SEBI CSCRF Compliance: A Guide to Securing Financial Entities with CyberCube Services

Understanding SEBI’s Cyber Security and Cyber Resilience Framework (CSCRF)

Security from cyber-attacks is the essence of contemporary operation of financial services in the digital world. The Securities and Exchange Board of India (SEBI) has formulated the Cyber Security and Cyber Resilience Framework (CSCRF) for Regulated Entities (REs) to safeguard themselves and stay resilient to cyber threats. It endeavors to implement improved security at the institutions that are liable for maintaining financial market security while allowing them to avoid, detect, and address cyber-attacks.

The Necessity of SEBI CSCRF Compliance

CSCRF compliance has been made mandatory by SEBI for the protection of the financial ecosystem from constantly emerging, more vicious cyber threats. Keeping in mind the intensifying frequency of cyberattacks, SEBI has mandated that REs adopt the most stringent cybersecurity measures to protect sensitive data regarding the financial domain from unauthorized access. Loss of CSCRF compliance entails various threats to the financial, legal, and reputational stakes of an organization.

Entities Required to Follow SEBI CSCRF

The Cyber Security and Cyber Resilience Framework (CSCRF) for entities regulated by SEBI in the financial sector includes Market Infrastructure Institutions like Stock Exchanges, Clearing Corporations, and Depositories; as well as Qualified, Mid-Size, Small-size, and Self-Certification REs, categorized according to operational risk and asset size. Each RE must self-classify at the start of the financial year based on the previous year’s data and maintain that classification throughout the year.

The category shall be validated by the respective reporting authority at the time of compliance submission. Further, the criteria given and their thresholds for different categories will continue to be updated as and when required.

Entity-wise categorization and corresponding thresholds shall be as follows:

• Alternative Investment Fund (AIF)

S.No.	Criteria	Self-certification REs	Small-size REs	Mid-size REs	Qualified REs
Criteria and thresholds for AIFs categorization
1	AUM	Less than Rs. 100 crores	Rs. 100 crores and above but less than Rs. 500 crores	Rs. 500 crores and above but less than Rs. 1000 crores	Rs. 10 Lakh crores and above
Criteria and thresholds for Client-based and proprietary stock brokers’ categorization
2	Active Client-base as per UCC	≤ 10,000 active clients and not providing IBT or Algo trading facility	>10,000 and ≤50,000 OR ≤10,000 with IBT/Algo facility	>50,000 and ≤5,00,000	>5,00,000
Criteria and thresholds for Portfolio Managers categorization
3	AUM	Less than Rs. 1000 crores	Rs. 1000 crores and above but less than Rs. 3000 crores	Rs. 3000 crores and above	N.A.
Criteria and thresholds for VCFs categorization
4	Sum of corpus of all schemes of the VCF	Less than Rs. 100 crores	Rs. 100 crores and above but less than Rs. 500 crores	Rs. 500 crores and above but less than Rs. 1000 crores	Rs. 1000 crores and above

Additional Entity Guidance

• Banker to an Issue and Self-Certified Syndicate Banks (SCSBs) - Banker to Issue and Self-Certified Syndicate Banks shall submit a certificate of compliance with CSCRF to SEBI on the cybersecurity guidelines issued by RBI. Wherever the bank is a listed entity, the above-mentioned certificate of compliance shall also be intimated to Stock Exchanges.
• Collective Investment Schemes (CIS) — Under Self-certification REs category.
• Credit Rating Agencies (CRAs) — Under Self-certification REs category.

S.No.	Criteria	Small-size REs	Mid-size REs	Qualified REs
Criteria and Thresholds for Custodians Categorization
1	AUC	Less than Rs. 1 Lakh crores	Rs. 1 Lakh crores and above but less than Rs. 10 Lakh crores	Rs. 10 Lakh crores and above
Criteria and thresholds for DPs categorization
2	Type of DP	N.A.	Non-institutional DP	Institutional DP
Criteria and thresholds for MFs/ AMCs categorization
3	AUM	Less than Rs. 10,000 crores	Rs. 10,000 crores and above but less than Rs. 1 lakh crore	Rs. 1 lakh crores and above
Criteria and thresholds for VCFs categorization
4	Servicing number of folios	10,000 and above but less than 1 crore	1 crore and above but less than 2 crore	N.A.

• Debenture Trustee (DT) - DTs which have not added any new issuer of listed debt security as client in the last three financial years shall be excluded from submission of compliance with CSCRF. Remaining DTs shall be under the Self-certification REs category.
• Designated Depository Participants (DDPs) - To get approval as a DDP, an entity, inter alia, is required to have valid SEBI registration as a Depository Participant (DP) as well as a Custodian. Therefore, As per SEBI circular SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2023/24 dated February 06, 2023, enhanced obligations and responsibilities have been casted upon Qualified Stock Brokers (QSBs) defined based on their size of operations, trading volumes, amount of client funds handled by them etc. Hence, such QSBs shall be categorized as Qualified REs.

Categorization of highest category among DPs and Custodians shall be applicable to DDPs for submission of compliance with CSCRF.

• Foreign Portfolio Investors (FPIs) - FPIs shall be excluded from submission of compliance with CSCRF.
• Foreign Venture Capital Investors (FVCI) - FVCI shall be excluded from submission of compliance with CSCRF.
• Investment Advisors (IAs) / Research Analysts (RAs)
• Investment Advisors (IAs)

Criteria and Thresholds for IAs Categorization
Individual IAs	Non-individual IAs
Individual IAs shall be excluded from submission of compliance with CSCRF.	Non-individual IAs shall be categorized as Small-size REs.

• Research Analysts (RAs) -

Criteria and thresholds for RAs categorization
All RAs who are not registered in other category of REs	Institutional RAs who are registered in other category of REs
All RAs who are not registered in other categories of REs shall be excluded from submission of compliance with CSCRF. However, SEBI SaaS circular titled “Advisory for Financial Sector Organizations regarding Software as a Service (SaaS) based solutions” dated November 03, 2020 is applicable to RAs under which a declaration shall be submitted in respect of SaaS for managing their governance, risk compliance functions, and to improve their cybersecurity posture.	Institutional RAs who are registered with SEBI in other category of REs shall be classified as Qualified REs/ Mid-size REs/ Small size REs based on their categorization in their respective other REs/ group entity category.

• KYC Registration Agencies (KRAs) - KRAs shall be treated at par with MIIs category for the applicability of the CSCRF.
• Limited Purpose Clearing Corporation (LPCC) - LPCC shall be excluded from submission of compliance with CSCRF.
• Merchant Bankers (MBs) -

Criteria and thresholds for MBs categorization
S.No.	Merchant Banker	Category for CSCRF
1	An entity or its parent/ subsidiary/ associate company which is a part of a conglomerate/ Systemically Important Financial Institutions	Qualified REs
2	MBs which are engaged in any activity pertaining to issue management inter alia Public Issues (IPOs, FPOs, IPOs by SME), Public Offers by REITs/InvITs, Buy-Back of Securities, Delisting of Equity Shares, Open Offer under SEBI (Substantial Acquisition of Shares and Takeovers) Mid-size REs Regulations, 2011	Mid-size REs
3	All other MBs which are not covered in clause 1 & 2 of this table above.	Small-size REs

Wherever the MB is a listed entity, the compliance requirement shall also be intimated to Stock Exchanges.

• Qualified Depository Participants (QDPs) - QDPs shall be excluded from CSCRF compliance.
• Real Estate Investment Trust (REIT)/ Infrastructure Investment Trust (InvIT) -REITs/ InvITs shall be excluded from submission of compliance with CSCRF.
• RTAs servicing less than 10,000 folios shall be excluded from submission of compliance with CSCRF.
• Vault Managers -Vault Managers shall be excluded from submission of compliance with CSCRF.

In case an RE is registered under more than one category of REs, then the provision of highest category under which such an RE falls shall be applicable to that RE.

Consequences of Non-Compliance with SEBI CSCRF

• Regulatory fines and legal consequences
• Suspension or revocation of operating licenses
• Loss of customer trust and market reputation
• Increased vulnerability to cyber threats and financial fraud

How CyberCube Services Ensures CSCRF Compliance

CyberCube Services provides end-to-end cybersecurity solutions tailored for SEBI-regulated entities. Our comprehensive compliance approach includes:

• SEBI-Aligned Audit Framework
• Expertise in Regulated Entities
• Full Compliance Support
• Certified Cybersecurity Auditors

CyberCube’s CSCRF Audit Services

• Cyber Risk and Governance Audits: Documenting governance structures and risk frameworks.
• Vulnerability Assessment & Penetration Testing (VAPT): Identifying and eliminating security risks.
• Security Operations Center (SOC) Assessment: Ensuring real-time threat detection and response.
• Incident Response & Crisis Management Review: Testing and verifying strategic readiness.
• Cyber Capability Index: Measuring resilience levels as per SEBI standards.
• Data Security & Compliance Checks: Ensuring encryption, classification, and localization compliance.
• Audit Reporting and Compliance Assistance: Providing structured audit reports and advisory for SEBI compliance.

Stay Ahead with CyberCube — Get Your SEBI CSCRF Compliance Checklist

CSCRF compliance sounds complex, but it becomes easy with CyberCube Services. We offer a SEBI CSCRF Compliance Checklist that enables financial institutions to confirm adherence to all regulatory requirements well before the deadline.