Quick Summary
SEBI Adjudicating Officer Jai Sebastian fined Central Depository Services (India) Limited ₹1,00,00,000 under Section 15HB on October 30, 2026. The order follows an inspection for FY 2023-24 and a show cause notice with 12 charges. Six were upheld, covering pledge rejection reasons, CUSA controls, data loss prevention on 24 endpoints, a disaster recovery drill, vulnerability patching and VAPT scope. Six were not established. CDSL must pay within 45 days.
Half the charges against CDSL fell away on a close reading of SEBI’s own circulars. The other half still cost it ₹1 crore.
On October 30, 2026, a SEBI adjudicating officer fined Central Depository Services (India) Limited after an inspection of FY 2023-24.
This CDSL SEBI penalty touches pledge rejections, frozen client accounts, cybersecurity, and disaster recovery drills.
Here is what stood, what fell, and why.
Why Was CDSL Inspected, And How Did The Case Reach A ₹1 Crore Order?
The order is titled “in the matter of inspection of Central Depository Services (India) Limited conducted during FY 2023-24”.
It describes CDSL as a depository and a Market Infrastructure Institution (MII).
The case moved slowly, with a settlement attempt in the middle.
The key dates from the order are below:
1. Findings Shared: January 9, 2024
SEBI emailed the inspection findings to CDSL on January 9, 2024.
CDSL replied on February 13, 2024, and March 20, 2024.
2. Show Cause Notice: August 27, 2024
The notice asked why an inquiry and penalty should not follow under Section 15HB of the SEBI Act and Sections 19FA and 19G of the Depositories Act, 1996.
CDSL filed its reply on October 4, 2024.
3. Settlement Route: October 9, 2024 to April 6, 2026
CDSL filed a settlement application on October 9, 2024. A hearing took place on November 26, 2024, and an additional reply came on December 6, 2024.
The matter stayed in abeyance until CDSL withdrew the application on April 6, 2026.
4. A New Adjudicating Officer: April 4, 2025
The earlier officer had retired on superannuation. Jai Sebastian was appointed on April 4, 2025.
5. Final Hearing: May 18, 2026
A fresh hearing notice went out on April 15, 2026. The hearing was held on May 18, 2026, and CDSL filed a further reply on June 1, 2026.
6. A Request For Every Document Was Turned Down
CDSL had asked for a certified list of all documents and an inspection of the full file. The officer called this a roving and fishing enquiry and noted that all relied-upon documents had been provided.
7. The Order: October 30, 2026
Jai Sebastian passed the order in Mumbai under Section 15-I of the SEBI Act and Section 19H of the Depositories Act, read with Rule 5 of the respective inquiry rules.
Six Charges Stood And Six Fell: The Full Scorecard
The show cause notice raised twelve questions.
The officer answered each one separately, and the result was an even split.
| # | Charge in the notice | Outcome |
|---|---|---|
| 1 | Reasons for pledge rejection not communicated (regulation 79(5), DP Regulations) | Upheld |
| 2 | Supervision of BSDA conversion (circulars of 2012, 2014 and 2015) | Not established |
| 3 | Pledge release or disposal on 6th and 7th trading days (clauses 3.4 and 3.5, circular of Nov 11, 2022) | Not established |
| 4 | Systems and controls for Client Unpaid Securities Accounts (clause 5, circular of Nov 11, 2022) | Upheld |
| 5 | Data loss prevention on 24 endpoints (clause 31, Annexure A, circular of July 6, 2015) | Upheld |
| 6 | Baseline security standards (clauses 27 and 28) | Not established |
| 7 | RTO and RPO in the cyber crisis plan (clauses 4(c) and (d), circular of March 22, 2021) | Not established |
| 8 | RTO exceeded in four disaster recovery drills (clause 5(h)) | Not established |
| 9 | Manpower at the primary data centre (clause 3(d)) | Not established |
| 10 | Security logs collected at the primary site during a DR drill (clause 5(c)) | Upheld |
| 11 | Vulnerabilities not patched within three months (clause 2(41), circular of May 20, 2022) | Upheld |
| 12 | VAPT not comprehensive (clause 2(40), circular of May 20, 2022) | Upheld |
The sections below take the six upheld lapses first, then the six that did not survive.
The Six Lapses SEBI Held Against CDSL
These are the findings that carried the penalty.
For each one, we look at what inspectors saw, what CDSL argued, and why the officer ruled as he did.
Pledge Rejections Where The Reasons Never Reached Participants
Regulation 79(5) of the DP Regulations says that if a depository does not create a pledge, it must send the reasons to the participants of the pledger and the pledgee.
1. What The Inspection Data Showed
For every rejected pledge in the data, CDSL used one common note.
It read, “Reason for rejection is known only to the Pledgee DP & the details can be verified during audit & inspection”.
2. What CDSL Argued
CDSL said the participants were told about the rejection, but the reason was not captured in its system. It said its pledge system dated from August 2001 and had no mandatory field for reasons.
It admitted 27 records with no reason in the optional Remarks field.
It also pointed to a system change made mandatory on July 13, 2024, after its action-taken report of June 21, 2024.
3. Why The Officer Said No
The duty under regulation 79(5) sits with the depository, and an optional Remarks field used at the participants’ discretion cannot replace it.
The officer also noted that CDSL’s own bye-law 14.4 mirrors the same requirement.
The later fix, he said, showed that the earlier system was not in line with the rule.
4. “No Complaints” And “SEBI Never Objected” Were Both Rejected
The officer held that the absence of complaints or investor loss is no defence to a statutory duty.
He also held that earlier inspections not flagging the issue cannot create a legitimate expectation against an express provision.
CUSA Accounts Unfrozen In Full And Frozen On Wrong Dates
A circular of November 11, 2022 required existing Client Unpaid Securities Accounts (CUSA) to be wound up by April 15, 2023, failing which they would be frozen for debit and credit.
Exchanges and depositories then adopted a joint process dated May 22, 2023, to release specific securities to clients.
1. The Entire Account Was Unfrozen
When exchanges sent requests naming specific securities, quantities, and client accounts, CDSL unfroze the whole CUSA.
CDSL admitted this but said the joint process did not spell out unfreezing by security and quantity.
The officer read the words “client-wise securities details” and “to the respective clients only” as calling for a granular unfreeze.
2. No Checks On Where The Shares Went
The inspection found no system-level check that a participant moved shares only to the beneficiary named in the exchange email.
There was also no way to do an ISIN-level unfreeze once a beneficiary-level freeze existed.
CDSL did not dispute this. It added extra internal steps from June 14, 2024.
3. Two Missed Dates Found In A Sample
For JM Financial, a CUSA due for freezing by June 27, 2023, was frozen on July 5, 2023.
For Bajaj Financial Securities Limited, an unfreeze request of August 28, 2023, was not processed, and CDSL later asked BSE for a new date.
The order treats both as CDSL’s own processing lapses.
4. Why “Isolated Errors” Did Not Help
CDSL called both cases individual operational errors with no market impact. The officer noted they came from a sample, not a full review.
He relied on the Supreme Court’s ruling in SEBI v. Shriram Mutual Fund, which holds that penalty follows contravention whether or not the intent was guilty.
24 Endpoints Outside The Data Loss Prevention Tool
Clause 31 of Annexure A to the circular of July 6, 2015 asks market infrastructure institutions to prevent unauthorised access, copying or transmission of data held in a contractual or fiduciary capacity.
1. What The Audit Reports Showed
A cyber audit report for October 2022 to March 2023 found 24 endpoints not integrated with CDSL’s Data Loss Prevention (DLP) solution.
A KPMG cyber risk assessment in August 2023 showed DLP at all channels was still incomplete.
The order holds the violation for the period July 2015 to October 2023.
2. The Other Safeguards CDSL Listed
CDSL said DLP was one extra layer. It listed USB and CD drive blocking, email controls, a privileged identity management tool, web filtering, and mobile device management.
It added that the 24 endpoints sat inside its own network and that no data was leaked.
3. Why The Officer Was Not Convinced
CDSL placed no endpoint-level records or logs to show these controls were running on the 24 endpoints. The officer also held that none of them replaces the content-based work DLP does.
He said cyber compliance is continuous and preventive, so the lack of an incident is no cure.
Failing to act on a red flag from the cyber audit, in the order’s words, “appears to show a casual approach”.
A Disaster Recovery Drill Where Security Logs Still Ran From The Main Site
Clause 5(c) of the circular of March 22, 2021 says a disaster recovery drill should run all operations from the DR site for at least one full trading day.
SEBI visited the DR site in Hyderabad with its Technical Advisory Committee members on October 12, 2023.
1. What Was Seen
During the drill, Security Information and Event Management (SIEM) logs were still being collected at the primary data centre. CDSL admitted this.
2. What CDSL Argued
CDSL said “all operations” means core business functions, and SIEM is a detective control that does not affect continuity.
It said DR-site collectors forward logs to the primary site for central monitoring.
It added that it could switch the SIEM console manually in a real disaster and expected to re-architect SIEM by September 2024.
3. The Officer’s Plain Reading
The officer read “all operations” literally. He noted that SIEM handles log management, event correlation, continuous monitoring, and incident response.
Accepting CDSL’s view, he said, would read in an exception and make the word “all” meaningless.
A depository’s recovery readiness matters to investors in practice, as our guide on what to do when CDSL is not working explains.
Vulnerabilities That Stayed Open Past The Three-Month Limit
Clause 2(41) of the circular of May 20, 2022, read with clause 41 of Annexure A to the circular of July 6, 2015, requires vulnerabilities found in VAPT to be closed within three months of the final report.
1. What Stayed Open
Web scripts flagged for “Using Components with Known Vulnerabilities” were still open during the inspection.
They were closed only after seven months, once SEBI pointed them out. The VAPT had concluded in May 2023.
2. CDSL’s Risk-Based Approach
CDSL said it closed high and medium risks in time and handled low risks later. It said jQuery moved from 3.4.1 to 3.6.4 and Bootstrap from 3.3.5 to 5.2.3.
It kept the old Bootstrap library in a folder for contingency. Its technology committee, SCOT, confirmed remediation on March 11, 2025.
3. Why It Failed
The circular sets a three-month timeline for every vulnerability, whatever its risk label. The officer said CDSL’s own classification could not override it.
He added that the old library had been flagged as vulnerable, the contingency reason was never explained, and the system stayed exposed in the meantime.
4. One Part Of The Charge Did Not Stand
SEBI had also alleged that a TLS version 1.1 issue repeated across the 2021-22 and 2022-23 reports.
The officer gave CDSL the benefit of the doubt because the reports carried no CVE number or similar identifier.
A VAPT Exercise That Left Out Domains And External Applications
Clause 40 of the July 6, 2015 circular, as amended, requires periodic vulnerability assessment and penetration testing (VAPT) of critical assets, at least once a financial year, by CERT-In empanelled firms.
1. The Finding That Stuck
The officer found that the VAPT did not extend to all domains and external applications needed for full coverage.
Testing in a mock environment did not help, as the rule drew no such distinction.
2. What CDSL Won Within This Charge
CDSL’s email of March 12, 2024 showed the audit reports for eDIS and AuditWeb had been sent to SEBI, and the officer accepted that.
He also held that a source code review is a separate requirement and not part of VAPT. The open vulnerabilities in the sample were treated as a closure issue already covered under the patching charge.
Why Six Charges Fell Away?
Most of the dropped charges turned on what the circulars actually say.
The officer held that several did not clearly require what the notice alleged.
1. The BSDA Charge Over 1.10 Crore Eligible Accounts
The notice said 71,89,934 accounts were converted to Basic Services Demat Accounts (BSDA) in the period, while 1,10,95,451 eligible accounts were not. Opt-out confirmations stood at only 8,321.
The officer found that the circulars gave a depository three jobs: amend its bye-laws, inform participants and publish the rules, and report progress in the monthly development report.
Converting accounts was the participants’ duty.
2. Why The BSDA Charge Fell
The notice did not allege a failure in those three jobs.
The officer drew on the Securities Appellate Tribunal’s ruling in NSDL v. SEBI that depositories cannot be saddled with failures of participants.
He also noted that a duty to put compliance systems in place for BSDA reached depositories only through a circular of June 28, 2024.
3. Pledge Release On The 6th And 7th Trading Days
The notice said brokers released or sold unpaid securities on the sixth and seventh trading days, and CDSL had no system to stop it.
The officer reasoned that a client could pay until the end of the fifth day, so the earliest lawful sale was the sixth.
The circular set no timeline for releasing a pledge, and clause 3.9 allowed invocation or release up to the seventh day.
4. The Officer Pointed To SEBI’s Later Clarifications
A SEBI consultation paper of April 24, 2026 admitted “lack of clarity” in the provisions. A circular of July 3, 2026 then replaced the framework.
A settlement order of December 17, 2025 for the other depository, NSDL, showed the same practice. The officer used it only as a factual pointer and gave CDSL the benefit of the doubt.
5. Baseline Standards: Clauses 27 And 28
The officer found no evidence that DLP formed part of CDSL’s baseline standards. He read clause 28 as covering network security devices such as firewalls and intrusion systems, not data protection tools.
SEBI’s own analysis had also recorded that the firewall explanation could be considered.
6. RTO And RPO In The Cyber Crisis Plan
The March 22, 2021 circular deals with business continuity and does not regulate what a cyber crisis plan must contain.
CDSL’s business continuity plan version 2.2 showed an RTO of 45 minutes and an RPO of “till the last transaction”.
Even so, the officer called it a matter of concern that this plan was not given to inspectors.
7. Four Slow Drills And The Primary Data Centre Staff
Four drills ran past the 45-minute limit, and the longest took 2 hours 55 minutes on March 17, 2023.
The officer held that clause 5(h) asks a depository to “demonstrate its preparedness to meet” the RTO. It does not require every drill to meet it.
On manpower, clause 3(d) concerns the DR site, where CDSL had eight staff in Hyderabad. The notice only alleged a gap at the primary centre.
How Did The Officer Arrive At ₹1 Crore, And Why Was Section 19FA Left Out?
Once the six lapses were established, the next question was which penalty law applied and how much was fair.
The officer’s answer turned on the nature of the lapses, the factors in Section 15J and the role of a depository.
1. Section 19FA Did Not Apply
The notice had also invoked Section 19FA of the Depositories Act for the pledge and CUSA lapses.
That section covers failure to conduct business in a fair manner and carries a penalty of not less than ₹5 crore, as the order quotes it.
The officer called these lapses operational shortcomings of day-to-day work. He found no loss to any client, no undue gain to CDSL, and nothing showing unfair or bad-faith dealing.
2. One Penalty Law, Not Two
Section 15HB of the SEBI Act and Section 19G of the Depositories Act are residuary penalty provisions of similar nature. The officer held that justice was best served by a penalty under one of them.
He used Section 15HB alone and did not separately invoke Section 19G.
3. The “Technical And Venial” Plea Was Rejected
CDSL argued the lapses were technical, relying on earlier SAT and Supreme Court rulings.
The officer replied that those cases did not involve a market infrastructure institution, and one predated the 2014 amendments to the securities laws.
He stressed that a depository’s failure can have wide effects, so its lapses “cannot be characterized as mere technical or procedural violations”.
Inspections lead to penalties for other intermediaries too, as in the MCS Share Transfer Agent SEBI order covering a share transfer agent.
4. What Section 15J Showed
The record gave no quantifiable gain to CDSL and no measurable loss to investors.
On repetition, the order notes an earlier penalty of ₹1 crore on CDSL under Section 15HB and Section 19G, by an order dated July 20, 2026.
The officer added that CDSL’s later remedial steps were considered.
5. The Final Figure
He imposed ₹1,00,00,000 under Section 15HB and called it commensurate with the lapses. The section, as quoted in the order, allows a penalty from ₹1 lakh up to ₹1 crore.
Is CDSL SEBI Registered Or Not?
Yes. The order’s first paragraph describes CDSL as a depository and a Market Infrastructure Institution registered with SEBI.
The order does not state a registration number.
Proceedings ran under both the SEBI Act and the Depositories Act, 1996, and cite the DP Regulations, 2018.
When and How Must CDSL Pay the ₹1 Crore?
The payment route and the consequences of delay are set out in the order.
1. The Deadline
CDSL must pay within 45 days of receiving the order.
2. The Payment Route
Payment goes through SEBI’s online facility on sebi.gov.in. The path is ENFORCEMENT > Orders > Orders of AO > PAY NOW.
3. If CDSL Does Not Pay
Recovery proceedings may begin under Section 28A of the SEBI Act. They can include interest and attachment and sale of movable and immovable property.
A copy of the order goes to CDSL and to SEBI.
What Does This Order Mean For Demat Account Holders?
The order records no investor loss and no gain to CDSL.
Still, several findings touch things investors depend on.
1. Pledge Rejections Come With Reasons
When a pledge is not created, the rule is that the reasons go to the participants on both sides.
The order held CDSL to that rule.
2. Client Securities Need Controls
In its reasoning, the officer said the CUSA requirements are meant to safeguard client securities, ensure traceability, and enable regulatory oversight.
3. Where To Raise A Grievance
If you have a complaint about your demat account, the steps to file a CDSL complaint begin with your depository participant and then move to the CDSL portal.
Conclusion
The officer split the case down the middle.
Where a circular was clear, as on pledge reasons, CUSA checks, DLP, patching and VAPT scope, CDSL was held to it.
Where the wording was open to doubt, as on BSDA and the 6th and 7th day pledges, CDSL got the benefit.
The result was a ₹1 crore penalty for a depository whose lapses the order called serious.
For investors, the takeaway is practical. Know your depository participant, keep your records, and learn how to file a SEBI SCORES complaint before something goes wrong.
Report. Recover. Stay Fraud Free.
SEBI fined Central Depository Services (India) Limited ₹1,00,00,000 on October 30, 2026. It followed an inspection for FY 2023-24. Adjudicating Officer Jai Sebastian passed Order/JS/RJ/2026-27/32798 in Mumbai on October 30, 2026. Six of twelve. They cover pledge rejection reasons, CUSA controls, DLP on 24 endpoints, SIEM logs in a DR drill, vulnerability patching and VAPT scope. BSDA supervision, pledge release on the 6th and 7th trading days, baseline standards, RTO and RPO in the crisis plan, slow DR drills and primary centre manpower. The officer found the lapses were operational shortcomings with no loss to clients, no undue gain and no unfair dealing. Only Section 15HB was used. The order says nothing on record shows any client suffered loss or that CDSL made undue gain from these lapses. Within 45 days of receiving the order, through the online payment facility on sebi.gov.in. SEBI's complaint system is SCORES. It lets investors register a complaint against a market intermediary and track it online.Frequently Asked Questions
Add us as a preferred source on Google »
