Sebi's KYC database plan faces data privacy concerns

Large overseas fund managers like Templeton, Fidelity and BlackRock have expressed privacy concerns on Securities and Exchange Board of India (Sebi)'s KYC database plans. According to the new idea, Sebi proposes to create a central database containing the personal information of all beneficial owners of offshore funds, as reported from reliable but unnamed resources.

The argument is that a database like this, held by an external agency in India would violate the law in their home countries. The Know Your Customer (KYC) data that Sebi holds will ask for and hold direct information on ownership and benefits for overseas investors.

In April 2018, Sebi had issued a circular that asked for foreign portfolio investors (FPIs) to identify the BO of a fund-based ownership as well as control. At that point, stiff opposition from FPIs, especially non-resident Indians (NRIs), on this issue forced Sebi to back down and the rule was watered down, restricting the new interpretation of beneficial ownership to KYC purposes. Under the new rule, FPIs will have to submit KYC documents of beneficial owners to custodian banks. These banks will share them with registrars.

Sebi’s request for registrars to create a centralized database of documents that can be accessed even by other market intermediaries (with consent from the FPIs), was met by no response from Templeton, Fidelity and BlackRock. The main reason for this seems to be the privacy laws in many countries - where employee data cannot be saved outside the home country. This is specially for investors from Europe, where the General Data Protection Regulation (GDPR) have come into effect, and data privacy is taking centrestage for all discussions.

These funds have complied with this requirement from Sebi in some other countries, so there seems to be no move from Sebi to back down on these requirements. They have also assured offshore funds that their data will be safe. Stiff penalties will be imposed against entities or individuals trying to access confidential information without the regulator's approval, and the license of such violators could also be revoked, Sebi has assured.

Given the distinct rise of data privacy in global subjects of concern, Sebi and RBI will need to provide better assurance and ensure they meet international privacy requirements and act upon more stringent laws, before this kind of data will be shared.