India’s securities regulator is proposing a simple rule for a complicated corporate structure: if a subsidiary runs part of an exchange, handles its data or shares its infrastructure, the technology risk does not stop at the subsidiary’s legal boundary.
The SEBI consultation published on 11 September would extend the parent market infrastructure institution’s IT and cyber framework to qualifying subsidiaries. A linked governance consultation would standardise how exchanges, clearing corporations and depositories set qualifications for four critical executives and fill vacancies.
These are proposals, not binding rules. Neither paper gives an implementation date. But together they show what SEBI thinks the control perimeter should look like: follow the regulated function, data and infrastructure, then attach named governance to it.
A subsidiary can behave like the exchange
The first proposal uses three tests. The parent’s framework would apply when a subsidiary performs an activity the parent is supposed to perform, handles data the parent is supposed to handle, or shares infrastructure with the parent.
That formulation matters because it does not depend on a subsidiary being labelled a technology company. It depends on what the entity can operate, see or affect.
SEBI’s five-page proposal and annex make the reach concrete. A subsidiary operating a trading engine would be covered. So would one running the security operations centre, hosting production or disaster-recovery systems, analysing trading or investor data, managing identity and access, or administering production servers and storage. Training, property management and unrelated financial businesses with independent systems sit outside the proposed perimeter.
Covered subsidiaries would have to meet all applicable requirements for cybersecurity, system audits, incident reporting, business continuity and disaster recovery, and technology governance. This is more than a demand for a stronger service contract. It takes duties written for the regulated parent and follows the operating dependency into the group.
Corporate separation can allocate revenue and staff. It cannot be allowed to hide the blast radius of a failed control.
The practical change is evidence. An MII would need an inventory that maps each subsidiary to regulated functions, protected data and shared systems. The same map would define audit scope, incident escalation and recovery testing. A group chart alone cannot do that job.
The exemption is narrow, but unfinished
The proportionality route applies only when a subsidiary is caught by the third test alone: shared infrastructure. A subsidiary that performs an MII function or handles MII data does not get that route under the text.
Nor can the parent grant itself relief. The MII would have to seek an exemption from SEBI. Its proposal must describe compensating controls and include the views of its Standing Committee on Technology and governing board. The decision-maker is therefore SEBI, supported by a documented committee and board trail at the institution.
That is tighter than a broad group exemption. It forces the parent to explain why shared infrastructure will not weaken its resilience. It also puts senior governance bodies behind the claim.
The unresolved part is consistency. The paper does not specify exemption criteria, a decision timetable, renewal conditions or a public disclosure requirement. It asks for compensating controls without defining the minimum proof. Two institutions could present similar network segmentation or recovery arrangements and receive different outcomes unless the final framework adds a common test.
This does not preserve a free pass. It creates a supervised exception whose quality will depend on the evidence SEBI demands. The useful final rule would require the application to cover privileged access, dependency mapping, recovery objectives, testing results and the residual impact on market operations. Otherwise, “proportionality” risks becoming a file of assurances assembled after the architecture is already fixed.
Governance follows the same operating map
The companion paper addresses the people who own those controls. It would require each MII’s governing board to approve a standard operating procedure for the qualifications, experience, skills and certifications of the chief technology officer, chief information security officer, compliance officer and chief risk officer.
The board would not work alone. The Standing Committee on Technology would provide input for the CTO and CISO. The Regulatory Oversight Committee would cover the compliance officer. The Risk Management Committee would cover the chief risk officer. SEBI’s proposal also says a vacancy may remain open for no more than three months and asks whether MIIs should appoint deputies. Deputies are a consultation question, not yet a proposed requirement.
The same paper would loosen a different boundary. Current rules can disqualify a director because another company in the same conglomerate has a trading member, clearing member or depository participant association. SEBI proposes extending a carve-out to directors of companies with well-diversified shareholding. The definition would turn on whether any non-public-sector shareholder, alone or with persons acting in concert, owns at least 10 percent, controls the company or holds at least 10 percent of its voting rights.
That combination is deliberate. Corporate separateness may be recognised when SEBI tests whether a director is too close to a market member. It would be ignored when a subsidiary operates systems or data that can impair the market. One boundary is about conflicts. The other is about operational consequence.
Operators should prepare before the effective date exists
The cyber proposal is open for comments until 2 October. The governance paper closes on 30 September. Neither gives firms a compliance clock after a final measure is issued.
That omission narrows what can be claimed now. No subsidiary has acquired these duties merely because the consultation was published. It also increases the value of early scoping. An MII can identify qualifying subsidiaries, test whether contracts permit regulator-grade audits and incident reporting, and decide which shared-infrastructure entities may need an exemption case.
Technology leaders should treat that case as an architecture review, not a drafting exercise. If an identity platform, cloud account, data centre or recovery site is shared, the parent needs to show how a failure is contained and how the regulated service recovers. Compliance teams need to know which incidents cross the group boundary and when the MII reports them. Boards need succession plans that make the three-month vacancy limit credible.
SEBI’s proposals do not eliminate subsidiaries or shared services. They make their operating relationship visible to the regulator. For market infrastructure, that is the correct direction. The regulated perimeter should end where the critical function, data and blast radius end, not where the corporate chart changes colour.
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.