a Clearing Corporation shall ensure that, during trading hours, the Mark-to-Market losses on open futures contracts are adequately collateralized at regular intervals, based on its risk assessment framework.

32. RISK MANAGEMENT

32.1. The MII shall have maintain robust risk management systems and infrastructure for comprehensive management of risks, in accordance with regulation 33 of the MII Regulations.

32.2. The MIIs shall specify the risk management measures in alignment with the Principles for Financial Market Infrastructures by Committee on Payments and IFSCA - Master circular on Stock Exchanges & Clearing Corporations 46 | PageMarket Infrastructures (CPMI) and International Organization of Securities Commissions (IOSCO).

32.3. Such measures shall, inter alia, include the following:

32.3.1. A margin framework aligned with Principle 6 of the Principle for Financial Market Infrastructure (PFMI)

32.3.2. Position limits that are defined at client level, member level and market wide level. Any change in position limits shall be subject to prior approval of IFSCA

32.3.3. Collateral policies specifying the forms of collaterals and liquid assets acceptable to the Clearing Corporation)

32.3.4. Settlement frameworks including the settlement mechanism and determination of settlement price

33. SURVEILLANCE AND DISCLOSURES

33.1. The Stock Exchanges, in their capacity as first level regulators, shall maintain robust online surveillance systems with real-time monitoring capabilities over positions, prices and trading volumes, with a view to detecting and deterring market manipulation.

33.2. The surveillance systems of the Stock Exchanges shall be designed, having due regard to all the relevant aspects, including, inter alia, the following :

33.3. The alert framework within the online surveillance system shall be designed to automatically generate alerts indicating material deviations from normal market activity.

33.4. The parameters to be monitored, whether through the online surveillance system or otherwise, shall, inter alia, include the following:

33.4.1. Open interest, cost of carry/impact cost and volatility.

33.4.2. Closing prices.

33.4.3. Open positions in the derivatives market in conjunction with corresponding positions in the cash market, including monitoring of position deltas.

33.4.4. The timing of disclosure by corporates, given their potential impact on contract prices, particularly at the time of introduction and expiry.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 47 | Page33.4.5. Strike prices with significant open positions, particularly in the context of their potential influence on contract prices at the time of introduction and expiry.

33.4.6. Strike prices with significant open positions, where such levels may act as target prices in the cash market to maximize gains from derivative positions.

33.5. The surveillance systems and processes sall be capable of the following:

33.5.1. Capturing and processing client level information.

33.5.2. Developing and maintaining comprehensive databases of trading activity at the level of Broker Dealers and clients.

33.5.3. Generating trading patterns in individual products or group of products over a period of time, at both the Broker Dealer level and at the client or group of clients level.

33.5.4. Analysing trading patterns in a product over a period of time, including details of purchases, sales, positions and open interest held by various Broker Dealers or clients or groups of clients.

33.5.5. Monitoring the proportion of trading in the derivatives market vis-a -vis the underlying cash market and identifying aberrations relative to historical trends and market averages.

33.5.6. Monitoring large trades, put-call ratios and exercise patterns.

33.6. Examination of trading activity in the derivatives market shall be undertaken in conjunction with surveillance of the cash market and vice versa.

33.7. While surveillance systems may generate significant volumes of data, such output shall constitute only the initial step in analysing market behaviour for the identification of potential risks. Stock Exchange surveillance personnel shall undertake timely and effective analysis of the information generated and maintain proper documentation of such analysis. All such documentation shall be duly authenticated and verified by a designated authority of the Stock Exchange.

33.8. The Stock Exchanges shall adopt a risk-based approach for the inspection of Broker Dealers. The inspection framework shall be based on a weighted risk matrix that, inter alia, takes into account:

33.8.1. The nature and extent of proprietary and client trading activity.

33.8.2. Client profile, including demographic and associated risk factors.

33.8.3. The number and nature of complaints received against the Broker Dealer.

33.8.4. Historical patterns of risk management related defaults and regulatory violations.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 48 | Page33.9. The findings arising from such inspections shall be appropriately integrated into the real-time surveillance systems of the Stock Exchange to strengthen ongoing market oversight.

33.10. The Clearing Corporation shall ensure that critical data generated during risk management and settlement cycles is incorporated into the overall market surveillance framework. Such data shall, inter alia, include:

33.10.1. recurring default patterns in specific contracts or securities

33.10.2. extraordinary risk measures necessitated by periods of heightened market volatility

33.11. The Stock Exchanges shall mandate the submission of information by the Broker Dealers through standardized electronic formats. All such submissions shall be digitally signed and authenticated by the Principal Officer or a Designated Officer or authorized signatory of the Broker Dealer. Manual or non-standardized submissions shall be permitted only in exceptional circumstances and with prior written approval of the Stock Exchange.

33.12. Systems for monitoring derivatives transactions shall maintain an online archive of all trading parameters for a rolling period of at least one year. Such data shall be readily retrievable for comparative analysis without undue delay.

33.13. In cases where the underlying securities of derivatives contracts are listed on multiple Stock Exchanges and Broker Dealers hold membership across such Exchanges, the Stock Exchangesshall, as deemed necessary, share relevant information to mitigate systemic risk and prevent market abuse across fragmented markets. Such information sharing shall, inter alia, include:

33.13.1. Concentrations of large open interest in derivatives contracts

33.13.2. Anomalous trading activity, including significant fluctuations in price, volume or volatility that trigger internal surveillance alerts

33.13.3. Trading patterns of Broker Dealers holding memberships across multiple Stock Exchanges IFSCA - Master circular on Stock Exchanges & Clearing Corporations 49 | PageCHAPTER – VI: ADMINISTRATION OF STOCK EXCHANGES AND CLEARING CORPORATIONS

34. GOVERNANCE

34.1. MIIs shall be subject to the governance norms as specified in the Chapter III of the MII Regulations.

34.1.1. As per MII Regulations, the governing board of a recognised market infrastructure institution shall include Non-Independent Directors (NID), Public Interest Directors (PIDs), and Managing Director.

34.1.2. The Governing Board of the MII shall have the following qualifications and

experience:

34.1.2.1. The Governing Board shall consist of directors having the requisite qualifications and experience in the areas of capital markets, finance and accountancy, legal and regulatory practice, technology, risk management and management or administration

34.1.2.2. The Governing Board shall consist of at least one PID having the requisite

qualification and experience in each of the areas of : a) capital markets, b) finance and accountancy, c) legal and regulatory practice, and d) technology.

Provided that the MII may also appoint directors having qualification and experience in other specialised areas which may be relevant to their functioning.

35. PROCEDURE FOR APPOINTMENT OF DIRECTORS

35.1. The person desirous of being appointed as Director on the Governing Board of an MII shall submit the details as mentioned in the Annexure-VIII to the MII.

35.2. The MII shall forward the above details to the Authority while recommending their names along with the minutes of the Governing Board meeting where their name(s) was approved, copy of the shareholders’ resolution (wherever applicable) and a confirmation by the MII that they are fit and proper IFSCA - Master circular on Stock Exchanges & Clearing Corporations 50 | Pagepersons in terms of the fit and proper criteria, are not associated with any Broker Dealer or clearing member in terms of regulation 24(2)(e) read with regulation 2

(1) (a) of the MII Regulations and compliance with the requirements related to experience and qualification of the Directors stated in clause 34.1.2.2 of this

circular.

36. APPOINTMENT PROCESS OF A PID

36.1. The process for appointment of PID shall be as under:

36.1.1. The Nomination and Remuneration Committee (NRC) shall identify at least two candidates for each vacancy of a PID, considering the eligibility criteria

and other factors stipulated herein:

Provided that prior consent in writing shall be obtained from all the candidates before shortlisting them.

36.1.2. The NRC shall assess the suitability of the candidates based on their profile, inter alia, including educational background, work experience and accordingly recommend their names to the Governing Board.

36.1.3. The Governing Board shall carry out an independent assessment of the candidates based on the information provided by the NRC, and may seek additional information, if required.

36.1.4. In the event the candidates recommended by the NRC are unable to meet the independent assessment criteria of the Governing Board, the Governing Board shall instruct the NRC to recommend another candidate, till the time at least two candidates are shortlisted by it.

36.1.5. The names along with brief profile of all the candidates shortlisted by the Governing Board shall be submitted by the MII to the Authority for its approval.

Explanation I.- It is hereby clarified that in case the requirement of appointment of new PID arises due to the office falling vacant upon expiry of the term, an application for appointment of a new PID shall be submitted by the MII to the Authority, at least two months prior to such vacancy falling due.

Explanation II.- In case the position falls vacant due to any exigency, the competent authority may consider such application for appointment of a new PID.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 51 | Page36.1.6. The Authority may select one of the shortlisted candidates for appointment as PID on the Governing Board of the MII.

36.1.7. In the event the Authority is not satisfied with the names proposed by the MII, the Authority may either instruct the MII to shortlist and submit names of alternate candidates, or the Authority itself may nominate a person as a PID on the Governing Board of the MII, in accordance with sub-regulation

(2A) of regulation 24 of the MII Regulations.

36.1.8. The MIIs shall obtain such additional information and documents as specified in Annexure-VIII from the person selected for appointment as PID, and shall submit the same to the Authority for its approval.

Explanation. - For the purpose of this Clause, it is hereby clarified that for appointment of PIDs, the MIIs shall not be required to obtain approval of its shareholders.

37. REAPPOINTMENT OF A PID

37.1. In the case of reappointment of an existing PID, the MII shall make an application

to the Authority at least two months prior to the expiry of the term of such PID:

Explanation. - Application for reappointment of existing PID shall be submitted

after due consideration of the following:

(i) the diversity of experience in the areas specified under clause 34 of this

circular and experience in participating in the Governing Board; and

(ii) performance review conducted by the NRC, in accordance with clause 38 of this Circular.

37.2. Additionally, such an application for reappointment shall be accompanied with information pertaining to the participation of the PID in the meetings of various internal Committees, the Governing Board, and any other information as may be required by the Authority.

37.3. The existing PID, may continue to hold office for a maximum period of three months from the date of expiry of their term or till a new PID is appointed, whichever is earlier, only if the Governing Board does not meet the mandatory regulatory requirements in relation to its constitution as specified under clause

(b) of sub-regulation (2) of regulation 24.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 52 | Page38. PERFORMANCE REVIEW OF PIDS

38.1. The MII shall frame the performance review policy for the PIDs ensuring the

following:

38.1.1. The policy shall, inter alia, include criteria and calculation methodology for such an evaluation.

38.1.2. The policy and any changes made therein shall be approved by the Governing Board.

38.2. A comprehensive and objective approach shall be adopted while undertaking performance review of PIDs, which shall, inter alia, include:

38.2.1.1. Prior responsibilities as a PID;

38.2.1.2. Domain expertise/experience in technology/ law/ finance and accounts/ capital market/ other specialised areas;

38.2.1.3. Sufficient mix of skillsets on the Governing Board;

38.2.1.4. General competencies and personal attribute-related parameters.

39. KNOWLEDGE UPGRADATION OF PIDs

39.1. The MIIs, in coordination with reputed institutions, may organize training programs in the areas of capital markets, technology, regulatory responsibilities, or any other relevant areas for the PIDs.

39.2. The MIIs shall provide adequate training to all their PIDs, every year.

40. APPOINTMENT OF MANAGING DIRECTOR

40.1. The Nomination and Remuneration Committee of the recognized MII shall be responsible for selection of CEO /Managing Director, as the case may be. The Managing Director shall be selected through open advertisement.

40.2. The MII shall forward the new names to the Authority before two months from the last working day of the existing Managing Director.

40.3. In case a vacancy of Managing Director arises due to unforeseen reasons, the MII shall forward the new names to the Authority within 60 days from the date of submission of resignation or such vacation of office.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 53 | Page41. STATUTORY COMMITTEES

41.1. Regulation 26 of the MII Regulations, inter alia, requires an MII to constitute functional committees, oversight committees and other committees.

41.2. The overarching principles for composition and quorum for the statutory

committees at MIIs shall be as under:

Composition of Statutory Committees at MIIs Sr. No. Name of Composition Statutory Committee

1. Member a. The Committee may include two Key Management Committee Personnel (KMP), including the Managing Director

(MC) (MD), Non-Independent Directors (NIDs) (who is not an employee of the MII) along with Public Interest Directors (PIDs). b. The committee shall be chaired by the PID with experience in Capital Markets.

2. Nomination & a. The Committee may include NIDs (who is not an Remuneration employee of the MII), IEPs along with PIDs.

Committee b. IEPs may be part of the committee for the limited

(NRC) purpose of recommendation relating to selection of the MD.

3. Standing a. The Committee may include the MD, NIDs (who is Committee on not an employee of the MII), at least 2 IEPs along Technology with PIDs.

(SCOT) b. The IEPs should be proficient in technology with at least one of them being an expert and practitioner in cyber security. c. The Chief Technology Officer (CTO) and Chief Information Security Officer (CISO) should be invitees to the meetings of the Committee.

d. The committee shall be chaired by the PID with experience in technology.

4. Regulatory a. The Committee may include NIDs (who is not an Oversight employee of the MII) and IEPs, along with PIDs.

Committee b. Relevant KMP(s) may be invited to the meetings

(ROC) of the committee, whenever required. c. The Committee shall be chaired by the PID with experience in legal and regulatory practices.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 54 | PageComposition of Statutory Committees at MIIs Sr. No. Name of Composition Statutory Committee

5. Risk a. The Committee may include the MD, NIDs (who Management is not an employee of the MII) and IEPs, along Committee with PIDs.

(RMC) b. The Chief Risk Officer (CRiO) and CISO should be invitees to the meetings of the Committee. c. If a PID with experience in risk management is present in the governing board, the committee may preferably be chaired by the said PID.

6 Audit a. The Audit Committee shall comprise a Committee minimum of three directors with PIDs forming a majority b. Chairperson shall be a person with an ability to read and understand the financial statements

41.3. In any statutory committee, the total number of PIDs shall not be less than the total number of other members of the Committee (including IEPs) put together.

In case of SCOT, the total number of PIDs shall not be less than the total number of other members of the Committee, excluding IEPs.

41.4. The Chairperson of each statutory committee at the MII shall be a PID.

41.5. The voting on a resolution in the meetings of the statutory committees at MII shall be valid only when the number of PIDs that have casted their vote on such resolution is not less than the total number of other members put together who have casted their vote on such resolution.

41.6. The invitees, if any, to the meetings of the Committees shall not have any voting rights.

41.7. The casting vote in the meetings of the statutory committees shall be with the Chairperson of the committee.

41.8. All significant and material decisions of the Committee shall be deliberated and resolved exclusively through duly convened meetings, whether held physically or virtually. The use of circular resolutions shall be limited to routine, administrative, or urgent matters that do not require substantial deliberation and discussions among the committee members.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 55 | Page41.9. The terms of reference of the statutory committees are as under:

S.N. Name of Brief terms of reference Committee

(I) Functional Committees

1. Member (I) On admission, transfer and surrender of Committee membership/Withdrawal and Change in control

(MC) a. Formulate the policy to scrutinize, evaluate, accept or reject applications for admission of members, transfer of membership and approve surrender of membership or withdrawal and Change in Control.

b. The activities with regard to scrutinizing, evaluating, accepting or rejecting applications for admission, transfer, surrender, withdrawal and change in control of membership can be implemented through an Internal Committee (IC) under MC.

c. Define the Standard Operating Procedure (SOP) for the IC, including the timelines to be followed by IC, its composition, standardize criteria to scrutinize, evaluate, accept and grounds for rejection of applications, and other associated aspects to ensure uniformity and consistency while dealing with applications or cases. For scenarios not covered in the SOP, IC should seek approval of MC.

d. Oversee the implementation of the membership policy by the IC, including its timelines, uniformity and consistency in approach, based on quarterly report submitted by IC. MC shall continue to be responsible and accountable for the activities of the IC.

(II) On Regulatory Actions: e. Ensure that the MIIs have detailed SOP and processes in place towards monitoring the activities of its members through inspections. f. Ensure that there is mechanism for monitoring of the members on various parameters including through adoption of technology and take necessary action for non-compliance.

g. Formulate the policy for regulatory actions including warning, monetary penalty, suspension, withdrawal of membership, declaration of default, expulsion, etc. to be taken by the MII for various violations by the members. The policy should have an SOP for undertaking such actions.

h. Based on the laid down policy, consider all cases of violations IFSCA - Master circular on Stock Exchanges & Clearing Corporations 56 | PageS.N. Name of Brief terms of reference Committee observed and impose appropriate regulatory measures on the members.

i. For enforcement actions against violations, where no discretion of MC is involved, the same could be delegated to an IC,

provided corresponding regulatory action, including penalty amount, if any, is standardized in the policy framed by MC or through a circular issued by the MII or IFSCA. If the same is delegated, quarterly report in this regard should be placed before MC by the IC. However, for scenarios which require immediate regulatory action, the MII shall inform the MC post imposition of such actions.

j. Oversee the regulatory actions taken by IC, if delegated, including evaluating that no discretion has been exercised in the process. For any violation by IC, MC will be responsible and liable for the same.

k. While imposing the regulatory measure, the Committee shall adopt a laid down process, based on the ‘Principles of natural justice’ and 'Principle of proportionality'. The 'Principle of natural justice' may be extended by the MC/IC, as applicable.

l. Any review, appeal or waiver of penalty filed shall be placed before MC for its consideration.

(III) On Defaulter Members of MIIs: m. Formulate the policy to realize all the assets, and deposits of the defaulter or expelled member and appropriate the same amongst various dues and claims against the defaulter or expelled member in accordance with the Rules, Byelaws, Regulations of the MII and applicable regulatory provisions.

n. The activities with regard to realization of assets and deposits of the defaulter or expelled member and appropriation of the same amongst various dues and claims against the defaulter or expelled member, etc. can be implemented through an IC under MC.

o. Define the SOP for the IC, including the timelines to be followed by IC and its composition. For scenarios not covered in the SOP, IC should seek approval of MC. p. In the event both the broker dealer and the constituent clearing member are declared defaulter, then the MC of the Stock Exchange and that of the Clearing Corporation shall work together to realize the assets of both the trading member and IFSCA - Master circular on Stock Exchanges & Clearing Corporations 57 | PageS.N. Name of Brief terms of reference Committee the clearing member.

q. Admission or rejection of claims of client or trading members or clearing members over the assets of the defaulter or expelled member.

2. Nomination & (I) Governing Board & its Member related aspects:

Remuneratio n Committee a. Scrutinizing and interviewing applicants to select the MD of the

(NRC) MII. b. Assessment of applications of new or existing PIDs and NIDs for their appointment and/or reappointment and recommending their names to the Governing Board. c. Always ensuring that the governing board comprises of directors with required skill set and experience.

d. Framing & reviewing the policy to carry out internal evaluation of every director’s performance, including. e. Reviewing and recommending extension of the term of appointment and re-appointment of existing PIDs.

f. Appointment of Independent External Professionals (IEPs).

(II) KMPs related aspects: g. Identifying the KMPs as per the definition of KMP in the MII Regulations and review the same, at least, once a year in

order to identity KMPs due to change in roles and responsibilities h. The appointment and removal of KMPs other than resignations. i. Laying down policy for accountability of KMPs. Further, mapping legal and regulatory duties to the concerned position and Delegation of Power (DoP) at various levels.

j. Laying down the policy for compensation of KMPs and ensuring that the compensation paid to KMPs is as per the compensation policy. k. Framing performance review parameters for evaluation of KMPs including that of MD.

l. Assess the performance of KMPs based on reports submitted by the functional heads/reporting authority, and observations, if any, received from IFSCA, and submit such reports to the governing board every year.

m. Determining the tenure of a KMP, other than a director, to be posted in a particular role within regulatory, legal, IFSCA - Master circular on Stock Exchanges & Clearing Corporations 58 | PageS.N. Name of Brief terms of reference Committee compliance, risk management and investor grievance vertical.

n. Determining and finalizing the Key Result Areas (FRAs) of all KMPs at the beginning of every year. Review the same in line with organization needs. o. Ensuring that no KMP reports to a non-KMP.

(III) On other organization level related aspects: p. Ensure that no employee of the MII is working or reporting to an employee of any other company where the MII has invested and vice-versa. q. Ensure that hiring of consultants is based on a pre-defined SOP of the MII.

r. Framing, reviewing, implementing and monitoring SOP for imposing disciplinary actions against employees of the MII. s. Besides the above, it will also discharge the function as Nomination & Remuneration Committee under the Companies Act, 2013.

(II) Oversight Committees

2. Standing a. Ensure the availability of required IT infrastructure for core Committee on and critical functions under verticals for “Critical operations” Technology and “Regulatory, legal, compliance, risk management and

(SCOT) investor grievances”. b. Ensure existence of adequate Business Continuity Plan (BCP) and Disaster Recovery (DR) plans. c. Ensuring sound and prudent policies, standards and procedures for managing technology risks and safeguard information assets in the MII.

d. Review the implementation of technology risk management framework and strategy of MII. e. Monitor whether the technology used remains up to date and meets the growing demands of the markets. f. Periodic review of the IT system and network architecture design to identify any weaknesses in the existing design.

g. Review of in-house availability of appropriate IT staff to manage IT systems and related outsourcing arrangement. h. Monitor the adequacy of systems capacity and efficiency. i. To look into the changes being suggested by the MII to the existing software or hardware.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 59 | PageS.N. Name of Brief terms of reference Committee j. Oversee investigations into issues related to computerized trading/ clearing & settlement/ depository system, such as hanging, slowdown, breakdown, etc.

k. Ensure that transparency is maintained in disseminating information regarding slowdown or breakdown in these systems and ensure that the MII issues a press release specifying the reasons for any such breakdown.

l. Approve Root Cause Analysis (RCA) of any stoppage of trading/ clearing & settlement/ depository system and report to the governing board and IFSCA. m. Review the implementation of board approved cyber security and cyber resilience policy.

n. Review the identification and classification process of critical assets based on their sensitivity and criticality for business operations, services and data management. o. Ensuring that the scope of the system audit, cyber audit and VAPT of the MII is broad and representative of all critical areas of the Stock Exchange.

p. Monitoring the results of periodic cyber security and DR drills conducted by the MII. q. Review and approve the report regarding overall cyber security posture and technology implementation at the Stock Exchange and submit to the governing board. Upon approval by the governing board, submit the report to IFSCA.

r. On the above areas, the Committee shall submit a report to the Governing Board of the MII for necessary action, if any. s. Such other matters as may be referred by the Governing Board of MII and/or IFSCA.

4. Regulatory Oversee the matters related to the following:

Oversight A. For Stock Exchange:

Committee

(ROC) a. Surveillance and Investigation: i. Oversight of market through order and trade level alerts, security level alerts, processing of alerts, price band changes, rumour verifications, shifting of securities to trade for trade segment, action against listed companies as a part of Surveillance Action, detailed investigations undertaken, disciplinary actions, development of new alerts based on learnings from past or ongoing cases, etc..

ii. Requests, received from members of Stock Exchange, for IFSCA - Master circular on Stock Exchanges & Clearing Corporations 60 | PageS.N. Name of Brief terms of reference Committee review of decision taken by Stock Exchange regarding annulment of trades and provide its recommendation within 30 days of receipt of request by the Stock Exchange.

b. Listing of Securities: Oversight of admission of securities for trading, suspension, revocation, delisting, etc. c. Compliance: i. Oversee and monitor implementation of MII Regulations and other applicable rules and regulations along with IFSCA Circulars/ Guidelines and other directions issued thereunder.

ii. Review the observations arising from various IFSCA inspections, ensuring its advisories and findings are appropriately and timely addressed, and reports to governing board on timely basis. d. Code of Conduct:

i. Lay down procedures for implementation of the code of conduct and specify the reporting formats for disclosures required under the code of conduct. ii. Oversee the compliance of the code of conduct by KMPs and members of statutory committees (except directors) iii. Periodically oversee the dealings in securities by KMPs and IEPs.

iv. Periodically oversee the trading conducted by firms or corporate entities in which the directors of the Stock Exchange hold twenty percent or more beneficial interest or hold a controlling interest.

v. While monitoring trades by KMPs and members of statutory committees, ROC shall take into consideration sensitive information held by them as per structured digital database maintained by Stock Exchange.

e. Ensure the adequacy of resources dedicated to functions under verticals for “Critical operations” and “Regulatory, legal, compliance, risk management and investor grievances”. f. Grievance Redressal Mechanism:

i. Define policy and SOP for dealing with complaints by Stock Exchanges in compliance with the IFSCA circular dated December 02, 2024 on “Complaint Handling and Grievance Redressal by Regulated Entities in the IFSC” IFSCA - Master circular on Stock Exchanges & Clearing Corporations 61 | PageS.N. Name of Brief terms of reference Committee ii. Review of complaint resolution process, complaints remaining unresolved over long period of time, etc.

g. Ensuring that Stock Exchanges take proactive actions in case of repeated nature of complaints against particular trading members. h. Whistleblower Mechanism: i. Frame the Whistle Blower Policy to be approved by the governing board.

ii. Communicate the whistle blower policy internally to all persons and display the same on the Stock Exchange website. iii. Review the whistle blower policy based on feedback received. i. Fees and Charges:

i. Review the fees and charges levied by the Stock Exchange, including commenting on its appropriateness, on a periodic basis as well as each time there is change. ii. Review Liquidity Enhancement Scheme including reduction or waiver of transaction fees, etc., its justification and impact.

j. Oversee contribution of the Stock Exchange towards Settlement Guarantee Fund (SGF) of the Clearing Corporation. k. Oversee matters related to product design and review the design of the already approved and running contracts.

B. For Clearing Corporation: a. Compliance: i. Oversee implementation and compliance with MII Regulations as amended from time to time and other applicable rules and regulations along with IFSCA Circulars/Guidelines and other directions issued thereunder.

ii. Review the observations arising from various IFSCA inspections, ensuring its advisories and findings are appropriately and timely addressed, and reports to governing board on timely basis.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 62 | PageS.N. Name of Brief terms of reference Committee iii. Monitor and assess the Clearing Corporation against the PFMIs on an annual basis and submit a report to the governing board of the Clearing Corporation.

b. Code of Conduct i. Lay down procedures for implementation of the code of conduct and specify the reporting formats for disclosures required under the code of conduct. ii. Oversee the compliance of the code of conduct by KMPs and members of statutory committees (except directors).

iii. Periodically oversee the dealings in securities by KMPs and IEPs. iv. Periodically oversee the trading conducted by firms or corporate entities in which the directors of the Clearing Corporation hold twenty percent or more beneficial interest or hold a controlling interest.

v. While monitoring trades by KMPs and members of statutory committees, ROC shall take into consideration sensitive information held by them as per structured digital database maintained by Clearing Corporation.

c. Ensure the adequacy of resources dedicated to functions under verticals for “Critical operations” and “Regulatory, legal, compliance, risk management and investor grievance”. d. Grievance Redressal mechanism:

i. Define policy and SOP for dealing with complaints by Clearing Corporation. ii. Review of complaint resolution process, complaints remaining unresolved over long period of time, etc. iii. Ensuring that Clearing Corporations take pro-active actions in case of repeated nature of complaints against particular CMs, if any.

e. Whistleblower Mechanism: i. Frame the Whistle Blower Policy to be approved by the governing board. ii. Communicate the whistle blower policy internally to all persons and display the same on the Clearing IFSCA - Master circular on Stock Exchanges & Clearing Corporations 63 | PageS.N. Name of Brief terms of reference Committee Corporation’s website.

iii. Review the whistle blower policy based on feedback received. f. Review the fees and charges levied by a Clearing Corporation including comments on its appropriateness, on a periodic basis as well as each time there is change.

Manage the SGF of the Clearing Corporation, including its investments as per norms laid down and ensure proper utilization of SGF.

5. Risk a. Formulate a detailed Risk Management Framework (RMF) Management which shall be approved by the governing board of the MII to Committee ensure continuity of operation at all points of time.

(RMC) b. The RMF shall include the following: i. The framework for identification of internal and external risks. ii. Measures for risk mitigation including systems and processes for internal control. iii. Business continuity plan c. Monitor each risk associated with the functioning of the MII more specifically for functions under vertical 1 and 2.

d. Review the RMF & Risk Mitigation Measures at least once annually taking into account the changing industry dynamics and evolving complexity. e. Monitor and review enterprise-wide risk management plan and lay down procedures to inform the governing board about the risk assessment and mitigation procedures.

f. RMC shall coordinate with other committees. In case of overlap with activities of other committees, RMC may consider views of such committees. g. Monitor implementation of the RMF and also keep the governing board informed about implementation of the RMF and deviation, if any.

h. Approve the Half-Yearly Risk report to be submitted by the Chief Risk Officer (CRiO) to IFSCA and the governing board of the MII. i. Evaluate each investment and divestment proposals, whether requiring infusion of funds or otherwise, except treasury investments.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 64 | PageS.N. Name of Brief terms of reference Committee j. Evaluate proposals of capital expenditure. k. Make detailed analysis of existing investments.

l. Comply with the roles and responsibilities provided under the Companies Act 2013.

41.10. The functions or terms of reference of any statutory committee cannot be delegated. However, for the Member Committee (MC) of MIIs, certain operational activities of the Committee can be delegated to Internal Committee(s) (ICs). In such cases the ICs shall at least have one member from the MC, other than KMPs.

41.11. MIIs shall lay down the policy for the procedure for conducting of meetings, frequency of meetings, timelines for placing of agenda papers, etc., of their statutory committees.

41.12. If certain activities of the MII are not covered under the TOR of statutory committees, the governing board of the MII shall be directly responsible for the functioning and oversight of such activities. Further, in order to ensure accountability within the MII, the governing board and each statutory committee shall identify the KMP(s) or employees for executing the responsibilities assigned to them by the governing board or statutory committees.

41.13. Further, MIIs shall ensure compliance with the following: a. PIDs in Statutory Committees at MIIs: i. PIDs on the governing board of a MII shall not act simultaneously as a member on more than five statutory committees of the MII.

ii. The above restrictions shall not be applicable to committees constituted under other relevant laws such as The Companies Act, 2013, or other regulations issued by the Authority, etc. iii. MIIs shall ensure availability of the required number of PIDs in order to fulfil the requirement of composition of statutory committees.

b. IEPs in Statutory Committees at MIIs: i. The IEPs forming a part of statutory committees shall be from amongst the persons of integrity, having a sound reputation and not having any conflict of interest. They shall be specialists in the field of work assigned to the committee; however, they shall not be associated in any manner with the IFSCA - Master circular on Stock Exchanges & Clearing Corporations 65 | Pagerelevant MII, its associates, its subsidiaries, any other entity associated with the MII and its members.

ii. MIIs shall frame the guidelines for appointment, tenure, code of conduct, etc., of IEPs. Extension of the tenure may be granted to IEPs at the expiry of the tenure, subject to performance review in the same manner as that of PIDs.

iii. The maximum tenure limit of IEPs in a committee of MII shall be at par with that of PIDs, as specified under Regulation 24(2)(h) of the MII Regulations,

2021. iv. IEPs shall not use or act on any sensitive information received in capacity as a member of the statutory committee for obtaining any undue benefit. c. The members of statutory committees shall abide by the code of conduct as applicable to them in terms of MII Regulations, 2021.

d. In the interest of securities market, IFSCA may suo moto nominate members on any statutory committee of the MIIs, if felt necessary. e. MIIs shall devise an internal mechanism to obtain regular feedback, inputs, suggestions, etc. on regulatory, non-regulatory and operational matters from various stakeholders including trading members, clearing members and depository participants, investors, etc.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 66 | PageCHAPTER - VII: PERIODIC REPORTING

42. MONTHLY ACTIVITY REPORTS / MONTHLY DEVELOPMENT REPORTS

42.1. The MII shall submit Monthly Activity Report and Monthly Development Report as per the format specified by the IFSCA. Such formats can be accessed at

https://ifsca.gov.in/Download. Such monthly reports shall be submitted within 7 working days from the end of month.

43. REPORTING REQUIREMENTS SPECIFIED IN THE MII REGULATIONS

43.1. The MIIs shall be subject to reporting requirements as specified in the MII Regulations which shall inter alia include submission of net worth certificate, report of Chief Risk Officer, Half yearly report of the Public Interest Directors and

Annual Return of the MII as under: a. Net worth certificate: as specified in regulation 15 of the MII Regulations (by the thirtieth day of September of every year for preceding financial year) b. Annual financial statements and return: as specified in regulation 64 of the MII Regulations (by the thirtieth of September of every year for preceding financial year) c. Report of chief risk officer on half-yearly basis as specified in regulation 63A of the MII Regulations: Within 45 days from the end of reporting period d. Half yearly report by public interest directors as specified in part-B of the schedule-I of the MII Regulations: within 60 days from the end of reporting period

44. SYSTEM AUDIT REPORT

44.1. The MIIs shall submit System Audit Report as specified in the Chapter-III of this Master Circular.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 67 | PageAnnexure-I FORM A [See regulations 5 and 12 and of MII Regulations] Application for recognition of Clearing Corporation under regulation 5/renewal of recognition of Clearing Corporation under regulation 12 of the International Financial Services Centres Authority (Market Infrastructure Institutions) Regulations, 2021.

To ………………………. ……………………….

Subject: Application for recognition of Clearing Corporation under regulation 5/ Application for renewal of recognition of Clearing Corporation under regulation 12 of the International Financial Services Centres Authority (Market Infrastructure Institutions) Regulations, 2021.

Sir,

1. We/I on behalf of ..................(name and address of Clearing Corporation) being a Clearing Corporation hereby apply for recognition/renewal of recognition for the purposes of the International Financial Services Centres Authority (Market Infrastructure Institutions) Regulations, 2021 (“the Regulations”).

2. Two copies of the rules, memorandum and articles of association relating in general to the constitution and management of the Clearing Corporation and two copies of the bye-laws for the clearing and settlement of contracts in securities are enclosed.

3. All the necessary information required in the Annexure to this Form is enclosed.

Any additional information will be furnished as and when called for by the Authority.

4. We/I, on behalf of the said Clearing Corporation, hereby undertake to comply with the requirements of regulation 8(3) of the Regulations and such other conditions and terms as may be contained in the certificate of recognition or be provided or imposed subsequently.

5. Remittance Receipt dated .......... for (amount of fees) is attached.

Yours faithfully, Authorised signatory IFSCA - Master circular on Stock Exchanges & Clearing Corporations 68 | PageANNEXURE TO FORM 'A' Part I — General

1. Name of the applicant Clearing Corporation.

2. Address.

3. Date of establishment or incorporation of a Clearing Corporation.

4. Is your Clearing Corporation a joint stock company (state whether public or private) registered under the Companies Act?

5. Give details of your capital structure and attach three copies of the audited balance sheets and profit and loss account of the Clearing Corporation for the preceding three years.

6. Give details of shareholding pattern of the Clearing Corporation.

7. Has your business viability plan been appraised by a reputed agency having expertise in securities market for its viability? Give a copy of the appraisal report.

8. Have you entered into an agreement with recognised Stock Exchange(s) for clearing and settling its trades? Give the name of such Stock Exchange(s) and details of its organisation and management.

Part II — Clearing membership of Clearing Corporation.

9. State the number of clearing members at the time of application. Also specify how many are inactive.

10. State whether there is any provision, resolution or convention for limiting the number of clearing members and whether in pursuance thereof you have fixed a ceiling on the number of clearing members that you would admit.

11. Do you insist on any minimum qualifications and experience before enrolling new clearing members? If so, give details.

12. State the different classes of clearing members, if any, the number thereof and the privileges enjoyed by each class. What is the procedure followed by your Clearing Corporation for the admission of different classes of new clearing members?

13. What are the rates of your annual subscription in respect of the different classes of clearing members?

14.Do you collect any security deposit from your clearing members? If so, give details and also state the manner in which such deposits are utilised and the rate of interest allowed, if any.

15.Do you collect any admission or entrance fees from your clearing members? If so, how much? IFSCA - Master circular on Stock Exchanges & Clearing Corporations 69 | Page16.Do you insist on your clearing members divesting themselves of other activities either as principal or as employee?

17. Give details of the scale of brokerage and other charges, if any, specified by your Clearing Corporation.

18.Do you specify standard form of agreement to be entered with the trading member for engaging the services of your clearing member? Attach two copies of such agreement.

19.What are the measures adopted by you to regulate or prohibit advertising or issuing circulars by your clearing members?

20.Do you require clearing members to supply such information or explanation and to produce such books relating to their business as your governing board may require?

21.Do you undertake periodic inspection of your clearing members? Give details including the number of annual inspections and manpower available for conducting inspection.

Part III — Governing Board

22.What is the present strength of your governing board? Give details of the constitution, powers of management, election and tenure of office of members of the governing board, and the manner in which its business is transacted.

23.Are any trade or commercial interest represented on your governing board? If so, give details of interests represented.

24.Do you associate members of investors associations with the management of your Clearing Corporation? If so, state the manner in which it is done.

25.Are there any Government or the Board representatives on your governing board? If so, furnish their names.

26.How many public interest directors are there on the governing board? Furnish their names, qualifications and experience.

27.Do your rules provide for the direct election by clearing members on the Advisory Committee of the governing board? If so, give details of its constitution, tenure, powers and functions.

28.Do you have any provision for the appointment of standing or ad hoc subcommittees of the governing board? If so, furnish details of their composition, appointment, term of office, powers and functions.

29.Give the designations, powers and duties of key management personnel of your Clearing Corporation. Give details as to the mode of their appointment, tenure of office and remuneration.

30.What are the disciplinary powers with the governing board to enforce due compliance by clearing members of the rules and bye-laws of the Clearing Corporation and generally to ensure proper standard of business conduct? IFSCA - Master circular on Stock Exchanges & Clearing Corporations 70 | Page31.What provisions have you made for the levy and recovery of fees, fines and penalties? Part IV — Clearing and Settlement

32.Describe the clearing and settlement system of the Clearing Corporation.

33.State the different kinds of products being cleared and settled or proposed to be cleared and settled in your Clearing Corporation (e.g., equity, equity derivative, currency derivatives, interest rate derivatives, debt instruments, etc.). State the period of delivery, payment and the settlement mechanism in each case.

34.What are the conditions subject to which trades are settled and cleared on your Clearing Corporation?

35.What are your requirements for admitting derivative transactions for clearing and settlement?

36.Do you have the right to prohibit, withdraw or suspend clearing and settlement of dealings admitted for clearing and settlement? If so, under what circumstances is this right exercised?

37.Give details of the clearing and settlement charges and other charges, if any, levied by your Clearing Corporation.

38.What provisions have you made for periodical settlement of contracts and differences thereunder, the delivery of, and payment for securities and the passing of delivery orders?

39. How do you fix, alter or postpone the dates of settlement?

40. Do you provide any safeguards for the prevention of market manipulation, especially in the case of physical delivery of shares in the derivative markets and for meeting emergencies in settlement? Give details.

41. Provide a detailed assessment of the measures adopted to address the various risks faced by the Clearing Corporation in terms of the BIS-IOSCO paper on 'Principles for Financial Market Infrastructures.'

42. Do you publish any statistics in regard to business done on the Clearing Corporation including the value of Settlement Guarantee Fund and transactions settled through the Clearing Corporation, if maintained? In particular, have you evolved any machinery for computing the gross and net exposure of the Clearing Corporation and the value of clearing and settling of different kinds of contracts permitted on your Clearing Corporation? Give details.

43. (a) Do you have any bye-laws, contravention of which makes a contract void?

(b) Do you have necessary infrastructure, margin mechanism and adequate risk management mechanism to ensure market safety and integrity? Give Details

(c) Do you undertake any other activity other than clearing and settling? Give Details.

(d) What is your net worth? Give Details.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 71 | Page(e) Give details of business hours?

(f) What are the conditions subject to which dealings are admitted for clearing and settlement?

44. Do you maintain Settlement Guarantee Fund? Give details of the corpus of the settlement guarantee fund, its contribution, circumstances for utilisation, priority of utilisation, etc

45. How do you ensure the adequacy of the Settlement Guarantee Fund? Do you perform stress tests on a periodic basis. Give details and results of the latest stress test.

46. What is the netting procedure adopted by the Clearing Corporation for determining the obligations of the clearing member?

47. What is your policy in respect of settling trades of shareholder Stock Exchange and non-shareholder Stock Exchange?

48. Do you have any provisions for regulating the volume of business and exposure taken by any individual clearing member other than through a system of margins? If so, give details.

49. What provisions have you made for regulating— (a) the entering into contracts, their performance and rescission (b) the consequences of breach, default or insolvency on the part of trading or clearing members whether acting as buyers, sellers or intermediaries? Part V — Infrastructure

50. Do you have any machinery for arbitration of disputes between clearing members and/or between clearing members and their constituents and trading member and clearing member? Give details.

51. Have you established connectivity with the depositories, clearing banks, Stock Exchange and clearing members? Give details.

52. What is the average load that is being handled by your systems? What is the peak load that can be handled and the extent of scalability of the systems in times of stress?

53. What is your business continuity plan? Give details including details of the disaster recovery site.

54. What are the names, qualifications and experience of your key management personnel? IFSCA - Master circular on Stock Exchanges & Clearing Corporations 72 | PageAnnexure-II Audit Process

1. For the System and Network Audit, the following broad areas shall be considered in

order to ensure that the audit is comprehensive and effective: a. The Audit shall be conducted according to the Norms, Terms of Reference (TOR) and Guidelines issued by the Authority. b. The Governing Board of the Market Infrastructure Institution (MII) shall appoint the Auditors based on the specified Auditor Selection Norms and TOR.

c. An Auditor can perform a maximum of 3 successive years. However, such auditor shall be eligible for re-appointment after a cooling-off period of two years. d. Further, during the cooling-off period, the incoming auditor may not include:

(i) Any firm that has common partner(s) with the outgoing audit firm; and

(ii) Any associate/ affiliate firm(s) of the outgoing audit firm which are under the same network of audit firms wherein the term "same network" includes the firms operating or functioning, hitherto or in future, under the same brand name, trade name or common control.

e. The number of years an auditor has performed an audit prior to this circular shall also be considered in order to determine its eligibility in terms of sub-clause c above. f. The scope of the Audit may be broadened by the Auditor to inter alia incorporate any new developments that may arise due to issuance of circulars/ directions/ advice by the Authority from time to time.

g. The audit shall be conducted once in a financial year and period of audit shall be 12 months. However, for the MIIs, whose systems have been identified as “protected system” by National Critical Information Infrastructure Protection Centre (NCIIPC), the audit shall be conducted on a half yearly basis and audit period shall be of 6 months.

h. In the Audit report, the Auditor shall include its comments on whether the areas covered in the Audit are in compliance with the norms/ directions/ advisory issued by the Authority, internal policy of the MII, etc. Further, the audit report shall also include specific non-compliances (NCs), observations for minor deviations and suggestions for improvement. The audit report shall take previous audit reports into consideration and cover any open items therein. The auditor should indicate if a follow-on audit is required to review the status of NCs.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 73 | Pagei. For each of the NCs/ observations and suggestions made by the Auditor, specific corrective action as deemed fit may be taken by the MII. The management of the MII shall provide its comments on the NCs, observations and suggestions made by the Auditor, corrective actions taken or proposed to be taken along with time-line for such corrective actions.

j. The Audit report along with the comments of management shall be placed before the Governing Board of the MII. The Audit report along with comments of the Governing Board shall be submitted to the Authority, within 5 months from the end of audit period.

k. The follow-on audit should be completed within one month of the corrective actions taken by the MII. After the follow-on audit, the MII shall submit a report to the IFSCA within 1 month from the date of completion of the follow-on audit. The report shall include updated Issue-Log to indicate the corrective actions taken and specific comments of the Auditor on the NCs and the corrective actions.

l. In cases wherein follow-on audit is not required, the MII shall submit an Action Taken Report (ATR) to the Auditor. After verification of the ATR by the Auditor, the MII shall submit a report to the Authority within 1 month from the date of completion of verification by the Auditor. The report shall include updated Issue- Log to indicate the corrective actions taken and specific comments of the auditor on the ATR.

m. The overall timeline from the last date of the audit period till completion of final compliance by MII, including follow-on audit, if any, should not exceed one year/6 months (as applicable). In exceptional cases, if Stock Exchange or Clearing Corpration is of the view that compliance with certain observations may extend beyond said period, then the concerned MII shall seek specific approval from the Governing Board.

Auditor Selection norms

2. The MII shall ensure compliance with the following norms while appointing Auditor: a. The auditor must have minimum 3 years of demonstrable experience in IT audit of securities market participants e.g. Stock Exchanges, Clearing Corporations, depositories, intermediaries, etc. and/ or financial services sector i.e. banking, insurance, Fin-tech etc.

b. The team performing system and network audit must have experience in / direct access to experienced resources in the areas covered under TOR. It is recommended that resources deployed by the Auditor for the purpose of system and network audit shall have relevant industry recognized IFSCA - Master circular on Stock Exchanges & Clearing Corporations 74 | Pagecertifications e.g. CISA (Certified Information Systems Auditor) from ISACA, CISM (Certified Information Securities Manager) from ISACA, GSNA (GIAC Systems and Network Auditor), CISSP (Certified Information Systems Security Professional) from International Information Systems Security Certification Consortium, commonly known as (ISC).

c. The Auditor shall have experience in working on Network Audit/IT audit/governance/IT service management frameworks and processes conforming to industry leading practices like CobiT/ ISO 27001 and beyond.

d. The Auditor should have the capability to undertake forensic audit and undertake such audit as part of system and network audit, if required. e. The Auditor must not have any conflict of interest in conducting fair, objective and independent audit of the Stock Exchange / depository/ Clearing Corporation. It should not have been engaged over the last three years in any consulting engagement with any departments / units of the entity being audited.

f. The Auditor should not have any cases pending against it, which point to its incompetence and/or unsuitability to perform the audit task. g. The proposed audit agency must be empanelled with CERT-In.

h. Any criteria, in addition to the aforesaid criteria, that the Stock Exchange or Clearing Corporation may deem fit for the purpose of selection of Auditor.

Audit Report Guidelines

3. The Audit report should cover each of the major areas mentioned in the TOR and compliance with Authority’s circulars/directions/advices, etc. related to technology.

The Auditor in the Audit Report shall give its views indicating the NCs to the standards or observations or suggestions. For each section, auditors should also provide qualitative inputs/suggestions about ways to improve the processes, based upon the best industry practices.

4. The auditor shall certify that entire network architecture, connectivity (including co- lo facility) and its linkage to the trading infrastructure are in conformity with SEBI’s regulatory framework to provide fair equitable, transparent and non-discriminatory treatment to all the market participants.

5. The report should also include tabulated data to show NCs / observations for each of the major areas in the TOR.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 75 | Page6. The audit report to include point-wise compliance of areas specified in Terms of Reference (TOR) and areas emanating from relevant IFSCA circulars/directions/advices along with any accompanying evidence.

7. Evidences should be specified in the audit report while reporting/ closing an issue.

8. A detailed report with regard to the system and network audit shall be submitted to the Authority. The report shall include an Executive Summary as per the following

format:

Issue Log Column Description Responsibility Heading Major Area Comprehensive identification of major Auditor/Auditee areas in compliance with guidelines of IFSCA and internal policies of MII Point wise Point-wise list of areas/relevant Auditor Compliance clauses in TOR against which compliance is being audited (in tabular format) Description of Describe the findings in sufficient Auditor Finding/ Observation detail, referencing any accompanying evidence (e.g. procedure manual, interview notes, reports etc.) Reference Reference to the section in detailed Auditor report – where full background information about the findings are available Process/ Unit Process or unit where the audit is Auditor conducted and the finding pertains to Category of Findings Major/Minor Non-compliance, Auditor Observation, Suggestion etc.

Audited By Which Auditor covered the findings Auditor Root Cause Analysis A detailed analysis on the cause of the Auditee Non-compliance Remediation The action (to be) taken to correct the Auditee Non-compliance Target Completion The date by which remedial action Auditor/Auditee Date for Remedial must be/will be completed Action Status Status of finding on reporting date Auditor/Auditee (open/close) Verified By Auditing personnel (upon verification Auditor that finding can be closed) IFSCA - Master circular on Stock Exchanges & Clearing Corporations 76 | PageIssue Log Column Description Responsibility Heading Closing Date Date when finding is verified and can Auditor be closed IFSCA - Master circular on Stock Exchanges & Clearing Corporations 77 | PageAnnexure-III System and Network Audit Program – Terms of Reference (TOR)

1. The scope of audit shall encompass all the IT resources including hardware, software, network, policies, procedures etc. of MII (Primary Data Centre (PDC), Disaster Recovery Site (DRS) and Near Site (NS).

2. IT environment

2.1. Organization details a. Name b. Address c. IT team size (in house- employees) d. IT team size (vendors)

2.2. IT and network set up and usage a. PDC, DRS, NS and Regional/ Branch offices (location, owned/ outsourced) b. Connectivity amongst PDC, NS and DRS c. IT infrastructure / applications pertaining to the activities done as d. MII e. System Architecture f. Network Architecture g. Telecommunication network

3. IT Governance

3.1. Whether IT Governance framework exists to include the following: a. IT organization structure including roles and responsibilities of key IT personnel; b. IT governance processes including policy making, implementation and monitoring to ensure that the governance principles are followed;

3.2. IT policies and procedures a. Whether the organization has a defined and documented IT policy? If yes, is it approved by the Governing Board (GB)? b. Is the current System Architecture including infrastructure, network and application components describing system linkages and dependencies, documented? IFSCA - Master circular on Stock Exchanges & Clearing Corporations 78 | Pagec. Whether defined and documented Standard Operating Procedures

(SOPs) for the following processes are in place? i. IT Assets Acquisition ii. Access Management iii. Change Management iv. Backup and Recovery Management v. Incident Management vi. Problem Management vii. Patch Management viii. Data Centre Operations ix. Operating Systems and Database Management x. Network Management xi. DRS Operations xii. Asset Inventory xiii. IT asset refresh/replacement policy xiv. Database Security xv. Interface Security xvi. Application Security xvii. Password Security

3.3. Whether the above mentioned SOPs is reviewed at periodic intervals or upon the occurrence of any major event? In this regard, whether any organization policy has been formulated by the MII?

4. Business Controls

4.1. General Controls for Data Centre Facilities a. Application Access – segregation of duties, database and application access etc. (Approved Policy clearly defining roles and responsibilities of the personnel handling business operations) b. Maintenance Access – vendor engineers c. Physical Access Controls – permissions, logging, exception reporting & alerts d. Environmental Controls – fire protection, AC monitoring, etc.

e. Fault Resolution Mechanism f. Folder Sharing and Back Up Controls – safeguard of critical information on local desktops g. Incidences of violations in the previous audit report and corrective action(s), if any, taken h. Any other controls, as deemed fit, by the MII

4.2. Software change control IFSCA - Master circular on Stock Exchanges & Clearing Corporations 79 | Pagei. Whether pre-implementation review of application controls (including controls over change management) was undertaken? j. Adherence to secure Software Development Life Cycle (SDLC) / Software Testing Life Cycle (STLC) standards/ methodologies k. Whether post implementation review of application controls was undertaken? l. Is the review of processes to ensure data integrity post implementation of new application or system followed by implementation team? m. User awareness n. Processing of new feature request o. Fault reporting / tracking mechanism & process for resolutions p. Testing of New releases / Bug-fixes – Testing process (automation level) q. Version Control – History, Change Management process etc.

r. Development / Test/ Production environment – Segregation s. New Release in Production – Promotion, Release note approvals t. Production Issues / disruptions reported in the previous audit report, root cause analysis & corrective actions taken, if any u. Software Development Stage v. Software Design to ensure adequate system capacity to enable functioning in a degraded manner in the event of a crash w. Any other controls, as deemed fit, by the MII

4.3. Data Communication/ Network Controls a. Network Administration – Redundancy, Monitoring, breakdown resolution etc. b. WAN Management – Connectivity provisions for business continuity c. Encryption during transmission d. Connection Permissions – Restriction on need to have basis e. Fallback Mechanism.

f. Multi factor authentication Incidences of access violations in the previous report & corrective actions taken, if any g. Any other controls, as deemed fit, by the MII

4.4. Security Controls a. Secured e-mail with other entities such as the Authority, other partners b. Email Archival Implementation

4.5. Access Policy and Controls a. Defined and documented policies and procedures for managing access to applications and infrastructure – PDC, DRS, NS, branches (including network, operating systems and database) and approved by relevant authority b. Review of access logs c. Access rights and roles review procedures for all systems d. Segregation of Duties (SOD) matrix describing key roles IFSCA - Master circular on Stock Exchanges & Clearing Corporations 80 | Pagee. Risk acceptance for violation of SOPs and alternate mechanism put in place f. Privileged access to system and record of logs, g. Periodic monitoring of access rights for privileged users h. Authentication mechanisms used for access to systems including use of passwords, One Time Passwords (OTP), Single Sign on, etc.

i. Any other controls, as deemed fit, by the MII

4.6. Electronic Document Controls

4.7. General Access Controls

4.8. Performance Audit a. Comparison of changes in transaction volumes since previous audit b. Review of systems (hardware, software, network) performance over the period c. Review of the current volumes against the last performance test and against the current system utilization

4.9. Business Continuity / Disaster Recovery Facilities a. Business Continuity Planning (BCP) manual, including Business Impact Analysis (BIA), Risk Assessment and Disaster Recovery (DR) process, Roles and responsibilities of Incident Response Team (IRT) /Crisis Management Team (CMT), employees, support/outsourced staff b. Implementation of policies c. Back-up procedures and recovery mechanism using back-ups d. Storage of Back-up (Remote site, DRS etc.) e. Redundancy – Equipment, Network, Site etc.

f. DRS installation and Drills - Management statement on targeted resumption capability (in terms of time required & extent of loss of data) g. Evidence of achieving the set targets during the DR drills in event of various disaster scenarios h. Debrief / review of any actual event when the DR/BCP was invoked during the year i. User awareness and training j. Is Recovery Time Objective (RTO) /Recovery Point Objective (RPO) during BIA documented? k. Is annual review of BCP-DR or in case of major change in business/infrastructure undertaken? l. Is quarterly review regarding implementation of BCP policy done by Standing Committee of Technology (SCOT) of the MII? m. Testing of BCP-DR plan through appropriate strategies including simulations, DR drills, system recovery, etc.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 81 | Pagen. Is the recordkeeping of quarterly DR drills, live trading sessions from DRS being maintained? o. Is BCP-DR policy document prepared and implemented in line with the Authority circular on BCP and DR of MII?

4.10. IT/Network Support & IT Asset Management a. Utilization Monitoring – including report of prior year utilization b. Capacity Planning – including projection of business volumes c. Capacity and performance management process for the network/systems d. IT (S/W, H/W & N/W) Assets, Licenses & maintenance contracts e. Comprehensive review of Assets life cycle management (Acquisition, commissioning, deployment, monitoring, maintenance and de commissioning) and relevant records related to it.

f. Insurance g. Disposal – Equipment, media, etc.

5. Entity Specific Software used for or in support of trading/clearing systems / peripheral systems and critical processes

6. Human Resources Management

6.1. Screening of Employee, Third party vendors / contractors

6.2. Onboarding

6.3. Offboarding

6.4. Consequence Management (Incident / Breach of policies)

6.5. Awareness and Trainings

6.6. Non-Disclosure Agreements (NDAs) and confidentiality agreement

7. Network Audit

7.1. The audit shall cover entire network infrastructure which shall inter alia includes physical verification and tracing of the connectivity paths, server configuration, physical checking wire to wire connectivity and configurations of computer networking devices etc.

7.2. The audit shall require tracing of the connectivity and network diagram based on the physical audit.

7.3. The audit shall cover the link, the path, device-level redundancy, no single-point failures, high availability, and fault tolerance aspects in the network.

7.4. The audit shall cover entire network that is used to connect members to the MII (POP, MPLS, VSAT, COLO, etc.)

7.5. The audit shall cover applications, internal networks, servers, etc. of the MII/offered by the MII to its members that are used for trading, risk management, clearing and settlement etc.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 82 | Page7.6. Network performance and design

7.7. Network Security implementation

7.8. Network health monitoring and alert system

7.9. Log management process

7.10. Service level definition for vendors/Service level management

7.11. Governance process for network service delivery by vendors

8. The results of all testing that was conducted before deployment of any IT system/application in production environment, shall be checked by auditor during system audit.

9. IT Vendor Selection and Management

9.1. Identification of eligible vendors

9.2. Dissemination process of Request for Proposal (RFP)

9.3. Definition of criteria of evaluation

9.4. Process of competitive analysis

9.5. Approach for selection

10. E-Mail system

10.1. Existence of policy for the acceptable use of electronic mail

10.2. Regulations governing file transfer and exchange of messages with external parties

10.3. Rules based on which e-mail addresses are assigned

10.4. Storage, backup and retrieval

11. Redressal of Technological Complaints

11.1. Ageing analysis of technology complaints

11.2. Whether all complaints received are brought to their logical conclusion?

12. Any other Item(s)

12.1. Electronic Waste Disposal

12.2. Observation(s) based on previous Audit Report(s)

12.3. Any other specific area(s) that may be informed by the Authority IFSCA - Master circular on Stock Exchanges & Clearing Corporations 83 | PageAnnexure-IV Format for monitoring compliance with requirements emanating from circulars/guidelines/advisories related to technology of IFSCA S. Technological Mechanis Non Compliance Timeline No requirement specified by m put in Complianc Status for taking . the IFSCA along with date place by e with (Open/Clos corrective of IFSCA the MII IFSCA e) action in

circular/guidelines/advis Guidelines case of ory open observatio ns IFSCA - Master circular on Stock Exchanges & Clearing Corporations 84 | PageAnnexure-V Exception Observation Reporting Format

Note: MIIs are expected to submit following information with regard to exceptional major non-compliances (NCs) / minor NCs observed in the System and Network Audit. MIIs should also categorically highlight those observations/NCs/suggestions pointed out in the System and Network Audit (current and previous) which are not yet complied with.

Name of the MII:

Name of the Auditor:

System and Network Audit Report Date:

Table 1 : For Preliminary Audit Audi Observati Descripti Departm Statu Risk Audi Root Impac Correcti Deadlin Managem Wheth t on No. on of ent of MII s/ Rating t Cause t ve e for the ent er perio finding Natur of TOR Analys Analys Actions correcti response similar d e of findin clau is is propose ve in case of issue findi g as se d by action acceptanc was ng per auditor e of observ Audito associated ed in r* risks any of the previo us 3 Audits IFSCA - Master circular on Stock Exchanges & Clearing Corporations 85 | Page*Risk Rating of finding - A rating has to be given for each of the observations based on its impact and severity to reflect the risk exposure as well as the suggested priority for action Rating Description HIGH Represents weakness in control with respect to threat(s) that is /are sufficiently capable and impacts asset (s) leading to regulatory non-compliance, significant financial, operational and reputational loss. These observations need to be addressed with utmost priority.

MEDIUM Represents weakness in control with respect to threat(s) that is /are sufficiently capable and impacts asset (s) leading to exposure in terms of financial, operational and reputational loss. These observations need to be addressed in reasonable timeframe.

LOW Represents weaknesses in control, which in combination with other weakness can develop into an exposure. Suggested improvements for situations not immediately/directly affecting controls.

Table-2: For follow on/ follow up system audit Preliminar Preliminar Preliminar Preliminar Preliminar Curren Curren Revised Deadline Reason for y Audit y Audit y y Status y t t Correctiv for the delay in Date Period Observatio Corrective Findin Status e Action, Revised implementation n Number Action as g if any Correctiv / compliance proposed e Action by Auditor IFSCA - Master circular on Stock Exchanges & Clearing Corporations 86 | PageAnnexure-VI Standard Operating Procedure (SOP) for handling of technical glitches Definition of “Technical Glitch”

1. Technical glitch shall mean any malfunction in the systems of an MII. Malfunction in the systems shall include malfunction in its (a) hardware, or; (b) software, or; (c) any products/ services provided by the MII, whether on account of inadequate infrastructure/ systems or otherwise, which may lead to either stoppage or variance in the normal functions/ operations of systems of the MII.

Reporting Requirements

2. The following reporting structure for technical glitches shall be adopted by the MII:

S. No. Disruption Reporting 1 No business disruption ▪ Standing Committee on Technology

(SCOT) ▪ Governing Board of MII 2 Business disruption ▪ Standing Committee on Technology

(SCOT) ▪ Governing Board of MII ▪ IFSCA

3. With regard to incidents resulting in business disruption, the following shall be

submitted by the MII to the IFSCA: i. Information of technical glitch on immediate basis but not later than 2 hours from the time of occurrence of the glitch; provided that glitches of the nature of a disaster - shall be reported immediately upon declaration of disaster.

ii. Preliminary report within 24 hours of the occurrence of the glitch. iii. Comprehensive Root Cause Analysis (RCA) report and corrective action taken to address the technical glitch within 21 days of the incident. Such report shall be submitted to IFSCA, after placing the same before the Standing Committee on Technology and the Governing Board of the MII and confirming compliance with their observations.

iv. RCA submitted by the MIIs should inter alia include exact cause of the technical glitch (including root cause from vendor(s), if applicable), exact duration of the technical glitch, chronology of events, list of business processes/systems and time for which they were impacted, recommendations of SCOT / Governing Board of MII, details of corrective/ preventive measures taken (or to be taken) by MII along with timelines and any other aspect relevant to the technical glitch. As part of the RCA, MIIs are required to demonstrate compliance with various requirements of IFSCA - Master circular on Stock Exchanges & Clearing Corporations 87 | Pagethis SOP. The RCA shall include details regarding time of incident, time when operations were restored and in the event of a disaster, time when disaster was declared

4. IFSCA on identification of the Technical Glitch resulting into Financial Disincentive to the MIIs, or upon receipt of the information of any such instance shall provide an opportunity to the concerned MIIs to make their submissions in respect of the facts of the case. The financial disincentives mentioned at Annexure-VII shall not be automatically levied. IFSCA, after taking into account the facts and circumstances of each case, shall decide on levying the financial disincentives including the quantum of levy – proportionately or otherwise.

5. The MII shall carry out internal examination pertaining to occurrence of technical glitches to ascertain individual accountability and take appropriate action including suitable recording and reckoning in the performance appraisal of those individuals.

IFSCA would retain the right to initiate enforcement action against the individuals at the MII, if there is sufficient ground to do so.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 88 | PageAnnexure-VII “Financial Disincentive” structure with regard to handling of technical glitches Failure to timely submit RCA

1. In case of delay in submission or submission of incomplete/ inadequate RCA by an MII, a “financial disincentive” of ‘up to USD 1,500 per working day’ shall be paid by the MII for each working day of delay from the timeline specified at Para 3 (iii) of Annexure VI above or any revised timeline specified by the IFSCA for submission of exact RCA.

Failure to timely address technical glitch

2. In order to ensure that MIIs address technical glitch within the specified timeline of IFSCA, the following progressive slab-wise “financial disincentive” shall be paid from the

expiry of the timeline:

S. No. No. of working days during which Financial disincentive to be paid by the failure continues MII 1 First 15 working days Up to USD 3,000 per working day 2 Subsequent 15 working days Up to USD 4,000 per working day in addition to S. No. (1) above 3 Beyond 30 working days Up to USD 35,000 in addition to S. No. (1) and (2) above Failure to declare disaster within stipulated timelines

3. It has been mandated that, in the event of disruption of any one or more of the ‘Critical Systems’, the MII shall, within 30 minutes of the incident, declare that incident as ‘Disaster’. In case of delay in declaration of disaster beyond the specified timeline, the following “financial disincentive” shall be paid:

S. Delay in declaration of disaster beyond Financial disincentive No. specified timeline 1 Financial disincentive on MII Maximum of 10% of average of standalone net profit for previous two financial years subject to a minimum of USD 5,000.

Failure to restore operations within Recovery Time Objective (RTO)

4. In the event of a disaster, if an MII fails to restore its operations within the RTO, i.e. to restore operations of ‘Critical Systems’ including from Disaster Recovery Site within 45 minutes of declaration of Disaster, the following “financial disincentive”

shall be paid:

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 89 | PageS. Failure to restore operations within Financial disincentive No. the specified RTO 1 Financial disincentive on MII Maximum of 10% of average of standalone net profit for previous two financial years subject to a minimum of USD 5,000.

“Financial disincentive” under Clause 3 and Clause 4 above, in relation to the same disaster, shall be paid only once either under Clause 3 or Clause 4.

5. Further, if an MII fails to restore operations of Critical Systems including from Disaster Recovery Site within three hours from the occurrence of the disaster, the following additional “financial disincentive” (over and above S No 3 or 4 above)

shall be paid:

S. Failure to restore operations of critical Financial disincentive No. operations within specified timelines 1 Financial disincentive on MII Maximum of 10% of average of standalone net profit for previous two financial years subject to a minimum of USD 5,000.

Failure to restore normalcy in cases of business disruption, not being in the nature of a Disaster

6. In the event of any business disruption, which is not required to be declared as “Disaster”, if a MII fails to restore normalcy of operations within 75 minutes of the incident, the following slab wise “financial disincentive” shall be paid by the MII:

S. No. Failure to Restore normalcy within Financial disincentive 1 75 minutes to 3 hours of the incident Up to USD 50,000 2 Beyond 3 hours of the incident Up to USD 100,000

7. The amount of “financial disincentive” paid as per the above structure shall be

credited by MII to the following funds maintained by it:

S. No. Financial Disincentive on MII Credit to Fund 1 Stock Exchange Investor Protection Fund 2 Clearing Corporation Settlement Guarantee Fund IFSCA - Master circular on Stock Exchanges & Clearing Corporations 90 | Page8. Further, the MII shall submit a compliance report within 90 days of occurrence of disaster/ business disruption to IFSCA providing details of payment of “financial disincentives” including computation of “financial disincentives” as per the SOP and the date when the amount was credited to the aforementioned funds.

9. MII shall disclose on their websites (and in their respective annual reports), the details of financial disincentive paid by them on account of technical glitches.

10. The financial disincentives triggered under predefined circumstances as stated in clauses 1, 2, 3, 4, 5, 6 above shall be paid by the MIIs. However, these financial disincentives shall be without prejudice to any action as may be initiated by the IFSCA.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 91 | PageAnnexure-VIII Following additional information and documents to be obtained by the MII from

the person approved for appointment as PID on the Governing Board: a) Name; b) Address; c) Educational qualification; d) Details of employment/ Occupation, past and present; e) Details of other directorships;

f) Director Identification Number; g) Declaration regarding fulfilment of the requirements specified under regulation 23 of the MII Regulations; h) Declaration confirming compliance with the requirements specified under regulation 24(2)(e)&(f) read with regulation 2 (1) (a) of the MII Regulations, in respect of non-association with Broker Dealer or Clearing Member or Depository Participant;

i) Details of any regulatory action, pending or completed taken by any statutory or regulatory authority against the person proposed to be appointed as directors; j) Details of activities which, in the opinion of the director, lead to his/her disqualification;

k) Association with Broker Dealers /Clearing Members/ Depository Participants in IFSC; l) Disclosure of the names of his/her dependents, if any, associated with the securities market in IFSC; m) An undertaking that he/she shall abide by the code of conduct as specified in Part B of Schedule I of the MII Regulations;

n) Consent letter for acting as a PID; o) Details of any criminal cases, pending or disposed off before any judicial/quasi-judicial/adjudicatory body or tribunal.

IFSCA - Master circular on Stock Exchanges & Clearing Corporations 92 | Page