The ₹6 Lakh SEBI Penalty: How Rishabh Tanwar’s Outsourcing Mistake Cost Him Big?

Hand your clients’ KYC files and complaints to someone else, and one day SEBI asks for the records.

What if 471 of 509 are gone?

That is the story behind the Rishabh Tanwar SEBI order, which ended in a ₹6 lakh penalty on October 22, 2026.

He admitted every lapse and asked for the minimum penalty.

Here is the full story, step by step.

SEBI Order Against Rishabh Tanwar: ₹6 Lakh Penalty Under Section 15EB on October 22, 2026

On October 22, 2026, SEBI’s Adjudicating Officer Medha Sonparote passed an order against Rishabh Tanwar in Mumbai.

It is numbered Order/MS/SM/2026-27/32789 and was passed under Section 15-I of the SEBI Act, 1992, read with Rule 5 of the Adjudication Rules.

The order looks at his conduct during the inspection period, April 1, 2023 to October 31, 2024.

SEBI found six violations, and he admitted every one of them.

The penalty is ₹6,00,000 under Section 15EB, payable within 45 days of receiving the order.

Now let’s see how it got there.

It Started With A Tip From Another Agency: How SEBI Came To Inspect Rishabh Tanwar?

This case did not begin with an angry investor. It began with a reference from another government agency.

Here is how it moved from that reference to a show cause notice.

1. The Inter-Governmental Reference

SEBI received an inter-governmental reference. It alleged that an entity associated with the research analyst was running a share trading call centre, possibly violating SEBI’s Research Analyst Regulations.

The order is clear that only the noticee is before the officer.

The service provider’s own activities are not part of these proceedings.

2. The Inspection And The Findings

SEBI inspected the entity for the period April 1, 2023 to October 31, 2024.

It sent its findings by email and letter on June 17, 2025, and he replied by email on June 22, 2025.

3. The Officer And The Show Cause Notice

SEBI assigned the case to the Adjudicating Officer on July 10, 2026. The show cause notice followed on September 4, 2026, delivered by speed post.

He acknowledged it and filed his reply on September 19, 2026.

4. The Hearing

SEBI issued a hearing notice on September 22, 2026. He sent additional submissions on September 23, 2026 and appeared in person.

A Sole Analyst And A Service Provider Who Looked Established: How The Arrangement Began?

To understand the lapses, you need to know how the arrangement started. The order tells it largely through his own explanation.

Here is the background, as he described it to SEBI.

1. Working Alone

He said he worked as a sole research analyst with no compliance officer, no legal staff and no support staff.

He relied on a service provider represented to him as experienced in working with several other research analysts.

2. The First Email

SEBI noted the service provider first approached him by email on December 27, 2023.

The agreement, however, named December 21, 2023 as its start date, which SEBI took as a sign that checks came after the fact.

3. The Visit To Navi Mumbai

He said he travelled from Bengaluru by bus on January 4, 2024, to visit the provider’s office in Navi Mumbai. He was shown the operations and collected identity documents of the people running them.

The provider appeared well established and was reportedly associated with other research analysts.

4. What The Visit Did Not Leave Behind

He admitted he recorded no assessment of what he saw, and that this was the deficiency.

The officer said he furnished no documents to support his account, so it was only an assertion. SEBI held that there was no due diligence under Para 4 of Annexure E.

Work Started Before The Paperwork: The Agreement Signed After The FIU Crime Branch Visit

Now to the first violation, and it is all about dates. Services began before a legally binding agreement was in place.

The order lines the dates up like this.

1. What SEBI Saw?

The agreement was notarised only on July 6, 2024, after the FIU Crime Branch visit on June 15, 2024.

So services began before a legally binding agreement existed.

2. What He Said?

He admitted he commenced operations prematurely and blamed delays in negotiating with his auditor and in legal vetting.

He asked the officer to reconsider the view that the agreement was an afterthought following the FIU visit, while accepting operations began without a concluded agreement.

3. What The Officer Held?

Executing an agreement later does not automatically establish compliance for the earlier period.

He found the violation established under Regulations 13(i) and 24(2) and Para 5 of Annexure E.

Outsourcing KYC & Client Complaints: The Core Compliance Trap

Here is where the arrangement crossed a line SEBI draws clearly. The circular says core business activities and compliance functions cannot be outsourced.

The order records that two core functions were handed to the service provider.

1. What The Agreement Handed Over

Clauses 4.5 and 4.6 of the agreement dated December 26, 2023 effectively gave KYC and client grievance handling to the service provider.

He accepted that these are core activities that could not be outsourced.

2. The 88% and 90% Payment Split

He agreed to pay the provider 88% of the invoice amount as commission for introducing new clients. In most cases, about 90% was transferred.

He admitted paying 90%, which was 2% above the agreed rate.

3. How He Explained the Extra 2%

He said he accepted the revised split because of the provider’s experience and its claim that this reflected market practice.

He added that he bore the risks despite being the minority beneficiary.

4. Four Individuals Or One

He said he planned to formalise the arrangement with four individuals. He then signed with a single individual to simplify enforcement in case of future legal complications.

5. The Grievance Clause And The SCORES Complaint

He said Clause 4.6 covered operational grievances such as payment issues, non-receipt of educational content, and delays in starting services, not advisory grievances.

One complaint was lodged through SCORES, and he handled it himself. It was closed administratively because the complainant stopped responding and gave no supporting evidence.

The Missing Data Trap: How 471 Out of 509 Client KYC Records Disappeared?

This is the part of the story with the biggest number. When SEBI asked for KYC records, most of them could not be produced.

Two lapses sit behind it: no outsourcing policy and no contingency plan.

1. No Outsourcing Policy Or Risk Programme

SEBI observed he had no formal policy on whether and how activities could be outsourced, and no outsourcing risk management programme.

He admitted this and said an Indemnity Bond was not a substitute for the prescribed policy.

2. The Missing Records

SEBI observed that he failed to provide KYC records, including PAN and Aadhaar documents, for 471 out of 509 clients.

He said the data had been deleted from the systems.

3. No Backup, No Recovery Plan

He admitted he had no contingency plan and no disaster recovery plan. The KYC documents came through the provider’s onboarding process and were lost when the data was deleted.

He kept no backup and no recovery arrangement of his own.

4. The Officer’s Finding

The absence of a documented contingency and disaster recovery plan established the violation of Para 6 of Annexure E. Paras 1 and 2 were held violated for the missing policy and risk programme.

His submission, recorded in the order, said no affected client suffered any loss and no complaints were received.

The Silent Violation: Why Missing Monthly Complaint Updates Still Cost Him

The sixth lapse is quieter, but the officer still held it established. Research analysts must show complaint data every month.

Here is what the rule asks and what happened.

1. What Clause 5.3 Requires

An analyst must disclose all complaints, including SCORES complaints, in the format in Annexure B. The information must be updated by the 7th of the succeeding month.

Those without a website or app must email the status to investors each month.

2. What SEBI Observed

SEBI observed that the status was not displayed by the 7th in the prescribed format.

He said he had given no active service as a research analyst since September 2024, so nothing had changed.

3. Why That Did Not Work

SEBI said the monthly update is still required even when no active service is being given.

For the basics of how complaints reach SEBI, read our guide to filing a SEBI SCORES complaint.

4. The Later Fix

He said he updated the status monthly until October 2025. After his domain’s premium plan expired, he gave an alternative website link.

The officer said rectification does not absolve the violation and counts only as a mitigating factor.

The Full Charge Sheet: Every Violation SEBI Found Against Rishabh Tanwar

Let’s pull the story together. The notice alleged six violations; he admitted all six, and the officer held each one established.

Here is each lapse with the provision SEBI relied on.

The Master Circular is SEBI/HO/MIRSD-PoD-1/P/CIR/2024/49 dated May 21, 2024. Annexure E is its “Principles for Outsourcing for Intermediaries” under clause 10.4.

SEBI also uses Section 15EB against other research analysts, as our summary of the OnePaper Research Analysts order shows.

Is Rishabh Tanwar SEBI Registered Or Not?

You may be wondering about his status. The order answers it directly: he is a SEBI-registered Research Analyst, and this order did not change that.

Here are the registration details recorded in the order.

1. The Registration Details

The order lists his registration number as INH100009293 and describes him as a registered Research Analyst. He told SEBI he has been registered since March 31, 2022.

[Screenshot 3: SEBI Adjudication Order, page 1, the order title block and paragraph 1. Crop out and cover the PAN]

2. What The Order Does Not Do

The order imposes a monetary penalty only. It does not cancel or suspend his registration.

He told SEBI he applied to surrender it on September 15, 2025. The order does not say whether that was accepted.

3. How To Verify A Research Analyst

Check any analyst’s registration number on SEBI’s website before you pay. Our SEBI registered research analyst verification checklist walks through the steps.

Admitting the Lapses: What Rishabh Tanwar Told SEBI in His Reply

So how did he respond to all this? He did not fight the lapses. He asked the officer to look at the full picture when setting the amount.

Here are the main points of his submissions:

1. An Admission, Not A Defence

He said he was not filing the reply to contest the violations but to place the factual, chronological and financial position before the officer under Section 15J.

He added that he had cooperated at every stage and withheld nothing.

2. One Arrangement, About Six Months

He said every allegation arose from one commercial arrangement with one service provider over about six months.

He described the defaults as failures of documentation, policy and oversight, not acts of dishonesty.

3. Obligations He Accepted Were His Own

He said he was a sole analyst without support staff, and offered that only as context, not a defence.

He accepted the obligations were his own, could not be delegated and that he ought to have discharged them himself.

4. The Fixes He Pointed To

He said he discontinued the arrangement without waiting for directions, formulated an outsourcing policy in July 2025 and applied to surrender his registration on September 15, 2025.

He also said the arrangement ended in July 2024 and never resumed.

5. Mitigating Factors And A Consolidated Penalty

He said he admitted the lapses at the first opportunity and operated as an individual proprietor with limited resources. The proceedings were the first against him, and he had earned no income from the registration since October 2024.

He argued the defaults came from one failure to set up a compliance framework, with the missing KYC records resulting from the outsourcing and the complaint status a separate technical lapse, so he sought a consolidated, moderate penalty.

6. The Prayer

He asked for the minimum penalty under Section 15EB.

Where The ₹1.09 Crore Went: The Money Trail He Placed Before The Officer

Next came the money. He argued he gained little, and the order reproduces his reconciliation.

Here is the table as printed in the order.

1. His Argument

He said total client receipts should not count as his gain or unfair advantage. About 90% went to the service provider, and income tax and direct costs absorbed much of the rest.

2. The Officer’s Answer

The officer said the 90% remittance does not absolve him, because the arrangement itself stemmed from non-compliance and improper delegation.

He added that an entity cannot plead its own non-compliance, here an unvetted outsourcing arrangement, as a mitigating factor.

The Officer’s Verdict: Why ₹6 Lakh Under Section 15EB And Not The ₹1 Lakh Minimum

Now the part everyone wants to know.

The officer held that penalty follows once a violation is established, then used Section 15J to set the amount.

Here is how he reasoned:

1. Penalty Follows The Violation

He relied on the Supreme Court in SEBI v. Shri Ram Mutual Fund (2006), which held that penalty is attracted as soon as the contravention is established.

2. The Section 15EB Range

Section 15EB sets a penalty of not less than ₹1 lakh, up to ₹1 lakh for each day of failure, subject to a maximum of ₹1 crore.

3. What Section 15J Showed

The material on record does not indicate any loss to an investor or group of investors. It also does not specifically show the violations were repetitive.

4. Why Deterrence Still Mattered

He said the penalty must deter the noticee and others who act the same way.

In his words, the activity was “akin to lending his license to another unregistered entity for a fee”.

5. What The Order Does Not Cover

Only the noticee’s proceedings are before this officer. The service provider’s activities are not part of these proceedings.

6. The Final Penalty

He imposed ₹6,00,000 (Rupees Six Lakhs Only) under Section 15EB and said it was commensurate with the violations.

Deadline & Consequences: How to Pay the ₹6 Lakh SEBI Penalty?

The story ends with a deadline. The order sets a payment route and a consequence for non-payment.

These come from paragraphs 55 to 59.

1. The 45-Day Deadline

He must pay within 45 days of receiving the order.

2. The Payment Path

Payment is online at sebi.gov.in, through Enforcement, Orders, Orders Of AO, Pay Now.

3. Recovery If Unpaid

If he does not pay in 45 days, SEBI may start recovery proceedings under Section 28A, with interest.

These can include attachment and sale of movable and immovable property.

4. Copies Of The Order

Under Rule 6, a copy goes to the noticee and to SEBI.

Lessons From The Rishabh Tanwar SEBI Order

This section is general guidance. The order does not set out these steps.

The story shows how an outsourcing arrangement can leave clients’ records and complaints without a clear owner.

1. Ask Who Holds Your KYC And Complaints

If you pay an analyst, ask who handles your KYC documents and who answers your complaints. SEBI’s circular says an analyst cannot outsource those core functions.

2. Look For The Monthly Complaint Disclosure

Check whether the analyst’s website shows complaint data every month. Clause 5.3 requires it.

3. Raise Problems In Writing

If you have a problem, write to the analyst and keep the reply. Our guide to complaining against a stock advisory service explains the routes.

4. Use The Formal Route For A Registered Analyst

If the analyst does not resolve it, SEBI’s SCORES portal is the first formal step. Our guide to filing a complaint against a SEBI registered research analyst lays out the full sequence.

5. Move To SMART ODR If SCORES Does Not Settle It

SMART ODR comes after SCORES, with conciliation as the next stage. Here is how to use the SMART ODR portal for a dispute with a registered intermediary.

6. Know What Arbitration Can Look Like

Arbitration is the stage after conciliation. One of our case write-ups follows a trader’s arbitration against a SEBI registered research analyst from claim to award.

7. A Note For Research Analysts

The officer treated regulatory duties as the analyst’s own. A later agreement, a later policy or a later fix did not cancel the earlier lapse.

Conclusion

SEBI fined Rishabh Tanwar ₹6,00,000 after he admitted six lapses linked to outsourcing, including missing KYC records for 471 of 509 clients.

The officer noted no investor loss on record, and the order does not cancel his registration.

Admission and later fixes softened the story, but they did not remove the penalty.

---

Report. Recover. Stay Fraud Free.

---

Frequently Asked Questions

1. Why was Rishabh Tanwar fined ₹6 lakh by SEBI?

He outsourced KYC and client grievance handling and lacked the required agreement, policy, due diligence, backup plan and monthly complaint disclosure. The officer held all six violations established, and he admitted each one.

2. Can a research analyst outsource KYC and client complaints?

No. SEBI’s Master Circular says core business activities and compliance functions cannot be outsourced. He accepted that KYC and grievance handling were core activities.

3. How many client KYC records could he not produce?

He could not provide KYC records for 471 of 509 clients. He said the data had been deleted and he kept no backup of his own.

4. Did admitting the lapses get him the minimum penalty?

He asked for the minimum under Section 15EB, but the officer imposed ₹6,00,000. The officer said penalty follows once a violation is established.

5. Did SEBI cancel his registration or find any investor loss?

No. The order imposes only a monetary penalty and does not cancel or suspend his registration. The material on record does not indicate any investor loss.

6. When and how must the ₹6 lakh be paid?

Within 45 days of receiving the order, online at sebi.gov.in under Enforcement, Orders, Orders Of AO, Pay Now. If it is unpaid, SEBI may start recovery under Section 28A.