The Securities and Exchange Board of India (SEBI) has issued a Cybersecurity and Cyber Resilience Framework (CSCRF) aimed at strengthening the cybersecurity posture of SEBI-regulated entities (REs). This framework, effective from January 1, 2025, addresses the evolving threat landscape and ensures that REs are equipped to withstand, respond to, and recover from cyber threats. Clarifications on the compliance timeline and data localisation provisions have been provided, with regulatory forbearance allowed until March 31, 2025, for certain non-compliances, provided REs make meaningful progress.

Background: In response to the growing risks associated with cyber threats and technological advancements, SEBI introduced the CSCRF to enhance the cybersecurity and resilience of REs. This measure is aimed at maintaining the integrity of the financial market by protecting IT infrastructure and data.

In Response

Regulatory Forbearance: SEBI has allowed a temporary grace period for compliance until March 31, 2025. During this time, REs demonstrating progress in implementing CSCRF will not face regulatory action.
Extended Compliance Dates: The compliance timeline for KYC Registration Agencies (KRAs) and Depository Participants (DPs) has been extended to April 1, 2025.
Data Localisation: The provisions related to data localisation have been temporarily suspended, pending further consultations and future notifications.