Sebi releases disaster recovery and business-continuity guidelines for Qualified RTAs

Ideally, the recovery site should be set at least 500 km away from the primary site so that both are not affected by the same disaster, according to the guidelines.

Qualified Registrar and Transfer Agents (QRTAs) must now have in place a Business Continuity Plan (BCP) and Disaster Recovery Site (DRS) to ensure continuity of operations, maintain data and transaction integrity, said a circular issued by the market regulator on October 20.

The QRTAs have been asked to declare a disaster within 30 minutes of the incident and switch to the DRS within 45 minutes, among the guidelines given by the regulator.

The circular from the Securities and Exchange Board of India (Sebi) said, “Qualified RTAs (i.e. RTAs having more than 2 Crore folios) are systemically important institutions as they, inter-alia, provide infrastructure necessary for the smooth and uninterrupted functioning of the securities market. As part of the operational risk management, these QRTAs need to have high level of resiliency to provide essential facilities and perform systemically critical functions uninterruptedly in the securities market.”

Also read: Sebi eases norms for mandatory bond issuances, announces incentives for surplus

Therefore, guidelines have been issued to QRTAs on handling disruption, augmentation of systems and practices to achieve better Recovery Time Objective (RTO) and Recovery Point Objective (RPO), and to improve overall preparedness by conducting periodic announced / unannounced drills.

The manpower deployed at DRS/ Near Site (NS) must have the same expertise as available at the primary data centre (PDC) in terms of knowledge/ awareness of various technological and procedural systems and processes relating to all operations such that DRS/NS can function at short notice, independently.

QRTAs must have sufficient number of trained staff at their DRS so as to have the capability of running live operations from DRS without involving staff of the PDC.

All QRTAs must constitute an Incident and Response Team (IRT) / Crisis Management Team (CMT), chaired by the Managing Director (MD) of the QRTA or by the Chief Technology Officer (CTO), in case of non-availability of MD. This team will be responsible for the declaration of disaster, invoking the continuity plan and shifting of operations from the primary site to the recovery site.

Also read: Making the case for mini-PMS to fill a vacuum for retail investors

Ideally, the recovery site should be set at least 500 km away from the primary site so that both are not affected by the same disaster, and the QRTAs have been asked to develop systems that do not require configuration changes at the end of other regulatory entities to switch over to the DRS.