The story so far: Market regulator Securities and Exchange Board of India (SEBI) has introduced a technology health scorecard for market infrastructure institutions (MIIs) to measure the robustness of their critical IT systems rather than merely checking routine compliance.

SEBI’s IT Resilience Index (ITRI) appears to be among the first attempts globally by a regulator to design a quantitative resilience barometer, as measurable as capital adequacy for banks, for MIIs such as stock exchanges, clearing corporations and depositories.

Why SEBI is introducing the IT Risk Index (ITRI) for capital markets?

The move to assess MII vulnerabilities comes in view of the rising technological dependence of Indian capital markets, where even a few minutes of disruption can affect millions of investors and billions of rupees in trades.

The ITRI will gauge whether the IT systems supporting trading, clearing, settlement and securities holding are capable of handling operational shocks, cyber threats, technical failures and sudden spikes in market activity.

The foundation for the proposed index was laid in 2015, when SEBI, through a circular, termed MIIs as “systemically important”, thus calling for a “robust” cybersecurity framework to perform systemically critical functions.

How will the ITRI work and measure market technology risk?

The need for ITRI comes at a time when India’s securities market is experiencing sea changes in digital transformation, as seen from increased participation of retail investors through online platforms, higher algorithmic trading volumes and faster settlement cycles. Market efficiency has now become inseparable from technology reliability, making it a boardroom issue.

The proposed index, which seeks to shift from a pure compliance-based mode to a quantitative risk-monitoring framework, will be based on nine parameters, each weighted on the basis of a systemic-risk hierarchy, even as questions remain on the statistical estimation of the proposed weights, which have been assigned after discussions with its Technical Advisory Committee. The Industry Standards Forum of MIIs would further define the detailed sub-parameters and measurement criteria.

The weighting exercise implies a risk-prioritisation approach, giving greater importance to parameters whose failure can immediately disrupt the functioning of MIIs.

Availability and security have been accorded the highest weight, at 20% each, as they represent the first line of defence for a financial market’s functioning.

The 10% weightage on Business Continuity and Reliability reflects a change in regulatory perspective. The focus was earlier on preventing failures, but over time, resilience frameworks have focused on absorbing shocks and recovering quickly.

Scalability has been assigned a 5% weight amid SEBI’s view that Indian markets are growing rapidly but do not pose an immediate stability risk.

The present weights should, at best, be seen as a starting framework because the market regulator may have to refine them using actual outage data, cyber incidents and stress tests.

MIIs would also develop an Early Warning System (EWS) to detect any deterioration in ITRI parameters that could potentially lead to performance issues, system slowness or other disruptions, and take remedial measures.

How does SEBI’s ITRI compare to global regulatory standards?

Several markets have created similar operational resilience frameworks, though not always in the form of a single ITRI.

The U.K.’s Financial Conduct Authority and Prudential Regulation Authority have put in place operational resilience rules requiring financial institutions to identify important business services, set disruption tolerances and demonstrate their ability to recover from severe operational shocks.

Unlike SEBI’s proposed index, the European Union’s most comprehensive Digital Operational Resilience Act (DORA) is a regulatory rulebook rather than a numerical scorecard.

The U.S. does not have a single ITRI for bourses. Instead, technology resilience is embedded into regulatory oversight.

Singapore’s Monetary Authority of Singapore has one of Asia’s strongest technology risk guidelines, which could be particularly relevant for India since both countries have highly digital financial ecosystems and a large retail presence.

Hong Kong’s regulators have developed cyber resilience assessment frameworks for financial institutions and market intermediaries, closer to SEBI’s strategy as it uses measurable maturity levels, and regulators rely on comprehensive operational resilience frameworks and cross-sectoral exercises rather than a numeric scoring index.

Australia follows a resilience-based approach through regulators such as the Australian Securities and Investments Commission and the Australian Prudential Regulation Authority, but its focus areas are critical operations mapping, technology dependencies, outsourcing risks and cyber recovery.

How is ITRI different?

Most regulators worldwide follow a principle-based operational resilience model, but SEBI’s distinctive model attempts to convert resilience into a measurable index.

With India’s capital markets becoming among the most technology-intensive globally, a failure at an exchange or clearing corporation level is not just an IT problem but a financial stability risk. The EWS identifies weaknesses before they become failures.

With increasing dependence on AI (artificial intelligence), cloud infrastructure, high-frequency trading and digital settlement, technology risks would become more complex. SEBI has already initiated discussions on a long-term technology roadmap for MIIs covering areas such as AI, cloud computing, distributed ledger technology and quantum-safe systems.

SEBI has already constituted a working group to formulate a short-term and long-term technology roadmap for MIIs, taking a holistic view on the adoption of emerging technologies including AI/machine learning, Suptech, RegTech and tokenisation.

What are the key implementation challenges facing the ITRI?

The biggest challenge before SEBI is the pace of technological change because technology risks evolve faster than regulatory frameworks.

Questions may arise on a common index when stock exchanges, clearing corporations and depositories have different technology architectures and functions.

Cybersecurity remains unpredictable because institutions with sophisticated systems have suffered global cyber incidents.

Moreover, substantial investments are needed to build automated monitoring systems, conduct continuous testing and maintain redundant infrastructure.

Can the ITRI secure the future of India’s capital markets?

SEBI’s ITRI is a global assessment of India’s ability to build a future-ready financial market architecture. The real test will be whether a high score translates into faster recovery in the event of an actual cyberattack, system outage or technology shock.

If implemented effectively, it could become a global template to safeguard the digital foundations of finance.

SEBI observed that market institutions adhere to volume-based charge structures for the same. File
| Photo Credit: Reuters

The story so far: Markets regulator, the Securities and Exchange Board of India (SEBI) on Monday instructed stock exchanges and other market institutions to levy “uniform and equal” charge structure for all its members, irrespective of the nature of the transaction. The directive was bad news for stockbrokers since it is expected to potentially guide towards a regime entailing higher broking charges from stockbrokers. On Tuesday, scrips of Geojit Financial fell 7% at close on BSE, Motilal Oswal 3.1%, 5Paisa about 3.5% and SMC Global Securities 2.6%. The directions take effect from October 1.

What is the context of the directions?

Stock exchanges impose certain charges on stockbrokers for carrying out transactions on their platform. In turn, stockbrokers recover these charges from their clients (or end customers).

SEBI observed that market institutions adhere to volume-based charge structures for the same. In other words, the charges levied are based on slabs that are segregated based on the volume of the transaction(s) undertaken. Thus, the greater the volume a broker generates, the lesser their transaction fee to the exchange. The same mechanism also works in the U.S. housing NASDAQ and NYSE. Additionally, SEBI also observed that the related entities recover these charges on a daily basis whereas the exchanges receive aggregate charges from the stockbrokers on a monthly basis. The mechanism, as observed by SEBI, has resulted in aggregate charges collected by brokers being higher than the charges paid to the exchange – exhibiting a discrepancy between daily and monthly volumes. The regulator also held concerns about an incorrect or misleading disclosure being made to the client about the charges levied by the exchange. Furthermore, it believes, the charge structure of the exchanges could also create a hindrance for them to impart “equal and fair access” to all market participants. Therefore, with the directive it proposes to create a “level playing field between members” irrespective of their size or the volume of their transactions.

So, what has SEBI directed?

To address the paradigm, SEBI has directed exchanges and other market institutions to levy a “uniform and equal” charge structure for all their members (in this context, stockbrokers). The structure must not be differentiating based on the volume or activities of the member.

The regulator has further sought charges recovered from the end client must be “true to label”. That is, if a stock exchange institutes certain charges on the end client from brokers, it would be the former’s prerogative to ensure that they receive the same amount only.

Additionally, SEBI has sought that due consideration be given to existing per unit charges (on transactions) levied by the exchanges. This is to ensure that the end clients are able to benefit from reduced charges – starting from the unit basis itself.

What repercussions are we looking at?

The difference between the amount paid and charged from their customers forms an essential revenue stream for stockbrokers. The direction is expected to directly impact this paradigm. However, the impact could potentially not be the same across the board. It would vary as per the entity’s dependence on this stream of revenue. Some may possess alternative streams as well. For perspective, Nithin Kamath, CEO and Founder of Zerodha explained in a blog that Zerodha earns about 10% of its revenue as this difference. On similar lines, Geojit Financial in a communication to BSE informed the difference income in FY 2023-24 amounted to Rs 40 lakhs – constituting 0.067% of the total income and 0.22% of profit before tax. Satish Menon, Executive Director at Geojit Financial told The Hindu that 80% of the company’s brokerage income comes from cash markets. “We are of the view that SEBI circular will have an impact on discount brokers, and we can expect an increase in the brokerage rates offered by discount brokers,” he observed.

About Zerodha, Mr Kamath wrote in the blog that the range increased from about 3% to the present state because of the increase in revenue from options trading. “Today, 90% of our revenue from these rebates come from option trading alone. With the new circular, brokers will no longer earn these rebates (difference amount),” he said. The CEO also held that they may have to “probably let go of the zero-brokerage structure” on equity trading. His blog explained that Zerodha was able to provide zero brokerage on equity because it subsidised equity investments with revenue from the F&O trading activity. “This structure could now potentially change. As a business, we may have to introduce a brokerage fee for equity delivery investments, which is currently free, or/and increase F&O brokerage,” he stated.