Sebi fines Indian Clearing Corporation Rs 5 cr. BSE arm in violation of cyber, network audit norms

Synopsis

Sebi imposed a ₹5 crore penalty on Indian Clearing Corporation (ICCL) for non-compliance with cyber and network audit norms. ICCL failed to maintain updated inventory records, identify critical assets, and address cyber audit observations within the prescribed timelines.

Market regulator Securities and Exchange Board of India (Sebi) on Tuesday slapped a Rs 5 crore penalty on Indian Clearing Corporation (ICCL) for non-compliance of certain norms related to network and cyber audits.

Sebi had conducted an inspection of books of accounts and other records of Indian Clearing Corporation for the period between December 1, 2022 and July 31, 2023 to ascertain if it has complied with the provisions of Sebi regulations and circulars.

The BSE subsidiary which was established in 2007, was found in violation for non-maintenance of correct and up-to-date inventory and absence of software assets information in inventory. The company did not comply with norms that mandate Market Infrastructure Institutions (MIIs) to identify critical assets based on their sensitivity and criticality for business operations, services and data management and maintain up-to-date inventory of its hardware and systems, software and information assets.

Also Read: Up to 28% fall in one month. Will US stagflation mean more bad news for Indian IT stocks?

The norms are prescribed in the July 2015 Sebi circular on Cyber Security for MIIs.

The regulator also found ICCL to have failed to close out the observations in the bi-annual cyber audit in a time bound manner.

"From the Cyber Audit Report submitted during inspection, it was observed that the cyber audit is being conducted bi-annually as per the SEBI circular; however, the observations made in the said audit report are not closed in a time-bound manner. For instance, as per cyber audit report for period October 2022 — March 2023, an observation w.r.t having an updated IT asset inventory i.e. ‘The asset register lacks completeness and is not up-to-date’ was not closed within the deadline (October 31, 2023) given by the auditor," the 37-page order said.

In its defense, ICCL said that Sebi had failed to appreciate the auditor’s findings on the Closure Reports of November 6, 2023.

The order also noted ICCL's failure to obtain comments from the management and board of directors before submitting the Network Audit report to Sebi.

ICCL submitted that the report did not warrant any comments from the board which was rejected by Sebi.

...moreless

...moreless