Sebi proposes extending cybersecurity rules to subsidiaries of MIIs

Sebi has proposed extending the IT and cyber security framework applicable to market infrastructure institutions to some of their subsidiaries, as the regulator seeks to close a possible gap in oversight over entities handling critical market systems, data and technology infrastructure.

The proposal is part of a consultation paper issued on September 11. Sebi has sought public comments by October 2.

Market infrastructure institutions, or MIIs, include stock exchanges, clearing corporations and depositories. These entities form the core plumbing of the securities market, making their technology systems critical for trading, clearing, settlement, investor records and market data.


Sebi said it has prescribed IT frameworks for MIIs over time to maintain uninterrupted securities market operations. With rising reliance on digital systems, the threat of cyberattacks has also increased, and attackers are using advanced technologies to exploit security gaps and gain unauthorised access to organisational data.

The regulator said its IT and cyber security frameworks mandate strict technology risk management for MIIs to protect market data, ensure operational continuity and prevent cyberattacks.

Also Read: CAS stays, but derivatives settlement may change, says Sebi chief Tuhin Kanta Pandey after another 1,000-point Sensex swing

The proposal comes as MIIs expand their operations and use subsidiaries for technology-driven and market-related activities. Sebi said such subsidiaries may operate in close coordination with the parent MII and may use shared technology infrastructure, applications, market data or other critical IT resources.

While MIIs themselves are governed by Sebi’s IT and cyber security framework, the applicability and regulatory jurisdiction of these frameworks over their subsidiaries is not explicitly defined. Sebi said clearer rules would ensure that IT systems and activities performed through such subsidiaries are properly covered under the regulatory framework.

The issue was discussed in Sebi’s Technical Advisory Committee meeting held on December 9, 2025.

The move is important because many core market activities are now deeply linked to technology vendors, shared data centres, cloud systems, cybersecurity operations, analytics platforms and infrastructure-management arms. If a subsidiary handles a critical part of the MII’s operations, a cyber incident at that subsidiary can affect the parent market institution.

Sebi has proposed that the IT and cyber security framework applicable to the parent MII should also apply to a subsidiary if it meets any of three conditions.

The framework will apply if the subsidiary carries out an activity that directly contributes to the domain of the MII.

It will also apply if the subsidiary handles data that the MII is supposed to handle, or if it shares infrastructure with the MII. Such subsidiaries will have to comply with requirements relating to cybersecurity, system audits, incident reporting, business continuity planning, disaster recovery and technology governance.

This means a technology subsidiary running the trading platform of a stock exchange, a subsidiary providing cybersecurity services to the parent MII, or a shared data centre or cloud subsidiary hosting production servers or disaster recovery infrastructure would come under the framework.

Disclosure: This article has been written by Podishetti Akash, who is not a SEBI-registered Research Analyst or an Investment Adviser. Podishetti Akash and her ‘relative(s)’ (as defined under Section 2(77) of the Companies Act, 2013) do not hold any financial interest in the companies mentioned in this article as of the date of publication. The views/recommendations mentioned in this article, wherever applicable, are those of the respective SEBI-registered Research Analyst/brokerage and have been reproduced/reported with due attribution. They should not be construed as the views or recommendations of The Economic Times Digital or the journalist. Readers are advised to consider the original research report and make their investment decisions based on their own assessment.