Sebi Fines Indian Clearing Corporation Rs 5.05 Cr for Lapses

New Delhi, Feb 25 (PTI) Markets regulator Sebi on Tuesday imposed a Rs 5.05 crore penalty on Indian Clearing Corporation Ltd (ICCL) for non-compliance with cyber security and disaster recovery framework.

It has been directed to pay the penalty within 45 days, according to the Securities and Exchange Board of India (Sebi) order.

ICCL was incorporated in 2007 as a wholly-owned subsidiary of BSE Ltd.

It carries out the functions of clearing, settlement, collateral management and risk management for various segments of BSE.

The Securities and Exchange Board of India (Sebi) conducted an inspection of books of accounts and other records of Indian Clearing Corporation Ltd for the period December 1, 2022, to July 31, 2023, to ascertain whether ICCL has complied with the provisions of Sebi rules.

In its inspection, the regulator found non-compliance with key regulatory provisions, particularly in cybersecurity and disaster recovery.

The regulator found non-compliance with cybersecurity and cyber resilience framework as well as non-compliance with system and network audit requirements.

Sebi found that ICCL failed to maintain an up-to-date IT asset inventory, including software assets and criticality classification.

Moreover, ICCL did not close cyber audit observations within a time-bound manner, despite conducting the audit as required.

Additionally, ICCL's backup systems were not fully synchronised with its primary systems, violating disaster recovery rules.

This also indicated that ICCL's IT asset inventory was not properly maintained.

ICCL submitted the network audit report to Sebi without management or board comments.

The clearing corporation submitted its network audit report to Sebi on August 4, 2023, without board comments. ICCL later placed the report before the board on August 10, 2023, and the board approved it without comments on August 14, 2023.

Sebi ruled that even if no comments were needed, ICCL should have recorded and reported this. Hence, ICCL was found non-compliant.

The regulator found ICCL guilty of three out of four allegations and imposed penalties under the SEBI Act and Securities Contracts (Regulation) Act (SCRA) and accordingly imposed the penalty.