SEBI imposes Rs 1 crore penalty on CDSL over lapses found in FY 2023-24 inspection
SEBI's adjudicating officer has fined depository CDSL Rs 1 crore, finding lapses in pledge handling, cyber security and disaster-recovery drills during its FY 2023-24 inspection.
Key points
- SEBI imposed a penalty of Rs 1 crore on Central Depository Services (India) Limited in an order dated 30 October 2026.
- SEBI found lapses including unexplained pledge rejections, unpatched vulnerabilities and an incomplete disaster-recovery drill.
- CDSL must pay within 45 days of receiving the order, and the order can be appealed before the Securities Appellate Tribunal.
The Securities and Exchange Board of India (SEBI) has imposed a penalty of Rs 1 crore on Central Depository Services (India) Limited (CDSL), one of the country's two depositories that hold investors' shares in electronic (demat) form. The order, dated 30 October 2026, follows SEBI's inspection of CDSL for FY 2023-24.
What Happened
According to the order, SEBI's adjudicating officer found that CDSL had committed multiple compliance lapses in its depository functions. These included failing to tell the depository participants of the pledgor and the pledgee why a pledge request was rejected, not following the joint framework set under a SEBI circular of 11 November 2022 for client securities accounts, inadequate measures to prevent unauthorised transmission of data, an incomplete shift of operations to its disaster-recovery site during a drill, failing to patch vulnerabilities within SEBI's timeline, and a security testing exercise that was not comprehensive.
The order records that during the inspection period CDSL's data on rejected pledges carried a common note for every case, saying the reason was known only to the pledgee's depository participant. CDSL had argued that capturing the reason was not mandatory and that the lapses were technical. The officer held that the violations could not be treated as technical and were serious, given a depository's role in the market. The order notes that CDSL's remedial steps were considered, and that it found no quantifiable gain to CDSL or loss to investors. It also notes that a separate penalty of Rs 1 crore was imposed on CDSL by an order dated 20 July 2026.
The penalty was imposed under Section 15HB of the SEBI Act. CDSL must pay within 45 days of receiving the order, failing which recovery proceedings may follow.
What It Means
For investors, the order is a reminder that depositories must give reasons when they do not create a pledge on shares, and must keep their systems secure and ready for emergencies. The order is a regulator's finding and can be appealed before the Securities Appellate Tribunal. Investors with a complaint against a depository or depository participant can file it on SEBI's SCORES portal at https://scores.sebi.gov.in.
Source: SEBI order
This report describes enforcement actions and allegations on the public record, attributed to the officials cited. An order, FIR or chargesheet is not a conviction; parties are presumed innocent until proven guilty.
Named in this report, or spotted an error? Corrections and responses: editor@oquilia.com. We correct errors promptly and record responses from named parties.
Sources & Citations
- SEBI order — Securities and Exchange Board of India