Sebi fines NSE's subsidiary KRA Rs 12 lakh over violations including failure to report cyberattacks

The Seb order noted the entity's attempts to take corrective actions.

Market regulator SEBI has fined NSE Data and Analytics Ltd, formerly known as DotEx International Ltd, Rs 12 lakhs over irregularities with respect to BCP/DR  policy, delay in sending acknowledgement letters, and irregularities in system audit reports and cyber security audit framework, among others.

NSE Data and Analytics is a KYC Registration Agency (KRA) and a 100 percent step-down subsidiary of NSE Ltd.

In an order dated September 30, the Securities and Exchange Board of India (SEBI) stated, "The evidence/observations on record against noticee, ostensibly suggest irregularities with respect to BCP/DR (business continuity plan/disaster recovery) policy, delay in sending acknowledgement letters, irregularities w.r.t system audit reports and cyber security audit framework viz, non closure of VAPT activity within timelines and failure to get the same reflected in the Cyber security audit report, failure to capture ATR of previous SCOT meetings in the subsequent meetings, failure to include clauses pertaining to reporting of Cyber-attacks, threats, cyberincidents and breaches in its policy documents and clauses pertaining to periodicity of conducting cyber-security audit in its policy document, non-validation of KYC records and non segregation of operations and Infrastructures cannot be taken leniently and such violations deserve to be adequately penalised. The very purpose of the said provisions is to deter wrong doing and promote ethical conduct in the securities market. The Noticee (NSE KRA) was under an obligation to abide by the provisions of the Intermediaries Regulations, KRA Regulations and SEBI circulars, which it failed to do during the IP."

It added, "Although the noticee has stated that it had taken various corrective steps, the fact that irregularities were committed by the noticee during the aforementioned IP (investigation period) which cannot be ignored. The noticee being a registered intermediary is expected to adhere to fair practices and maintain a high degree of professionalism in the conduct of its business. The violations as established above certainly deserve imposition of penalty on the noticee."

(This is a developing story. The article will be updated.)