The story so far: Market regulator Securities and Exchange Board of India (SEBI) has introduced a technology health scorecard for market infrastructure institutions (MIIs) to measure the robustness of their critical IT systems rather than merely checking routine compliance.
SEBI’s IT Resilience Index (ITRI) appears to be among the first attempts globally by a regulator to design a quantitative resilience barometer, as measurable as capital adequacy for banks, for MIIs such as stock exchanges, clearing corporations and depositories.
Why SEBI is introducing the IT Risk Index (ITRI) for capital markets?
The move to assess MII vulnerabilities comes in view of the rising technological dependence of Indian capital markets, where even a few minutes of disruption can affect millions of investors and billions of rupees in trades.
The ITRI will gauge whether the IT systems supporting trading, clearing, settlement and securities holding are capable of handling operational shocks, cyber threats, technical failures and sudden spikes in market activity.
The foundation for the proposed index was laid in 2015, when SEBI, through a circular, termed MIIs as “systemically important”, thus calling for a “robust” cybersecurity framework to perform systemically critical functions.
How will the ITRI work and measure market technology risk?
The need for ITRI comes at a time when India’s securities market is experiencing sea changes in digital transformation, as seen from increased participation of retail investors through online platforms, higher algorithmic trading volumes and faster settlement cycles. Market efficiency has now become inseparable from technology reliability, making it a boardroom issue.
The proposed index, which seeks to shift from a pure compliance-based mode to a quantitative risk-monitoring framework, will be based on nine parameters, each weighted on the basis of a systemic-risk hierarchy, even as questions remain on the statistical estimation of the proposed weights, which have been assigned after discussions with its Technical Advisory Committee. The Industry Standards Forum of MIIs would further define the detailed sub-parameters and measurement criteria.
The weighting exercise implies a risk-prioritisation approach, giving greater importance to parameters whose failure can immediately disrupt the functioning of MIIs.
Availability and security have been accorded the highest weight, at 20% each, as they represent the first line of defence for a financial market’s functioning.
The 10% weightage on Business Continuity and Reliability reflects a change in regulatory perspective. The focus was earlier on preventing failures, but over time, resilience frameworks have focused on absorbing shocks and recovering quickly.
Scalability has been assigned a 5% weight amid SEBI’s view that Indian markets are growing rapidly but do not pose an immediate stability risk.
The present weights should, at best, be seen as a starting framework because the market regulator may have to refine them using actual outage data, cyber incidents and stress tests.
MIIs would also develop an Early Warning System (EWS) to detect any deterioration in ITRI parameters that could potentially lead to performance issues, system slowness or other disruptions, and take remedial measures.
How does SEBI’s ITRI compare to global regulatory standards?
Several markets have created similar operational resilience frameworks, though not always in the form of a single ITRI.
The U.K.’s Financial Conduct Authority and Prudential Regulation Authority have put in place operational resilience rules requiring financial institutions to identify important business services, set disruption tolerances and demonstrate their ability to recover from severe operational shocks.
Unlike SEBI’s proposed index, the European Union’s most comprehensive Digital Operational Resilience Act (DORA) is a regulatory rulebook rather than a numerical scorecard.
The U.S. does not have a single ITRI for bourses. Instead, technology resilience is embedded into regulatory oversight.
Singapore’s Monetary Authority of Singapore has one of Asia’s strongest technology risk guidelines, which could be particularly relevant for India since both countries have highly digital financial ecosystems and a large retail presence.
Hong Kong’s regulators have developed cyber resilience assessment frameworks for financial institutions and market intermediaries, closer to SEBI’s strategy as it uses measurable maturity levels, and regulators rely on comprehensive operational resilience frameworks and cross-sectoral exercises rather than a numeric scoring index.
Australia follows a resilience-based approach through regulators such as the Australian Securities and Investments Commission and the Australian Prudential Regulation Authority, but its focus areas are critical operations mapping, technology dependencies, outsourcing risks and cyber recovery.
How is ITRI different?
Most regulators worldwide follow a principle-based operational resilience model, but SEBI’s distinctive model attempts to convert resilience into a measurable index.
With India’s capital markets becoming among the most technology-intensive globally, a failure at an exchange or clearing corporation level is not just an IT problem but a financial stability risk. The EWS identifies weaknesses before they become failures.
With increasing dependence on AI (artificial intelligence), cloud infrastructure, high-frequency trading and digital settlement, technology risks would become more complex. SEBI has already initiated discussions on a long-term technology roadmap for MIIs covering areas such as AI, cloud computing, distributed ledger technology and quantum-safe systems.
SEBI has already constituted a working group to formulate a short-term and long-term technology roadmap for MIIs, taking a holistic view on the adoption of emerging technologies including AI/machine learning, Suptech, RegTech and tokenisation.
What are the key implementation challenges facing the ITRI?
The biggest challenge before SEBI is the pace of technological change because technology risks evolve faster than regulatory frameworks.
Questions may arise on a common index when stock exchanges, clearing corporations and depositories have different technology architectures and functions.
Cybersecurity remains unpredictable because institutions with sophisticated systems have suffered global cyber incidents.
Moreover, substantial investments are needed to build automated monitoring systems, conduct continuous testing and maintain redundant infrastructure.
Can the ITRI secure the future of India’s capital markets?
SEBI’s ITRI is a global assessment of India’s ability to build a future-ready financial market architecture. The real test will be whether a high score translates into faster recovery in the event of an actual cyberattack, system outage or technology shock.
If implemented effectively, it could become a global template to safeguard the digital foundations of finance.
