Resources Categories
INDUSTRY FACT FILE · CAPITAL MARKETS
Industry Overview: Capital Markets and Securities in India
The market infrastructure institutions and intermediaries that make up India's securities market, how they are owned and regulated, and who buys cybersecurity inside them.
|
In this document 1. Why capital markets cybersecurity matters now 2. The ecosystem at a glance 3. Categories of market participants 4. SEBI's CSCRF categories 5. Government, public-sector and private participants 6. Who buys cybersecurity inside these organisations 7. Why each participant needs a different approach 8. How Codec Networks works with capital market entities |
|
Sector scope Sector: Capital markets and securities — exchanges, clearing corporations, depositories, brokers, depository participants and professional clearing members. Primary service proposition: SEBI cyber resilience, system audits, trading platform security, cloud audits and SOC. Mutual funds, AMCs, portfolio managers and AIFs are covered in the separate Asset & Investment Management fact file. |
1. Why capital markets cybersecurity matters now
India's securities market has become a mass-market, app-driven system. Investors open demat accounts digitally, trade through mobile apps and APIs, and expect instant settlement and round-the-clock access to their holdings. A cyber incident at an exchange, depository, broker or registrar can disrupt trading, compromise investor assets and damage market integrity.
|
18.59 cr Demat accounts at CDSL (30 June 2026) |
5 Regulated-entity categories under SEBI CSCRF |
6 hours To report cyber incidents to SEBI and CERT-In |
31 Aug 2025 CSCRF compliance date for most REs |
SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), issued on 20 August 2024, consolidated earlier cybersecurity circulars into a single, graded framework aligned with international standards. Market infrastructure institutions, KYC registration agencies and qualified RTAs had to comply by 1 January 2025; all other regulated entities by 31 August 2025.
|
Key takeaway Every SEBI regulated entity now needs to know its CSCRF category and meet the audit, testing, monitoring and reporting cycle that comes with it. |
2. The ecosystem at a glance
Figure 1: India's capital markets ecosystem — trade flow, intermediaries and oversight.
3. Categories of market participants
|
Participant |
Role |
Typical ownership |
Key regulatory basis |
|
Stock exchanges |
Operate trading platforms for equities, derivatives, currencies and commodities |
Public shareholding with institutional investors; some listed |
SECC Regulations; SEBI CSCRF (MII category) |
|
Clearing corporations |
Clear and settle trades and manage counterparty risk |
Subsidiaries of exchanges |
SECC Regulations; SEBI CSCRF (MII category) |
|
Depositories |
Hold securities in dematerialised form (NSDL and CDSL) |
Institutional shareholders; listed |
Depositories Act, 1996; SEBI CSCRF (MII category) |
|
Stock brokers |
Provide trading access through branches, apps, APIs and algo platforms |
Bank-owned, independent and discount brokers; many listed |
SEBI (Stock Brokers) Regulations; CSCRF category by size |
|
Depository participants |
Open and service demat accounts on behalf of depositories |
Banks, brokers and custodians |
SEBI (Depositories and Participants) Regulations; CSCRF |
|
Professional clearing members |
Clear and settle trades for trading members |
Banks and specialised firms |
SEBI circulars including the 2024 system audit framework |
|
Custodians |
Safekeeping and asset servicing for institutional investors |
Banks and specialised custodians |
SEBI (Custodian) Regulations; CSCRF |
|
KYC registration agencies |
Maintain centralised KYC records for the securities market |
Subsidiaries of MIIs and others |
SEBI KRA Regulations; CSCRF (Qualified RE category since April 2025) |
|
RTAs |
Maintain investor records and process corporate actions for issuers |
Private companies |
SEBI RTA Regulations; CSCRF (qualified RTAs in the MII category) |
|
Market technology vendors |
Trading, OMS/RMS, back-office, algo and cloud providers |
Indian and international technology companies |
Clients' CSCRF third-party requirements and contracts |
4. SEBI's CSCRF categories
CSCRF grades regulated entities into five categories based on their systemic importance and size—for example, client numbers and trading volumes for brokers, or assets under management for AMCs. Requirements increase with the category; an entity registered in more than one capacity follows the highest applicable category.
|
CSCRF category |
Typical entities |
Indicative obligations |
|
Market Infrastructure Institutions (MIIs) |
Exchanges, clearing corporations, depositories and qualified RTAs |
Most stringent controls; cyber audits and VAPT on the most frequent cycle; own 24x7 SOC; Cyber Capability Index assessment |
|
Qualified REs |
Large brokers, custodians, KRAs and other large entities |
Frequent cyber audits; 24x7 SOC; red teaming and threat hunting; Cyber Capability Index self-assessment |
|
Mid-size REs |
Medium-sized brokers and other intermediaries |
Annual cyber audits (more frequent for internet or algo trading); 24x7 SOC (own, managed or Market SOC) |
|
Small-size REs |
Smaller brokers and intermediaries |
Baseline controls; annual audits; onboarding to the Market SOC unless running their own SOC |
|
Self-certification REs |
The smallest regulated entities |
Baseline controls with self-certification |
|
Thresholds change SEBI revised categorisation thresholds in April 2025 and issued technical clarifications in August 2025. Entities should confirm their category against the latest circulars each year. |
5. Government, public-sector and private participants
- SEBI regulates the securities market under the SEBI Act, 1992, the Securities Contracts (Regulation) Act, 1956 and the Depositories Act, 1996.
- Public sector banks and financial institutions participate as depository participants, custodians, clearing banks and investors.
- Government is the largest issuer of securities through government bonds, and several PSUs are listed issuers.
- NCIIPC may notify critical systems of market infrastructure as protected systems, adding further obligations.
- Private participants range from large listed brokers and institutions to small regional brokers and DPs.
6. Who buys cybersecurity inside these organisations
|
Stakeholder |
What they care about |
What they buy |
|
Board and IT or risk committees |
Market integrity, regulatory standing, resilience |
Board reporting, crisis exercises, Cyber Capability Index support |
|
CISO and information security |
CSCRF control effectiveness, monitoring, VAPT closure |
Cyber audits, VAPT, SOC, red teaming |
|
CTO and trading technology |
Platform availability and latency, secure change |
Trading platform and API testing, DevSecOps |
|
Compliance officer |
SEBI circulars, audits, reporting |
CSCRF gap assessments, system audits, evidence management |
|
Operations and surveillance |
Unauthorised trades and transfers, investor complaints |
Fraud and surveillance reviews, back-office access controls |
|
Data protection lead |
Investor KYC and personal data |
DPDPA programme, DLP, data-flow mapping |
7. Why each participant needs a different approach
|
Participant |
Highest-consequence risk |
Starting point for assurance |
|
Exchange / clearing corporation |
Market-wide outage, DDoS, settlement integrity |
Resilience testing, red teaming, SOC efficacy, RTO/RPO validation |
|
Depository |
Unauthorised transfers, insider misuse, systemic data exposure |
Privileged-access audit, transfer-control testing, SOC |
|
Stock broker |
Account takeover, API and algo abuse, DDoS, fake apps |
Trading app and API testing, CSCRF audit, managed SOC |
|
Depository participant |
Back-office misuse, unauthorised pledges and transfers |
Back-office access and maker-checker testing, VAPT |
|
RTA / KRA |
Ransomware and investor data exposure |
Segmentation and backup testing, data protection review |
|
Technology vendor |
Supply-chain compromise across many REs |
Secure SDLC, VAPT, client assurance pack |
8. How Codec Networks works with capital market entities
Codec Networks is a CERT-In empanelled information security auditing organisation—meeting CSCRF's requirement that cyber audits and VAPT be performed by CERT-In empanelled auditors—and is certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. We deliver CSCRF cyber audits, system and PCM audits, trading platform security testing, cloud audits under SEBI's cloud framework and managed SOC services.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026, including SEBI, CERT-In and MeitY publications and depository releases. CSCRF requirements depend on each entity's category; confirm obligations against the current SEBI circulars.