Resources Categories
INDUSTRY FACT FILE · ASSET MANAGEMENT
Industry Overview: Asset and Investment Management in India
The types of asset and investment managers, how they are owned and regulated, who buys cybersecurity inside them, and why each needs a distinct approach.
|
In this document 1. Why asset management cybersecurity matters now 2. The ecosystem at a glance 3. Categories of managers and industry players 4. How CSCRF applies to asset managers 5. Government, public-sector and private participants 6. Who buys cybersecurity inside these organisations 7. Why each manager type needs a different approach 8. How Codec Networks works with asset managers |
|
Sector scope Sector: Asset and investment management — mutual funds, AMCs, portfolio managers, AIFs, investment advisers and wealth platforms. Primary service proposition: system audits, cyber resilience, investor data protection, application security and BCP/DR. |
1. Why asset management cybersecurity matters now
Mutual funds have become the savings vehicle of choice for millions of Indian households. According to AMFI data, the industry's net assets under management stood at about ₹82.22 lakh crore in June 2026 across 27.86 crore folios. Most investors now transact digitally—through AMC apps, distributor platforms, stock-exchange MF platforms and fintech apps—so investor trust depends on the security of a wide chain of systems and partners.
|
₹82.22 lakh cr Mutual fund industry AUM (AMFI, June 2026) |
27.86 cr Mutual fund folios (June 2026) |
6 hours To report cyber incidents to SEBI and CERT-In |
31 Aug 2025 CSCRF compliance date for AMCs and other REs |
SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), issued on 20 August 2024, applies graded requirements to AMCs, portfolio managers and AIF managers among other regulated entities, with compliance due by 31 August 2025. Mutual funds and AMCs also remain subject to SEBI's system audit framework.
|
Key takeaway For asset managers, a cyber incident is an investor-protection incident: it touches savings, NAVs and trust in the fund—so regulators, trustees and investors all expect demonstrable resilience. |
2. The ecosystem at a glance
Figure 1: India's asset and investment management ecosystem.
3. Categories of managers and industry players
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Asset management companies and mutual funds |
Manage mutual fund schemes for retail and institutional investors |
Bank-, insurer- and group-sponsored AMCs; several listed; some public-sector sponsors |
SEBI (Mutual Funds) Regulations, 1996; CSCRF (category by AUM); MF system audit framework |
|
Portfolio managers |
Manage individual portfolios on a discretionary or advisory basis |
Independent firms, broker and bank affiliates |
SEBI (Portfolio Managers) Regulations, 2020; CSCRF |
|
AIF managers |
Manage Category I, II and III alternative investment funds |
Private equity, venture and hedge-fund-style managers |
SEBI (AIF) Regulations, 2012; CSCRF (assessed at manager level since April 2025) |
|
Investment advisers and research analysts |
Provide investment advice and research to clients |
Individuals, partnerships and companies |
SEBI (Investment Advisers) and (Research Analysts) Regulations; confirm CSCRF applicability |
|
Wealth and investment platforms |
Online platforms offering mutual funds, stocks and other products |
Fintechs, brokers and banks |
Registration of the platform or partners (distributor, broker, RIA); partner requirements |
|
RTAs, custodians and fund accountants |
Investor servicing, custody and NAV computation for funds |
Specialised service providers |
SEBI regulations for the respective activity; CSCRF; AMC third-party oversight |
4. How CSCRF applies to asset managers
CSCRF grades regulated entities into five categories—MIIs, Qualified, Mid-size, Small-size and Self-certification REs. AMCs are categorised by assets under management, while portfolio managers and AIF managers have their own thresholds. Higher categories carry more frequent cyber audits and VAPT by CERT-In empanelled auditors, a 24x7 SOC and maturity assessments; smaller entities can onboard to the Market SOC operated by NSE and BSE.
|
Check every registration Many groups hold several SEBI registrations (for example an AMC, a PMS licence and an AIF manager). CSCRF generally applies the highest applicable category to an entity registered in multiple capacities, so registrations should be assessed together. |
5. Government, public-sector and private participants
- SEBI regulates mutual funds, portfolio managers, AIFs, investment advisers and research analysts.
- AMFI, the industry association, publishes industry data and codes of conduct for AMCs and distributors.
- Public-sector sponsors—such as public sector banks and insurers—sponsor several AMCs.
- Trustees oversee AMCs on behalf of unitholders and expect assurance on technology and cyber risk.
- Private managers range from large listed AMCs to boutique PMS and AIF managers.
6. Who buys cybersecurity inside these organisations
|
Stakeholder |
What they care about |
What they buy |
|
Board and trustees |
Investor protection, regulatory standing, resilience |
Board and trustee reporting, crisis exercises |
|
CISO and technology |
CSCRF control effectiveness, monitoring, vulnerability closure |
Cyber audits, VAPT, SOC |
|
Chief Investment Officer and dealing |
Confidentiality of orders and research |
Dealing-room controls, insider monitoring, DLP |
|
Operations and investor services |
Redemption accuracy, fraud, complaints |
Fraud controls review, application testing |
|
Compliance officer |
SEBI circulars, system audits, reporting |
System audits, CSCRF gap assessments, evidence |
|
Data protection lead |
Investor data across RTAs and distributors |
DPDPA programme, data-flow mapping |
7. Why each manager type needs a different approach
|
Manager type |
Highest-consequence risk |
Starting point for assurance |
|
Large AMC |
Redemption fraud, ransomware, insider leakage, third-party RTA risk |
CSCRF audit and VAPT, SOC, insider monitoring, RTA assurance |
|
Portfolio manager |
Client data leakage, phishing, BEC |
Email and endpoint security, VAPT, data protection |
|
AIF manager |
Investor and deal data theft, BEC on capital calls |
Executive impersonation testing, data protection, VAPT |
|
Investment adviser |
Account compromise, impersonation scams |
Baseline controls, phishing awareness, brand monitoring |
|
Wealth platform |
Account takeover, API exposure, fake apps |
App and API testing, fraud monitoring, brand monitoring |
|
Fund service provider |
Ransomware and data tampering affecting many funds |
Segmentation, backup testing, integrity controls |
8. How Codec Networks works with asset managers
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For asset and investment managers we deliver system audits, CSCRF cyber audits and VAPT, investor data protection programmes, application security testing, BCP/DR reviews and managed SOC services.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026, including SEBI, AMFI, CERT-In and MeitY publications. Requirements depend on each entity's registrations and CSCRF category; confirm obligations against current SEBI circulars.