MASTER CIRCULAR
SEBI/HO/MRD/MRD-PoD-2/P/CIR/2023/166 October 06, 2023 To, All Depositories Dear Sir / Madam, Subject: Master Circular for Depositories

Securities and Exchange Board of India (SEBI), from time to time, has been issuing
various circulars/directions to Depositories. Further, a Master Circular in the form of a compilation of all the relevant circulars was also issued on this subject on February 05, 2021. In order to enable the users to have access to all the applicable circulars/directions pertaining to depositories at one place, the Master Circular for Depositories has been prepared.
This Master Circular shall come into force from the date of its issuance. This Master
Circular covers the relevant circulars/communications pertaining to depositories issued by SEBI upto August 31, 2023. References to the Statutes/Regulations which now stand repealed have been suitably updated in the Master Circular. This Master Circular rescinds the circulars and communications listed in Schedule-A.
Notwithstanding such rescission:
a) anything done or any action taken or purported to have been done or taken under the rescinded circulars, including registrations or approvals granted, fees collected, registration or approval suspended or cancelled, any inspection or investigation or enquiry or adjudication commenced or show-cause notice issued, prior to such rescission, shall be deemed to have been done or taken under the corresponding provisions of this Master Circular; b) any application made to SEBI under the rescinded circulars, prior to such rescission, and pending before it shall be deemed to have been made under the corresponding provisions of this Master Circular; c) the previous operation of the rescinded circulars or anything duly done or suffered thereunder, any right, privilege, obligation orliability acquired, accrued or incurred under the rescinded circulars, any penalty, incurred in respect of any violation committed against the rescinded circulars, or any investigation, legal proceeding or remedy in respect of any such right, privilege, obligation, liability,

penalty as aforesaid, shall remain unaffected as if the rescinded circulars have never been rescinded.
4. The Master Circular consists of four sections i.e. Beneficial Owner (BO) Accounts,
Depository Participants (DP) Related, Issuer related and Depositories Related. Efforts have been made to include provisions of circulars/communications relevant to each sections. However, cross referencing of circulars/communications amongst the sections may exist. Users may refer other sections also for compliance to provisions applicable to them.
5. Words and expressions used but not defined in this Circular shall have the same
meanings as may be defined in Securities Contracts (Regulation) Act, 1956 or the Securities and Exchange Board of India Act, 1992 or the Depositories Act, 1996 or Regulations made thereunder i.e. Securities Contracts (Regulation) (Stock Exchanges and Clearing Corporations) Regulations, 2018, SEBI (Depositories and Participants) Regulations, 2018, PIT Regulations, SEBI (Prohibition of Fraudulent and Unfair Trade Practices relating to Securities Market) Regulations, 2003, unless the context requires otherwise.
6. This Master Circular is issued in exercise of powers conferred under Section 11(1) of
the Securities and Exchange Board of India Act, 1992 to protect the interests of investors in securities and to promote the development of, and to regulate the securities market.
7. This Master Circular is available on the SEBI website at https://www.sebi.gov.in/
under the category “LegalMaster Circulars”.
Yours faithfully
Vishal Shukla
General Manager
Market Regulation Department
Email: vishals@sebi.gov.in
Phone 022-26449959

Table of Contents
Section - 1: Beneficial Owner (BO) Accounts
1.1 Opening of BO Account by non-body corporates
1.1.1 Proof of Identity (PoI)
1.1.2 Proof of Address (PoA)
1.1.3 Clarification on voluntary adaptation of Aadhaar based e-KYC process
1.1.4 Common and simplified norms for processing investor’s service requests by
RTAs and norms for furnishing PAN, KYC details and Nomination
1.1.5 SARAL Account Opening Form for resident individuals
1.1.6 Uniform Know Your Client (KYC) Requirements for the Securities Markets
1.1.7 Acceptance of third party address as correspondence address
1.2 Exemptions from and clarifications relating to mandatory requirement of PAN
1.3 Simplification of demat account opening process
1.4 Guidelines for online closure of demat accounts
1.5 Guidelines on Identification of Beneficial Ownership
1.6 Opening of demat account in case of HUF
1.7 Operation of minor’s demat account
1.8 Facility for a Basic Services Demat Account (BSDA)
1.9 Change of Name in the Beneficial Owner (BO) Account
1.10 Fees/Charges to be paid by BO
1.11 Framework for automated deactivation of trading and demat accounts in cases of
inadequate KYCs
1.12 Safeguards to address the concerns of the investors on transfer of securities in
dematerialized mode
1.13 Delivery Instruction Slip (DIS) Issuance and Processing
1.14 Nomination for Eligible Trading and Demat Accounts
1.15 Transmission of shares
1.16 Simplification of procedure and standardization of formats of documents for
transmission of securities
1.17 Mode of Operation and Transmission of Securities in Joint Demat Accounts
1.18 Execution of Power of Attorney (PoA) by the Client in favour of the Stock Broker/ Stock
Broker and Depository Participant
1.19 Execution of ‘Demat Debit and Pledge Instruction’ (DDPI) for transfer of securities
towards deliveries / settlement obligations and pledging / re-pledging of securities
1.20 SMS alerts for demat accounts operated by Power of Attorney

1.21 Exemption from sending quarterly statements of transactions by depository participants
(DPs) to clients in respect of demat accounts with no transactions and no security balances
1.22 Discontinuation of sending transaction statements by depository participants to clients
1.23 Exemption to Depository Participants (DPs) from providing hard copies of transaction
statements to BOs
1.24 Consolidated Account Statement (CAS) for all securities assets
1.25 Generation and Dispatch of Consolidated Account Statement
1.26 Redressal of investor grievances through SCORES platform & Procedure for filing
investor grievances using SCORES
1.27 Framework for the process of accreditation of investors for the purpose of Innovators
Growth Platform
1.28 Common Application Form for Foreign Portfolio Investors
Section - 2: Depository Participants (DP) Related
2.1 Online Registration Mechanism for Securities Market Intermediaries
2.2 Supervision of branches of depository participants
2.3 Incentivisation to Depositories Participants (DPs)
2.4 Guidelines on Outsourcing of Activities by Intermediaries
2.5 Implementation of the Multilateral Competent Authority Agreement and Foreign
Account Tax Compliance Act
2.6 Interest and Dividend information reporting in case of Custodial Accounts Rule
114G(1)(e) of the Income Tax Rules, 1962
2.7 Printing of Grievances Redressal Mechanism on Delivery Instruction Form Book
2.8 Operationalization of Central KYC Records Registry (CKYCR)
2.9 Rollout of Legal Entity Template
2.10 e-KYC Authentication facility under section 11A of the Prevention of Money
Laundering Act, 2002 by Entities in the securities market for Resident Investors and Entities permitted to undertake e-KYC Aadhaar Authentication service of UIDAI in Securities Market
2.11 The Securities and Exchange Board of India (KYC Registration Agency) Regulations,
2.12 Guidelines in pursuance of the SEBI KYC Registration Agency (KRA) Regulations, 2011
and for In-Person Verification (IPV)
2.13 Clarification on Know Your Client (KYC) Process and Use of Technology for KYC
2.14 Simplification and Rationalization of Trading Account Opening Process
2.15 Recording of Non Disposal Undertaking(NDU)in the Depository System
2.16 Recording of all types of Encumbrances in Depository system

2.17 Cyber Security & Cyber Resilience framework for Depository Participants
2.18 Standard Operating Procedure (SOP) for handling cyber security incidents of
intermediaries and Categorisation of Intermediaries
2.19 CERT-In Advisory "Preventing Data Breaches / Data Leaks"
2.20 Reporting for Artificial Intelligence (AI) and Machine Learning (ML) applications and
systems offered and used by market intermediaries
2.21 Flashing a link to SCOREs on the dashboard of Demat Accounts
2.22 Displaying of information regarding SEBI Complaint Redress System (SCORES) in the
website
2.23 Block Mechanism in demat account of clients undertaking sale transactions
2.24 Validation of Instructions for Pay-In of Securities from Client demat account to Trading
Member (TM) Pool Account against obligations received from the Clearing Corporations
2.25 Monitoring and Periodical Reporting of the Compliance with The Requirements
Pertaining to ‘Security and Covenant Monitoring’ System Hosted by Depositories
2.26 Maintenance of a website by stock brokers and depository participants
2.27 Advisory for SEBI Regulated Entities (REs) regarding Cybersecurity best practices
2.28 Combating Financing of Terrorism (CFT) under Unlawful Activities (Prevention) Act,
1967 – Directions to Stock Exchanges, Depositories and all Registered Intermediaries
2.29 Framework For Adoption Of Cloud Services By SEBI Regulated Entities (REs)
2.30 Cyber Security Operations Center for SEBI registered intermediaries
Section - 3: Issuer related
3.1 Charges to be paid by Issuers
3.2 Activation of International Securities Identification Number (ISIN) in case of IPOs
and additional issue of shares/ securities
3.3 Streamlining the Process of Rights Issue
3.4 Registrar and Share Transfer Agents
3.5 American Depository Receipts (ADRs)/Global Depository Receipts
3.6 Framework for issue of Depository Receipts (DRs)
3.7 Redemption of Indian Depository Receipts (IDRs) into Underlying Equity Shares
3.8 Electronic Clearing System (ECS) facility
3.8.1 Use of ECS for refund in public/ rights issues
3.8.2 Usage of electronic payment modes for making cash payment to the investors
3.9 Withdrawal by issuers from the depository
3.10 Further issue of shares under Section 43 of Companies Act and the Companies (Share
Capital and Debentures) Rules, 2014
3.11 Redressal of investor grievances through SCORES platform

3.12 Streamlining issuance of SCORES Authentication for SEBI registered intermediaries
3.13 Clarification on applicability of regulation 40(1) of SEBI (Listing Obligations and
Disclosure Requirements) Regulations, 2015 to open offers, buybacks and delisting of securities of listed entities
3.14 Streamlining the Process for Acquisition of Shares pursuant to Tender-Offers made
for Takeovers, Buy Back and Delisting of Securities
3.15 Non-compliance with the Minimum Public Shareholding (MPS) requirements
3.16 Non-compliance with certain provisions of the SEBI (Listing Obligations and
Disclosure Requirements) Regulations, 2015 and the Standard Operating Procedure for suspension and revocation of trading of specified securities
3.17 Investor grievances redressal mechanism – Handling of SCORES complaints by
stock exchanges and Standard Operating Procedure for non-redressal of grievances by listed companies
3.18 Automation of Continual Disclosures under Regulation 7(2) of SEBI (Prohibition of
Insider Trading) Regulations, 2015 - System driven disclosures
3.19 A Trading Window closure period under Clause 4 of Schedule B read with
Regulation 9 of SEBI (Prohibition of Insider Trading) Regulations, 2015 (“PIT Regulations”) – Framework for restricting trading by Designated Persons (“DPs”) by freezing PAN at security level
3.20 Reconciliation of Share Capital Audit
3.21 Streamlining the Process of Public Issue of Equity Shares and convertibles
Section - 4: Depositories Related
4.1 Online Registration Mechanism and Filing System for Depositories
4.2 Activity schedule for depositories for T+2 rolling Settlement
4.3 Introduction of T+1 rolling settlement on an optional basis
4.4 Settlement of transactions in case of holidays
4.5 Deadline time for accepting non pay-in related instructions
4.6 Approval of amendments to Bye Laws / Rules of Stock Exchanges and Depositories
4.7 Periodical Report – Grant of prior approval to Depository Participants
4.8 Preservation of Records
4.9 Participation as Financial Information Providers in Account Aggregator framework
4.10 Facilitating transaction in Mutual Fund schemes through the Stock Exchange
Infrastructure
4.11 Discontinuation of usage of pool accounts for transactions in units of Mutual Funds
on the Stock Exchange Platforms
4.12 RTA inter-operable Platform for enhancing investors’ experience in Mutual Fund
transactions / service requests
4.13 Pledge of Shares through depository system

4.14 Margin obligations to be given by way of Pledge/ Re-pledge in the Depository
System
4.15 Foreign investments in infrastructure companies in securities markets
4.16 Designated e-mail ID for regulatory communication with SEBI
4.17 Designated e-mail ID for redressal of investor complaints
4.18 Redressal of complaints against Stock Exchanges and Depositories through SEBI
Complaints Redress System (SCORES)
4.19 Limitation period for filing an arbitration reference
4.20 Disclosure of investor complaints and arbitration details on Depository website
4.21 Disclosure of Complaints against the Depositories
4.22 Disclosure of regulatory orders and arbitration awards on Depository website
4.23 Disclosure of Investor Charter for Depositories and Depositor Participants
4.24 Guideline for websites of depositories
4.25 Arbitration / Appellate Arbitration fees on the remanded back matter for fresh
arbitration proceedings
4.26 Establishment of connectivity by Clearing House / Clearing Corporation (CH/CC)
with the Depository – Clarification
4.27 Issue of Master Circular by Stock Exchanges, Clearing Corporations and Depositories
4.28 Principles of Financial Market Infrastructures (PFMIs)
4.29 System and Network Audit of Market Infrastructure Institutions (MIIs)
4.30 Testing Framework for the Information Technology (IT) systems of the Market
Infrastructure Institutions (MIIs)
4.31 Guidelines for Business Continuity Plan (BCP) and Disaster Recovery(DR)
4.32 IT (Information Technology) Governance for Depositories
4.33 Guidelines for inspection of Depository Participants (DPs) by Depositories
4.34 Dissemination of information on action taken against Trading Members/Depository
Participants on the website of Stock Exchanges / Depositories
4.35 Activity of Demat of warehouse receipts
4.36 Voting rights in respect of securities held in pool account
4.37 e-Voting Facility Provided by Listed Entities
4.38 Risk Management Policy at the Depositories
4.39 Code of Conduct & Institutional mechanism for prevention of Fraud or Market
Abuse
4.40 Outsourcing by Depositories
4.41 Cyber Security and Cyber Resilience framework of Depositories
4.42 Recommendations of high powered steering Committee
4.43 Database for Distinctive Number (DN) of Shares
4.44 Ticker on Website - For Investor awareness

4.45 Separate mobile number/ email id for the clients of Depository Participants (DPs)
4.46 Comprehensive guidelines for Investor Protection Fund (IPF) and Investor Services
Fund (ISF) at Stock Exchanges and Depositories
4.47 Enhanced Supervision of Depository Participant
4.48 Amendment pursuant to comprehensive review of Grievance Redressal Mechanism
4.49 Investor Grievance Redressal Mechanism
4.50 Digital Mode of Payment
4.51 Framework for Innovation Sandbox
4.52 Revised Framework for Innovation Sandbox
4.53 Framework for Regulatory Sandbox
4.54 Monitoring of Foreign Investment limits in listed Indian companies
4.55 Disclosure of performance of CRAs on Stock Exchange and Depository website
4.56 Handling of Clients’ Securities by Trading Members/Clearing Members
4.57 Early Warning Mechanism to prevent diversion of client securities
4.58 Standard Operating Procedure in the cases of Trading Member / Clearing Member
leading to default
4.59 Mapping of Unique Client Code (UCC) with demat account of the clients
4.60 Reporting for Artificial Intelligence(AI) and Machine Learning (ML) applications and
systems offered and used by Market Infrastructure Institutions (MIIs)
4.61 Measures to expedite Dematerialisation of securities
4.62 Capacity Planning Framework for the Depositories
4.63 Trading supported by Blocked Amount in Secondary Market
4.64 Enhanced Due Diligence for Dematerialization of Physical Securities
4.65 Framework For Adoption Of Cloud Services By SEBI Regulated Entities (REs)
4.66 Committees at Market Infrastructure Institutions (MIIs)
4.67 Exemption from clubbing of investment limit for foreign Government agencies and
its related entities and Write-off of shares held by FPIs
4.68 Stealing of Customers data registered with NSE/ BSE
4.69 Advisory regarding remote access and telecommuting
4.70 Standard Operating Procedure (SOP) for Reporting of Technical Glitches by MIIs and
Imposition of “Financial Disincentive
4.71 Standard Operating Procedure for handling of Stock Exchange Outage and extension
of trading hours thereof
4.72 Standard Operating Procedure (SOP) for Reporting of Cyber Security Incidents/
breaches/ deficiencies by MIIs and Imposition of “Financial Disincentive”
4.73 Implementation of Cyber Capability Index
4.74 Advisory for SEBI Regulated Entities (REs) regarding Cybersecurity best practices

4.75 Norms for Scheme of Arrangement by unlisted Stock Exchanges, Clearing
Corporations and Depositories
4.76 Procedures for ensuring compliance with Securities Contracts (Regulation) (Stock
Exchanges and Clearing Corporations) Regulations, 2018 (SECC Regulations) by Listed Stock Exchanges
4.77 Measures to strengthen tracking and reporting of delay in pay-in/pay-out for rolling
settlement
4.78 Advisory on Security Patch Management Policy
4.79 Strengthening Resiliency of Websites of Stock Exchanges, Clearing Corporations and
Depositories (MIIs)
4.80 Bolstering Cyber Resiliency
4.81 Advisory on Cyber Audit and VAPT
4.82 Comprehensive Review of Cyber Security at Stock Exchanges, Clearing Corporations
and Depositories (MIIs)
4.83 Activity schedule for depositories for T+2 rolling Settlement
Annexures
List of Circulars & Communications
Schedule A

Section 1: Beneficial Owner (BO) Accounts
1.1 Opening of BO Account by non-body corporates
1.1.1 Proof of Identity (PoI)
1.1.1.1 Permanent Account Number (PAN) to be the sole identification number for
all transactions in the securities market1 With effect from July 02, 2007, PAN is the sole identification number for all transactions in the securities market, irrespective of the amount of transaction. A copy of the PAN card with photograph may be accepted as Proof of Identity. In this regard, intermediaries shall:- a. Put necessary systems in place so that the databases of the clients and their transactions are linked to the PAN details of the client. b. Build necessary infrastructure to enable accessibility and query based on PAN thereby enabling retrieval of all the details of the clients.
c. Collect copies of PAN cards issued to the existing as well as new clients by
the Income Tax Department and maintain the same in their record after verifying with the original. d. Cross-check the aforesaid details collected from their clients with the details on the website of the Income Tax Department i.e. http://incometaxindiaefiling.gov.in/challan/enterpanforchallan.jsp2.
1.1.1.2 PAN as the sole identification number for all transactions in the securities
market3
1.1.1.2.1 It has been decided to discontinue with the requirement of Unique
Identification Number (UIN) under the SEBI (Central Database of market Participants Regulations), 2003 (MAPIN regulations)/circulars.
1.1.1.3 List of documents admissible as Proof of Identity4
a. Unique Identification Number (UID) (Aadhaar)/ Passport/ Voter ID card/ Driving license. b. PAN card with photograph.
c. Identity card/ document with applicant’s Photo, issued by any of the
following: Central/State Government and its Departments, Statutory/Regulatory Authorities, Public Sector Undertakings, Scheduled Commercial Banks, Public Financial Institutions, Colleges affiliated to

1 Reference: SEBI Circular MRD/DoP/Cir-5/2007 dated April 27, 2007 2 Income Tax Department since changed the link for verification to:
https://incometaxindiaefiling.gov.in/e-Filing/Services/KnowYourPanLink.html 3 Reference: SEBI Circular MRD/DoP/Cir-08/2007 dated June 25, 2007 4 Reference: SEBI Circular MIRSD/SE/Cir-21/2011 dated October 05, 2011

Universities, Professional Bodies such as ICAI, ICWAI, ICSI, Bar Council etc., to their Members; and Credit cards/Debit cards issued by Banks. d. e-KYC service launched by UIDAI shall also be accepted as a valid process for Know Your Client (“KYC”) verification. The information containing the relevant client details and photograph made available from UIDAI as a result of e-KYC process shall be treated as a valid proof of Identity.5 e. With a view to bring about operational flexibility and in order to ease the PAN verification process, the intermediaries may verify the PAN of their clients online at the Income Tax website without insisting on the original PAN card, provided that the client has presented a document for Proof of Identity other than the PAN card.6
1.1.2 Proof of Address (PoA)7
1.1.2.1 List of documents admissible as Proof of Address:
(*Documents having an expiry date should be valid on the date of submission.) a. Passport/ Voters Identity Card/ Ration Card/ Registered Lease or Sale Agreement of Residence/ Driving License/ Flat Maintenance bill/ Insurance Copy. b. Utility bills like Telephone Bill (only land line), Electricity bill or Gas bill - Not more than 3 months old.
c. Bank Account Statement/Passbook -- Not more than 3 months old.
d. Self-declaration by High Court and Supreme Court judges, giving the new address in respect of their own accounts. e. Proof of address issued by any of the following: Bank Managers of Scheduled Commercial Banks/Scheduled Co-Operative Bank/Multinational Foreign Banks/Gazetted Officer/Notary public/ elected representatives to the Legislative Assembly/Parliament/Documents issued by any Govt. or Statutory Authority. f. Identity card/document with address, issued by any of the following:
Central/State Government and its Departments, Statutory/Regulatory Authorities, Public Sector Undertakings, Scheduled Commercial Banks, Public Financial Institutions, Colleges affiliated to Universities and Professional Bodies such as ICAI, ICWAI, ICSI, Bar Council etc., to their Members. g. For FPI: Power of Attorney given by FPI to the Custodians (which are duly notarized and/or apostiled or consularised) that gives the registered address should be taken.

5 Reference: SEBI Circular SEBI/MIRSD/09/2013 dated October 08, 2013 6 Reference: SEBI Circular SEBI/MIRSD/01/2013 dated January 04, 2013 7 Reference: SEBI Circular MIRSD/SE/Cir-21/2011 dated October 05, 2011

h. The proof of address in the name of the spouse may be accepted.
i. Aadhaar Letter issued by UIDAI shall be admissible as Proof of Address in
addition to Proof of Identity.8 j. e-KYC service launched by UIDAI shall also be accepted as a valid process for KYC verification. The information containing the relevant client details and photograph made available from UIDAI as a result of e-KYC process shall be treated as a valid proof of address.9
1.1.2.2 DP shall ensure that all documents pertaining to proof of identity and proof of
address are collected from all the account holders.10 Submission of the aforesaid documents is the minimum requirement for opening a BO Account. DPs must verify the copy of the aforementioned documents with the original before accepting the same as valid. While opening a BO Account, DPs shall exercise due diligence11 while establishing the identity of the person to ensure the safety and integrity of the depository system.
1.1.3 Clarification on voluntary adaptation of Aadhaar based e-KYC process12
SEBI has enabled Aadhaar based e-KYC service offered by UIDAI for KYC verification. Intermediaries have sought clarifications from SEBI on certain operational aspects of the same. It is clarified that for accessing the details enabling client identification and authentication from UIDAI based on client authorisation, on voluntary basis, intermediaries who utilize the services of KYC Service Agencies (KSAs) would be registered as KYC User Agencies (KUA) with UIDAI.13
i. For entering into account based relationship, the client may provide the following
information to the intermediary:
a) Name b) Aadhaar number c) Permanent Account Number (PAN)
ii. The above information can be provided by the client electronically including
through any web enabled device.
iii. The intermediary shall perform verification of the client with UIDAI through
biometric authentication (fingerprint or iris scanning). Mutual Funds can also perform verification of the client with UIDAI through One Time password (OTP) received on client’s mobile number or on e-mail address registered with UIDAI

8 Reference: SEBI Circular MIRSD/09/2012 dated August 13, 2012 9 Reference: SEBI Circular SEBI/MIRSD/09/2013 dated October 08, 2013 10 Reference: SEBI Circular MRD/DoP/Dep/Cir-29/2004 dated August 24, 2004 11 Reference: SEBI Circular Point 5 of part II on ‘Customer Due Diligence’ of Master SEBI Circular no. ISD/AML/CIR-1/2008 dated December 19, 2008 12 Reference: SEBI Circular SEBI/MIRSD/09/2013 dated October 08, 2013 13 Reference: SEBI Circular CIR/MIRSD/29/2016 dated January 22, 2016

provided, the amount invested by the client does not exceed INR 50,000 per financial year per Mutual Fund and payment for the same is made through electronic transfer from the client’s bank account registered with that Mutual Fund.
iv. PAN of such client is to be verified from the income tax website.
v. After due validation of Aadhaar number provided by the client, the intermediary
(acting as KUA) shall receive the KYC information about the client from UIDAI through KSA.
vi. The information downloaded from UIDAI shall be considered as sufficient
information for the purpose of KYC verification. The intermediary shall upload this KYC information on the KRA system in terms of Securities and Exchange Board of India {KYC (Know Your Client) Registration Agency} Regulations, 2011 (“KRA Regulations”).
vii. In case material difference is observed either in the name (as observed in the PAN
vis-a-vis Aadhaar) or photograph in Aadhaar is not clear, the intermediary shall carry out additional due diligence and maintain a record of the additional documents sought pursuant to such due diligence.
viii. The records of KYC information so received shall be maintained by the intermediary
as per the SEBI Act, Regulations and various circulars issued thereunder.
1.1.4 Common and simplified norms for processing investor’s service requests by RTAs and
norms for furnishing PAN, KYC details and Nomination 14 Kindly refer para titled ‘Common and Simplified Norms for processing investor's service request by RTAs and norms for furnishing PAN, KYC details and Nomination’ of SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2023/70 dated May 17, 2023 (Master Circular for Registrars to an Issue and Share Transfer Agents)
1.1.5 SARAL Account Opening Form for resident individuals15
1.1.5.1 It is gathered that a majority of new investors in the securities market begin with
participation in the cash segment without obtaining various other facilities such as internet trading, margin trading, derivative trading and use of power of attorney. The account opening process can be simplified for such individual investors. With a view to encourage their participation, it is, therefore, decided that such individual investors can open a trading account and demat account by filling up a simplified Account Opening Form ('AOF') termed as 'SARAL AOF' given at Annexure 1.
1.1.5.2 This form will be separately available with the intermediaries and can also be
downloaded from the Exchanges' and Depositories' website. The investors who open account through SARAL AOF will also have the option to obtain other

14Reference: SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2023/37 dated March 16, 15 Reference: SEBI Circular MIRSD/1/2015 dated March 04, 2015

facilities, whenever they require, on furnishing of additional information as per prescribed regulations/circulars.
1.1.5.3 The standard set of documents viz. Rights and Obligations document, Uniform
Risk Disclosure Document and Guidance Note and documentary proof related to identity and address as specified under Para 2.14, Para 1.1.1 and Para 1.1.2 shall continue to remain applicable. It is further clarified that the provisions laid down under the PMLA, Prevention of Money Laundering (“PML”) Rules 2005, SEBI Master Circular on Guidelines on Anti-Money Laundering (AML) Standards and Combating the Financing of Terrorism (CFT) /Obligations of Securities Market Intermediaries under the Prevention of Money Laundering Act, 2002 and Rules framed there under dated February 03, 2023 shall also continue to remain applicable for set of individual investors mentioned in Para 1.1.5.1 above.
1.1.5.4 For these set of individual investors, it has been decided to simplify the
requirement of submission of ‘proof of address’. The matter has been examined in the light of amendment to the PML Rules, 2005 and accordingly, the requirement of submission of ‘proof of address’ is as follows:
1.1.5.4.1 Henceforth, individual investor may submit only one documentary
proof of address (either residence/correspondence or permanent) while opening a trading account and / or demat account or while undergoing updation.
1.1.5.4.2 In case the proof of address furnished by the said investor is not the
address where the investor is currently residing, the intermediary may take a declaration of the residence/correspondence address on which all correspondence will be made by the intermediary with the investor. No proof is required to be submitted for such correspondence/residence address. In the event of change in this address due to relocation or any other reason, investor may intimate the new address for correspondence to the intermediary within two weeks of such a change. The residence/ correspondence address and any such change thereof may be verified by the intermediary through ‘positive confirmation’ such as (i) acknowledgment of receipt Welcome Kit/ dispatch of contract notes / any periodical statement, etc. (ii) telephonic conversation; (iii) visits, etc.
1.1.6 Uniform Know Your Client (KYC) Requirements for the Securities Markets 16

16 Reference: SEBI Circular MIRSD/SE/Cir-21/2011 dated October 05, 2011

1.1.6.1 In case of stock brokers (and also for the stock brokers who are depository
participants), the account opening process for investors has been simplified vide Para 2.14, KYC form capturing the basic details about the client has been prescribed as Part I of the account opening form and additional information specific to dealing in the stock exchange(s) are obtained in Part II of the form.
1.1.6.2 With a view to bring about uniformity in securities markets, it has also been decided
that the same KYC form and supporting documents shall also be used by all captioned SEBI registered intermediaries. The KYC form as given in Annexure 2 shall be filled by an investor at the account opening stage while dealing with any of the above intermediaries. Additional details specific to the area of activity of the intermediary being obtained now but not covered in the KYC form shall also be obtained from the investors in Part II of the account opening form.
1.1.6.3 The additional information (Part II) shall be prescribed by depositories for their
depository participants and by Association of Mutual Funds in India (“AMFI”) for all mutual funds. The portfolio managers, venture capital funds, and collective investment schemes shall capture the additional information specific to their area of activities, as considered appropriate by them. The intermediaries shall also continue to abide by circulars issued by SEBI from time to time for prevention of money laundering.
1.1.7 Acceptance of third party address as correspondence address17
1.1.7.1 SEBI has no objection to a BO authorizing the capture of an address of a third party
as a correspondence address, provided that the DP ensures that all prescribed KYC norms are fulfilled for the third party also. The DP shall obtain proof of identity and proof of address for the third party. The DP shall also ensure that customer due diligence norms as specified in Rule 9 of PML Rules, 2005 are complied with in respect of the third party.
1.1.7.2 The depository participant should further ensure that the statement of transactions
and holding are sent to the BO’s permanent address at least once in a year.
1.1.7.3 However, the above provision shall not apply in case of PMS (Portfolio
Management Services) clients.
1.2 Exemptions from and clarifications relating to mandatory requirement of PAN
1.2.1 Mandatory requirement of Permanent Account Number (PAN)18
The demat accounts for which PAN details have not been verified are “suspended for debit” until the same is verified with the DP. With effect from August 16, 2010 such PAN non-compliant demat accounts were also "suspended for credit" other than the credits arising out of automatic corporate actions. It was clarified that other credits

17 Reference: SEBI Circular CIR/MRD/DP/37/2010 dated December 14, 2010 18 Reference: SEBI Circular MRD/DP/22/2010dated July 29, 2010

including credits from IPO/FPO/Rights issue, off-market transactions or any secondary market transactions would not be allowed into such accounts.
1.2.2 Central and State Government and officials appointed by Courts19
PAN card may not be insisted upon in case of transactions undertaken on behalf of Central Government and/or State Government and where transactions are conducted by officials appointed by Courts e.g. Official liquidator, Court receiver etc.20 However DPs, before implementing the above exemption, shall verify the veracity of the claim of the organizations by collecting sufficient documentary evidence in support of their claim for such an exemption.
1.2.3 Investors in Sikkim21
Investors residing in the state of Sikkim are exempted from the mandatory requirement of furnishing PAN card details for their demat accounts.22 DPs shall verify the veracity of the claim of the investors that they are residents of Sikkim, by collecting sufficient documentary evidence in support of their address.
1.2.4 UN entities and multilateral agencies exempt from paying taxes/ filing tax returns
in India23
UN entities/ multilateral agencies exempt from paying taxes/filing tax returns in India are also exempt from the mandatory requirement of submitting their PAN card details, subject to the DPs collecting documentary evidence in support of such claims.
1.2.5 FPIs/Institutional Clients24
Custodians shall verify the PAN card details of institutional clients with the original PAN card and provide duly certified copies of such verified PAN details to the brokers. This requirement is applicable in respect of institutional clients, namely, FPIs, MFs, VCFs, FVCIs, Scheduled Commercial Banks, Multilateral and Bilateral Development Financial Institutions, State Industrial Development Corporations, Insurance Companies registered with IRDA and Public Financial Institution as defined under section 2(72) of the Companies Act, 2013.
1.2.6 HUF, Association of Persons (AoP), Partnership Firm, unregistered Trust,
Registered Trust, Corporate Bodies, minors, etc.

19 Reference: SEBI Circular MRD/DoP/Cir-20/2008 dated June 30, 2008 20 Reference: Rule 114C (1)(c) of Income Tax Rules 21 Reference: SEBI Circular MRD/DoP/Dep/Cir-09/06 dated July 20, 2006 22 Reference: Hon’ble High Court of Sikkim judgment dated March 31, 2006 23 Reference: SEBI Circular MRD/DoP/Dep/Cir-09/06 dated July 20, 2006 24 Reference: SEBI Circular MRD/DoP/Dep/SE/Cir-13/06 dated September 26, 2006

The BO account shall be in the name of natural persons, PAN card details of the respective HUF, AoP, Partnership Firm, Unregistered Trust, etc. shall be obtained. The PAN number of Registered Trust, Corporate Bodies and minors shall be obtained when accounts are opened in their respective names.
1.2.7 Difference in maiden name and current name of investors.
DPs can collect the PAN card proof as submitted by the account holder subject to the DPs verifying the veracity of the claim of such investors by collecting sufficient documentary evidence in support of the identity of the investors.25
1.2.8 NRI/PIOs26
Citizens of India residing outside India, foreign citizens and other persons (like companies/ trusts/ firms) having no office of their own in India may obtain PAN card based on the copy of their passport as ID proof and a copy of passport/ bank account in the country of residence as address proof, based on the Directorate of Income Tax (Systems) guidelines.27
1.3 Simplification of demat account opening process28
1.3.1 SEBI has taken a number of steps in the recent past to simplify the account opening
and KYC process in the securities markets. In continuation of the efforts in the same direction, it has now been decided in consultation with both the depositories and associations of stock brokers and DPs to further simplify and rationalize the demat account opening process.
1.3.2 The existing Beneficial Owner-Depository Participant Agreements shall be replaced
with a common document “Rights and Obligations of the Beneficial Owner and Depository Participant” (Annexure 3) . The document annexed herewith shall be mandatory and binding on all the existing and new clients and DPs. This will harmonize the account opening process for trading as well as demat account. This will also rationalize the number of signatures by the investor, which he is required to affix at present on a number of pages.
1.3.3 The DP shall provide a copy of Rights and Obligations Document to the BO and shall
take an acknowledgement of the same. They shall ensure that any clause in any voluntary document neither dilutes the responsibility of the depository participant nor it shall be in conflict with any of the clauses in this document, rules, bye-laws, regulations, notices, guidelines and circulars issued by SEBI and the depositories from time to time. Any such clause introduced in the existing as well as new documents shall stand null and void.

25 Reference: SEBI Circular MRD/DoP/Dep/Cir-29/2004 dated August 24, 2004 26 Reference: SEBI Circular MRD/DoP/Dep/SE/Cir-17/06 dated October 27, 2006 27 Reference: Income Tax (Systems) PAN SEBI Circular No. 4 dated October 11, 2006 28 Reference: SEBI Circular SEBI/MIRSD/ 12/2013 dated December 04, 2013

1.3.4 In consultation with market participants, with a view to simplify the account
opening kit, SEBI has decided that DP shall make available this document “Rights and Obligations of the Beneficial Owner and Depository Participant” to the clients, either in electronic or physical form, depending upon the preference of the client as
part of account opening kit. In case the documents are made available in electronic
form, DP shall maintain the logs of the same. It is also reiterated that Depositories/DP shall continue to make the aforesaid document available on their website and keep the clients informed about the same.29
1.4 Guidelines for online closure of demat accounts30
1.4.1 Depositories are advised to issue guidelines under Para 1.4.4 to their participants
and make available the facility for online closure of demat accounts from August 01, 2021.
1.4.2 Depositories shall inform clients regarding the availability of facility for online
closure of demat accounts through emails, SMS, weekly / fortnightly / monthly newsletters etc.
1.4.3 Depositories shall also advise their participants to inform their clients regarding the
availability of facility for online closure of demat accounts through emails, SMS, weekly / fortnightly / monthly newsletters etc. The procedure for online closure of demat accounts shall be prescribed in such communications.
1.4.4 Guidelines for online closure of demat accounts
1.4.4.1 Client shall be entitled to close the demat account through online mode without
mandatorily giving any reasons to the DP. Clients shall not be restricted from requesting, through online mode or offline mode, for the closure of demat account maintained with the DP, subject to the compliance requirements as stipulated by SEBI / Depository from time to time.
1.4.4.2 Online closure of demat accounts shall be made available for the clients who
have opened their accounts offline or online, by the DPs that provide various Depository related services in online mode. Those DPs which do not provide any services online and do not open accounts online may not be required to offer online closure of demat accounts.
1.4.4.3 Account closure for account with balance shall be done only through web portal
/ app of DP through secured access by way of client specific user ID and password (in case of internet clients) and the request send through emails, SMS, other messaging apps, etc. shall not be entertained by the DP. As the KYC process requires e-sign post which demat accounts can be opened by the DP, for online closure of accounts with balance also, client shall be required to e-sign the

29 Reference: SEBI Circular CIR/MIRSD/64/2016 dated July 12, 2016 30 Reference: SEBI MIRSD email dated July 15, 2021

form (using Aadhaar based online electronic signature service) to be verified by the DP in accordance with guidelines as stipulated by SEBI / Depositories from time to time.
1.4.4.4 In case of clients having demat accounts with nil balances can be closed by the
DPs on the basis of emails received from the registered email ID of the demat account holder.
1.4.4.5 Once the application for closure of demat account is received, the DP shall
intimate to the client on registered email id and / or mobile number (on both if available) about the receipt of closure request. A confirmation regarding the request made shall be sought from the client by way of OTP sent on the email id and / or mobile number updated in its source account (to be closed account).
1.4.4.6 The request for demat account closure shall include target account details (in
case of request for closure of demat account having security balances is made) where the client intends to shift the securities.
1.4.4.7 Client would have to upload the scan / photograph of his / her signature
alongwith Client Master Report (CMR) of the target account digitally signed by official of the target DP (CMR applicable in case of account having security balances). Filled Account Closure form alongwith uploaded ink-signature of the client and CMR as uploaded, would be displayed in one single file to the client, subsequent to which, client shall then be required to e-sign the form (using Aadhaar based online electronic signature service) alongwith the documents and submit the same for further processing. The requirement of obtaining a CMR will be exempted if the DP is able to verify the target demat account details (i.e. sole holder’s name and PAN should match perfectly) directly from the Depository electronically.
1.4.4.8 If the DP authorises the request received, the account will get closed in the
Depository system. If the DP rejects the client requests received, the DP shall inform the reason for such rejection to the client.
1.4.4.9 In case the target account of the client specified in the account closure form is not
its own account i.e. not the same PAN both in source and target accounts, as per the extant requirements, it will be necessary for the client to submit an off-market transfer instruction delivery instruction slip for execution of such transfers along with the requirement of entering OTP as provided by the Depository.
1.4.4.10 After the closure of demat account by the DP, the same shall be intimated to the
client through electronic mode enclosing the CMR & Transaction cum Holding Statement of the closed account.
1.4.4.11 DP shall maintain and store system logs of the closure instructions and e-signed
electronic requests (uneditable) received in electronic form in a secured manner and the same shall be subject to 100% internal audit.

1.4.4.12 Notwithstanding any such closure of demat account, all rights, liabilities and
obligations of the parties arising out of or in respect of transactions entered into prior to the closure of demat account shall continue to subsist and vest in / be binding on the respective parties or his / its respective heirs, executors, administrators, legal representatives or successors, as the case may be.
1.4.4.13 The above process shall be applicable in case of individual client accounts with
single holder (without pledge/freeze/pending demat requests balances) and the closure requests accepted through above mechanism shall be considered as a valid client request and DPs / Depository shall not be held liable for acting on such requests.
1.4.4.14 Depositories shall put in place a complaint redressal mechanism for dealing with
complaints related to online closure of demat accounts.
1.5 Guidelines on Identification of Beneficial Ownership31
1.5.1 The beneficial owner has been defined as the natural person or persons who
ultimately own, control or influence a client and/or persons on whose behalf a transaction is being conducted, and includes a person who exercises ultimate effective control over a legal person or arrangement.
1.5.2 SEBI has prescribed uniform KYC requirements for the securities markets. Also, the
KRA Regulations have been notified and guidelines have been issued under these regulations from time to time.
1.5.3 Further, the PML Rules, 2005 also require that every banking company, financial
institution and intermediary, as the case may be, shall identify the beneficial owner and take all reasonable steps to verify his identity. The Government of India in consultation with the regulators has now specified a uniform approach to be followed towards determination of beneficial ownership. Accordingly, the intermediaries shall comply with the following guidelines. A. For clients other than individuals or trusts:
1.5.4 Where the client is a person other than an individual or trust, viz., company,
partnership or unincorporated association/body of individuals, the intermediary shall identify the beneficial owners of the client and take reasonable measures to verify the identity of such persons, through the following information:
a. The identity of the natural person, who, whether acting alone or together, or through one or more juridical person, exercises control through ownership or who ultimately has a controlling ownership interest. Explanation: Controlling ownership interest means ownership of/entitlement to:

31 Reference: SEBI Circular CIR/MIRSD/2/2013 dated January 24, 2013

i. more than 10%32 of shares or capital or profits of the juridical person,
where the juridical person is a company;
ii. more than 15% of the capital or profits of the juridical person, where
the juridical person is a partnership; or
iii. more than 15% of the property or capital or profits of the juridical
person, where the juridical person is an unincorporated association or body of individuals. b. In cases where there exists doubt under Para 1.5.4 (a) above as to whether the person with the controlling ownership interest is the beneficial owner or where no natural person exerts control through ownership interests, the identity of the natural person exercising control over the juridical person through other means. Explanation: Control through other means can be exercised through voting rights, agreement, arrangements or in any other manner.
c. Where no natural person is identified under Para 1.5.4 (a) or Para 1.5.4 (b)
above, the identity of the relevant natural person who holds the position of senior managing official. B. For client which is a trust:
1.5.5 Where the client is a trust, the intermediary shall identify the beneficial owners of
the client and take reasonable measures to verify the identity of such persons, through the identity of the settler of the trust, the trustee, the protector, the beneficiaries with 10%33 or more interest in the trust and any other natural person exercising ultimate effective control over the trust through a chain of control or ownership.
C. Exemption in case of listed companies:
1.5.6 Where the client or the owner of the controlling interest is a company listed on a
stock exchange, or is a majority-owned subsidiary of such a company, it is not necessary to identify and verify the identity of any shareholder or beneficial owner of such companies. D. Applicability for foreign investors:
1.5.7 Intermediaries dealing with foreign investors’ viz., Foreign Portfolio Investors, Sub
Accounts and Qualified Foreign Investors, may be guided by the clarifications issued vide SEBI circular CIR/MIRSD/11/2012 dated September 5, 2012, for the purpose of identification of beneficial ownership of the client.

32 Reference: Ministry of Finance (Department of Revenue) Notification No. S.O. 1074(E) dated March 07, 2023 33 Reference: Ministry of Finance (Department of Revenue) Notification No. S.O. 1074(E) dated March 07, 2023

1.6 Opening of demat account in case of HUF34
It is noted that as per law, in case of HUF, shares can be held in the name of Existing Karta on behalf of HUF. Therefore, HUF demat accounts can be opened in the name of Existing Karta but not in the name of Deceased Karta and HUF entity. After examining the issues regarding difference in opening of HUF demat account and procedure adopted in the event of death of Karta of HUF, it has been decided that opening of HUF demat account and procedure adopted in the event of death of Karta of HUF shall be as per the following guidelines35:
1.6.1 Opening of HUF Demat Account
a) The Demat account shall be opened in the name of HUF entity as the name of entity appears on the PAN Card. The PAN details of both the HUF entity and Karta of HUF shall be submitted to the DP.
1.6.2 Death of Karta
a) In the event of death of Karta of HUF, the name of the deceased Karta in the BO account shall be replaced by the new Karta of the HUF who in such a case shall be eldest coparcener in the HUF or a coparcener who is appointed as Karta by an agreement reached amongst all the coparceners of the HUF36. b) The new Karta shall submit the new list of members, a notarized copy of death certificate of the deceased Karta and a no objection from the surviving members of the HUF for him/her to act as Karta of the HUF. c) In the event of death of Karta of HUF, the existing BO account need not to be closed and the same account may continue. The death of Karta shall not mean that the securities lying in the BO account of the HUF is deemed to have divided among coparceners as if the partition has taken place.
1.6.3 Partition of HUF
a)A total or partial partition shall be recognized only if a claim to that effect is made by one or more coparceners. b)An intimation of a total or partial partition shall be accompanied by a signed letter mentioning the names of the members and their confirmation of a partition having taken place. c)In case of partial partition of the HUF, if desired by one or more coparceners, the new Karta shall transfer shares to the said coparceners who seek partition

34 Reference: SEBI Letter SEBI/HO/MRD/DP/OW/2016/25739/1 & 25740/1 dated September 14, 2016 and SEBI Letter MRD/DSA1/OW/4946/2018 and 4947/2018 dated February 14, 2018 35 Reference: SEBI Letter SEBI/HO/MRD/DP/OW/2016/25739/1 & 25740/1 dated September 14, 2016 36 Reference: SEBI Circular SEBI/HO/MRD/MRD-POD-2/P/CIR/2022/114 dated August 26,

and the BO account of the HUF shall continue. The account of such coparceners shall be treated as their individual accounts. d)In case of full partition of the HUF, the shares shall be divided amongst all the coparceners in the manner specified by the applicant subject to fulfilment of Para 1.6.3 (c) above and the HUF account shall cease to exist.
1.7 Operation of minor’s demat account37
Under The Hindu Minority and Guardianship Act, 1956, permission of Court is required in the case of transfer by a natural guardian of immovable property of a minor. However, shares are not immovable properly. Section 2(7) of Sale of Goods Act, 1930 includes shares within the definition of "goods''. Neither the Indian Contract Act, 1872 nor the Sale of Goods Act, 1930 provide for transfer by sale or otherwise by guardian /natural guardian of goods/movable property in the name of minor to the effect that permission of court is required in the matter of such transfer. In the case of accounts of minor in banks also, the guardian is entitled to open, operate and even close the account also. The DP account can, therefore, be operated by a natural guardian without any order from the court though the same is neither expressly permitted nor prohibited.
1.8 Facility for a Basic Services Demat Account (BSDA)38
1.8.1 All depository participants (DPs) shall make available a "Basic Services Demat
Account" (BSDA) with limited services as per terms specified herein.
1.8.2 Eligibility: Individuals shall be eligible to opt for BSDA subject to the following
conditionsi. All the individuals who have or propose to have only one demat account where they are the sole or first holder.
ii. Individuals having any other demat account/s where they are not the first holder
shall be eligible for BSDA in respect of the single demat account where they are sole or first holder.
iii. The individual shall have only one BSDA in his/her name across all depositories.
iv. Value of securities held in the demat account shall not exceed Rupees Two Lakhs
at any point of time.
1.8.3 Option to open BSDA: The DP shall give option:
i. To open BSDA to all eligible individuals who open a demat account;
ii. To all the existing eligible individuals to convert their demat account into BSDA
on the date of the next billing cycle based on value of holding of securities in the account as on the last day of previous billing cycle.

37 Reference: SEBI Letter SEBI SMDRP/NSDL/4615 /2000 dated March 13, 2000 38 Reference: SEBI Circular CIR/MRD/DP/22/2012 dated August 27, 2012

iii. In order to facilitate the eligible individuals to avail the benefits of BSDA, DPs
are advised to convert all such eligible demat accounts into BSDA unless such Beneficial Owners (BOs) specifically opt to continue to avail the facility of a regular demat account.
1.8.4 Charges:
To further boost participation in Debt Market and based on representation received from market participants, the structure of charges for debt securities as defined in Securities and Exchange Board of India (Issue and Listing of Non-Convertible Securities) Regulations, 2021 is given below:
i. The charge structure may be on a slab basis as indicated below39:
a. No Annual Maintenance Charges (AMC) shall be levied if the value of holdings of debt securities is up to Rs. 1 lakh and a maximum AMC of Rs. 100 shall be levied if the value of holdings of debt securities is between Rs. 1,00,001 and Rs.2,00,000. No AMC shall be levied if the value of holdings other than debt securities is below Rs. 50,000 and a maximum AMC of Rs. 100 shall be levied if the value of holdings other than debt securities is between Rs.50,001 and Rs.2,00,000.
ii. The value of holding shall be determined by the DPs on the basis of the daily
closing price or NAV of the securities or units of mutual funds, as the case may be. Where such price is not available the last traded price may be taken into account and for unlisted securities other than units of mutual funds, face value may be taken in to account. The value of suspended securities may not be considered for the purpose of determining eligibility of demat account as BSDA.
iii. If the value of holding in such BSDA exceeds the prescribed criteria at any
date, the DPs may levy charges as applicable to regular accounts (non BSDA) from that date onwards.
iv. The DPs shall assess the eligibility of the BOs at the end of the current billing
cycle and convert eligible demat accounts into BSDA.
1.8.5 Services for Basic Services Demat Accounts:
i. Transaction statements:
a. Transaction statements shall be sent to the BO at the end of each quarter. If there are no transactions in any quarter, no transaction statement may be sent for that quarter. b. If there are no transactions and no security balance in an account, then no further transaction statement needs to be provided.

39 Reference: SEBI Circular MRD/DoP2DSA2/CIR/P/2019/51 dated April 10, 2019

c. Transaction statement shall be required to be provided for the quarter in
which the account became a zero balance account.
ii. Holding Statement40:
a. DP shall send atleast one annual physical statement of holding to the stated address of the BO in respect of accounts with no transaction and nil balance even after the account has remained in such state for one year. The DP shall inform the BO that the dispatch of the physical statement may be discontinued if the account continues to remain zero balance even after one year. b. One annual statement of holding shall be sent in respect of remaining accounts in physical or electronic form as opted for by the BO.
iii. Charges for statements: Electronic statements shall be provided free of cost. In
case of physical statements, the DP shall provide at least two statements free of cost during the billing cycle. Additional physical statement may be charged at a fee not exceeding Rs.25/- per statement.
iv. All BOs opting for the facility of BSDA, shall register their mobile number for
availing the SMS alert facility for debit transactions.
v. At least Two Delivery Instruction Slips (DIS) shall be issued at the time of account
opening.
vi. All other conditions as applicable to regular demat accounts, other than the ones
mentioned in this circular shall continue to apply to basic services demat account.
1.8.6 Rationalisation of services with respect to regular accounts.
In partial modification of the earlier directions, the following rationalisation measures shall be available for regular demat accounts:
i. Accounts with zero balance and nil transactions during the year41: DP shall send
atleast one annual physical statement of holding to the stated address of the BO in respect of accounts with no transaction and nil balance even after the account has remained in such state for one year. The DP shall inform the BO that if no Annual Maintenance Charge (AMC) is received by the DP, the dispatch of the physical statement may be discontinued for the account which continues to remain zero balance even after one year.
ii. Accounts which become zero balance during the year: For such accounts, no
transaction statement may be sent for the duration when the balance remains nil. However, an annual statement of holding shall be sent to the BO.

40 Reference: SEBI Circular CIR/MRD/DP/21/2014 dated July 01, 2014 41 Reference: SEBI Circular CIR/MRD/DP/21/2014 dated July 01, 2014

iii. Accounts with credit balance: For accounts with credit balance but no
transactions during the year, half yearly statement of holding for the year shall be sent to the BO.
1.9 Change of Name in the Beneficial Owner (BO) Account42
1.9.1 In order to simplify the procedure of change of name in individual Beneficial
Owner’s (BO) account, it has been decided that an individual BO may be allowed to change his/ her name, subject to the submission of following documents at the time of change of name of the individual in the BO account.
i. In case of change in name on account of marriage following documents shall be
submitted:
Marriage Certificate or copy of Passport showing husband’s name or publication of name change in official gazette.
ii. In case of change in name on account of reasons other than marriage Publication
of name change in official gazette.
In case of change of name of an individual residing in the State of Karnataka and Punjab, for reasons other than marriage, the same may be allowed for the individual in the BO account subject to the submission of following documents43:
a) Request letter for change of name; b) Sworn affidavit executed before the Notary Public/ Magistrate of First Class/ Executive Magistrate mentioning the reason for change of name and his complete address; c) Paper publication in one local newspaper and one national newspaper; and d) KYC in changed name
iii. In case of change in father’s name:
Publication of name change in official gazette.
1.9.2 The Depository Participants (DPs) shall collect the self-attested copies of above
documents and maintain the same in their records after verifying with the original document.
1.10 Fees/Charges to be paid by BO
1.10.1 Account opening, custody and credit of securities44
i. No investor shall pay any charge towards opening of a Beneficial Owner (BO)
Account except for statutory charges as applicable;
ii. No investor shall pay any charge for credit of securities into his/her BO account;
and
iii. No custody charge shall be levied on any investor who is opening a BO account.

42 Reference: SEBI Circular CIR/MRD/DP/27/2012 dated November 01, 2012 43 Reference: SEBI Circular CIR/MRD/DP/158/2018 dated December 27, 2018 44 Reference: SEBI Circular MRD/DoP /SE/Dep/Cir-4/2005 dated January 28, 2005

1.10.2 Account Closure45
No Account closure charges shall be levied on BO on the closure of any account.
1.10.3 Inter Depository Transfer46
Inter-depository transfer of shares does not attract Stamp duty and it does not require compliance with section 56 of the Companies Act, 2013.
1.10.4 Transfer of a BO Account47
No charges shall be levied by a depository on any DP and by a DP on any BO when the BO transfers all the securities lying in his account to another branch of the same DP or to another DP under the same depository or another depository, provided the BO Account(s) at transferee DP and at transferor DP are one and the same, i.e. identical in all respects. In case the BO Account at transferor DP is a joint account, the BO Account at transferee DP should also be a joint account in the same sequence of ownership.
1.10.5 Account Maintenance Charges collected upfront on annual/ half yearly basis on
demat accounts48
i. In the event of closing of the demat account or shifting of the demat account from
one DP to another, the AMC collected upfront on annual/half yearly basis by the DP, shall be refunded by the DP to the BO for the balance of the quarter/s. For instance, in case annual AMC has been paid by the BO and if the BO closes/shifts his account in the first quarter, he shall be refunded the amount of the balance 3 quarters i.e. 3/4th of the AMC. Likewise, if a BO closes/shifts his account in the third quarter, he shall be refunded the amount for the balance one quarter i.e. 1/4th of the AMC.
ii. For the purpose of the above requirement the year shall begin from the date of
opening of the account in quarterly rests.
iii. The above requirements shall be applicable to all existing and new accounts held
with DPs which collect annual/half yearly upfront AMC. It is clarified that the above requirements shall not be applicable to those DPs who collect quarterly/ monthly AMC.
1.10.6 Dissemination of tariff/charge structure of DPs on the website of depositories 49
i. DPs shall submit to their depository the tariff/charge structure every year, latest
by 30th April, and also inform the depository the changes in their tariff/charge

45 Reference: SEBI Circular D&CC/FITTC/CIR - 12/2002 dated October 30, 2002 46 Reference: SEBI Circular SMDRP/Policy/Cir-29/99 dated August 23, 1999 47 Reference: SEBI Circular MRD/DoP/Dep/Cir-22 /05 dated November 9, 2005 48 Reference: SEBI Circular MRD/DP/20/2010 dated July 1, 2010 49 Reference: SEBI Circular MRD/Dep/Cir- 20/06 dated December 11, 2006

structure as and when they are effected with a view to enabling the BOs to have a comparative analysis of the tariff/charge structure of various DPs.
ii. For this purpose depositories shall put in place necessary systems and
procedures including formats, periodicity, etc. for collection of necessary data from the DPs and dissemination of the same on their website which would enable the investors to have a comparative analysis of the tariff/charge structure of various DPs.
1.11 Framework for automated deactivation of trading and demat accounts in cases of
inadequate KYCs50
1.11.1 SEBI has, vide various circulars issued from time to time, mandated that addresses
form a critical part of the KYC procedures. Thus, every address recorded for the purpose of compliance with KYC procedure has to be accurate. An intermediary has to update the address from time to time. However, it has been observed that in some cases accurate/updated addresses of clients are not maintained. This is borne out of the fact that when SEBI issues any notices, etc. during the course of any enforcement proceedings on such addresses, the same remain unserved.
1.11.2 To ensure that the client furnishes accurate/updated details of address and to ensure
that KYC details are correct, the following framework involving stock exchanges (except Commodity Derivatives Exchanges) and depositories (hereinafter collectively referred to as “the MIIs”) is proposed
1.11.2.1 Where SEBI instructs MIIs to serve any Show Cause Notice (“SCN”) or order
issued by SEBI, the MIIs shall arrange to physically deliver the same to the entity. The MIIs shall forward the signed acknowledgement of its receipt by the concerned addressee or its authorized representative to SEBI within a period of 30 working days from the date of receipt of such instructions from SEBI. If none of the MIIs are – a. able to deliver the SCN or order, as the case may be, at any of the addresses mentioned in the KYC records linked to any trading/demat account of the entity; and b. obtain a signed acknowledgement of its receipt from the entity or its authorized representative, then all MIIs shall deactivate all trading and demat accounts i.e. implement a restraint/freeze on debit and credit (except for corporate actions) of all trading and demat accounts of the entity based on the entity’s Permanent Account Number (PAN), within 5 working days from the last unsuccessful delivery report. MIIs shall send an email/SMS to the entity before deactivation. It is clarified that if one of the MIIs is able to deliver the SCN or order, as the case

50 Reference: SEBI Circular SEBI/HO/EFD1/EFD1_DRA4/P/CIR/2022/104 dated July 29, 2022

may be, to the entity and obtain signed acknowledgement, then none of the accounts of the entity shall be deactivated. However, the MIIs, through their registered intermediaries, shall ensure that the KYC records linked to all accounts held by the entity, are updated, accurate and confirm the new KYC details to the concerned KYC Registration Agency (KRA).
1.11.2.2 Pending pay-in and pay-out obligations and open positions may be permitted
to be settled, squared off or closed out, as the case may be, while enforcing the deactivation of trading/demat accounts of such entities.
1.11.2.3 MIIs shall ensure that they communicate the details of the deactivation along
with reasons thereof to the respective registered intermediary. They shall also ensure that the reasons for the deactivation are displayed in a clear and unambiguous manner, when the entity attempts to transact using his trading/demat account.
1.11.2.4 Subject to the above, the MIIs shall ensure that the deactivated accounts are not
used for dealing in securities market in any manner whatsoever.
1.11.2.5 The concerned entity may place a request to the registered intermediaries with
which the entity holds a trading/demat account, seeking re-activation of trading/demat accounts along with – a. the correct proof of address; and, b. signed acknowledgement of receipt of the SCN or order, as the case may be, issued by SEBI referred to in Para 1.11.2.1.
1.11.2.6 The registered intermediary shall update the KYC records as per the extant
norms and forward the copy of the signed acknowledgement of receipt of the SCN or order, as the case may be, to the concerned MII for re-activation of the trading/demat account.
1.11.2.7 The concerned MII shall re-activate all trading accounts/demat accounts of the
entity after ensuring that – a. the entity has provided a signed acknowledgement of receipt of the SCN / order passed by SEBI; and, b. confirmation is received from the registered intermediary that the KYC records are compliant with the extant norms. The concerned MII shall also inform the above to all other MIIs for reactivation of trading/ demat accounts. The signed acknowledgement shall be forwarded by the registered intermediary to the MII within 2 working days from the date of its receipt from the entity and the MII shall in turn forward it to SEBI within 2 working days of its receipt.
1.11.2.8 The process of reactivating the accounts by the MIIs shall not exceed more than
5 working days after receipt of request from the entity along with all the documents mentioned in Para 1.11.2.5.

1.11.2.9 The framework would also apply to joint accounts. However, before
deactivating the joint accounts, MIIs shall endeavor to contact the entity through the co-holders for delivery of SCN / order simultaneously by following the same process outlined above. 1.11.2.10The MIIs may deviate from the above provisions in appropriate cases, where the compliance with the framework is hampered due to factors beyond the control of the entity. In such cases, the MIIs shall record the reasons for deviating from the mandate of the framework and communicate the same to SEBI within 2 working days of such deviation. 1.11.2.11MIIs shall have a mechanism for exchange of information and coordination amongst themselves for the purpose of implementing the framework described above. MIIs shall submit a consolidated report indicating status of requests forwarded by SEBI, on a monthly basis. 1.11.2.12MIIs shall advise their registered intermediaries to ensure updation of KYC records at regular intervals as per the extant norms. This framework shall be in addition to and not in derogation of any Circular issued by SEBI or the MIIs with respect to KYC requirements or Unique Client Code norms. 1.11.2.13An Illustration covering different scenarios is as follows:
Illustration:
Scenarios: Delivery failure, deactivation of accounts and reactivation of accounts. SEBI advises the exchanges and depositories to serve the SCN on August 01, 2022. For the sake of simplicity, it is assumed that the entity has accounts with BSE, NSE, NSDL and CDSL with each account having different addresses* and that all calendar days are working days. The following table depicts the course of action that would be taken by the MIIs depending on the circumstances. Action BSE NSE NSDL CDSL Physical delivery of SCN BSE makes multiple attempts on different addresses from August 1, 2022 to August 25, 2022 and the delivery at all locations becomes unsuccessful. NSE attempts the service on August 15, 2022 and the delivery becomes unsuccessfu l. NSDL attempts the service on August 16, 2022 and the delivery becomes unsuccessfu l. CDSL attempts the service on August 16, 2022 and the delivery becomes unsuccessfu l.

Sharing of information on delivery status
The detail s of unsuccessful delivery shall be shared with all the other MIIs on August 25, 2022. The details of unsuccessfu l delivery shall be shared with all the other MIIs on August 15, 2022. The details of unsuccessfu l delivery shall be shared with all the other MIIs on August 16, 2022. The details of unsuccessfu l delivery shall be shared with all the other MIIs on August 16, 2022. Implementing freeze on debit and credit of trading/demat accounts (within 5 working days from the last unsuccessful delivery report) Freeze shall be implemented by MIIs by August 30, 2022 as the last date of unsuccessful delivery is August 25, 2022. Before deactivation of the accounts, the MIIs shall once again reach out to the entity through email/SMS. Pursuant to the implementation of freeze, the reasons for the same shall be informed to the concerned intermediary and also displayed to the entity when an attempt is made to transact through his trading/demat account. Submission of updated KYC by the entity The entity submits updated KYC and the signed acknowledgeme nt to the registered intermediary of BSE through which it is registered, on October 01, 2022. The intermediary shall intimate the same to BSE immediately. The registered intermediary shall also confirm NA

the updated KYC details to the concerned KRA.
Action BSE NSE NSDL CDSL
Re-activation of demat and trading accounts (within 5 working days from the date of request by the entity) BSE shall reactivate the accounts and inform all the other MIIs within October 06, 2022 as the date of submission of request by the entity was October 01, 2022. All the demat and trading accounts shall be re-activated within October 06, 2022. Forwarding of signed acknowledgeme nt to MII within 2 working days from date of receipt by the intermediary Signed acknowledgeme nt shall be forwarded to BSE by the registered intermediary within October 03, 2022 as the date of receipt of signed acknowledgeme nt by the intermediary was October 01, 2022. NA Forwarding of signed acknowledgeme nt to SEBI within 2 working days from the date of receipt by MII In case the signed acknowledgment is received by BSE on October 10, 2022, the same shall be forwarded to SEBI within October 12, 2022. NA

*-In cases where the same address is available across the MIIs, the MIIs shall co-ordinate among themselves and share the information to avoid duplication of efforts.
1.12 Safeguards to address the concerns of the investors on transfer of securities in
dematerialized mode51
Following safeguards shall be put in place to address the concerns of the investors arising out of transfer of securities from the BO Accounts:
1.12.1 The depositories shall give more emphasis on investor education particularly with
regard to careful preservation of Delivery Instruction Slip (“DIS”) by the BOs. The Depositories may advise the BOs not to leave “blank or signed” DIS with the DPs or any other person/entity.
1.12.2 The DPs shall not accept pre-signed DIS with blank columns from the BO(s).
1.12.3 If the DIS booklet is lost / stolen / not traceable by the BO, then the BO shall
immediately intimate the DP in writing about the loss. On receipt of such intimation, the DP shall cancel the unused DIS of the said booklet.
1.12.4 The DPs shall not issue more than 10 loose DIS to one accountholder in a financial
year (April to March). The loose DIS can be issued only if the BO(s) come in person and sign the loose DIS in the presence of an authorised DP official.
1.12.5 The DP shall also ensure that a new DIS booklet is issued only on the strength of the
DIS instruction request slip (contained in the previous booklet) duly complete in all respects, unless the request for fresh booklet is due to loss, etc., as referred to in Para
1.12.3 above
1.12.6 The DPs shall put in place appropriate checks and balances with regard to
verification of signatures of the BOs while processing the DIS.
1.12.7 The DPs shall cross check with the BOs under exceptional circumstances before
acting upon the DIS.
1.12.8 The DPs shall mandatorily verify with a BO before acting upon the DIS, in case of an
account which remained inactive i.e., where no debit transaction had taken place for a continuous period of 6 months, whenever all the International Securities Identification Number (ISIN) balances in that account (irrespective of the number of ISINs) are transferred at a time. However, in case of active accounts, such verification may be mandatory only if the BO account has 5 or more ISINs and all such ISIN balances are transferred at a time. The authorized official of the DP verifying such transactions with the BO, shall record the details of the process, date, time, etc., of the verification on the instruction slip under his signature.
1.13 Delivery Instruction Slip (DIS) Issuance and Processing52

51 Reference: SEBI Circular SEBI/MRD/Dep/Cir-03/2007 dated February 13, 2007 and SEBI Circular SEBI/MRD/Dep/Cir-03/2008 dated February 28, 2008 52 Reference: SEBI Circular SEBI/MRD/DOP/01/2014 dated January 07, 2014

Standardization of DIS
i. Depositories shall ensure that the DIS is standardized across all DPs in terms of:
a) Serial Numbering of DIS so as to enable system level checks by the depositories. b) Layout and size of DIS so as to facilitate scanning and easy retrievability of records
ii. The DIS must bear a pre-printed serial number, DP ID, and a pre-printed/pre
stamped Beneficial Owner (BO) ID. The depositories shall prescribe a standard method of serial numbering and ensure that serial numbers issued by a DP are unique within the DP-ID.
iii. DPs shall ensure that
a) same DIS shall not be used for giving both market and off-market instructions b) a single DIS shall not be used for transactions with multiple execution dates. Monitoring of DIS
iv. Upon issuance of DIS booklets or loose slips to BO, the DPs shall make available
immediately the following details of the DIS to the depository system electronically:
a) the DIS serial number b) BO ID c) date of issuance, and d) any other relevant details as decided by the depository
v. At the time of execution of DIS, DPs shall enter the serial number of DIS in the
depository system for validation. The depositories shall make provisions in their systems to facilitate the same.
vi. In respect of all the transfer instructions on a DIS, Depositories shall validate the
serial number of DIS and shall ensure that no instructions accompanied by a used DIS or unissued DIS are processed. Scanning of DIS
vii. DPs shall scan every DIS executed during a day along with all Annexures/
Computer printouts, if any, by the end of the next working day in the manner specified by the depository.
viii. The depositories shall ensure that their DPs have adequate infrastructure, systems
and processes to implement scanning, storage and transfer of the scanned DIS in the manner specified by the depositories.
ix. The depositories shall ensure that the systems set up by the DPs maintain proper
records of all scanned DIS images including audit trails for changes made, if any and put in place adequate checks and procedures to prevent unauthorized changes to scanned DIS.
x. Depositories shall utilize the archived scanned images for off-site inspection.

xi. Above provisions shall not be applicable for the instructions received from the
clients by the DPs electronically in a manner approved by the Depository.
xii. Once a new DIS booklet is issued to a BO as per above provisions, old DIS issued to
such a BO shall not be accepted by the DP. A period of one month may be given for receipt of DIS by the BOs. The DPs may accept old DIS during this transit period.53 All the measures listed above under the head 'Monitoring of DIS' shall be made applicable to the DIS issued as per the provisions of this circular.  Acceptance of Delivery Instructions through Online Portal of Depository Participants54:
While accepting delivery instructions through online portal of Depository Participants, Depositories need to ensure that investors' authentication is being carried-out by them, through Password/TPIN, along-with OTP, both generated at Depositories end, for each transaction.  Acceptance of Delivery Instruction through Online Portal of Intermediaries55

Towards safeguarding the interest of the investors and market eco-system, it is
decided that in case Depositories intend to permit acceptance of Delivery Instruction through Online Portal of intermediaries, they need to ensure that risk entailed by introducing such system are curtailed. Towards this end, Depositories need to incorporate necessary risk containment measures, including the following:
a) e-DIS facility: The facility of e-DIS has to be true to its label and should: -
i. Necessarily capture all details that are otherwise being captured in
physical DIS, including settlement number and actual quantity to be transferred in case of on-market transfers.
ii. be an instruction towards actual transfer of securities to meet obligation
for a single settlement number/date. b) Pre-trade authorization/ mandate: If Depositories wish to continue providing the facility of enabling receipt of pre-trade mandate from client, Depositories should ensure the following:
i. The mandate should be received from client authorizing the concerned
intermediary to transfer specific securities for meeting on-market settlement obligation only.
ii. Such mandate should necessarily pertain to a single settlement
number/settlement date.

53 Reference: SEBI Circular CIR/MRD/DP/22/2014 dated July 04, 2014 54 Reference: SEBI Letter MRD2/DDAP/OW/P/2020/19443/1 dated November 13, 2020 55 Reference: SEBI Letter SEBI/HO/MRD2/DDAP/OW/P/2021/1632/1 dated January 20, 2021

iii. Client shall be required to authorize each mandate valid for a single
settlement number / settlement date, by way of OTP and PIN/password, both generated at Depositories end.
iv. Prior to executing actual transfer of securities based on details provided
by intermediary, Depositories need to match and confirm the same with mandate provided by client as well as client-wise net delivery obligation arising from the trades executed on exchanges, as provided by Clearing Corporation to Depositories for each settlement date.
v. Securities transferred on the basis of mandate provided by client should
be credited only to client's trading member pool account.
vi. Intermediary providing this facility have enabled its client to revoke /
cancel the mandate provided by them.
vii. Depositories shall take necessary steps to safeguard themselves from any
liability arising under Section 16 of Depositories Act, 1996, for losses, if any, to the beneficiary owner on account of providing this facility. In addition, within the specified timeline, Depositories need to communicate to Stock Brokers/DPs providing this facility to ensure that mandate provided by client adheres to requirement specified in Annexure 4. c) Depository shall ensure they have taken all risk containment measures while permitting intermediaries to provide e-DIS facility and pre-trade authorization/mandate, including cyber-security related measures. d) Depository shall make necessary amendments to its bye-laws/business rules/operating instruction of Depositories for implementation of above directions. e) Further, the requirement for Depositories to carry-out authentication based on Password/TPIN, along-with OTP, both generated at Depositories end for each transaction/ e-DIS transfer instruction/pre-trade mandate, shall continue to apply.
2. Implementation:
a. No new intermediary shall be permitted to provide e-DIS / mandate facility, until Depositories ensure necessary checks and balances are in place, including implementation of above directions. b. Further, for existing Intermediaries to continue providing e-DIS/mandate facility, Depositories need to ensure that necessary checks and balances are in place, including implementation of the above directions
3. Depositories are further advised to place before their respective Boards the
measures taken by the Depository towards incorporating the directions as stated above. Further, a compliance report, along-with comments of the board of

Depository, with regard to implementation of abovementioned SEBI directions shall be submitted to SEBI.
1.14 Nomination for Eligible Trading and Demat Accounts56
1.14.1 Section 72 of Companies Act, 2013 provides for nomination by a holder of securities.
1.14.2 Investors opening new demat account(s) on or after October 01, 2021, shall have the
choice of providing nomination or opting out nomination, as follows; a. The format for nomination form is given in Annexure 5 b. Opt out of nomination through ‘Declaration Form’, as provided in Annexure 6 These forms at Annexure 5 or 6, would also be applicable for any subsequent change/withdrawal of nomination.
1.14.3 In this regard, DPs shall activate new Demat accounts from October 01, 2021, only
upon receipt of above formats.
1.14.4 The nomination and Declaration form shall be signed under wet signature of the
account holder(s) and witness shall not be required. However, if the account holder(s) affixes thumb impression (instead of wet signature), then witness signature shall be required in the forms.
1.14.5 The on-line nomination and Declaration form may also be signed using e-Sign
facility and in that case witness will not be required.
1.14.6 DPs shall ensure that adequate systems are in place including for providing for eSign
facility and also take all necessary steps to maintain confidentiality and safety of client records.
1.14.7 Further, all existing eligible demat account holders shall provide choice of
nomination as per the option given in Para 1.14.2 above, on or before September 30, 202357, failing which the trading accounts shall be frozen for trading and demat account shall be frozen for debits.
1.14.8 DPs shall encourage their clients to update ‘choice of nomination’ by sending a
communication on fortnightly basis by way of emails and SMS to all such demat accounts wherein the ‘choice of nomination’ is not captured. The communication shall provide guidance through which the client can provide his/her ‘choice of nomination’.
1.14.9 On the basis of representations received from various stakeholders, it has been
decided that58:

56 Reference: SEBI Circular SEBI/HO/MIRSD/RTAMB/CIR/P/2021/601 dated July 23, 2021 57 Reference: SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2023/42 dated March 27, 58 Reference: SEBI Circular SEBI/HO/MIRSD/MIRSD_RTAMB/P/CIR/2022/23 dated February 24, 2022

a. Requirement mentioned at Para 1.14.2 read with Para 1.14.7 w.r.t. resubmission of nomination details shall be optional for the existing investors who have already provided the nomination details prior to July 23, 2021 b. existing investors who have not submitted nomination details and intend to submit their nomination or opt out of nomination (not to nominate any one) may also be allowed to do so by way of two factor authentication (2FA) login on the internet trading platform for Depository Participants providing such services.
1.15 Transmission of shares59
The depositories may permit upto three nominees with respect to a demat account.
1.16 Simplification of procedure and standardization of formats of documents for
transmission of securities60
1.16.1 SEBI has reviewed the process being followed by the Registrars to an Issue and
Share Transfer Agents (“RTAs”) and the Depositories/ Issuer companies for effecting transmission of securities.
1.16.2 As an on-going measure to enhance ease of dealing in securities markets and
with a view to make the transmission process more efficient and investor friendly, the procedure for transmission of securities has been further simplified vide the Securities and Exchange Board of India (Listing Obligations and Disclosure Requirements) (Fourth Amendment) Regulations, 2022 (“LODR Amendment Regulations”) Gazette Notification no. SEBI/LADNRO/GN/2022/80 dated April 25th, 2022).
1.16.3 The LODR Amendment Regulations has inter alia enhanced the monetary limits
for simplified documentation for transmission of securities, allowed ‘Legal Heirship Certificate or equivalent certificate’ as one of the acceptable documents for transmission and provided clarification regarding acceptability of Will as one of the valid documents for transmission of securities. Pursuant to the notification of the LODR Amendment Regulations, the formats of various documents which are required to be furnished for the processing of transmission of securities are being specified hereunder.
1.16.4 For ease of reference, a ready reckoner listing out the documents required for
transmission of securities, in case of demise of the sole holder, is provided below:
Documents Required For Transmission Of Securities

59 Reference: SEBI Letter MRD//DP/OW/23881/2015 dated August 24, 2015 regarding multiple nominations in demat accounts 60 Reference: SEBI Circular SEBI/HO/MIRSD/MIRSD_RTAMB/P/CIR/2022/65 dated May 18,

Sr.
No.
Documents required for transmission
Sole holder deceased& nomination registered Sole holder deceased & nomination not registered

Transmission Request Form Annexure 7 Annexure 7

Original death certificate or Copy of death certificate attested by a notary public/gazette officer or copy of the death certificate attested by the nominee(s)/claimant(s)/legal heir(s), subject to verification with original by the RTA/Listed Issuer ✓ ✓ 3. Self-attested copy of Permanent Account Number Card of the nominee(s)/claimant(s)/legal heir(s) issued by the Income Tax Department ✓ ✓ 4. Copy of Birth Certificate (in case the nominee/claimant/legal heir is a minor) ✓ ✓ 5. KYC* of the Claimant Guardian (in case of nominee /claimant being a minor / of unsound mind). *If not KYC compliant ✓ ✓
6. Original security certificate(s) ✓ ✓
7. Notarized affidavit from all legal heir(s) made
on non-judicial stamp paper of appropriate value on identity and claim of ownership, as per the format provided in Annexure 8 NA ✓
8. In case the legal heir(s)/claimant(s) are named
in the Succession Certificate or Probate of Will or Will or Letter of Administration or Legal Heirship Certificate (or its equivalent certificate), instead of the document mentioned in point 7 above, an Affidavit from such legal heir(s)/claimant(s), duly Notarised and as per the format provided in Annexure 8, shall be sufficient. NA ✓

Copy of any of the following documents:
(a) Succession certificate; or
(b) Probate of Will; or
(c) Will, along with a notarized indemnity bond from the legal heir(s)/claimant(s) to whom the securities are transmitted, as per the format specified provided in Annexure 9; or (d) Letter of Administration; or (e) Court Decree; or (f) Legal Heirship Certificate or its equivalent, along with
i. a notarized indemnity bond from the
legal heir (s)/claimant(s) to whom the securities are transmitted, as per the format specified provided in Annexure 9; and
ii. No Objection from all the nonclaimants, duly attested by a notary
public or by a gazetted officer as per the format provided in Annexure 10. The document should be Attested by the legal heir(s)/claimant(s) subject to verification with the original or duly attested by a notary public or by a Gazetted officer. NA ✓ ✓
For cases where the value of securities is up to
rupees five lakhs per listed entity as on the date of submission of complete documentation in case of securities held in physical mode and up to rupees fifteen lakhs per beneficial owner in case of securities held in dematerialized mode, instead of and where the documents mentioned in point 9 above are not available, the following documents may be submitted; (i) no objection certificate from all legal heirs(s), as per the format provided in Annexure 10, or copy of family settlement NA ✓

The Operational Guidelines for processing investor’s service request for the purpose of transmission of securities is provided as follows:
a. The RTA/Issuer Companies shall use the format for:
(i) Transmission Request Form (“TRF”) – (Annexure 7), (ii) Affidavit made on non-judicial stamp paper, to the effect of identification and claim of legal ownership to the securities (“Affidavit”) – (Annexure 8), (iii) Indemnity Bond made on appropriate non-judicial stamp paper of appropriate value(“Indemnity Bond”) – Annexure 9), and (iv) No objection certificate from all legal heirs who do not object to such transmission (“NOC”) – (Annexure 10). b. After verifying and processing the request, the RTA / Issuer Companies shall intimate the claimant(s) about its execution as may be applicable, by way of issuing a Letter of Confirmation (Format at Annexure 11).
c. The RTA shall retain the physical securities as per the existing procedure
and deface the certificate with a stamp “Letter of Confirmation Issued” on the face / reverse of the certificate, subsequent to processing of service request d. The Letter of Confirmation shall, inter-alia, contain details of folio and demat account number (if available) of the claimant(s). e. The Letter of Confirmation shall be sent by the RTA / Issuer Companies through Registered / Speed Post to the claimant(s) and a digitally signed copy of the Letter of Confirmation shall be sent by the RTA/Issuer Companies to the claimant(s) through e-mail. f. Within 120 days of issue of the Letter of Confirmation, the claimant(s) shall submit the demat request, along with the original Letter of Confirmation or the digitally signed copy of the Letter of Confirmation, to the Depository Participant (“DP”). deed executed by all the legal heirs, duly attested by a notary public or by a gazetted officer; and (ii) notarized indemnity bond made on nonjudicial stamp paper of appropriate value, indemnifying the Share Transfer Agent/listed entity, in as per the format provided in Annexure 9.

g. DP shall generate the demat request on the basis of the Letter of Confirmation and forward the same to the Issuer Company / RTA for processing the demat request. h. In case of the securities which are required to be locked in, the RTA while approving / confirming the demat request, shall incorporate / intimate the Depository about the lock-in and its period.
i. The RTA / Issuer Companies shall issue a reminder after the end of 45 days
and 90 days from the date of issuance of the Letter of Confirmation, informing the claimant(s) to submit the demat request as above, in case no such request has been received by the RTA / Issuer Company. In case of non-receipt of demat request from the claimant(s) within 120 days of the date of issue of the Letter of Confirmation, the securities shall be credited to Suspense Escrow Demat Account of the Issuer Company.
1.16.5 The format of the form to be filed by nominee/claimant/legal heir while
requesting transmission of securities is provided under Annexure 7
1.16.6 The revised documentation requirements in case of transmission of securities are
specified below:
1.16.6.1 Where the securities are held in a single name with a nomination, nominee shall
be informed about the procedure to be followed for the claim on the receipt of the intimation of death of the security holder.
1.16.6.2 Where the securities are held in single name with a nomination, the following
documents shall be submitted:
(a) duly signed transmission request form by the nominee; (b) original death certificate or copy of death certificate attested by the nominee subject to verification with the original or copy of death certificate duly attested by a notary public or by a gazetted officer; (c) self-attested copy of the Permanent Account Number card of the nominee, issued by the Income Tax Department.
1.16.6.3 where the securities are held in single name without nomination, the following
documents shall be submitted:
(a) duly signed transmission request form by the legal heir(s)/claimant(s); (b) original death certificate or copy of death certificate attested by the legal heir(s)/claimant(s) subject to verification with the original or copy of death certificate duly attested by a notary public or by a gazetted officer; (c) self-attested copy of the PAN card of the legal heir(s)/claimant(s), issued by the Income Tax Department; (d) a notarized affidavit, in the format provided in Annexure 8 from all legal heir(s) made on non-judicial stamp paper of appropriate value,

to the effect of identification and claim of legal ownership to the securities. However, in case the legal heir(s)/claimant(s) are named in any of the documents for transmission of securities as mentioned in S. No. 8 of Para 1.16.4, an affidavit from such legal heir(s)/claimant(s) alone shall be sufficient; (e) a copy of other requisite documents for transmission of securities as may be applicable as per Para 1.16.4, attested by the legal heir(s)/claimant(s) subject to verification with the original or duly attested by a notary public or by a gazetted officer:
1.16.6.4 In cases where a copy of Will is submitted as may be applicable in terms of Indian
Succession Act, 1925 (39 of 1925) the same shall be accompanied with a notarized indemnity bond from the claimant (appropriate beneficiary of the Will) to whom the securities are transmitted, in the format provided in Annexure 9.
1.16.6.5 In cases where a copy of Legal Heirship Certificate or its equivalent certificate
issued by a competent Government Authority is submitted, the same shall be accompanied with:
i. a notarized indemnity bond from the legal heir(s) /claimant(s) to whom
the securities are transmitted, in the format provided in Annexure 9.
ii. No Objection from all non-claimants (remaining legal heirs), stating that
they have relinquished their rights to the claim for transmission of securities, duly attested by a notary public or by a gazetted officer, in the format provided in Annexure 10.
1.16.6.6 For value of securities up to rupees five lakhs per listed entity in case of securities
held in physical mode, and up to rupees fifteen lakhs per beneficial owner in case of securities held in dematerialized mode, as on date of application by the claimant, and where the documents mentioned in S. No. 9 of Para 1.16.4, are not available, the legal heir(s) /claimant(s) may submit the following documents:
i. a notarized indemnity bond made on non-judicial stamp paper of
appropriate value in the format provided in Annexure 9, indemnifying the Share Transfer Agent/ listed entity;
ii. no objection certificate from all legal heir(s) stating that they do not object
to such transmission in the format provided in Annexure 10 or copy of family settlement deed executed by all the legal heirs, duly attested by a notary public or by a gazetted officer; and The listed entity may, at its discretion, enhance the value of securities from the threshold limit of rupees five lakhs, in case of securities held in physical mode.

1.16.7 For transmission of securities to the surviving joint holder(s), RTAs shall comply
with clause 23 of Table F in Schedule 1 read with Section 56(2)& 56(4)(c) of the Companies Act, 2013, and transmit securities in favour of surviving Joint holder(s), in the event of demise of one or more joint holder(s), provided that there is nothing contrary in the Articles of Association of the company.
1.16.8 The common norms stipulated in Para 1.1.4 shall be
applicable for transmission service requests.
1.16.9 In case the securities were held by the deceased holder in a single name and in
physical mode, then after verifying and processing the documents submitted for transmission of securities, the RTAs/ Issuer companies shall intimate the claimant(s) about its execution as may be applicable, within 30 days of the receipt of such request, by way of issuing a Letter of Confirmation in the format provided in Annexure 11.
1.17 Mode of Operation and Transmission of Securities in Joint Demat Accounts61
1.17.1 In order to streamline the process of operation and make the transmission of
securities more efficient and investor friendly in demat accounts with joint holding, it has been decided to incorporate the following changes:
Mode of Operation
i. The account holders having joint accounts may opt for any of the following
modes of operation of the account by submitting a specific instruction at the time of demat account opening or at a later date duly signed by all account holders:
a. 'Jointly' b. 'Anyone of the holders or survivor(s)'
ii. The mode of operation mentioned at Para 1.17.1 (i) (a) and (b) above may be
used only for the following transactions:
a. Transfer of securities including Inter-Depository Transfer. b. Pledge / hypothecation / margin pledge / margin re-pledge (creation, closure and invocation, and confirmation thereof, as applicable).
c. Freeze/unfreeze account and/or the ISIN and/or specific number of
securities
However, for all other transactions at joint account level, the mode of operation shall be as mentioned at Para 1.17.1 (i) (a) above.
iii. All existing joint account holders may also opt for one of the modes of operation
mentioned at Para 1.17.1 (i).
iv. Where the account holders have opted for operation by any one holder, the
instructions above should be duly signed by any one of the holders of the joint

61 Reference: SEBI Letter MRD2/DDAP/OW/P/2021/8568/1 dated April 09, 2021

account.
v. With regard to all transactions undertaken in the client demat account,
signature of one of the client account holders as per the mandate of operation given by the joint account holders shall discharge the Participant in full vis-àvis all account holders.
vi. Each client account holder in the demat account is jointly and severally liable
towards the Participant for all the commitments entered into by himself/herself or by any other client account holder or authorized representative (within the limits of power).
vii. Any account holder may opt out from the facility as mentioned at Para 1.17.1 (i)
by giving signed written request to the Participant and upon receipt of such a request by Participant, the Participant shall change the mode of operation to 'jointly'.
viii. In case of a joint account, all communications shall be sent to the first holder
and shall be deemed to have been duly sent to all client account holders. Participant shall give an option to all joint account holders that communication will be sent to all joint account holders in electronic mode, if desired by account holders.
ix. This arrangement of mode of operation shall not expire on the death of one of
the client holders, if the surviving account holders choose the option to continue with the same account by deletion of deceased's name. The surviving members have to inform the Participant about the death of account holder with requisite document within one year. If the surviving account holder(s) fails to report the death of deceased joint holder within one year of the date of demise, a new demat account shall be opened by the surviving account holder(s) to execute transmission as per the existing procedure. Depository shall retain an audit trail in the system to record the deletion of the client holders due to death.
x. In the event of the death of any of the joint holders, the liability of the Participant
shall be discharged provided the Participant:
a. Exercises due care and caution in establishing the identity of the survivor(s) and the fact of death of the joint demat account holder, through appropriate documentary evidence; b. Reasonably satisfies itself that there is no order from any competent court brought to its notice restraining the transmission of the deceased's securities; and
c. Makes it clear to the survivor(s) that he/she would be receiving the
securities of the deceased as a trustee of the legal heirs of the deceased demat account holder.
1.18 Execution of Power of Attorney (PoA) by the Client in favour of the Stock Broker/ Stock

Broker and Depository Participant62
Kindly refer para titled ‘Execution of Power of Attorney (PoA) by the Client in favour of the Stock Broker/ Stock Broker and Depository Participant’ of SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2023/71 dated May 17, 2023 (Master circular for Stock Brokers)
1.19 Execution of ‘Demat Debit and Pledge Instruction’ (DDPI) for transfer of securities
towards deliveries / settlement obligations and pledging / re-pledging of securities63 Kindly refer para titled ‘Execution of Demat Debit and Pledge Instruction (DDPI) for transfer of securities towards deliveries / settlement obligations and pledging / repledging of securities’ of SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD1/P/CIR/2023/71 dated May 17, 2023 (Master circular for Stock Brokers)
1.20 SMS alerts for demat accounts operated by Power of Attorney64
Subscription to SMS Alert facility for depository accounts operated through Power of Attorney (POA) would be mandatory except in case of accounts held by non-individuals, foreign nationals, and NRIs.
1.21 Exemption from sending quarterly statements of transactions by depository
participants (DPs) to clients in respect of demat accounts with no transactions and no security balances65
1.21.1 SEBI has provided exemption to DPs from sending quarterly transaction statements
to the clients in respect of demat accounts with no transactions and no security balances subject to the following conditions:
1.21.1.1 Client is informed in advance that it will not be receiving Transaction
Statements for such accounts till there are any transactions or security holdings in the demat account.
1.21.1.2 KYC and PAN requirement in respect of all such depository accounts are
complied.
1.21.1.3 No Annual Maintenance Charges are levied for such an account.
1.21.1.4 Information which is required to be disseminated by Participants by way of a
note in the Transaction Statements will be required to be communicated to such

62 Reference: SEBI Circular CIR/MRD/DMS/13/2010 dated April 23, 2010, CIR/MRD/DMS/28/2010 dated August 31, 2010 and SEBI/HO/MIRSD/DOP/CIR/P/2020/158 dated August 27, 2020 63 Reference: SEBI Circular SEBI/HO/MIRSD/DoP/P/CIR/2022/44 dated April 04, 2022 and SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2022/137 dated October 06, 2022 64 Reference: SEBI Letter SEBI/MRD/DEP/VM/169784 /09 dated July 15, 2009 65 Reference: SEBI Letter MRD/CDSL/VM/155773/2009 dated February 27, 2009, MRD/DoP/NSDL/VM/168994 /2009 dated July 07, 2009 and MRD/CDSL/VM/168989 /2009 dated July 07, 2009

Clients separately.
1.21.1.5 The Internal Auditor of the Participant shall comment in its internal audit report
on compliance of the aforesaid requirements.
1.21.2 Further, depository may like to consider whether, DPs should send a consolidated
Transaction Statements for the entire financial year in case of the BOs to whom quarterly Transaction Statements are not sent.
1.22 Discontinuation of sending transaction statements by depository participants to
clients66
SEBI has allowed discontinuation of sending transaction statements by depository participants to clients subject to the following conditions:
1.22.1 Transaction statements were returned undelivered on three consecutive occasions.
1.22.2 The DP maintains proof that the transaction statements were returned undelivered.
1.22.3 The transaction statements were returned undelivered for the reasons which clearly
establish that the client no longer resides at the given address (i.e. party shifted, etc.) and not for other reasons (i.e. residence/office closed, address incorrect, address incomplete, etc.).
1.22.4 The DP informs such clients through alternative means (such as outbound call, SMS
or email) that their transaction statements are returned undelivered and they need to communicate the proper (new) address.
1.22.5 The DP ensures that on receipt of request for address modification from the client
as per the stipulated procedure, the dispatch of transaction statements is immediately started. Further, the DP ensures that transaction statements that were not delivered and dispatched due to discontinuation are also dispatched immediately without any additional cost to the clients.
1.23 Exemption to Depository Participants (DPs) from providing hard copies of transaction
statements to BOs67
DPs are permitted to provide transaction statements and other documents to the BOs under Digital signature, as governed under the Information Technology Act, 2000, subject to the DP entering into a legally enforceable arrangement with the BO for the said purpose. While such practice in the aforesaid manner shall be deemed to be in compliance of the provisions of the Regulation 60 of Securities and Exchange Board of India (Depositories & Participants) Regulations, 2018 (“DP Regulations”); if the BO is still desirous of receiving statements in hard copy, DPs shall be duty bound to provide the same.
1.24 Consolidated Account Statement (CAS) for all securities assets68

66 Reference: SEBI Letter MRD/NSDL/VM/158886 /2009 dated March 30, 2009 67 Reference: SEBI Circular MRD/DoP/Dep/Cir-27/2004 dated August 16, 2004 68 Reference: SEBI Circular CIR/MRD/DP/31/2014 dated November 12, 2014

1.24.1 It has been decided to enable a single consolidated view of all the investments of
an investor in Mutual Funds (MF) and securities held in demat form with the Depositories.
1.24.2 The Depositories and the Asset Management Companies (AMCs)/ MF-RTAs shall
put in place systems to facilitate generation and dispatch of single Consolidated Account Statements (CAS) for investors having MF investments and holding demat accounts. AMCs/ RTAs shall share the requisite information with the Depositories on monthly basis to enable generation of CAS.
1.24.3 Consolidation of account statement shall be done on the basis of PAN. In case of
multiple holding, it shall be PAN of the first holder and pattern of holding. Based on the PANs provided by the AMCs/MF-RTAs, the Depositories shall match their PAN database to determine the common PANs and allocate the PANs among themselves for the purpose of sending CAS. For PANs which are common between depositories and AMCs, the Depositories shall send the CAS. In other cases (i.e. PANs with no demat account and only MF units holding), the AMCs/ MF-RTAs shall continue to send the CAS to their unit holders as is being done presently in compliance with the Regulation 36(4) of the Securities and Exchange Board of India (Mutual Funds) Regulations, 1996 (“Mutual Fund Regulations”).
1.24.4 In case investors have multiple accounts across the two depositories, the depository
having the demat account which has been opened earlier shall be the default depository which will consolidate details across depositories and MF investments and dispatch the CAS to the investor. However, option shall be given to the demat account holder by the default depository to choose the depository through which the investor wishes to receive the CAS.
1.24.5 The CAS shall be generated on a monthly basis. The AMCs /MF-RTAs shall
provide the data with respect to the common PANs to the depositories within three days from the month end. The depositories shall then consolidate and dispatch the CAS within ten days from the month end.
1.24.6 Where statements are presently being dispatched by email either by the Mutual
Funds or by the Depositories, CAS shall be sent through email. However, where an investor does not wish to receive CAS through email, option shall be given to the investor to receive the CAS in physical form at the address registered in the Depository system.
1.24.7 A proper grievance redressal mechanism shall be put in place by the depositories
and the AMCs/MF-RTAs which shall also be communicated to the investors through CAS. AMCs/MF-RTAs would be accountable for the authenticity of the information provided through CAS in respect of MF investments and timely sharing of such information with Depositories. The Depositories would be responsible for the timely dispatch of CAS to the investors serviced by them and

the demat account information.
1.24.8 The depositories and the AMCs/ MF-RTAs shall ensure data integrity and
confidentiality in respect of the shared information. The depositories shall utilise the shared data only for the purpose of providing CAS and shall not share the same with their DPs. Where Depositories are required to share such information with unregulated entities like third party printers, the depositories shall enter into necessary data confidentiality agreements with them.
1.24.9 The CAS shall be implemented from the month of March 2015 with respect to the
transactions carried out during the month of February 2015.
1.24.10 If an investor does not wish to receive CAS, an option shall be given to the investor
to indicate negative consent. Depositories shall accordingly inform investors in their statements from the month of January 2015 about the facility of CAS and give them information on how to opt out of the facility if they do not wish to avail it.
1.24.11 Where such an option is exercised, the concerned depository shall inform the
AMC/MF-RTA accordingly and the data with respect to the said investor shall not be shared by the AMC/MF-RTA with the depository.
1.24.12 If there is any transaction in any of the demat accounts of the investor or in any of
his mutual fund folios, then CAS shall be sent to that investor on monthly basis. In case there is no transaction in any of the mutual fund folios and demat accounts then CAS with holding details shall be sent to the investor on half yearly basis. However, in case of demat accounts with nil balance and no transactions in securities and in mutual fund folios, the requirement to send physical statement shall be applicable as specified under Para 1.8.5 and Para 1.8.6.
1.24.13 Further, the holding statement dispatched by the DPs to their BOs with respect to
the dormant demat accounts with balances shall also be dispatched half-yearly.
1.24.14 The dispatch of CAS by the depositories to BOs would constitute compliance by
the Depository Participants with requirement under Regulation 60 of DP Regulations, to provide statements of account to the BOs as also compliance by the MFs with the requirement under Regulation 36(4) of the Mutual Funds Regulations.
1.25 Generation and Dispatch of Consolidated Account Statement69
1.25.1 It is noted that depositories are providing CAS to all investors having a demat
account and mutual fund holdings in statement of account (SOA) form only. Further, in scenarios where investor is having mutual fund holdings in demat form or having only demat account with no mutual fund holdings, no consolidation is happening across depositories and depositories are providing separate holding statements for

69 Reference: SEBI Letter SEBl/HO/MRD/SEC-2/P/OW/2023/00001730411 dated April 28,

themselves.
1.25.2 In this regard, it is felt that extending the requirement of generation and dispatch of
CAS to abovementioned scenarios will truly enable a single consolidated view of all the investments of investor in mutual fund and securities held in demat form with the depositories.
1.25.3 In view of the above, depositories are advised to coordinate with each other so as to
provide for generation and dispatch of CAS for the above mentioned scenarios.
1.25.4 Further, all the other provisions and modalities with regards to generation and
dispatch of CAS will remain the same as prescribed in Para 1.24 above.
1.26 Redressal of investor grievances through SEBI Complaints Redress System (SCORES)
platform70 & Procedure for filing and redressal of investor grievances using SCORES71 Kindly refer SEBI Circular SEBI/HO/OIAE/IGRD/P/CIR/202 dated November 07, 2022 (Master Circular on the redressal of investor grievances through the SEBI Complaints Redress System (SCORES) platform)
1.27 Framework for the process of accreditation of investors for the purpose of Innovators
Growth Platform72
Kindly refer para titled ‘Framework for the process of recognition of investors for the purpose of Innovators Growth Platform’ of SEBI Circular SEBI/HO/CFD/PoD2/P/CIR/2023/00094 dated June 21, 2023 (Master Circular for Issue of Capital and Disclosure Requirements)
1.28 Common Application Form for Foreign Portfolio Investors73
Kindly refer para titled ‘Guidance for Processing of FPI applications by DDPs’ of SEBI Circular SEBI/HO/AFD-2/CIR/P/2022/175 dated December 19, 2022 (Master Circular for Foreign Portfolio Investors, Designated Depository Participants and Eligible Foreign Investors)

70 Reference: SEBI Circular CIR/OIAE/1/2014 dated December 18, 2014 71 Reference: SEBI Circular SEBI/HO/OIAE/IGRD/CIR/P/2018/58 dated March 26, 2018 72 Reference: SEBI Circular SEBI/HO/CFD/DIL2/CIR/P/2019/67 dated May 22, 2019 73 Reference: SEBI Circular IMD/FPI&C/CIR/P/2020/022 dated February 04, 2020

Section 2: Depository Participants Related
2.1 Online Registration Mechanism for Securities Market Intermediaries74
Kindly refer para titled ‘Online Registration Mechanism for Securities Market Intermediaries’ of SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2023/71 dated May 17, 2023 (Master circular for Stock Brokers)
2.2 Supervision of branches of DPs75
2.2.1 To ensure compliance with Regulation 63 of the DP Regulations, and Clause 19 of
the Code of Conduct for Participants contained in the Third Schedule to the DP Regulations the DP shall ensure that it has satisfactory internal control procedure in place, inclusive of their branch offices. DPs are therefore required in terms of these provisions to put in place appropriate mechanisms to ensure that their branches are carrying on the operations in compliance with the applicable regulations, bye-laws, etc. DPs are also required to put in place suitable internal control systems to ensure that all branches exercise due diligence in opening accounts, complying with KYC requirements, in ensuring systems safety in complying with client instructions, manner of uploading client instructions, in verifying signatures and maintaining client records, etc. DPs shall also ensure that the branches are suitably integrated.
2.2.2 Depositories shall examine the adequacy of the above mechanisms during their
inspections of DPs. The Depositories shall also carry out surprise inspections/ checks of the DP branches apart from the regular inspection of the DPs. Depositories shall also put in place appropriate mechanisms for monitoring opening of branches by DPs.
2.3 Incentivisation to Depositories Participants (DPs)76
2.3.1 In order to compensate the DPs towards the cost of opening and maintaining Basic
Services Demat Accounts (BSDA), the depositories shall pay an incentive of Rs. 100/- for every new BSDA opened by their participants in other than the top 15 cities. The name of the top 15 cities is given in following table:
Top 15 Cities
Sr.
No.
Name of the City

MUMBAI
DELHI
AHMEDABAD

74 Reference: SEBI Circular SEBI/HO/MIRSD/MIRSD1/CIR/P/2017/38 dated May 02, 2017 75 Reference: SEBI Circular MIRSD/DPS-III/Cir-9/07 dated July 3, 2007 76 Reference: SEBI Circular CIR/MRD/DP/18/2015 dated December 09, 2015

BANGALORE
CHENNAI
PUNE
KOLKATA
THANE
HYDERABAD
SURAT
JAIPUR
VADODARA
SECUNDARABAD
RAJKOT
INDORE
2.3.2 The incentive shall be provided at the end of the financial year only with respect to
the new BSDA opened during the financial year and which displayed at least one credit in the account during the Financial Year.
2.3.3 Further to the above, in order to incentivize the DPs to promote holdings in the
BSDA, the depositories may pay an amount of Rs. 2 per folio per ISIN to the respective depository participant (DP), in respect of the ISIN positions held in Basic Service Demat Accounts (BSDA). This incentive may be provided with respect to all the BSDA in the depository system.
2.3.4 The reimbursement to DPs shall be made on an annual basis at the end of the
financial year. The depositories shall set aside 20% of the incremental revenue received from the Issuers to manage the aforementioned incentive schemes. Any surplus after reimbursement of DPs may be utilized by the depositories to incentivize the DPs for promoting financial inclusion, encouraging investors to hold Mutual Fund Units in demat account and familiarizing the investors on the OFS mechanism, etc.
2.3.5 The incentive scheme may be reviewed after a period of two years.
2.4 Guidelines on Outsourcing of Activities by Intermediaries77
2.4.1 SEBI Regulations for various intermediaries require that they shall render at all
times high standards of service and exercise due diligence and ensure proper care in their operations.
2.4.2 It has been observed that often the intermediaries resort to outsourcing with a view
to reduce costs, and at times, for strategic reasons.

77 Reference: SEBI Circular CIR/MIRSD/24/2011 dated December 15, 2011

2.4.3 Outsourcing may be defined as the use of one or more than one third party – either
within or outside the group - by a registered intermediary to perform the activities associated with services which the intermediary offers.
2.4.4 Principles for Outsourcing
The risks associated with outsourcing may be operational risk, reputational risk, legal risk, country risk, strategic risk, exit-strategy risk, counter party risk, concentration and systemic risk. In order to address the concerns arising from the outsourcing of activities by intermediaries based on the principles advocated by the IOSCO and the experience of Indian markets, SEBI had prepared a concept paper on outsourcing of activities related to services offered by intermediaries. Based on the feedback received on the discussion paper and also discussion held with various intermediaries, stock exchanges and depositories, the principles for outsourcing by intermediaries have been framed. The principles for outsourcing are given below at Para 2.4.7 to Para 2.4.14. These principles shall be followed by all intermediaries registered with SEBI.
2.4.5 Activities that shall not be Outsourced
The intermediaries desirous of outsourcing their activities shall not, however, outsource their core business activities and compliance functions. A few examples of core business activities may be – execution of orders and monitoring of trading activities of clients in case of stock brokers; dematerialisation of securities in case of depository participants; investment related activities in case of Mutual Funds and Portfolio Managers. Regarding Know Your Client (KYC) requirements, the intermediaries shall comply with the provisions of KRA Regulations and Guidelines issued thereunder from time to time.
2.4.6 Other Obligations
i. Reporting To Financial Intelligence Unit (FIU) - The intermediaries shall be
responsible for reporting of any suspicious transactions / reports to FIU or any other competent authority in respect of activities carried out by the third parties.
ii. Need for Self-Assessment of existing Outsourcing Arrangements – In view of
the changing business activities and complexities of various financial products, intermediaries shall conduct a self-assessment of their existing outsourcing arrangements within a time bound plan* and bring them in line with the requirements of the guidelines/principles *not later than six months from the date of issuance of original circular i.e. December 15, 2011 PRINCIPLES FOR OUTSOURCING FOR INTERMEDIARIES
2.4.7 An intermediary seeking to outsource activities shall have in place a
comprehensive policy to guide the assessment of whether and how those activities can be appropriately outsourced. The Board / partners (as the case may be)

{hereinafter referred to as the “the Board”} of the intermediary shall have the responsibility for the outsourcing policy and related overall responsibility for activities undertaken under that policy.
2.4.7.1 The policy shall cover activities or the nature of activities that can be outsourced,
the authorities who can approve outsourcing of such activities, and the selection of third party to whom it can be outsourced. For example, an activity shall not be outsourced if it would impair the supervisory authority’s right to assess, or its ability to supervise the business of the intermediary. The policy shall be based on an evaluation of risk concentrations, limits on the acceptable overall level of outsourced activities, risks arising from outsourcing multiple activities to the same entity, etc.
2.4.7.2 The Board shall mandate a regular review of outsourcing policy for such
activities in the wake of changing business environment. It shall also have overall responsibility for ensuring that all ongoing outsourcing decisions taken by the intermediary and the activities undertaken by the third-party, are in keeping with its outsourcing policy.
2.4.8 The intermediary shall establish a comprehensive outsourcing risk management
programme to address the outsourced activities and the relationship with the third party.
2.4.8.1 An intermediary shall make an assessment of outsourcing risk which depends
on several factors, including the scope and materiality of the outsourced activity, etc. The factors that could help in considering materiality in a risk management programme include2.4.8.1.1 The impact of failure of a third party to adequately perform the activity on the financial, reputational and operational performance of the intermediary and on the investors / clients;
2.4.8.1.2 Ability of the intermediary to cope up with the work, in case of nonperformance or failure by a third party by having suitable back-up
arrangements;
2.4.8.1.3 Regulatory status of the third party, including its fitness and probity status;
2.4.8.1.4 Situations involving conflict of interest between the intermediary and the
third party and the measures put in place by the intermediary to address such potential conflicts, etc.
2.4.8.2 While there shall not be any prohibition on a group entity / associate of the
intermediary to act as the third party, systems shall be put in place to have an arm’s length distance between the intermediary and the third party in terms of infrastructure, manpower, decision-making, record keeping, etc. for avoidance of potential conflict of interests. Necessary disclosures in this regard shall be made as part of the contractual agreement. It shall be kept in mind that the risk

management practices expected to be adopted by an intermediary while outsourcing to a related party or an associate would be identical to those followed while outsourcing to an unrelated party.
2.4.8.3 The records relating to all activities outsourced shall be preserved centrally so
that the same is readily accessible for review by the Board of the intermediary and / or its senior management, as and when needed. Such records shall be regularly updated and may also form part of the corporate governance review by the management of the intermediary.
2.4.8.4 Regular reviews by internal or external auditors of the outsourcing policies, risk
management system and requirements of the regulator shall be mandated by the Board wherever felt necessary. The intermediary shall review the financial and operational capabilities of the third party in order to assess its ability to continue to meet its outsourcing obligations.
2.4.9 The intermediary shall ensure that outsourcing arrangements neither diminish its
ability to fulfil its obligations to customers and regulators, nor impede effective supervision by the regulators.
2.4.9.1 The intermediary shall be fully liable and accountable for the activities that are
being outsourced to the same extent as if the service were provided in-house.
2.4.9.2 Outsourcing arrangements shall not affect the rights of an investor or client
against the intermediary in any manner. The intermediary shall be liable to the investors for the loss incurred by them due to the failure of the third party and also be responsible for redressal of the grievances received from investors arising out of activities rendered by the third party.
2.4.9.3 The facilities / premises / data that are involved in carrying out the outsourced
activity by the service provider shall be deemed to be those of the registered intermediary. The intermediary itself and Regulator or the persons authorized by it shall have the right to access the same at any point of time.
2.4.9.4 Outsourcing arrangements shall not impair the ability of SEBI/SRO or auditors
to exercise its regulatory responsibilities such as supervision/inspection of the intermediary.
2.4.10 The intermediary shall conduct appropriate due diligence in selecting the third
party and in monitoring of its performance.
2.4.10.1 It is important that the intermediary exercises due care, skill, and diligence in the
selection of the third party to ensure that the third party has the ability and capacity to undertake the provision of the service effectively.
2.4.10.2 The due diligence undertaken by an intermediary shall include assessment of:
2.4.10.2.1 third party’s resources and capabilities, including financial soundness, to
perform the outsourcing work within the timelines fixed;

2.4.10.2.2 compatibility of the practices and systems of the third party with the
intermediary’s requirements and objectives;
2.4.10.2.3 market feedback of the prospective third party’s business reputation and
track record of their services rendered in the past;
2.4.10.2.4 level of concentration of the outsourced arrangements with a single third
party; and
2.4.10.2.5 the environment of the foreign country where the third party is located.
2.4.11 Outsourcing relationships shall be governed by written contracts / agreements /
terms and conditions (as deemed appropriate) {hereinafter referred to as “contract”} that clearly describe all material aspects of the outsourcing arrangement, including the rights, responsibilities and expectations of the parties to the contract, client confidentiality issues, termination procedures, etc.
2.4.11.1 Outsourcing arrangements shall be governed by a clearly defined and legally
binding written contract between the intermediary and each of the third parties, the nature and detail of which shall be appropriate to the materiality of the outsourced activity in relation to the ongoing business of the intermediary.
2.4.11.2 Care shall be taken to ensure that the outsourcing contract:
2.4.11.2.1 clearly defines what activities are going to be outsourced, including
appropriate service and performance levels;
2.4.11.2.2 provides for mutual rights, obligations and responsibilities of the
intermediary and the third party, including indemnity by the parties;
2.4.11.2.3 provides for the liability of the third party to the intermediary for
unsatisfactory performance/other breach of the contract
2.4.11.2.4 provides for the continuous monitoring and assessment by the
intermediary of the third party so that any necessary corrective measures can be taken up immediately, i.e., the contract shall enable the intermediary to retain an appropriate level of control over the outsourcing and the right to intervene with appropriate measures to meet legal and regulatory obligations;
2.4.11.2.5 includes, where necessary, conditions of sub-contracting by the thirdparty, i.e. the contract shall enable intermediary to maintain a similar
control over the risks when a third party outsources to further third parties as in the original direct outsourcing;
2.4.11.2.6 has unambiguous confidentiality clauses to ensure protection of
proprietary and customer data during the tenure of the contract and also after the expiry of the contract;
2.4.11.2.7 specifies the responsibilities of the third party with respect to the IT
security and contingency plans, insurance cover, business continuity and disaster recovery plans, force majeure clause, etc.;

2.4.11.2.8 provides for preservation of the documents and data by third party ;
2.4.11.2.9 provides for the mechanisms to resolve disputes arising from
implementation of the outsourcing contract;
2.4.11.2.10 provides for termination of the contract, termination rights, transfer of
information and exit strategies;
2.4.11.2.11 addresses additional issues arising from country risks and potential
obstacles in exercising oversight and management of the arrangements when intermediary outsources its activities to foreign third party. For example, the contract shall include choice-of-law provisions and agreement covenants and jurisdictional covenants that provide for adjudication of disputes between the parties under the laws of a specific jurisdiction;
2.4.11.2.12 neither prevents nor impedes the intermediary from meeting its respective
regulatory obligations, nor the regulator from exercising its regulatory powers; and
2.4.11.2.13 provides for the intermediary and /or the regulator or the persons
authorized by it to have the ability to inspect, access all books, records and information relevant to the outsourced activity with the third party.
2.4.12 The intermediary and its third parties shall establish and maintain contingency
plans, including a plan for disaster recovery and periodic testing of backup facilities.
2.4.12.1 Specific contingency plans shall be separately developed for each outsourcing
arrangement, as is done in individual business lines.
2.4.12.2 An intermediary shall take appropriate steps to assess and address the potential
consequence of a business disruption or other problems at the third party level. Notably, it shall consider contingency plans at the third party; co-ordination of contingency plans at both the intermediary and the third party; and contingency plans of the intermediary in the event of non-performance by the third party.
2.4.12.3 To ensure business continuity, robust information technology security is a
necessity. A breakdown in the IT capacity may impair the ability of the intermediary to fulfil its obligations to other market participants/clients/regulators and could undermine the privacy interests of its customers, harm the intermediary’s reputation, and may ultimately impact on its overall operational risk profile. Intermediaries shall, therefore, seek to ensure that third party maintains appropriate IT security and robust disaster recovery capabilities.
2.4.12.4 Periodic tests of the critical security procedures and systems and review of the
backup facilities shall be undertaken by the intermediary to confirm the adequacy of the third party’s systems.

2.4.13 The intermediary shall take appropriate steps to require that third parties protect
confidential information of both the intermediary and its customers from intentional or inadvertent disclosure to unauthorised persons.
2.4.13.1 An intermediary that engages in outsourcing is expected to take appropriate
steps to protect its proprietary and confidential customer information and ensure that it is not misused or misappropriated.
2.4.13.2 The intermediary shall prevail upon the third party to ensure that the employees
of the third party have limited access to the data handled and only on a “need to know” basis and the third party shall have adequate checks and balances to ensure the same.
2.4.13.3 In cases where the third party is providing similar services to multiple entities,
the intermediary shall ensure that adequate care is taken by the third party to build safeguards for data security and confidentiality.
2.4.14 Potential risks posed where the outsourced activities of multiple intermediaries are
concentrated with a limited number of third parties.
2.4.14.1 In instances, where the third party acts as an outsourcing agent for multiple
intermediaries, it is the duty of the third party and the intermediary to ensure that strong safeguards are put in place so that there is no co-mingling of information /documents, records and assets.
2.5 Implementation of the Multilateral Competent Authority Agreement and Foreign
Account Tax Compliance Act78
Kindly refer para titled ‘Implementation of the Multilateral Competent Authority Agreement and Foreign Account Tax Compliance Act’ of SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2023/71 dated May 17, 2023 (Master circular for Stock Brokers)
2.6 Interest and Dividend information reporting in case of Custodial Accounts Rule
114G(1)(e) of the Income Tax Rules, 196279
2.6.1 In terms of Rule 114G(1)(e)(i) of Income Tax Rules, 1962 issued under Section
285BA of Income Tax Act, 1961 following information is required to be reported by reporting financial institution in the case of reportable custodial account: - (i) the total gross amount of interest, the total gross amount of dividends, and the total gross amount of other income generated with respect to the assets held in the account, in each case paid or credited to the account (or with respect to the account) during the calendar year;

78 Reference: SEBI Circular CIR/MIRSD/2/2015 dated August 26, 2015 79 Reference: SEBI Circular CIR/HO/MIRSD/MIRSD2/CIR/P/2017/59 dated June 15, 2017

2.6.2 In respect of the above it has been decided in consultation with Central Board of
Direct Taxes, Department of Revenue, Ministry of Finance that:-
2.6.2.1 Depositories shall provide additional field in the depository system to the RTAs
whereby the RTAs can incorporate the details of corporate action viz. dividend/interest in rupee terms per unit of the security at the time of setting up of corporate action. Depositories shall make available such information to DPs to enable them to do necessary reporting.
2.6.2.2 The reporting with respect to dividend/interest is to be done by DPs on
‘entitlement’ basis and not on the basis of actual payment received by the demat account holder.
2.6.2.3 If a demat account is identified as a ‘reportable account’ during a calendar year
by the DP, the reporting under Rule 114G (1) (e) is to be done for the dividend /interest entitlements during the entire calendar year i.e. including the period of the calendar year before identification of such account as a ‘reportable account’ by the DP.
2.7 Printing of Grievances Redressal Mechanism on Delivery Instruction Form Book 80
To promote investor awareness regarding mechanism for redressing investor grievances, the information placed below shall be printed on the inside back cover of the Delivery Instruction Form (DIF) Book issued by all Depository Participants. In case you have grievances against a listed company or intermediary registered with SEBI, you should first approach the concerned company or intermediary against whom you have grievance. If you are not satisfied with their response, you may approach SEBI or other regulatory bodies. You can approach SEBI for following type of grievances. Listed Companies  Refund / Allotment/ Bonus/ Dividend/ Rights/ Redemption/ Interest  Prelisting offer documents (shares)  Prelisting offer documents (debentures and bonds)  Delisting of Securities  Buyback of Securities  Takeover and Restructuring Brokers and stock exchanges  Stock Brokers  Sub brokers  Portfolio managers  Stock exchanges

80 Reference: SEBI Circular CIR/MRD/DP/DA/25/2012 dated September 21, 2012

 Corporate Governance and Listing conditions Registrar and Transfer Agents Other entities Collective Investment Schemes Debenture Trustees Merchant Bankers Bankers to Issue Credit Rating Agencies Custodian of Securities Foreign Institutional Investors Underwriters Venture Capital Funds KYC Registration Agency(KRA) Alternative Investment Fund Mutual Funds Depository and Depository Participants Information to SEBI:
 Price Manipulation
 Insider trading
You can file your complaints online at http://scores.gov.in or alternately send your complaints to Office of Investor Assistance and Education of SEBI at Mumbai or Regional Offices at the following addresses:
Address of SEBI Offices
 Office of Investor Assistance and Education, SEBI Bhavan, Plot No.C4-A, 'G' Block, Bandra Kurla Complex, Bandra (E), Mumbai 400 051 Tel: 022-26449188 / 26449199 (http://scores.gov.in)  SEBI, Northern Regional Office, 5th Floor, Bank of Baroda Building, 16, Sansad Marg, New Delhi -110001 Tel: 011-23724001-05 (sebinro@sebi.gov.in)  SEBI, Eastern Regional Office, L&T Chambers, 3rd Floor, 16, Camac Street, Kolkata - 700 016 Tel: 033-23023000. (sebiero@sebi.gov.in)  SEBI, Southern Regional Office, 7th Floor, Overseas Towers, 756-L, Anna Salai Chennai 600 0102 Tel: 044-24674000/ 24674150 (sebisro@sebi.gov.in)  SEBI, Ahmedabad Regional Office, Unit No: 002, Ground Floor, SAKAR I, Near Gandhigram Railway Station, Opp. Nehru Bridge Ashram Road, Ahmedabad - 380 009 Tel : 079-26583633-35 (sebiaro@sebi.gov.in) For more information visit our website - http://scores.gov.in

2.8 Operationalisation of Central KYC Records Registry (CKYCR)81
2.8.1 Government of India has authorized the central Registry of Securitization and
Asset Reconstruction and Security interest of India (CERSAI), setup under subsection (1) of Section 20 of Securitisation and Reconstruction of Financial Assets and Enforcement of Security Interest Act, 2002, to act as, and to perform the functions of, the Central KYC Records Registry under the PML Rules 2005, including receiving, storing, safeguarding and retrieving the KYC records in digital form of a client.
2.8.2 As per the 2015 amendment to Prevention of Money Laundering (Maintenance of
Records) Rules, 2005, every reporting entity shall capture the KYC information for sharing with the Central KYC Records Registry in the manner mentioned in the Rules, as per the KYC template for “individuals” finalised by CERSAI.
2.8.3 Accordingly, the KYC template finalised by CERSAI (as and when amended by
CERSAI) shall be used by the registered intermediaries as Part I of Account Opening Form (AOF) for individuals. The Revised KYC template for “individuals”82 and the “Central KYC Registry Operating Guidelines 2016” for uploading KYC records on CKYCR as finalised by CERSAI is available for reference and necessary action.
2.8.4 In this regard, it is clarified that the requirement for Permanent Account Number
(PAN) would continue to be mandatory for completing the KYC process.
2.9 Rollout of Legal Entity Template83
2.9.1 CKYCR, in its communication no. CKYC/2020/11 dated January 04, 2021 has
specified that since CKYCR is fully operational for individual clients, it has been decided to extend CKYCR to Legal Entities (LE) as well. Accordingly, Registered Intermediaries (RIs) shall upload the KYC records of LE accounts opened on or after April 01, 2021 on to CKYCR in terms of Rule 9 (1A) of the Prevention of Money Laundering (Maintenance of Records) Rules, 2005. The LE Template and the Annexure thereof are attached below:
2.9.1.1 LE Template
2.9.1.2 Annexure to LE Template
2.9.2 The LE template is made available by CERSAI in the CKYCR test environment
(https://testbed.ckycindia.in/ckyc/index.php) enabling RIs to develop necessary infrastructure.
2.9.3 RIs shall ensure that in case of LE accounts opened prior to April 1, 2021, the KYC
records are uploaded on to CKYCR when the updated KYC information is

81 Reference: SEBI Circular CIR/MIRSD/ 66/2016 dated July 21, 2016 82 Reference: Central KYC Registry Circular CKYC/2020/01 dated January 10, 2020 83 Reference: SEBI Circular SEBI/HO/MIRSD/DOP/CIR/P/2021/31 dated March 10, 2021

obtained/received from the client. RIs shall ensure that during such receipt of updated information, the clients’ KYC details are migrated to current Client Due Diligence (CDD) standards.
2.9.4 Further, to ensure that all existing KYC records of individual clients are
incrementally uploaded on to CKYCR, RIs shall upload the KYC records pertaining to accounts of individuals opened prior to August 01, 2016, as and when updated KYC information is obtained/received from the client.
2.9.5 Where a client, for the purpose of establishing an account based relationship,
submits a KYC Identifier to a RI, with an explicit consent to download records from CKYCR, then such RI shall retrieve the KYC records online from CKYCR using the KYC Identifier and the client shall not be required to submit the same KYC records or information or any other additional identification documents or details, unless there is a change in the information of the client as existing in the records of CKYCR.
2.9.6 Once KYC Identifier is generated by CKYCR, the RIs shall ensure that the same is
communicated to the individual/legal entity.
2.9.7 The above provisions are not applicable to Foreign Portfolio Investors (FPIs).
2.10 e-KYC Authentication facility under section 11A of the Prevention of Money
Laundering Act, 2002 by Entities in the securities market for Resident Investors84 and Entities permitted to undertake e-KYC Aadhaar Authentication service of UIDAI in Securities Market85
2.10.1 SEBI simplified the account opening process for investors vide Para 2.14.
Further, SEBI vide Para 1.1.6 issued guidelines for uniform KYC requirements for investors while opening accounts with any intermediary in the securities market.
2.10.2 SEBI vide Para 1.1.2.1 clarified that the Aadhaar Letter issued by UIDAI shall
be admissible as Proof of Address in addition to its being recognized as Proof of Identity.
2.10.3 Subsequently, vide Para 1.1.1.3 (d) and Para 1.1.2.1 (j), it is clarified that it was
decided to accept e-KYC service launched by UIDAI also, as a valid process for KYC verification. The information containing relevant client details and photograph made available from UIDAI as a result of e-KYC process shall be treated as sufficient Proof of identity and Address of the client. Also vide Para 1.1.3, it is clarified that the usage of Aadhaar card as issued by the UIDAI is voluntary.

84 Reference: SEBI Circular SEBI/HO/MIRSD/DOP/CIR/P/2019/123 dated November 05, 2019 85 Reference: SEBI Circular SEBI/HO/MIRSD/DOP/CIR/P/2020/80 dated May 12, 2020

2.10.4 Hon’ble Supreme Court, in its judgement dated September 26, 2018, had struck
down Section 57 of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (“Aadhaar Act”) as “unconstitutional” which means that no company or private entity can seek Aadhaar identification from clients or investors.
2.10.5 The Aadhaar and Other Laws (Amendment) Ordinance, 2019 was promulgated
on March 02, 2019 through which a new Section 11A was inserted in chapter IV of the PMLA. The Aadhaar and Other Laws (Amendment) Act, 2019 was notified in the Gazette of India on July 24, 2019.
2.10.6 The Department of Revenue (DoR), Ministry of Finance issued a circular dated
May 09, 2019 on procedure for processing of applications under section 11A of the PMLA), for use of Aadhaar authentication services by entities other than the Banking companies. In terms of the said circular, if the Central Government is satisfied with the recommendations of the Regulator and UIDAI and reporting entity complies with such standards of privacy and security under the Aadhaar Act, and it is necessary and expedient to do so, it may by notification, permit such entity to carry out authentication of the Aadhaar number of clients using e-KYC authentication facility.
2.10.7 The said circular also inter-alia specified that, applications by the concerned
entities under Section 11A of the PMLA for use of Aadhaar authentication services shall be filed before the Regulator, who after scrutiny shall forward the applications to UIDAI along with its recommendation. UIDAI shall scrutinize the applications received and send its recommendation to the Department of Revenue for notification under Section 11A of the PMLA. The Central Government, if satisfied with the recommendations of the Regulator and the UIDAI that the applicant fulfils all conditions under Section 11A, may by notification permit such applicant to perform authentication under clause (a) of sub-section (1) of Section 11A. At any point, after issue of such notification, based on a report of the appropriate Regulator or UIDAI or otherwise, if it is found that the reporting entity no longer fulfils the requirements for performing authentication under clause (a) of sub-section (1) of section 11A, the Central Government may withdraw the notification after giving an opportunity to the reporting entity.
2.10.8 Accordingly, entities in the securities market, as may be notified by the Central
Government, shall be allowed to undertake Aadhaar Authentication under
section 11A of the PMLA. SEBI Registered intermediaries for reasons such as
online on-boarding of clients, customer convenience, increased efficiency and reduced time for client on- boarding would prefer to use Aadhaar based e-KYC facility to complete the KYC of the client.

Government of India, DoR, vide Gazette Notification No. G.S.R. 261(E) dated April 22, 2020 has notified nine reporting entities as per the recommendation by UIDAI and SEBI to undertake Aadhaar authentication service of the UIDAI under section 11A of the PMLA. In view of the same, the following entities shall undertake Aadhaar Authentication service of UIDAI subject to compliance of the conditions as laid down in this regard:
a. Bombay Stock Exchange Limited b. National Securities Depository Limited
c. Central Depository Services (India) Limited
d. CDSL Ventures Limited e. NSDL Database Management Limited f. NSE Data and Analytics Limited g. CAMS Investor Services Private Limited h. Computer Age Management Services Private Limited
i. National Stock Exchange of India Limited86
Note a. Department of Revenue-Ministry of Finance, Government of India, vide Gazette Notification No. S.O. 3187(E) dated July 13, 2022 has notified 155 reporting entities as sub-KUA to use Aadhaar authentication services of UIDAI under
section 11A of the Prevention of Money-laundering Act, 2002. A copy of the
same is enclosed here. (Reporting entities as sub-KUA to use Aadhaar authentication services of UIDAI)87 The KUAs shall facilitate the onboarding of these entities as sub-KUAs to provide the services of Aadhaar authentication with respect to KYC. b.Department of Revenue-Ministry of Finance, Government of India, vide Gazette Notification No. S.O. 446 (E) dated January 30, 2023 has notified another 39 reporting entities to use Aadhaar authentication services of UIDAI under
section 11A of the Prevention of Money-laundering Act, 2002. A copy of the
notification is attached here: Notification88
2.10.9 These entities shall get registered with UIDAI as KYC user agency (“KUA”) and
shall allow SEBI registered intermediaries / mutual fund distributors to undertake Aadhaar Authentication of their clients for the purpose of KYC through them.
2.10.10 The SEBI registered intermediaries/mutual fund distributors, who want to
undertake Aadhaar authentication services through KUAs, shall enter into an

86 Reference: SEBI Circular SEBI/HO/MIRSD/DOP/CIR/P/2020/167 dated September 08, 2020 87 Reference: SEBI Circular SEBI/HO/MIRSD/SEC-5/P/CIR/2022/99 dated July 20, 2022 88 Reference: SEBI Circular SEBI/HO/MIRSD/SEC-5/P/CIR/2023/0026 dated February 08, 2023

agreement with any one KUA and get themselves registered with UIDAI as sub-KUAs. The agreement in this regard shall be as may be prescribed by UIDAI.
2.10.11 Upon notification by the Central Government / registration with UIDAI, the
KUAs and sub-KUAs shall adopt the following process for Aadhaar e-KYC of investors (resident) in the securities market and as may be prescribed by UIDAI from time to time.
2.10.11.1 Online Portal based Investor (Resident) e-KYC Process (Aadhaar as an
OVD)
2.10.11.1.1 Investor visits portal of KUA or the SEBI registered intermediary which
is also a Sub-KUA to open account/invest through intermediary.
2.10.11.1.2 For Aadhaar e-KYC, investor is redirected to KUA portal. Investor enters
the Aadhaar Number or Virtual Id and provides consent on KUA portal. Adequate controls shall be in place to ensure that Aadhaar Number is not stored anywhere by the Sub-KUA or KUA.
2.10.11.1.3 Investor will receive OTP in mobile number registered with Aadhaar.
Investor enters the OTP sent by UIDAI on KUA portal for Aadhaar eKYC.
2.10.11.1.4 KUA will receive the e-KYC details from UIDAI upon successful Aadhaar
authentication which will be further forwarded to Sub-KUA in encrypted format (using KUAs own encryption key) and will be displayed to the investor on portal. Sharing of e-KYC data by the KUA with Sub-KUA may be allowed under Regulation 16(2) of Aadhaar (Authentication) Regulation, 2016. Sub-KUA shall clearly specify the name of the KUA and Sub- KUA, and details of sharing of data among KUA and Sub-KUA while capturing investor consent.
2.10.11.1.5 Investor will fill the additional detail as required under KYC format.
2.10.11.1.6 SEBI registered Intermediary will upload additional KYC details to the
KUA.
2.10.11.2 Assisted Investor (Resident) e-KYC process (Aadhaar as an OVD)
2.10.11.2.1 Investor approaches any of the SEBI Registered Entity/ Sub-KUAs i.e.
Mutual Fund Distributors or appointed persons for e-KYC through Aadhaar.
2.10.11.2.2 SEBI registered entities (Sub-KUAs) will perform e-KYC using registered
/ Whitelisted devices with KUAs.
2.10.11.2.3 KUA will ensure that all devices and device operators of Sub-KUA are
registered / whitelisted devices with KUA.
2.10.11.2.4 Investor will enter Aadhaar No. or Virtual Id and provides consent on the
registered device.

2.10.11.2.5 Investor provides biometric on the registered device.
2.10.11.2.6 SEBI registered intermediary (Sub-KUA) fetches the e-KYC details
through the KUA from UIDAI which will be displayed to the investor on the registered device.
2.10.11.2.7 Investor will also provide the additional detail as required.
2.10.12 The KUA/ sub-KUA while performing the Aadhaar authentication shall also
comply with the following:
2.10.12.1 For sharing of e-KYC data with Sub-KUA under Regulation 16(2) of Aadhaar
(Authentication) Regulations, 2016, KUA shall obtain special permission from UIDAI by submitting an application in this regard. Such permissible sharing of e- KYC details by KUA can be allowed with their associated SubKUAs only.
2.10.12.2 KUA shall not share UIDAI digitally signed e-KYC data with other KUAs.
However, KUAs may share data after digitally signing it using their own signature for internal working of the system.
2.10.12.3 e-KYC data received as response upon successful Aadhaar authentication
from UIDAI will be stored by KUA and Sub-KUA in the manner prescribed by Aadhaar Act/Regulations and circulars issued by UIDAI time to time.
2.10.12.4 KUA/Sub-KUA shall not store Aadhaar number in their database under any
circumstances. It shall be ensured that Aadhaar number is captured only using UIDAI`s Aadhaar Number Capture Services (ANCS).
2.10.12.5 The KUA shall maintain auditable logs of all such transactions where e-KYC
data has been shared with sub-KUA, for a period specified by the Authority.
2.10.12.6 It shall be ensured that full Aadhaar number is not stored and displayed
anywhere in the system and wherever required only last 4 digits of Aadhaar number may be displayed.
2.10.12.7 As per Regulation 14(i) of the Aadhaar (Authentication) Regulation, 2016,
requesting entity shall implement exception-handling mechanisms and backup identity authentication mechanism to ensure seamless provision of authentication services to Aadhaar number holders.
2.10.12.8 UIDAI may conduct audit of all KUAs and Sub KUAs as per the Aadhaar
Act, Aadhaar Regulations, AUA/KUA Agreement, Guidelines, circulars etc. issued by UIDAI from time to time.
2.10.12.9 Monitoring of irregular transactions - KUAs shall develop appropriate
monitoring mechanism to record irregular transactions and their reporting to UIDAI.
2.10.12.10 Investor Grievance Handling Mechanism - Investor may approach KUA for
their grievance redressal. KUA will ensure that the grievance is redressed

within the timeframe as prescribed by UIDAI. KUA will also submit report on grievance redressal to UIDAI as per timelines prescribed by UIDAI.
2.10.13 Onboarding process of KUA/Sub-KUA by UIDAI:
2.10.13.1 As provided in the DoR circular dated May 09, 2019, SEBI after scrutiny of
the application forms of KUAs shall forward the applications along with its recommendation to UIDAI.
2.10.13.2 For appointment of SEBI registered intermediary / MF distributors as SubKUAs, KUA will send list of proposed Sub-KUAs to SEBI and SEBI would
forward the list of recommended Sub-KUAs to UIDAI for onboarding. An agreement will be signed between KUA and Sub-KUA, as prescribed by UIDAI. Sub-KUA shall also comply with the Aadhaar Act, Regulations, circulars, Guidelines etc. issued by UIDAI from time to time.
2.10.13.3 Each sub-KUA shall be assigned a separate Sub-KUA code by UIDAI.
2.10.14 The KUA/sub-KUA shall be guided by the above for use of Aadhaar
authentication services of UIDAI for e-KYC.
2.10.15 For non-compliances if any observed on the part of the reporting entities
(KUAs/ Sub- KUAs), SEBI may take necessary action under the applicable laws and also bring the same to the notice of DoR / FIU for further necessary action, if any. Reporting entity (KUAs/Sub-KUAs) shall also adhere to the continuing compliances and standards of privacy and security prescribed by UIDAI to carry out Aadhaar Authentication Services under section 11A of PMLA. Based on a report from SEBI / UIDAI or otherwise, if it is found that the reporting entity no longer fulfils the requirements for performing authentication under clause (a) of section 11A(1) of PMLA, the Central Government may withdraw the notification after giving an opportunity to the reporting entity.
2.11 The Securities and Exchange Board of India (KYC Registration Agency) Regulations,
201189
SEBI has formulated the KRA Regulations, which have been notified vide notification No. LAD-NRO/GN/2011-12/29/36772 dated December 2, 2011. The KRA Regulations cover the registration of KRAs, functions and responsibilities of the KRAs and intermediaries, code of conduct, data security, etc. A copy of the same is attached below:
Enclosure: Copy of KRA Regulations

89 Reference: SEBI Circular MIRSD/Cir-23/2011 dated December 02, 2011

2.12 Guidelines in pursuance of the SEBI KYC Registration Agency (KRA) Regulations,
2011 and for In-Person Verification (IPV)90 With a view to implement the KRA Regulations effectively, the following guidelines are being issued:
2.12.1 Guidelines for Intermediaries:
2.12.1.1 After doing the initial KYC of the new clients, the intermediary shall forthwith
upload the KYC information with proper authentication on the system of the KRA, furnish the scanned images of the KYC documents to the KRA, and retain the physical KYC documents.
2.12.1.2 In case a client’s KYC documents sent by the intermediary to KRA are not
complete, the KRA shall inform the same to the intermediary who shall forward the required information / documents promptly to KRA.
2.12.1.3 For existing clients, the KYC data may be uploaded by the intermediary
provided they are in conformity with details sought in the uniform KYC form specified under Para 1.1.6. While uploading these clients’ data the intermediary shall ensure that there is no duplication of data in the KRA system.
2.12.1.4 The intermediary shall carry out KYC when the client chooses to trade/invest
/deal through it.
2.12.1.5 The intermediaries shall maintain electronic records of KYCs of clients and
keeping physical records would not be necessary.
2.12.1.6 The intermediary shall promptly provide KYC related information to KRA, as
and when required.
2.12.1.7 The intermediary shall have adequate internal controls to ensure the
security/authenticity of data uploaded by it.
2.12.2 Guidelines for KRAs:
2.12.2.1 KRA system shall provide KYC information in data and image form to the
intermediary.
2.12.2.2 KRA shall send a letter to the client within 10 working days of the receipt of
the initial/updated KYC documents from intermediary, confirming the details thereof and maintain the proof of dispatch.
2.12.2.3 KRA(s) shall develop systems, in co-ordination with each other, to prevent
duplication of entry of KYC details of a client and to ensure uniformity in formats of uploading / modification / downloading of KYC data by the intermediary.

90 Reference: SEBI Circular MIRSD/Cir- 26 /2011 dated December 23, 2011 91 Reference: KYC Registration Agency (Amendment) Regulations, 2013 vide Notification No. LAD-NRO/GN/2012-13/35/6998 dated March 22, 2013

2.12.2.4 KRA shall maintain an audit trail of the upload / modifications / downloads
made in the KYC data, by the intermediary in its system.
2.12.2.5 KRA shall ensure that a comprehensive audit of its systems, controls,
procedures, safeguards and security of information and documents is carried out annually by an independent auditor. The Audit Report along with the steps taken to rectify the deficiencies, if any, shall be placed before its Board of Directors. Thereafter, the KRA shall send the Action Taken Report to SEBI within 3 months.
2.12.2.6 KRA systems shall clearly indicate the status of clients falling under PAN
exempt categories viz. investors residing in the state of Sikkim, UN entities / multilateral agencies exempt from paying taxes / filing tax returns in India.
2.12.2.7 A client can start trading / investing/ dealing with the intermediary and its
group / subsidiary / holding company as soon as the initial KYC is done and other necessary information is obtained while the remaining process of KRA is in progress.
2.12.3 In-Person Verification (IPV):
With regard to the requirement of in-person’ verification (IPV), SEBI has issued guidelines to the stock brokers and DPs. However, in line with the uniformity brought out in the KYC procedure across intermediaries, the IPV requirements for all the intermediaries have now been streamlined and harmonized, as follows:
2.12.3.1 It shall be mandatory for all the intermediaries addressed under this section
to carry out IPV of their clients.
2.12.3.2 The intermediary shall ensure that the details like name of the person doing
IPV, his designation, organization with his signatures and date are recorded on the KYC form at the time of IPV.
2.12.3.3 The IPV carried out by one SEBI registered intermediary can be relied upon
by another intermediary.
2.12.3.4 In case of Stock brokers, their sub-brokers or Authorised Persons (appointed
by the stock brokers after getting approval from the concerned Stock Exchanges in terms of Section 32.2 of SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2023/71 dated May 17, 2023) can perform the IPV.
2.12.3.5 In case of Mutual Funds, their Asset Management Companies (AMCs) and
the distributors who comply with the certification process of National Institute of Securities Market (NISM) or Association of Mutual Funds (AMFI) and have undergone the process of ‘Know Your Distributor (KYD)’, can perform the IPV. However, in case of applications received by the mutual funds directly from the clients (i.e. not through any distributor), they may also rely upon the IPV performed by the scheduled commercial banks.

Note:92 a. IPV/ VIPV would not be required when the KYC of the investor is completed using the Aadhaar authentication / verification of UIDAI. b. IPV/ VIPV shall not be required by the RI when the KYC form has been submitted online, documents have been provided through digilocker or any other source which could be verified online.
2.13 Clarification on Know Your Client (KYC) Process and Use of Technology for KYC93
2.13.1 Know Your Customer (KYC) and Customer Due Diligence (CDD) policies as part of
KYC are the foundation of an effective Anti-Money Laundering process. The KYC process requires every SEBI registered intermediary (hereinafter referred to as ‘RI’) to collect and verify the Proof of Identity (PoI) and Proof of Address (PoA) from the investor.
2.13.2 The provisions as laid down under the PMLA, Prevention of Money-Laundering
(Maintenance of Records) Rules, 2005, SEBI Master Circular on Guidelines on AntiMoney Laundering (AML) Standards and Combating the Financing of Terrorism (CFT) /Obligations of Securities Market Intermediaries under the Prevention of Money Laundering Act, 2002 and Rules framed there under dated February 03, 2023 and relevant KYC / AML circulars issued from time to time shall continue to remain applicable. Further, the SEBI registered intermediary shall continue to ensure to obtain the express consent of the investor before undertaking online KYC.
2.13.3 SEBI, has issued various circulars to simplify, harmonize the process of KYC by
investors / RI. Constant technology evolution has taken place in the market and innovative platforms are being created to allow investors to complete KYC process online. SEBI held discussions with various market participants and based on their feedback and with a view to allow ease of doing business in the securities market, it is decided to make use of following technological innovations which can facilitate online KYC:
2.13.3.1 eSign service is an online electronic signature service that can facilitate an
Aadhaar holder to forward the document after digitally signing the same provided the eSign signature framework is operated under the provisions of Second schedule of the Information Technology Act, 2000 and guidelines issued by the controller.
2.13.3.2 In terms of Rule 2 (1) (cb) of PML Rules 2005, “equivalent e-document” means
an electronic equivalent of a document, issued by the issuing authority of such document with its valid digital signature, including documents issued to the Digital Locker account of the investor as per Rule 9 of the Information

92 Reference: SEBI Circular SEBI/HO/MIRSD/DOP/CIR/P/2020/73 dated April 24, 2020 93 Reference: SEBI Circular SEBI/HO/MIRSD/DOP/CIR/P/2020/73 dated April 24, 2020

Technology (Preservation and Retention of Information by Intermediaries Providing Digital Locker Facilities) Rules, 2016.
2.13.3.3 Section 5 of the Information Technology Act, 2000 recognizes electronic
signatures (which includes digital signature) and states that where any law provides that information or any other matter shall be authenticated by affixing the signature or any document shall be signed or bear the signature of any person then such requirement shall be deemed to have been satisfied, if such information or matter is authenticated by means of a digital signature affixed in such manner as prescribed by the Central Government. Therefore, the eSign mechanism of Aadhaar shall be accepted in lieu of wet signature on the documents provided by the investor. Even the cropped signature affixed on the online KYC form under eSign shall also be accepted as valid signature.
2.13.4 In order to enable the Online KYC process for establishing account based
relationship with the RI, Investor’s KYC can be completed through online / App based KYC, in-person verification through video, online submission of Officially Valid Document (OVD) / other documents under eSign, in the following manner:
2.13.4.1 The investor visits the website/App/digital platform of the RI and fills up the
online KYC form and submits requisite documents online.
2.13.4.2 The name, photograph, address, mobile number, email ID, Bank details of the
investor shall be captured online and OVD / PAN / signed cancelled cheque shall be provided as a photo / scan of the original under eSign and the same shall be verified as under:
2.13.4.2.1 Mobile and email is verified through One Time Password (OTP) or other
verifiable mechanism. The mobile number/s of investor accepted as part of KYC should preferably be the one seeded with Aadhaar. (the RI shall ensure to meet the requirements of the mobile number and email as detailed under
Section 33 ‘SMS and E-mail alerts to investors by Stock Exchanges’ of SEBI
Circular SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2023/71 dated May 17, 2023)
2.13.4.2.2 Aadhaar is verified through UIDAIs authentication / verification mechanism.
Further, in terms of Rule 9 (16) of the PML Rules 2005, every RI shall, where the investor submits his Aadhaar number, ensure that such investor to redact or blackout his Aadhaar number through appropriate means where the authentication of Aadhaar number is not required under sub-rule (15). RI shall not store/ save the Aadhaar number of investor in their system. e-KYC through Aadhaar Authentication service of UIDAI or offline verification through Aadhaar QR Code/ XML file can be undertaken, provided the XML file or Aadhaar Secure QR Code generation date is not older than 3 days from

the date of carrying out KYC. The usage of Aadhaar is optional and purely on a voluntary basis by the investor.
2.13.4.2.3 PAN is verified online using the Income Tax Database.
2.13.4.2.4 Bank account details are verified by Penny Drop mechanism or any other
mechanism using API of the Bank. (Explanation: based on bank details in the copy of the cancelled cheque provided by the investor, the money is deposited into the bank account of the investors to fetch the bank account details and name.) The name and bank details as obtained shall be verified with the information provided by investor.
2.13.4.2.5 Any OVD other than Aadhaar shall be submitted through Digilocker/under
eSign mechanism.
2.13.4.3 In terms of Rule 2 (d) of PML Rules 2005, “Officially Valid Documents” means
the following:
2.13.4.3.1 the passport,
2.13.4.3.2 the driving licence,
2.13.4.3.3 proof of possession of Aadhaar number,
2.13.4.3.4 the Voter's Identity Card issued by Election Commission of India,
2.13.4.3.5 job card issued by NREGA duly signed by an officer of the State Government
and
2.13.4.3.6 the letter issued by the National Population Register containing details of
name, address, or any other document as notified by the Central Government in consultation with the Regulator.
2.13.4.4 Further, Rule 9(18) of PML Rules 2005 states that in case OVD furnished by the
investor does not contain updated address, the document as prescribed therein in the above stated Rule shall be deemed to be the OVD for the limited purpose of proof of address.
2.13.4.5 PML Rules 2005 allows an investor to submit other OVD instead of PAN,
however, the requirement of mandatory submission of PAN by the investors for transaction in the securities market shall continue to apply.
2.13.4.6 Once all the information as required as per the online KYC form is filled up by
the investor, KYC process could be completed as under:
2.13.4.6.1 The investor would take a print out of the completed KYC form and after
affixing their wet signature, send the scanned copy / photograph of the same to the RI under eSign, or
2.13.4.6.2 Affix online the cropped signature on the filled KYC form and submit the
same to the RI under eSign.
2.13.4.7 The RI shall forward the KYC completion intimation letter through registered
post/ speed post or courier, to the address of the investor in cases where the investor has given address other than as given in the OVD. In such cases of

return of the intimation letter for wrong / incorrect address, addressee not available etc., no transactions shall be allowed in such account and intimation shall also sent to the Stock Exchange and Depository.
2.13.4.8 The original seen and verified requirement for OVD would be met where the
investor provides the OVD in the following manner:
2.13.4.8.1 As a clear photograph or scanned copy of the original OVD, through the eSign
mechanism, or;
2.13.4.8.2 As digitally signed document of the OVD, issued to the DigiLocker by the
issuing authority.
2.13.4.9 SEBI has harmonized the IPV requirements for the intermediaries. In order to
ease the IPV process for KYC, the said SEBI circular pertaining to IPV stands modified as under:
2.13.4.9.1 IPV/ VIPV would not be required when the KYC of the investor is completed
using the Aadhaar authentication / verification of UIDAI.
2.13.4.9.2 IPV / VIPV shall not be required by the RI when the KYC form has been
submitted online, documents have been provided through digilocker or any other source which could be verified online.
2.13.5 Features for online KYC App of the RI - SEBI registered intermediary may
implement their own Application (App) for undertaking online KYC of investors. The App shall facilitate taking photograph, scanning, acceptance of OVD through Digilocker, video capturing in live environment, usage of the App only by authorized person of the RI. The App shall also have features of random action initiation for investor response to establish that the interactions not pre-recorded, time stamping, geo-location tagging to ensure physical location in India etc is also implemented. RI shall ensure that the process is a seamless, real-time, secured, endto-end encrypted audio-visual interaction with the customer and the quality of the communication is adequate to allow identification of the customer beyond doubt. RI shall carry out the liveliness check in order to guard against spoofing and such other fraudulent manipulations. The RI shall before rolling out and periodically, carry out software and security audit and validation of their App. The RI may have additional safety and security features other than as prescribed above.
2.13.6 Feature for Video in Person Verification (VIPV) for Individuals – To enable ease
of completing IPV of an investor, intermediary may undertake the VIPV of an individual investor through their App. The following process shall be adopted in this regard:
2.13.6.1 Intermediary through their authorised official, specifically trained for this
purpose, may undertake live VIPV of an individual customer, after obtaining his/her informed consent. The activity log along with the credentials of the person performing the VIPV shall be stored for easy retrieval.

2.13.6.2 The VIPV shall be in a live environment.
2.13.6.3 The VIPV shall be clear and still, the investor in the video shall be easily
recognisable and shall not be covering their face in any manner.
2.13.6.4 The VIPV process shall include random question and response from the investor
including displaying the OVD, KYC form and signature or could also be confirmed by an OTP.
2.13.6.5 The RI shall ensure that photograph of the customer downloaded through the
Aadhaar authentication / verification process matches with the investor in the VIPV.
2.13.6.6 The VIPV shall be digitally saved in a safe, secure and tamper-proof, easily
retrievable manner and shall bear date and time stamping.
2.13.6.7 The RI may have additional safety and security features other than as prescribed
above.
2.14 Simplification and Rationalization of Trading Account Opening Process 94
Kindly refer para titled ‘Simplification and Rationalization of Trading Account Opening Process’ of SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD1/P/CIR/2023/71 dated May 17, 2023 (Master circular for Stock Brokers)
2.15 Recording of Non Disposal Undertaking (NDU) in the Depository System95
Securities and Exchange Board of India (Substantial Acquisition of Shares and Takeovers) Regulations, 2011 (“SAST Regulations”), requires promoters of a company to disclose details of their encumbered shares including NDUs by promoters which are covered under the scope of disclosures of 'Encumbrances'. It has been observed that some shareholders, primarily promoters, enter into nondisposal agreements/non-disposal undertaking (NDU) for borrowing funds from various lenders. NDUs are typically undertakings given by a shareholder not to transfer or otherwise alienate the securities and are in the nature of negative lien given in favour of another party, usually a lender. In order to enable the shareholders to record the NDUs in the depository system, it has been decided to permit the depositories to offer a system for capturing and recording the NDUs In this regard, the depositories are advised the following:
2.15.1 Depositories shall develop a separate module/ transaction type in their system
for recording NDUs.
2.15.2 Both parties to the NDU shall have a demat account with the same depository
and be KYC compliant.

94 Reference: SEBI Circular CIR/MIRSD/16/2011 dated August 22, 2011 95 Reference: SEBI Circular CIR/MRD/DP/56/2017 dated June14, 2017

2.15.3 Pursuant to entering the NDU, the Beneficial Owner (BO) along with the other
party shall make an application through the participant (where the BO holds his securities) to the depository, for the purpose of recording the NDU transaction.
2.15.4 The application shall necessarily include details of BO ID, PAN, email-id,
signature(s), name of the entity in whose favor such NDU is entered and the quantity of securities. Such entity in whose favor NDU is entered shall also authorize the participant of the BO holding the shares, to access the signatures as recorded in that entity’s demat account.
2.15.5 The participant after being satisfied that the securities are available for NDU
shall record the NDU and freeze for debit the requisite quantity of securities under NDU in the depository system.
2.15.6 The depositories shall make suitable provisions for capturing the details of BO
ID and PAN of the entity in whose favor such NDU is entered by the participant. The depositories shall also make available to the said participant, the details of authorized signatories as recorded in the demat account of the entity in whose favor such NDU is entered.
2.15.7 On creation of freeze in the depository system, the depository/ participant of
the BO holding shares, shall inform both parties of the NDU regarding creation of freeze under NDU.
2.15.8 The depositories shall make suitable provisions for capturing the details of
company/ promoters if they are part of the NDU.
2.15.9 In case if the participant does not create the NDU, it shall intimate the same to
the parties of the NDU along with the reasons thereof.
2.15.10 Once the freeze for debits is created under the NDU for a particular quantity of
shares, the depository shall not facilitate or effect any transfer, pledge, hypothecation, lending, rematerialisation or in any manner alienate or otherwise allow dealing in the shares held under NDU till receipt of instructions from both parties for the cancellation of NDU.
2.15.11 The entry of NDU made as per Para 2.15.5 above may be cancelled by the
depository/participant of the BO through unfreeze of specified quantity if parties to the NDU jointly make such application to the depository through the participant of the BO.
2.15.12 On unfreeze of shares upon termination/cancellation of NDU, the depository
shall inform both parties of the NDU in the form and manner agreed upon at the time of creating the freeze. The unfreeze shall be effected in the depository system after a cooling period of 2 clear business days but no later than 4 clear business days.

2.15.13 The freeze and unfreeze instructions executed by the Participant for recording
NDUs will be subject to 100% concurrent audit.
2.15.14 The DPs shall not facilitate or be a party to any NDU outside the depository
system as outlined herein.
2.16 Recording of all types of Encumbrances in Depository system96
2.16.1 The SAST Regulations requires promoters of a company to disclose details of their
encumbered shares. Apart from pledge, hypothecation and non-disposal undertakings(NDUs), there is no framework to capture the details of other types of encumbrances in the depository system.
2.16.2 In this regard, Depositories shall put in place a system for capturing and recording
all types of encumbrances, which are specified under Regulation 28(3) of the SAST Regulations, as amended from time to time. Towards this end, Depositories shall follow processes and other norms similar to that stipulated for the purpose of capturing and recording NDUs in Depository system. This is apart from pledge and hypothecation, whose processes and specific norms are separately provided in DP Regulations and circulars issued thereon. Further:
2.16.2.1 All types of encumbrances as defined under Regulation 28(3) of SAST
Regulations shall necessarily be recorded in the depository system.97
2.16.2.2 The depositories shall capture details of the ultimate lender along with
name of the trustee acting on behalf of such ultimate lender such as banks, NBFCs, etc. In case of issuance of debentures, name of the debenture issuer shall be captured in the depository system.
2.16.2.3 The depositories shall now capture the reasons for encumbrances in the
depository system.
2.16.3 The freeze and unfreeze instructions executed by the Participant for recording all
encumbrances will be subject to 100% concurrent audit.
2.16.4 The Depository Participant shall not facilitate or be party to any type of
encumbrance outside the Depository system as outlined herein.
2.17 Cyber Security & Cyber Resilience framework for Depository Participant98
2.17.1 Rapid technological developments in securities market have highlighted the need
for maintaining robust cyber security and cyber resilience framework to protect the integrity of data and guard against breaches of privacy.
2.17.2 Since depository participants perform significant functions in providing services to
holders of securities, it is desirable that these entities have robust cyber security and

96 Reference: SEBI Circular SEBI/HO/MRD2/DDAP/CIR/P/2020/137 dated July 24, 2020 97 Reference: SEBI Circular SEBI/HO/CFD/DCR-3/P/CIR/2022/27 dated March 07, 2022 98 Reference: SEBI Circular SEBI/HO/MIRSD/CIR/PB/2018/147 dated December 03, 2018

cyber resilience framework in order to provide essential facilities and perform systemically critical functions relating to securities market.
2.17.3 Accordingly, a framework on cyber security and cyber resilience has been designed
which is specified below. The framework would be required to be complied by all Depository Participants registered with SEBI.
2.17.4 Further, the Depository Participants are mandated to conduct comprehensive cyber
audit at least once in a financial year. All Depository Participants shall submit with Depository a declaration from the MD/ CEO/ Partners/ Proprietors certifying compliance by the Depository Participants with all SEBI Circulars and advisories related to Cyber security from time to time, along with the Cyber audit report99
2.17.5 The framework on cyber security and cyber resilience is as follows:
2.17.5.1 Cyber-attacks and threats attempt to compromise the Confidentiality, Integrity
and Availability (CIA) of the computer systems, networks and databases (Confidentiality refers to limiting access of systems and information to authorized users, Integrity is the assurance that the information is reliable and accurate, and Availability refers to guarantee of reliable access to the systems and information by authorized users). Cyber security framework includes measures, tools and processes that are intended to prevent cyber-attacks and improve cyber resilience. Cyber Resilience is an organization’s ability to prepare and respond to a cyber-attack and to continue operation during, and recover from, a cyber-attack. Governance
2.17.5.2 As part of the operational risk management framework to manage risk to
systems, networks and databases from cyber-attacks and threats, Depository Participants should formulate a comprehensive Cyber Security and Cyber Resilience policy document encompassing the framework mentioned hereunder. In case of deviations from the suggested framework, reasons for such deviations, technical or otherwise, should be provided in the policy document. The policy document should be approved by the Board / Partners / Proprietor of the Depository Participants. The policy document should be reviewed by the aforementioned group at least annually with the view to strengthen and improve its Cyber Security and Cyber Resilience framework.
2.17.5.3 The Cyber Security Policy should include the following process to identify,
assess, and manage Cyber Security risk associated with processes, information, networks and systems:
a. ‘Identify’ critical IT assets and risks associated with such assets. b. ‘Protect’ assets by deploying suitable controls, tools and measures.

99 Reference: SEBI Circular SEBI/HO/MIRSD/TPD/P/CIR/2022/80 dated June 07, 2022

c. ‘Detect’ incidents, anomalies and attacks through appropriate monitoring
tools/processes. d. ‘Respond’ by taking immediate steps after identification of the incident, anomaly or attack. e. ‘Recover’ from incident through incident management and other appropriate recovery mechanisms.
2.17.5.4 The Cyber Security Policy of Depository Participants should consider the
principles prescribed by National Critical Information Infrastructure Protection Centre (NCIIPC) of National Technical Research Organization (NTRO), Government of India (titled ‘Guidelines for Protection of National Critical Information Infrastructure’) and subsequent revisions, if any, from time to time.
2.17.5.5 Depository Participants may refer to best practices from international standards
like ISO27001, COBIT5,etc., or their subsequent revisions, if any, from time to time.
2.17.5.6 Depository Participants should designate a senior official or management
personnel (henceforth, referred to as the “Designated Officer”) whose function would be to assess, identify, and reduce security and Cyber Security risks, respond to incidents, establish appropriate standards and controls, and direct the establishment and implementation of processes and procedures as per the Cyber Security Policy.
2.17.5.7 The Board/Partners/Proprietor of the Depository Participants shall constitute
an Technology Committee100 comprising experts. This Technology Committee should on a half yearly basis review the implementation of the Cyber Security and Cyber Resilience policy approved by their Board/Partners/Proprietor, and such review should include review of their current IT and Cyber Security and Cyber Resilience capabilities, set goals for a target level of Cyber Resilience, and establish plans to improve and strengthen Cyber Security and Cyber Resilience. The review shall be placed before the Board/Partners/Proprietor of the Depository Participants for appropriate action.
2.17.5.8 Depository Participants should establish a reporting procedure to facilitate
communication of unusual activities and events to the Designated Officer in a timely manner.
2.17.5.9 The Designated officer and the technology committee of the Depository
Participants should periodically review instances of cyber-attacks, if any, domestically and globally, and take steps to strengthen Cyber Security and cyber resilience framework.

100 Reference: SEBI Circular CIR/HO/MIRSD/DOS2/CIR/PB/2019/038 dated March 15, 2019 - in Para 7, the words “Internal Technology Committee” stands replaced as “Technology Committee”.

2.17.5.10 Depository Participants should define responsibilities of its employees,
outsourced staff, and employees of vendors, members or participants and other entities, who may have privileged access or use systems / networks of Depository Participants towards ensuring the goal of Cyber Security. Identification
2.17.5.11 Depository Participants shall identify and classify critical assets based on their
sensitivity and criticality for business operations, services and data management. The critical assets shall include business critical systems, internet facing applications /systems, systems that contain sensitive data, sensitive personal data, sensitive financial data, Personally Identifiable Information (PII) data, etc. All the ancillary systems used for accessing/communicating with critical systems either for operations or maintenance shall also be classified as critical system. The Board/Partners/Proprietor of the Depository Participants shall approve the list of critical systems.101 To this end, Depository Participants shall maintain up-to date inventory of its hardware and systems, software and information assets (internal and external), details of its network resources, connections to its network and data flows.
2.17.5.12 Depository Participants should accordingly identify cyber risks (threats and
vulnerabilities) that it may face, along with the likelihood of such threats and impact on the business and thereby, deploy controls commensurate to the criticality. Protection Access controls
2.17.5.13 No person by virtue of rank or position should have any intrinsic right to access
confidential data, applications, system resources or facilities.
2.17.5.14 Any access to Depository Participants systems, applications, networks,
databases, etc., should be for a defined purpose and for a defined period. Depository Participants should grant access to IT systems, applications, databases and networks on a need-to-use basis and based on the principle of least privilege. Such access should be for the period when the access is required and should be authorized using strong authentication mechanisms.
2.17.5.15 Depository Participants should implement an access policy which addresses
strong password controls for users’ access to systems, applications, networks and databases. Illustrative examples for this are given under Annexure 14
2.17.5.16 All critical systems of the Depository Participant accessible over the internet
should have two-factor security (such as VPNs, Firewall controls etc.)

101 Reference: SEBI Circular SEBI/HO/MIRSD/TPD/P/CIR/2022/80 dated June 07, 2022

2.17.5.17 Depository Participants should ensure that records of user access to critical
systems, wherever possible, are uniquely identified and logged for audit and review purposes. Such logs should be maintained and stored in a secure location for a time period not less than two (2) years.
2.17.5.18 Depository Participants should deploy controls and security measures to
supervise staff with elevated system access entitlements (such as admin or privileged users) to Depository Participant’s critical systems. Such controls and measures should inter-alia include restricting the number of privileged users, periodic review of privileged users’ activities, disallow privileged users from accessing systems logs in which their activities are being captured, strong controls over remote access by privileged users, etc.
2.17.5.19 Employees and outsourced staff such as employees of vendors or service
providers, who may be given authorized access to the Depository Participants critical systems, networks and other computer resources, should be subject to stringent supervision, monitoring and access restrictions.
2.17.5.20 Depository Participants should formulate an Internet access policy to monitor
and regulate the use of internet and internet based services such as social media sites, cloud-based internet storage sites, etc. within the Depository Participant’s critical IT infrastructure.
2.17.5.21 User Management must address deactivation of access of privileges of users who
are leaving the organization or whose access privileges have been withdrawn. Physical Security
2.17.5.22 Physical access to the critical systems should be restricted to minimum and only
to authorized officials. Physical access of outsourced staff/visitors should be properly supervised by ensuring at the minimum that outsourced staff/visitors are accompanied at all times by authorized employees.
2.17.5.23 Physical access to the critical systems should be revoked immediately if the same
is no longer required.
2.17.5.24 Depository Participants should ensure that the perimeter of the critical
equipment room, if any, are physically secured and monitored by employing physical, human and procedural controls such as the use of security guards, CCTVs, card access systems, mantraps, bollards, etc. where appropriate. Network Security Management
2.17.5.25 Depository Participants should establish baseline standards to facilitate
consistent application of security configurations to operating systems, databases, network devices and enterprise mobile devices within their IT environment. The LAN and wireless networks should be secured within the Depository Participants’ premises with proper access controls.

2.17.5.26 For algorithmic trading facilities, adequate measures should be taken to isolate
and secure the perimeter and connectivity to the servers running algorithmic trading applications.
2.17.5.27 Depository Participants should install network security devices, such as
firewalls, proxy servers, intrusion detection and prevention systems (IDS) to protect their IT infrastructure which is exposed to the internet, from security exposures originating from internal and external sources.
2.17.5.28 Adequate controls must be deployed to address virus / malware / ransomware
attacks. These controls may include host / network / application based IDS systems, customized kernels for Linux, anti-virus and anti-malware software etc. Data security
2.17.5.29 Critical data must be identified and encrypted in motion and at rest by using
strong encryption methods. Illustrative measures in this regard are given under Annexure 12 & Annexure 13.
2.17.5.30 Depository Participants should implement measures to prevent unauthorized
access or copying or transmission of data / information held in contractual or fiduciary capacity. It should be ensured that confidentiality of information is not compromised during the process of exchanging and transferring information with external parties. Illustrative measures to ensure security during transportation of data over the internet are given under Annexure 13
2.17.5.31 The information security policy should also cover use of devices such as mobile
phones, faxes, photocopiers, scanners, etc., within their critical IT infrastructure, that can be used for capturing and transmission of sensitive data. For instance, defining access policies for personnel, and network connectivity for such devices etc.
2.17.5.32 Depository Participants should allow only authorized data storage devices
within their IT infrastructure through appropriate validation processes. Hardening of Hardware and Software
2.17.5.33 Depository Participants should only deploy hardened hardware / software,
including replacing default passwords with strong passwords and disabling or removing services identified as unnecessary for the functioning of the system.
2.17.5.34 Open ports on networks and systems which are not in use or that can be
potentially used for exploitation of data should be blocked and measures taken to secure them. Application Security in Customer Facing Applications
2.17.5.35 Application security for Customer facing applications offered over the Internet
such as IBTs (Internet Based Trading applications), portals containing sensitive or private information and Back office applications (repository of financial and

personal information offered by Brokers to Customers) are paramount as they carry significant attack surfaces by virtue of being available publicly over the Internet for mass use. An illustrative list of measures for ensuring security in such applications is provided under Annexure 14. Certification of off-the-shelf products
2.17.5.36 Depository Participants should ensure that off the shelf products being used for
core business functionality (such as Back office applications) should bear Indian Common criteria certification of Evaluation Assurance Level 4. The Common criteria certification in India is being provided by (STQC) Standardisation Testing and Quality Certification (Ministry of Electronics and Information Technology). Custom developed / in-house software and components need not obtain the certification, but have to undergo intensive regression testing, configuration testing etc. The scope of tests should include business logic and security controls. Patch management
2.17.5.37 Depository Participants should establish and ensure that the patch management
procedures include the identification, categorization and prioritization of patches and updates. An implementation timeframe for each category of patches should be established to apply them in a timely manner.
2.17.5.38 Depository Participants should perform rigorous testing of security patches and
updates, where possible, before deployment into the production environment so as to ensure that the application of patches do not impact other systems. Disposal of data, systems and storage devices
2.17.5.39 Depository Participants should frame suitable policy for disposal of storage
media and systems. The critical data / Information on such devices and systems should be removed by using methods such as crypto shredding / degauss / Physical destruction as applicable.
2.17.5.40 Depository Participants should formulate a data-disposal and data- retention
policy to identify the value and lifetime of various parcels of data. Vulnerability Assessment and Penetration Testing (VAPT)
2.17.5.41 Depository Participants should regularly conduct vulnerability assessment to
detect security vulnerabilities in their IT environments exposed to the internet.102
2.17.5.42 Depository Participants with systems publicly available over the internet should
also carry out penetration tests, at-least once a year, in order to conduct an in-

102 Reference: SEBI Circular SEBI/HO/MIRSD/TPD/P/CIR/2022/80 dated June 07, 2022

depth evaluation of the security posture of the system through simulations of actual attacks on its systems and networks that are exposed to the internet.103 In addition, Depository Participants should perform vulnerability scanning and conduct penetration testing prior to the commissioning of a new system that is accessible over the internet.
2.17.5.43 In case of vulnerabilities discovered in off-the-shelf products (used for core
business) or applications provided by exchange empanelled vendors, Depository Participants should report them to the vendors and the exchanges in a timely manner.
2.17.5.44 Remedial actions should be immediately taken to address gaps that are
identified during vulnerability assessment and penetration testing.104 Monitoring and Detection
2.17.5.45 Depository Participants should establish appropriate security monitoring
systems and processes to facilitate continuous monitoring of security events / alerts and timely detection of unauthorised or malicious activities, unauthorised changes, unauthorised access and unauthorised copying or transmission of data / information held in contractual or fiduciary capacity, by internal and external parties. The security logs of systems, applications and network devices exposed to the internet should also be monitored for anomalies.
2.17.5.46 Further, to ensure high resilience, high availability and timely detection of
attacks on systems and networks exposed to the internet, Depository Participants should implement suitable mechanisms to monitor capacity utilization of its critical systems and networks that are exposed to the internet, for example, controls such as firewalls to monitor bandwidth usage. Response and Recovery
2.17.5.47 Alerts generated from monitoring and detection systems should be suitably
investigated in order to determine activities that are to be performed to prevent expansion of such incident of cyber-attack or breach, mitigate its effect and eradicate the incident.
2.17.5.48 The response and recovery plan of the Depository Participants should have
plans for the timely restoration of systems affected by incidents of cyber-attacks or breaches, for instance, offering alternate services or systems to Customers. Depository Participants should have the same Recovery Time Objective (RTO) and Recovery Point Objective (RPO) as specified by SEBI for Market Infrastructure Institutions under Para 4.31 as amended from time to time

103 Reference: SEBI Circular SEBI/HO/MIRSD/TPD/P/CIR/2022/80 dated June 07, 2022 104 Reference: SEBI Circular SEBI/HO/MIRSD/TPD/P/CIR/2022/80 dated June 07, 2022

2.17.5.49 The response plan should define responsibilities and actions to be performed by
its employees and support / outsourced staff in the event of cyber-attacks or breach of Cyber Security mechanism.
2.17.5.50 Any incident of loss or destruction of data or systems should be thoroughly
analyzed and lessons learned from such incidents should be incorporated to strengthen the security mechanism and improve recovery planning and processes.
2.17.5.51 Depository Participants should also conduct suitable periodic drills to test the
adequacy and effectiveness of the aforementioned response and recovery plan. Sharing of Information
2.17.5.52 105All Cyber-attacks, threats, cyber-incidents and breaches experienced by
Depositories Participants shall be reported to Depositories & SEBI within 6 hours of noticing/detecting such incidents or being brought to notice about such incidents. This information shall be shared to SEBI through the dedicated e-mail id: sbdp-cyberincidents@sebi.gov.in. The incident shall also be reported to Indian Computer Emergency Response team (CERT-In) in accordance with the guidelines / directions issued by CERTIn from time to time. Additionally, the Depository Participants, whose systems have been identified as “Protected system” by National Critical Information Infrastructure Protection Centre (NCIIPC) shall also report the incident to NCIIPC. The quarterly reports containing information on cyber-attacks, threats, cyberincidents and breaches experienced by Depository Participants and measures taken to mitigate vulnerabilities, threats and attacks including information on bugs / vulnerabilities, threats that may be useful for other Depository Participants/ Depositories and SEBI, shall be submitted to Depositories within 15 days from the quarter ended June, September, December and March of every year. The following guidelines are for timelines & submission of report/information106:
i. The format for submitting the reports is attached below.
ii. The mode of submission of such reports by the depository participants
may be prescribed by Depositories.

105 Reference: SEBI Circular SEBI/HO/MIRSD/TPD/P/CIR/2022/93 dated June 30, 2022 106 Reference: SEBI Circular SEBI/HO/MIRSD/DOP/CIR/P/2019/109 dated October 15, 2019

Format
Incident Reporting Form
1.Letter/ Report SubjectName of the Member / Depository Participant - Name of the Stock Exchange/ DepositoryMember ID/DPID2. Reporting Periodicity YearQuarter1 (Apr-Jun) Quarter2 (Jul-Sep) Quarter3 (Oct-Dec) Quarter4(Jan-Mar)
3. Designated Officer (Reporting Officer details) -
Name: Organization: Title:
Phone / Fax No: Mobile: Email:
Address:
Cyber-attack/ breach observed in Quarter:
(If yes, please fill Annexure I)
(If no, please submit the NIL report)
Date & Time Brief information on the Cyber-attack/ breached observed Annexure I

Physical location of affected computer /network and name of ISP2. Date and time incident occurred -
Date: Time:
Information of affected systemIP Address:
Computer
/Host
Name:
Operating System
(incl. Ver. / release
No.):
Last Patched/
Updated:
Hardware
Vendor/
Model:
Type of incident -

Phishing
Network
scanning/Probing
Break- in/Root
Compromise
Virus/Malicious Code
Website Defacement
System Misuse
Spam
Bot/Botnet
Email Spoofing
Denial of Service (DoS)
Distributed Denial of Service
(DDoS)
User Account
Compromise
Website Intrusion
Social
Engineering
Technical
Vulnerability
IP Spoofing
Ransomware
Other

Description of incident6. Unusual behaviour/symptoms(Tick the symptoms)-

System crashes
New user accounts/ Accounting
discrepancies
Failed or successful social engineering
attempts
Unexplained, poor system performance
Unaccounted for changes in the DNS
tables, router rules, or firewall rules
Unexplained elevation or use of privileges
Operation of a program or sniffer device to capture network traffic;
An indicated last time of usage of a user
account that does not correspond to the actual last time of usage for that user
A system alarm or similar indication from
an intrusion detection tool
Altered home pages, which are usually the
intentional target for visibility, or other pages on the Webserver
Anomalies
Suspicious probes
Suspicious browsing New files
Changes in file lengths or dates
Attempts to write to system
Data modification or deletion
Denial of service
Door knob rattling
Unusual time of usage
Unusual usage patterns
Unusual log file entries
Presence of new setuid or setgid
files Changes in system directories and files
Presence of cracking utilities
Activity during non-working
hours or holidays
Other (Please specify)

Details of unusual behavior/symptoms -
Has this problem been experienced earlier? If yes, details9. Agencies notifiedLaw Enforcement Private Agency Affected Product Vendor Other
IP Address of apparent or suspected sourceSource IP address: Other information available:
How many host(s)are affected1 to 10 10 to 100 More than 100
Details of actions taken for mitigation and any preventive measure applied-

Training and Education
2.17.5.53 Depository Participants should work on building Cyber Security and basic
system hygiene awareness of staff (with a focus on staff from non-technical disciplines).
2.17.5.54 Depository Participants should conduct periodic training programs to enhance
knowledge of IT / Cyber Security Policy and standards among the employees incorporating up-to-date Cyber Security threat alerts. Where possible, this should be extended to outsourced staff, vendors etc.
2.17.5.55 The training programs should be reviewed and updated to ensure that the
contents of the program remain current and relevant.
Systems managed by vendors
2.17.5.56 Where the systems (IBT, Back office and other Customer facing applications, IT
infrastructure, etc.) of a Depository Participants are managed by vendors and the Depository Participants may not be able to implement some of the aforementioned guidelines directly, the Depository Participants should instruct the vendors to adhere to the applicable guidelines in the Cyber Security and Cyber Resilience policy and obtain the necessary self-certifications from them to ensure compliance with the policy guidelines. Systems managed by MIIs
2.17.5.57 Where applications are offered to customers over the internet by MIIs (Market
Infrastructure Institutions), for e.g.: NSE’s NOW, BSE’s BEST etc., the responsibility of ensuring Cyber Resilience on those applications reside with the MIIs and not with the Depository Participant. The Depository Participant is exempted from applying the aforementioned guidelines to such systems offered by MIIs such as NOW, BEST, etc. Periodic Audit107
2.17.5.58 The Depository Participants shall arrange to have their systems audited on an
annual basis to check compliance with the above areas and shall submit the report to Depositories along with the comments of the Board / Partners / Proprietor of Depository Participant within three months of the end of the financial year. The auditors qualified in following certifications can audit the systems of depository participants to check the compliance of Cyber Security and Cyber Resilience provisions:
a. CERT-IN empanelled auditor, an independent DISA (ICAI) Qualification, CISA (Certified Information System Auditor) from

107 Reference: SEBI Circular SEBI/HO/MIRSD/DOP/CIR/P/2019/109 dated October 15, 2019

ISACA, CISM (Certified Information Securities Manager) from ISACA, CISSP (Certified Information Systems Security Professional) from International Information Systems Security Certification Consortium (commonly known as (ISC)2).
2.18 Standard Operating Procedure (SOP) for handling cyber security incidents of
intermediaries and Categorisation of Intermediaries108 The following Standard Operating Procedure (SOP) needs to be complied with by DPs:
2.18.1 DPs to have their own cyber security incident handling process
document, SOP in place.
2.18.2 DPs to examine the incident and classify the incident High / Medium /
Low as per their cyber security incident handling document. Decide Action / Response for the incident based on severity.
2.18.3 Report incident to Indian Computer Emergency Response Team (CERTIn).
2.18.4 DPs to provide the reference details of the reported incident to the
respective depository and SEBI. They also need to provide details regarding whether CERT-In team is in touch with the DP for any assistance. If not reported to CERT-In, they should submit the reasons for the same to the depository and SEBI. DPs to communicate with CERT-In / MHA / Cybercrime police for further assistance.
2.18.5 DPs to submit details whether they have registered complaint with law
enforcement agencies such as Police or cyber security cell. If yes, details need to be provided to MIIs and SEBI. If not, reason for not registering complaint should also be provided to MIIs and SEBI. In addition to the above, the depositories are also requested to categorise their participants into three categories as per the details tabulated below:

108 Reference: SEBI MIRSD email dated April 16, 2021 Category of Intermed iaries Type of Intermediaries Frequency of Penetration Testing to be conducted by SEBI Frequency of PT to be conducted through MIIs Parameters that may be considered Set-A (High Impact) Depository Participants Will be conducted on yearly basis.

Top DPs in terms of number
of demat accounts.
The list shall also include intermediaries having significant online

presence like: Zerodha, ICICI direct, Upstox, HDFC securities, Kotak securities, Sharekhan, etc.erodha, ICICI direct, Upstox, HDFC securities, Kotak securities, Sharekhan, etc. The list is to be reviewed on yearly basis and the revised list shall be submitted to SEBI in first week of April. The parameters listed above are indicative and Depositories may include any other relevant parameter(s) to categorise their participants under Set A. For categorising participants under Set A, depositories may arrive at a suitable percentage for parameters identified. Set-B (Mediu m Impact) Depository Participants - For DPs coming under the purview of Depositorie s , risk based audit / PT will be conducted by Depositorie s once in a year. For categorising members / participants under Set B, depositories may arrive at a suitable percentage for parameters identified. The list is to be reviewed on yearly basis and the revised list shall be submitted to SEBI in first week of April. Depositories to define and communicate risk based policy / approach for conducting audit / PT for their intermediaries to Division of Supervision of Market Intermediaries Regulation and Supervision Department (DoS-MIRSD) and Chief Information Security Officer (CISO) of SEBI.

Depositories shall communicate the above to their participants and inform SEBI. The details as per Para 2.18.4 and Para 2.18.5 above, shall be submitted to Division Chiefs (in-charge of divisions at the time of submission) of DOS-MIRSD and CISO of SEBI. The list of depository participants, categorised as Set A, Set B, Set C, shall be sent to Division Chiefs (in-charge of divisions at the time of submission) of DoS-MIRSD and CISO of SEBI, along with the criteria decided by depositories to categorise participants. The revised list every year (in first week of April) shall also be submitted to Division Chiefs (in-charge of divisions at the time of submission) of DoS-MIRSD and CISO of SEBI.
2.19 CERT-In Advisory "Preventing Data Breaches / Data Leaks"109
In view of the rising incidents of data breaches / data leaks, CERT-In has issued an Advisory Dated January 20, 2021 w.r.t. "Preventing Data Breaches / Data Leaks", wherein following relevant aspects have been detailed:
2.19.1 Common causes of data breach / data leak,
2.19.2 Best practices to prevent data breaches,
2.19.3 Steps to be taken when organisation/entity is affected by a data
breach/data leak,
2.19.4 Best practices for individual users to safeguard against data breaches

109 Reference: SEBI MIRSD email dated March 02, 2022 The audit / PT report of Set B intermediaries shall be submitted by Depositories to DoS-MIRSD. Set-C (Low Impact) Depository Participants other than that in Set-A and SetB. The revised list shall be submitted to SEBI in first week of April.

For DPs
coming under the purview of
Depositorie s, risk based audit / PT will be conducted by Depositorie s once in 2 years. Depository to define and communicate risk based policy / approach for conducting audit / PT for their intermediaries to DoSMIRSD and CISO SEBI. The audit / PT report of Set C DPs shall be submitted by Depositories to DoS-MIRSD.

All Depositories are hereby advised to issue this advisory to their participants to prevent data breaches / data leaks in future. All Depositories are also advised to instruct their participants to continue to adhere to cyber security guidelines/advisories issued by SEBI in the past and follow best industry practices and comply with other guidelines issued by CERT-In and NCIIPC from time to time.
2.20 Reporting for Artificial Intelligence (AI) and Machine Learning (ML) applications
and systems offered and used by market intermediaries110 Background
2.20.1 There is increasing usage of AI (Artificial Intelligence) and ML (Machine
Learning) as product offerings by market intermediaries and participants (e.g..: “robo advisors”) in investor and consumer facing products. SEBI is conducting a survey and creating an inventory of the AI / ML landscape in the Indian financial markets to gain an in-depth understanding of the adoption of such technologies in the markets and to ensure preparedness for any AI / ML policies that may arise in the future.
2.20.2 As most AI / ML systems are black boxes and their behaviour cannot be easily
quantified, it is imperative to ensure that any advertised financial benefit owing to these technologies in investor facing financial products offered by intermediaries should not constitute to misrepresentation. Scope definition
2.20.3 Any set of applications/software/programs/executable/systems (computer
systems) –cumulatively called application and systems,
2.20.3.1 that are offered to investors (individuals and institutions) by market
intermediaries to facilitate investing and trading, or
2.20.3.2 to disseminate investments strategies and advice,
or
2.20.3.3 to carry out compliance operations / activities,
where AI / ML is portrayed as a part of the public product offering or under usage for compliance or management purposes, is included in the scope of this section. Here, “AI” / “ML” refers to the terms “Artificial Intelligence” and“ Machine Learning” used as a part of the product offerings. In order to make the scope of this section inclusive of various AI and ML technologies in use, the scope also covers Fin-Tech and Reg-Tech initiatives undertaken by market participants that involves AI and ML

110 Reference: SEBI Circular SEBI/HO/MIRSD/DOS2/CIR/P/2019/10 dated January 04, 2019

2.20.4 Technologies that are considered to be categorized as AI and ML technologies
in the scope of this section, are explained below:
Systems deemed to be based on AI and ML technology Applications and Systems belonging but not limited to following categories or a combination of these:
2.20.4.1 Natural Language Processing (NLP), sentiment analysis or text mining
systems that gather intelligence from unstructured data –In this case, Voice to text, text to intelligence systems in any natural language will be considered in scope. Eg: robo chat bots, big data intelligence gathering systems.
2.20.4.2 Neural Networks or a modified form of it –In this case, any systems that
uses a number of nodes (physical or software simulated nodes) mimicking natural neural networks of any scale, so as to carry out learning from previous firing of the nodes will be considered in scope. Eg:
Recurrent Neural networks and Deep Learning Neural Networks
2.20.4.3 Machine learning through supervised, unsupervised learning or a
combination of both. In this case, any application or systems that carry out knowledge representation to form a knowledge base of domain, by learning and creating its outputs with real world input data and deciding future outputs based upon the knowledge base. Eg: System based on Decision tree, random forest, K mean, Markov decision process, Gradient boosting Algorithms.
2.20.4.4 A system that uses statistical heuristics method instead of procedural
algorithms or the system/application applies clustering or categorization algorithms to categorize data without a predefined set of categories
2.20.4.5 A system that uses a feedback mechanism to improve its parameters and
bases it subsequent execution steps on these parameters.
2.20.4.6 A system that does knowledge representation and maintains a knowledge
base
Regulatory requirements
2.20.5 All registered Depository Participants offering or using applications or
systems as defined in Para 2.20.4, should participate in the reporting process by completing the AI/ML reporting form (See Annexure 15).
2.20.6 With effect from quarter ending March 2019, registered Depository
Participants using AI/ML based application or system as defined in Para 2.20.4, are required to fill in the form (Annexure 15) and make submissions on quarterly basis within 15 calendar days of the expiry of the quarter.
2.20.7 Depositories have to consolidate and compile a report, on AI/ML
applications and systems reported by registered Depository Participants in

the reporting format (Annexure 16) on quarterly basis. The said report (Annexure 16) shall be submitted in soft copy only at AI_DEP@sebi.gov.in (for Depositories) to SEBI within 30 calendar days of the expiry of the quarter, starting from quarter ending March 2019.
2.21 Flashing a link to SCOREs on the dashboard of Demat Accounts111
2.21.1 A study was conducted under aegis of Quality Council of India (QCI) to
understand some of the root causes of grievances / complaints on securities market related issues lodged on Centralised Public Grievance Redressal and Monitoring System (CPGRAMS) portal and the measures suggested to address the issues included providing a link to SCORES portal within Demat/Trading Account Dashboard of the Clients/ investors to make it easier to lodge grievances.
2.21.2 The suggestion has been examined and it has been decided to implement the same.
Accordingly, depositories are advised to issue necessary directions to depository participants to ensure that the Demat Account Dashboard of clients/investors provides a link to SCORES portal.
2.22 Displaying of information regarding SEBI Complaint Redress System (SCORES) in the
website112
2.22.1 SEBI has commenced processing of complaints through SCORES since June, 2011.
2.22.2 With a view to make the complaint redressal mechanism through SCORES more
efficient, all Depository Participants are directed to display the following information on their websites:
Filing complaints on SCORES – Easy & quick a.Register on SCORES portal b.Mandatory details for filing complaints on SCORES:
i. Name, PAN, Address, Mobile Number, Email ID
c. Benefits:
i. Effective communication
ii. Speedy redressal of the grievances
2.22.3 Further, all the Depository Participants to include procedure for filing of
complaints on SCORES and benefits for the same in the welcome kit to be given to the investors at the time of their registration with them.
2.22.4 The Depositories are advised to bring the contents to the notice of Depository
Participants for necessary action.

111 Reference: SEBI Letter MIRSD2/DB/AEA/OW/2018/7292 dated March 07, 2018 112 Reference: SEBI Letter SEBI/MIRSD/16742/2019 dated July 03, 2019

2.23 Block Mechanism in demat account of clients undertaking sale transactions113
Kindly refer para titled ‘Block Mechanism in demat account of clients undertaking sale transactions’ of SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2023/71 dated May 17, 2023 (Master circular for Stock Brokers)
2.24 Validation of Instructions for Pay-In of Securities from Client demat account to
Trading Member (TM) Pool Account against obligations received from the Clearing Corporations114 Kindly refer para titled ‘Validation of Instructions for Pay-In of Securities from Client demat account to Trading Member (TM) Pool Account against obligations received from the Clearing Corporations’ of SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD1/P/CIR/2023/71 dated May 17, 2023 (Master circular for Stock Brokers)
2.25 MONITORING AND PERIODICAL REPORTING OF THE COMPLIANCE WITH THE REQUIREMENTS
PERTAINING TO ‘SECURITY AND COVENANT MONITORING’ SYSTEM HOSTED BY DEPOSITORIES115
2.25.1 Depositories shall ensure periodic monitoring regarding compliance with the
requirements of various provisions pertaining to ‘Security & Covenant Monitoring System’ issued by SEBI from time to time, including circular SEBI/HO/DDHSPoD1/P/CIR/2023/109 dated March 31, 2023, and shall also bring to the notice of SEBI, any instances of noncompliance, on a quarterly basis, not later than one month from the end of the quarter, in the format specified as under:
ISIN Stakeholders involved
& their status of compliance
Reference to the provision of the relevant circulars pertaining to noncompliance Reasons/ remarks for such noncompliance Date of compliance / expected date of compliance <Name of the Issuer> <Name of the Debenture Trustee> <Name of the Credit Rating Agency>

113 Reference: SEBI Circular SEBI/HO/MIRSD/DOP/P/CIR/2021/595 dated July 16, 2021, SEBI Circular SEBI/HO/MIRSD/DoP/P/CIR/2022/109 dated August 18, 2022 & SEBI Circular SEBI/HO/MIRSD/DoP/P/CIR/2022/143 dated October 27, 2022 114 Reference: SEBI Circular SEBI/HO/MIRSD/DoP/P/CIR/2022/119 dated September 19, 2022 115 Reference: SEBI Circular SEBI/HO/DDHS/RACPOD1/CIR/P/2023/0002 dated January 05,

2.26 MAINTENANCE of a website by depository participants 116
2.26.1 Considering the advancement in technology and need to provide better services to
the investors, all DPs are mandated to maintain a designated website.
2.26.2 Such website shall mandatorily display the following information, in addition to
all such information, which have been mandated by SEBI/depositories from time to time.
2.26.2.1 Basic details of the DP such as registration number, registered address of
Head Office and branches, if any.
2.26.2.2 Names and contact details such as email ids etc. of all key managerial
personnel (KMPs) including compliance officer.
2.26.2.3 Step-by-step procedures for opening an account, filing a complaint on a
designated email id, and finding out the status of the complaint, etc.
2.26.2.4 Details of Authorized Persons.
2.26.3 Any modification in the URL to the website of a DP shall be reported to the
depositories within 3 days of such change.
2.27 Advisory for SEBI Regulated Entities (REs) regarding Cybersecurity best practices117
2.27.1 An efficient and effective response to and recovery from a cyber-incident by REs
are essential to limit any related financial stability risks. For ensuring the same, Financial Computer Security Incident Response Team (CSIRT-Fin) has provided important recommendations in its report sent to SEBI. The applicable recommendations, in the form of an advisory, are provided under Para 2.27.4
2.27.2 This advisory should be read in conjunction with the applicable SEBI circulars
(including but not limited to Cybersecurity and Cyber Resilience framework, Annual System Audit framework, etc.) and subsequent updates issued by SEBI from time to time.
2.27.3 The compliance of the advisory shall be provided by the REs along with their
cybersecurity audit report (conducted as per the applicable SEBI Cybersecurity and Cyber Resilience framework). The compliance shall be submitted as per the existing reporting mechanism and frequency of the respective cybersecurity audit.
2.27.4 In view of the increasing cybersecurity threat to the securities market, SEBI
Regulated Entities (REs) are advised to implement the following practices as recommended by CSIRT-Fin:
2.27.4.1 Roles and Responsibilities of Chief Information Security Officer (CISO)/
Designated Officer:

116 Reference: SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2023/30 dated February 15, 2023 117 Reference: SEBI Circular SEBI/HO/ITD/ITD_VAPT/P/CIR/2023/032 dated February 22,

REs are advised to define roles and responsibilities of Chief Information Security Officer (CISO) and other senior personnel. Reporting and compliance requirements shall be clearly specified in the security policy.
2.27.4.2 Measures against Phishing attacks/ websites:
2.27.4.2.1 The REs need to proactively monitor the cyberspace to identify phishing
websites w.r.t. to REs domain and report the same to CSIRT-Fin/CERTIn for taking appropriate action.
2.27.4.2.2 Majority of the infections are primarily introduced via phishing emails,
malicious adverts on websites, and third-party apps and programs. Hence, thoughtfully designed security awareness campaigns that stress the avoidance of clicking on links and attachments in email, can establish an essential pillar of defense. Additionally, the advisories issued by CERT-In/ CSIRT-Fin may be referred for assistance in conducting exercises for public awareness.
2.27.4.3 Patch Management and Vulnerability Assessment and Penetration Testing
(VAPT):
2.27.4.3.1 All operating systems and applications should be updated with the
latest patches on a regular basis. As an interim measure for zero-day vulnerabilities and where patches are not available, virtual patching can be considered for protecting systems and networks. This measure hinders cybercriminals from gaining access to any system through vulnerabilities in end-of-support and end-of-life applications and software. Patches should be sourced only from the authorized sites of the OEM.
2.27.4.3.2 Security audit / Vulnerability Assessment and Penetration Testing
(VAPT) of the application should be conducted at regular basis and in accordance with the Cyber Security and Cyber Resilience circulars of SEBI issued from time to time. The observation/ gaps of VAPT/Security Audit should be resolved as per the timelines prescribed by SEBI.
2.27.4.4 Measures for Data Protection and Data breach:
2.27.4.4.1 REs are advised to prepare detailed incident response plan.
2.27.4.4.2 Enforce effective data protection, backup, and recovery measures.
2.27.4.4.3 Encryption of the data at rest should be implemented to prevent the
attacker from accessing the unencrypted data.
2.27.4.4.4 Identify and classify sensitive and Personally Identifiable Information
(PII) data and apply measures for encrypting such data in transit and at rest.
2.27.4.4.5 Deploy data leakage prevention (DLP) solutions / processes.

2.27.4.5 Log retention:
Strong log retention policy should be implemented as per extant SEBI regulations and required by CERT-In and IT Act 2000. REs are advised to audit that all logs are being collected. Monitoring of all logs of events and incidents to identify unusual patterns and behaviours should be done.
2.27.4.6 Password Policy/ Authentication Mechanisms:
2.27.4.6.1 Strong password policy should be implemented. The policy should
include a clause of periodic review of accounts of ex-employees Passwords should not be reused across multiple accounts or list of passwords should not be stored on the system.
2.27.4.6.2 Enable multi factor authentication (MFA) for all users that connect using
online/internet facility and also particularly for virtual private networks, webmail and accounts that access critical systems.
2.27.4.6.3 Maker and Checker framework should be implemented in strict manner
and MFA should be enabled for all user accounts, especially for user accounts accessing critical applications.
2.27.4.7 Privilege Management:
2.27.4.7.1 Maker-Checker framework should be implemented for modifying the
user's right in internal applications.
2.27.4.7.2 For mitigating the insider threat problem, 'least privilege' approach to
provide security for both on-and off-premises resources (i.e., zero-trust models) should be implemented. Zero Trust is rooted in the principle of "trust nothing, verify everything." This security model requires strict identity verification for each and every resource and device attempting to get access to any information on a private network, regardless of where they are situated, within or outside of a network perimeter.
2.27.4.8 Cybersecurity Controls:
2.27.4.8.1 Deploy web and email filters on the network. Configure these devices to
scan for known bad domains, sources, and addresses, block these before receiving and downloading messages. Scan all emails, attachments, and downloads both on the host and at the mail gateway with a reputable antivirus solution.
2.27.4.8.2 Block the malicious domains/IPs after diligently verifying them without
impacting the operations. CSIRT-Fin/CERT-In advisories which are published periodically should be referred for latest malicious domains/IPs, C&C DNS and links.
2.27.4.8.3 Restrict execution of "powershell" and "wscript" in enterprise
environment, if not required. Ensure installation and use of the latest version of PowerShell, with enhanced logging enabled, script block

logging and transcription enabled. Send the associated logs to a centralized log repository for monitoring and analysis.
2.27.4.8.4 Utilize host based firewall to prevent Remote Procedure Call (RPC) and
Server Message Block (SMB) communication among endpoints whenever possible. This limits lateral movement as well as other attack activities.
2.27.4.8.5 Practice of whitelisting of ports based on business usage at Firewall level
should be implemented rather than blacklisting of certain ports. Traffic on all other ports which have not been whitelisted should be blocked by default.
2.27.4.9 Security of Cloud Services:
2.27.4.9.1 Check public accessibility of all cloud instances in use. Make sure that
no server/bucket is inadvertently leaking data due to inappropriate configurations.
2.27.4.9.2 Ensure proper security of cloud access tokens. The tokens should not be
exposed publicly in website source code, any configuration files etc.
2.27.4.9.3 Implement appropriate security measures for testing, staging and
backup environments hosted on cloud. Ensure that production environment is kept properly segregated from these. Disable/remove older or testing environments if their usage is no longer required.
2.27.4.9.4 Consider employing hybrid data security tools that focus on operating
in a shared responsibility model for cloud-based environments.
2.27.4.10 Implementation of CERT-In/ CSIRT-Fin Advisories:
The advisories issued by CERT-In should be implemented in letter and spirit by the regulated entities. Additionally, the advisories should be implemented promptly as and when received. 2.27.4.11Concentration Risk on Outsourced Agencies:
2.27.4.11.1 It has been observed that single third party vendors are providing
services to multiple REs, which creates concentration risk. Here, such third parties though being small non-financial organizations, if any cyber-attack, happens at such organizations, the same could have systemic implication due to high concentration risk.
2.27.4.11.2 Thus, there is a need for identification of such organizations and
prescribing specific cyber security controls, including audit of their systems and protocols from independent auditors, to mitigate such concentration risk.
2.27.4.11.3 Further, REs also need to take into account this concentration risk while
outsourcing multiple critical services to the same vendor.
2.27.4.12Audit and ISO Certification:

2.27.4.12.1 SEBI’s instructions on external audit of REs by independent auditors
empaneled by CERT-In should be complied with in letter and spirit.
2.27.4.12.2 The REs are also advised to go for ISO certification as the same provides
a reasonable assurance on the preparedness of the RE with respect to cybersecurity.
2.27.4.12.3 Due diligence with respect to audit process and tools used for such audit
needs to be undertaken to ensure competence and effectiveness of audits.
2.28 Combating Financing Of Terrorism (CFT) under Unlawful Activities (Prevention) Act,
1967 – Directions to Stock Exchanges, Depositories and all Registered Intermediaries Kindly refer SEBI Circular SEBI/HO/MIRSD/MIRSD-SEC-5/P/CIR/2023/022 dated February 03, 2023 (Guidelines on Anti-Money Laundering (AML) Standards and Combating the Financing of Terrorism (CFT) /Obligations of Securities Market Intermediaries under the Prevention of Money Laundering Act, 2002 and Rules framed thereunder)
2.29 Framework for Adoption of Cloud Services by SEBI Regulated Entities (REs)
Kindly refer SEBI Circular SEBI/HO/ITD/ITD_VAPT/P/CIR/2023/033 dated March 06, 2023 in respect of Adoption Of Cloud Services By SEBI Regulated Entities for necessary compliance in respect of Depository Participants.
2.30 Cyber Security Operations Center for SEBI registered intermediaries119
2.30.1 Recognizing the need for a robust Cyber Security and Cyber Resilience framework
at Market Infrastructure Institutions (MIIs), i.e. Stock Exchanges, Clearing Corporations and Depositories, SEBI under Para 4.41, has prescribed a detailed regulatory framework on cyber security and cyber resilience.
2.30.2 With the view to further strengthening cyber security in securities market the Cyber
Security and Cyber Resilience framework has been extended to Depository Participants under vide Para 2.17
2.30.3 During the discussions held with the market participants, it was gathered that
compliance with the cyber security guidelines may be onerous for smaller intermediaries because of the lack of knowledge in cyber security and also the cost factor involved in setting up own Security Operations Center (SOC). These intermediaries may utilize the services of Market SOC which is proposed to be set up by MIIs with the objective of providing cyber security solution to such intermediaries. The intermediaries’ membership in Market SOC is nonmandatory.
2.30.4 The particulars of the Market SOC will be as follows:

118 Reference: SEBI Circular SEBI/HO/ITD/ITD_VAPT/P/CIR/2023/033 dated March 06, 2023 119 Reference: SEBI Circular CIR/MRD/CSC/151/2018 dated December 14, 2018

2.30.4.1 The Market SOC shall be set up as a separate entity and MIIs shall have at least
51% stake in the new entity.
2.30.4.2 Intermediaries who do not have capability to set up a SOC on their own can
opt for the Market SOC.
2.30.4.3 The Market SOC should be in accordance with Para 2.17 and should ensure that
participating intermediaries are in compliance to the said circular, should they opt for the market SOC. Market SOC would provide only the technology perspective for the abovementioned cyber security guidelines and the people & process perspectives of cyber security as mandated by the aforementioned circular would still be have to be managed by the intermediaries.
2.30.4.4 The Market SOC should be evolving continuously in order to be able to manage
new security controls and guidelines that may issue by SEBI from time to time.
2.30.4.5 The Market SOC to ensure that intermediaries participating in their SOC
should adhere to the minimum IT guidelines and security protocols all the time.
2.30.4.6 MII will carry out audit of their Market SOC activity annually and submit the
report to SEBI.
2.30.4.7 The Market SOC will issue an audit report as prescribed under Para 2.17, to the
participating intermediary.
2.30.4.8 If an intermediary is subscribed to Market SOC, audit report submitted by
intermediary through the Market SOC would be deemed compliant.
2.30.4.9 Approval for the Market SOC which is to be set up as a separate entity would
be in terms of Regulation 38 of Securities Contracts (Regulation) (Stock Exchanges and Clearing Corporations) Regulations, 2018.

SECTION 3: Issuer Related
3.1 Charges to be paid by Issuers 120
3.1.1 Depositories may levy and collect the charges towards custody from the issuers, on
the basis of average no. of folios (ISIN position) during the previous financial year, as per the details given below:
3.1.1.1 Issuers to pay @ Rs.11.00 (*) per folio (ISIN position) in the respective
depositories, subject to a minimum as mentioned below:

Plus service tax as applicable
3.1.2 The average no. of folios (ISIN positions) for an Issuer may be arrived at by dividing
the total number of folios for the entire financial year by the total number of working days in the said financial year.
3.1.3 Temporary ISIN shall not be considered for the purpose of computing the annual
issuer charges.
If the issuer fails to make the payment, Depositories may charge penal interest subject to a maximum of 12% per annum
3.2 Activation of ISIN in case of IPO and additional issue of shares/ securities
3.2.1 Depositories shall activate the ISINs only on the date of commencement of trading
on the stock exchanges in case of IPOs for both the equity and debt securities.121
3.2.2 Further, in order to curtail the transfer of additional issue of shares/ securities
including by way of further public offerings, rights issue, preferential allotment, bonus issue etc of the listed company, prior to receipt of final listing / trading approval, the depositories shall devise a mechanism so that such new securities

120 Reference: SEBI Circular SEBI/MRD/SE/DEP/Cir-4/2005 dated January 28, 2005, SEBI Circular MRD/DoP/SE/Dep/Cir-2/2009 dated February 10, 2009, SEBI Circular CIR/MRD/ DP/05/2011 dated April 27, 2011 and SEBI Circular CIR/MRD/DP/18/2015 dated December 09, 2015 121 Reference: SEBI Circular SEBI/MRD/DEP/Cir-2/06 dated January 19, 2006 and SEBI Circular CIR/MRD/DP/ 21 /2012 dated August 02, 2012 and DDHS email dated February 20, 2020 Nominal value of admitted securities (Rs.) Annual Custodial Fee payable by an Issuer to each Depository (Rs.)(*) Upto 5 crore 9,000 Above 5 crore and upto 10 crore 22,500 Above 10 crore and upto 20 crore 45,000 Above 20 crore 75,000

created shall be frozen till the time final listing/ trading permission is granted by the exchange.122
3.2.3 In order to achieve the above, the Depositories are advised to allot such additional
shares/securities under a new temporary ISIN which shall be kept frozen. Upon receipt of the final listing/ trading permission from the exchange for such additional shares/ securities, the shares/securities credited in the new temporary ISIN shall be debited and the same would get credited in the pre existing ISIN for the said security. Thereafter, the additional securities shall be available for trading.
3.2.4 The stock exchanges are advised to provide the details to the depositories whenever
final listing / trading permission is given to securities. Further, in case of issuance of equity shares by a company, listed on multiple stock exchanges, the concerned stock exchanges shall synchronize their effective dates of listing / trading approvals and intimate the same to depositories in advance.
3.2.5 In similar lines, depositories are advised to follow similar process as provided above
even in case of units of REITs/InvITs as securities of a listed company.
3.3 Streamlining the Process of Rights Issue123
Kindly refer para titled ‘Streamlining the process of Rights Issue’ of SEBI Circular SEBI/HO/CFD/PoD-2/P/CIR/2023/00094 dated June 21, 2023 (Master Circular for Issue of Capital and Disclosure Requirements)
3.4 Registrar and Share Transfer Agent
3.4.1 Appointment of a single agency for share registry work124
All work related to share registry pertaining in terms of both physical and electronic shares shall be maintained at a single point i.e. either in-house by the company or by a SEBI registered Registrar and Transfer Agent.
3.4.2 Inter-Depository transfers125
In case of inter-Depository transfers of securities, the Registrars shall communicate the confirmation of such transfers within two hours, failing which such transfers shall be deemed to have been confirmed. The Registrars shall not reject interDepository transfers except where
i. A Depository does not have adequate balance of securities in its account or
ii. there is mismatch of transfer requests from the Depositories.
3.4.3 Common Registrars and Share Transfer agents

122 Reference: SEBI Circular CIR/MRD/DP/24/2012 dated September 11, 2012 123 Reference: SEBI Circular SEBI/HO/CFD/DIL2/CIR/P/2020/13 dated January 22, 2020 124 Reference: SEBI Circular D&CC/FITTC/Cir-15/2002 dated December 27, 2002 125 Reference: SEBI Circular SMDRP/Policy/Cir-28/99 dated August 23, 1999 126 Reference: SEBI Circular SMDRP/Policy/Cir-28/99 dated August 23, 1999

Every company shall appoint the same Registrars and Share Transfer agents for both the depositories.
3.4.4 Dematerialisation requests127
3.4.4.1 Registrars and Share Transfer agents shall accept partial dematerialisation
requests and will not reject or return the entire dematerialization request where only a part of the request had to be rejected. In cases where a DP has already sent information about dematerialisation electronically to a Registrar but physical shares have not yet been delivered, the Registrar shall accept the demat request and carry out dematerialization on an indemnity given by the DP and proof of dispatch of document given by DP.
3.4.4.2 The above provision shall be applicable to all the securities like scrips, bonds,
debentures, debenture stock or other marketable securities eligible to be held in dematerialised form in a depository as defined in Regulation 42 of the DP Regulations.
3.5 American Depository Receipts (ADRs)/Global Depository Receipts (GDRs)
3.5.1 Delivery of underlying shares of GDRs/ADRs in dematerialised form128
Underlying shares of GDRs/ADRs shall be compulsorily delivered in dematerialised form. Pursuant to RBI directions in this regard, a non-resident holder of ADRs/GDRs issued by a company registered in India, on surrender of such ADRs/GDRs, can acquire the underlying shares when such shares are released by the Indian Custodian of the ADR/GDR issue. Further, the company whose shares are so released, or a Depository shall enter in the register or books, wherein such securities are registered or inscribed, an address outside India of the non-resident holder of shares.
3.5.2 Tracking of underlying shares of GDRs/ADRs129
To ensure easy tracking of the underlying shares released on conversion of the “depositories receipts” all such shares shall be credited to a separate Depository Receipts (DRs) account of the respective investor. In this regard, Depositories shall ensure that the following information is provided to the domestic custodian holding the underlying shares on a regular basis:
i. Total number of shares at the beginning of the month
ii. Number of shares transferred into the account (credited) during the month
iii. Number of shares transferred out of the account (debited) during the month.
iv. Balance at the end of the month.

127 Reference: SEBI Letter D&CC/ 1099 / 2002 dated November 01, 2002 128 Reference: SEBI Circular SMDRP/Policy/Cir-9/99 dated May 6, 1999 129 Reference: SEBI Circular D&CC/FITTC/Cir-09/2002 dated July 4, 2002 and SEBI Circular D&CC/FITTC/Cir-10/2002 dated September 25, 2002

This service can be availed of only by foreign investors other than the OCBs.
3.6 Framework for issue of Depository Receipts (DRs)130
3.6.1 Reference is drawn to Section 41 of the Companies Act, 2013, Companies (Issue of
Global Depository Receipts) Rules, 2014 (‘GDR Rules’), the Depository Receipts Scheme, 2014 (‘DR Scheme’), Reserve Bank of India (‘RBI’) notification dated December 15, 2014, Central Government notification dated September 18, 2019 and Central Government notification dated October 07, 2019.
3.6.2 Only ‘a company incorporated in India and listed on a Recognized Stock Exchange
in India’ (‘Listed Company’) may issue Permissible Securities or their holders may transfer Permissible Securities, for the purpose of issue of DR, subject to compliance with the following requirements:
Eligibility
3.6.2.1 Listed Company is in compliance with the requirements prescribed under LODR
Regulations and any amendments thereof.
3.6.2.2 Listed company shall be eligible to issue Permissible Securities, for the purpose
of issue of DRs, if:
3.6.2.2.1 the Listed Company, any of its promoters, promoter group or directors or
selling shareholders are not debarred from accessing the capital market by SEBI;
3.6.2.2.2 any of the promoters or directors of the Listed Company is a promoter or
director of any other company which is not debarred from accessing the capital market by SEBI;
3.6.2.2.3 the listed company or any of its promoters or directors is not a wilful
defaulter;
3.6.2.2.4 any of its promoters or directors is not a fugitive economic offender.
3.6.2.3 Existing holders shall be eligible to transfer Permissible Securities, for the
purpose of issue of DRs, if:
3.6.2.3.1 the Listed Company or the holder transferring Permissible Securities are
not debarred from accessing the capital market by SEBI;
3.6.2.3.2 the Listed Company or the holder transferring Permissible Securities is not
a wilful defaulter;
3.6.2.3.3 the holder transferring Permissible Securities or any of the promoters or
directors of the Listed Company are not a fugitive economic offender. Explanation 1: The restrictions at Para 3.6.2.2 and Para 3.6.2.3 above shall not apply to the persons or entities mentioned therein, who were debarred in the

130 Reference: SEBI Circular SEBI/HO/MRD/DOP1/CIR/P/2019/106 dated October 10, 2019, and SEBI Circular SEBI/HO/MRD/DCAP/CIR/P/2020/190 dated October 01, 2020

past by SEBI and the period of debarment is already over as on the date of filing of the document as referred at Para 3.6.2.13 Explanation 2: DR means a foreign currency denominated instrument, listed on an international exchange, issued by a foreign depository in a permissible jurisdiction on the back of permissible securities issued or transferred to a domestic custodian and includes ‘global depository receipt’ as defined in section 2(44) of the Companies Act, 2013. Explanation 3: ‘Foreign Depository’ means a person which:
a) is not prohibited from acquiring permissible securities; b) is regulated in any of the Permissible Jurisdiction as defined here; and c) has legal capacity to issue DRs in the Permissible Jurisdiction where issue of DRs is proposed. Explanation 4: ‘transfer of permissible securities by existing holders’ means deposit of existing Permissible Securities of the Listed Company with a Domestic Custodian, for the purpose of issue of DRs, pursuant to formal agreement(s) among the Listed Company and the Foreign Depository. For this purpose, the Listed Company may also enter into arrangement(s) with, Indian Depository, Domestic Custodian and existing Permissible Securities holder(s), as may be necessary.
3.6.2.4 For the purpose of an initial issue and listing of DRs, pursuant to ‘transfer by
existing holders’, the Listed Company shall provide an opportunity to its equity shareholders to tender their shares for participation in such listing of DRs.
3.6.2.5 Subsequent issue and listing of DRs, pursuant to ‘transfer by existing
shareholders’ may take place subject to the limits approved pursuant to a special resolution in terms of GDR Rules.
3.6.2.6 A company proposing to make a public offer and list on a Recognized Stock
Exchange, and also simultaneously proposing to issue Permissible Securities or transfer Permissible Securities of existing holders, for the purpose of issue of DRs and listing such DRs on an International Exchange, may seek in-principle and final approval from Recognized Stock Exchange as well as International Exchange. However, such issue or transfer of Permissible Securities for the purpose of issue of DRs shall be subsequent to, the receipt of trading approval from the Recognized Stock Exchange for the public offer. Permissible Jurisdictions and International Exchanges
3.6.2.7 Listed Company shall be permitted to issue Permissible Securities or transfer
Permissible Securities of existing holders, for the purpose of issue of DRs, only

in Permissible Jurisdictions and said DRs shall be listed on any of the specified International Exchange(s) of the Permissible Jurisdiction. Explanation 1: ‘Permissible Jurisdiction’ shall mean jurisdictions as may be notified by the Central Government from time to time, pursuant to notification no. G.S.R. 669(E) dated September 18, 2019 in respect of sub-rule 1 of rule 9 of Prevention of Money-Laundering (Maintenance of Records) Rules, 2005. Explanation 2: ‘International Exchange(s)’ shall mean exchange(s) as may be notified by SEBI from time to time. Note131: The Central Government vide notification dated November 28, 2019, notified the list of Permissible Jurisdictions in pursuance of notification dated September 18, 2019. Accordingly, a list of Permissible Jurisdictions and International Exchange(s) is placed below:
List of Permissible Jurisdictions and International Exchanges

United States of America - NASDAQ, NYSE
Japan - Tokyo Stock Exchange
South Korea - Korea Exchange Inc.
United Kingdom excluding British Overseas Territories- London Stock
Exchange
France - Euronext Paris
Germany - Frankfurt Stock Exchange
Canada - Toronto Stock Exchange
International Financial Services Centre in India - India International
Exchange, NSE International Exchange
3.6.2.8 Listing of DRs on specified International Exchange shall meet the highest
applicable level / standards for such listing by foreign issuers. Explanation: Examples of DR listing programs that would qualify for the aforesaid criteria:
Issuer-sponsored Level III ADR programs listed on Nasdaq or the NYSE, DRs listed on the Main Board of the Hong Kong Stock Exchange, Global Depositary Receipts admitted to the Standard Segment of the Official List of the FCA and to trading on the London Stock Exchange. Obligations of Listed Company
3.6.2.9 Listed Company shall ensure compliance with extant laws relating to issuance
of DRs, including, requirements prescribed here, the Companies Act, 2013, the Foreign Exchange Management Act, 1999 (‘FEMA’), Prevention of MoneyLaundering Act, 2002, and rules and regulations made thereunder. For this

131 Reference: SEBI Circular SEBI/HO/MRD2/DCAP/CIR/P/2019/146 dated November 28, 2019

purpose, Listed Company may also enter into necessary arrangements with Custodian, Indian Depository and Foreign Depository.
3.6.2.10 Listed Company shall ensure that DRs are issued only with Permissible
Securities as the underlying.
Explanation: ‘Permissible Securities’ shall mean equity shares and debt securities, which are in dematerialized form and rank pari passu with the securities issued and listed on a Recognized Stock Exchange.
3.6.2.11 Listed Company shall ensure that the aggregate of Permissible Securities which
may be issued or transferred for the purpose of issue of DRs, along with Permissible Securities already held by persons resident outside India, shall not exceed the limit on foreign holding of such Permissible Securities under the applicable regulations of FEMA:
Provided that within the above limit, the maximum of aggregate of Permissible Securities which may be issued by the Listed Company or transferred by the existing holders, for the purpose of issue of DRs, shall be such that the Listed Company is able to ensure compliance with the minimum public shareholding requirement, after excluding the Permissible Securities held by the depository for the purpose of issue of DRs.
3.6.2.12 Listed Company shall ensure that the agreement entered with the Foreign
Depository, for the purpose of issue of DRs, provides that the Permissible holder, including its Beneficial Owner(s), shall ensure compliance with holding limits prescribed under Para 3.6.2.19 A. The onus of identification of NRIs holders, who are issued DRs in terms employee benefit scheme, would lie with the listed company. The listed company shall provide the information of such NRI DR holders to the designated depository for the purpose of monitoring of limits132
3.6.2.13 Listed Company shall, through an intermediary, file with SEBI and the
Recognized Stock Exchange(s), a copy of the initial document, by whatever name called, for initial issue of DRs issued on the back of Permissible Securities.
3.6.2.13.1 SEBI shall endeavor to forward its comments, if any, to the Recognized
Stock Exchange(s) within a period of 7 working days from the receipt of the document and in the event of no comments being issued by SEBI within such period, it shall be deemed that SEBI does not have comments to offer.
3.6.2.13.2 Recognized Stock Exchange(s) shall take into consideration the comments
of SEBI while granting in-principle approval to the Listed Company and decide on the approval within 15 working days of receipt of application and required documents.

132 Reference: SEBI Circular SEBI/HO/MRD2/DCAP/CIR/P/2020/243 dated December 18, 2020

Further, final document for such initial issue shall be filed with Recognized Stock Exchange(s) and SEBI for record purpose.
3.6.2.14 Listed Company shall ensure that any public disclosures made by the Listed
Company on International Exchange(s) in compliance with the requirements of the Permissible Jurisdiction where the DRs are listed or of the International Exchange(s), are also filed with the Recognized Stock Exchange as soon as reasonably possible but not later than twenty-four hours from the date of filing. Permissible holder 133
3.6.2.15 Permissible holder means a holder of DR, including its Beneficial Owner(s),
satisfying the following conditions:
a. who is not a person resident in India; b. who is not a Non-Resident Indian (NRI) Provided that the restriction under this Clause shall not apply in case of issue of DRs to NRIs, pursuant to share based employee benefit schemes which are implemented by a company in terms of SEBI (Share Based Employee Benefits) Regulations 2014; Provided further that the restriction under this Clause shall also not apply in case of issue of DRs by the company to NRIs pursuant to a bonus issue or a rights issue; Explanation 1: For the purpose of this Circular, ‘Beneficial Owner’ shall have the same meaning as provided in proviso to sub-rule 1 of rule 9 of Prevention of Money Laundering (Maintenance of Records) Rules, 2005, as amended by the Central Government vide notification no.G.S.R.669(E) dated September 18, 2019. Explanation 2: The Permissible holder, including its Beneficial Owner(s), shall be responsible for ensuring compliance with this requirement. Explanation 3: Except as permitted under the provisos above, NRIs shall neither subscribe to any further issue of DRs nor make any further acquisition of DRs (including of DRs issued prior to October 10, 2019). Voting rights
3.6.2.16 Listed Company shall ensure that the agreement entered between the holder of
DRs, the Listed Company and the Depository provides that the voting rights on Permissible Securities, if any, shall be exercised by the DR holder through the Foreign Depository pursuant to voting instruction only from such DR holder.

133 Reference: SEBI Circular SEBI/HO/MRD2/DCAP/CIR/P/2020/243 dated December 18, 2020

Pricing
3.6.2.17 In case of a simultaneous listing of, Permissible Securities on Recognised Stock
Exchange(s) pursuant to a public offer / preferential allotment / qualified institutions placement under ICDR Regulations, and DRs on the International Exchange, the price of issue or transfer of Permissible Securities, for the purpose of issue of DRs by Foreign Depository, shall not be less than the price for the public offer / preferential allotment / qualified institutions placement to domestic investors under the applicable laws.
3.6.2.18 Where Permissible Securities are issued by a Listed Company or ‘transferred by
the existing holders’, for the purpose of issue of DRs by the Foreign Depository, the same shall be issued at a price, not less than the price applicable to a corresponding mode of issue of such Permissible Securities to domestic investors under the applicable laws. Obligations of Indian Depository, Foreign Depository and Domestic Custodian
3.6.2.19 Indian Depositories, in consultation with each other, shall develop a system to
ensure that aggregate holding of DR holders along with their holding, if any, through offshore derivative instruments and holding as a Foreign Portfolio Investor belonging to same investor group shall not exceed the limit on foreign holding under the FEMA and applicable SEBI Regulations. For this purpose, Indian Depositories shall have necessary arrangement with the Domestic Custodian and / or Foreign Depository. Explanation- For the purposes of above para, the term ‘investor group’ shall have the meaning as prescribed to such term in the Securities and Exchange Board of India (Foreign Portfolio Investors) Regulations, 2019 or amendments thereof. The Broad operational guidelines for the above purpose are given under
3.6.3.19.1 to 3.6.3.19.6.
Indian Depositories, in consultation with each other and market participants, may prescribe the formats and other details, as may be necessary to operationalize the same. Broad Operational Guidelines
3.6.2.19.1 Listed Company shall appoint one of the Indian Depository as the
Designated Depository for the purpose of monitoring of limits in respect of Depository Receipts.
3.6.2.19.2 The Designated Depository in co-ordination with Domestic Custodian,
other Depository and Foreign Depository (if required) shall compute, monitor and disseminate the Depository Receipts (DRs) information as prescribed in the framework. The said information shall be disseminated on website of both the Indian Depositories. For this purpose, the

Designated Depository shall act as a Lead Depository and the other depository shall act as a Feed Depository.
3.6.2.19.3 Domestic Custodian shall:
3.6.2.19.3.1 Provide one-time details of DRs in the format and manner as may be
prescribed by the Indian Depositories.
3.6.2.19.3.2 Provide the requisite information as may be prescribed by Designated
Depository for the purpose of computation of information in respect of Depository Receipts as and when requested.
3.6.2.19.3.3 Ensure that the underlying permissible securities, pertaining to a
listed company, against which DRs are issued in the Permissible Jurisdiction, are held in a demat account, under a separate Type & Sub-Type as prescribed by the Indian Depositories for the purpose of issue of DRs.
3.6.2.19.3.4 Provide certificate / declaration / information, to the Designated
Depository in the prescribed format upon termination/cancellation of DR program. For this, the issuer or Foreign Depository shall be required to report such termination / cancellation to the Domestic Custodian.
3.6.2.19.4 Procedure for the purpose of monitoring of limits
3.6.2.19.4.1 The Designated Depository shall forward the list of such companies
(ISINs) for which it will be monitoring the DR issuance to Feed Depository. For any addition or deletion of ISINs, the Designated Depository shall communicate to the Feed Depository regarding the same through Incremental information sent on a periodic basis.
3.6.2.19.4.2 Feed Depository shall provide the ISIN wise demat holdings of
investors tagged with separate sub-type to the Designated Depository on a daily basis.
3.6.2.19.4.3 The Designated Depository shall ascertain the details of holdings
pertaining to Foreign Depository lying under demat account(s) tagged under such separate Type & Sub-Type as well as other investors with ‘DR’ sub type held at both depositories and consolidate such holdings to arrive at the outstanding Permissible Securities against which the DRs are outstanding.
3.6.2.19.4.4 Calculation of headroom i.e. ‘the limit up to which Permissible
Securities can be converted to DRs’, may be undertaken in the following manner:
Particulars
(A) Number of DRs originally issued including corporate action

(B) Outstanding Permissible Securities against which the DRs are outstanding (C) Re-issuance approval granted by Domestic Custodian (unutilized) at End of Day Headroom = A – (B + C) the limit up to which Permissible Securities can be converted to DRs
3.6.2.19.4.5 The Indian Depositories shall exchange with each other their
respective list of companies, for dissemination of DR headroom related information, which shall be consolidated by both depositories and thereafter published on their respective websites.
3.6.2.19.5 Re-issuance mechanism
3.6.2.19.5.1 For the purpose of re-issuance of permissible securities, a Foreign
Investor shall request SEBI registered Broker with requisite quantity of securities (based on available headroom) required for re-issuance of depository receipts which shall be forwarded to the Domestic Custodian.
3.6.2.19.5.2 Based on last available headroom disseminated by Designated
Depository, the Domestic Custodian shall grant approval (T- day where T is date of approval granted by Domestic Custodian) to such request received from SEBI registered Broker for re-issuance purpose which shall be valid for a period of 3 trading days (T+3) from the date of approval of request granted by Domestic Custodian.
3.6.2.19.5.3 The Domestic Custodian shall report such request approvals along
with requisite quantity granted to Designated Depository on same day (i.e. T day) and based on which the Designated Depository shall block the quantity for the purpose of calculation of Headroom.
3.6.2.19.5.4 The Domestic Custodian shall report the status of utilisation of such
approved request to the Designated Depository upon receipt of securities in the demat account of Foreign Depository for the purpose of calculation of Headroom. The domestic custodian shall report the final utilisation status of such approved request with respect to receipt of securities on D+1 basis (where D is a date of credit of security in the Foreign Depository’s account) before such time as may be prescribed by Designated Depository. In case of non-receipt of securities within the specified timeline, Custodian shall unblock the requisite quantity of approval granted and report the same to Designated Depository.
3.6.2.19.6 Monitoring of Investor group limits

3.6.2.19.6.1 FPI shall report the details of all such FPIs forming part of the same
investor group as well as Offshore Derivative Instruments (ODI) subscribers and/or DR holders having common ownership, directly or indirectly, of more than fifty percent or on the basis of common control, to its Designated Depository Participant (DDP). The investor group may appoint one such FPI to act as a Nodal entity for reporting the aforesaid grouping information to its DDP in the format enclosed at Annexure 17. Further, such Nodal FPI shall report the investment holding in the underlying Indian security as held by ODI subscriber and / or as DR holder, including securities held in the Depository Receipt account upon conversion (‘DR conversion’ account), to its Domestic Custodian on a monthly basis (by the 10th of every month) in the format enclosed at Annexure 18. Similarly, the FPIs who do not belong to the same investor group shall report such investment holding details in the underlying Indian security as ODI subscriber and / or as DR holder, including securities held in the ‘DR conversion’ account, to its Custodian in the aforesaid format on a monthly basis (by 10th of the month).
3.6.2.19.6.2 The DDP shall report FPI grouping information as reported by Nodal
FPI to such Indian Depository (by 17th of the month) where FPI group demat accounts are held in the manner and format as specified by such Indian Depository. Similarly, the Custodian of Nodal entity (who also happen to be the DDP) shall report the investment holdings in the underlying Indian security as held by the ODI subscriber and / or DR holder in respect of the aforesaid FPI group on monthly basis to such Indian Depository (by 17th of the month) where FPI group demat accounts are held in the manner and format as specified by such Indian Depository.
3.6.2.19.6.3 The Depository which monitors the FPI group limits shall club the
investment pertaining to DR holding, ODI holding and FPI holding of same investor group and monitor the investment limits as applicable to FPI group in a Listed Indian company on a monthly basis. However, in respect of FPIs which do not belong to the same investor group, responsibility of monitoring the investment limits of FPI shall be with the respective DDP / Custodian. The Custodian of such FPIs not forming part of investor group shall club the investment as held by FPIs as well as investment as held by such FPI in the capacity of ODI subscriber and / or DR holder and monitor the investment limits as applicable to single FPI. In case where the

investment holding breaches the prescribed limits, the Indian Depository / Custodian, as the case may be, shall advise the concerned investor / investor group, to divest the excess holding within 5 trading days similar to requirement prescribed under SEBI Circular dated November 05, 2019 on ‘Operational Guidelines for FPIs & DDPs under SEBI (Foreign Portfolio Investors), Regulations 2019 and for Eligible Foreign Investors.
3.6.2.20 Domestic Custodian shall maintain records in respect of, and report to, Indian
depositories all transactions in the nature of issue and cancellation of depository receipts, for the purpose of monitoring limits.
3.6.2.21 Indian Depositories shall coordinate among themselves and with Domestic
Custodian to disseminate:
(a) the outstanding Permissible Securities against which the DRs are outstanding; and, (b) the limit up to which Permissible Securities can be converted to DRs.
3.6.2.22 The Foreign Depository shall not issue or pre-release the DRs unless the
Domestic Custodian has confirmed the receipt of underlying Permissible Securities.
3.6.3 Words and expressions used and not defined here but defined in the DR Scheme,
Securities Contracts (Regulation) Act, 1956 or the Securities and Exchange Board of India Act, 1992 or the Depositories Act, 1996 or the Companies Act, 2013 or the Reserve Bank of India Act, 1934 or the Foreign Exchange Management Act, 1999 or Prevention of Money-Laundering Act, 2002, and rules and regulations made thereunder shall have the meanings respectively assigned to them, as the case may be, in those Acts, unless the context requires otherwise. Power to remove difficulties
3.6.4 In case of any difficulties in the application or interpretation or to relax strict
enforcement of the aforesaid requirements, the Board may issue clarifications through guidance notes or circulars after receipt of request from the issuer.
3.6.5 The above provisions shall be applicable only to DR issuance by a Listed Company
after the effective date i.e. October 10, 2019.
3.7 Redemption of Indian Depository Receipts (IDRs) into Underlying Equity Shares134
Kindly refer para titled ‘Disclosure norms for Indian Depository Receipts’ of SEBI Circular SEBI/HO/CFD/PoD2/CIR/P/2023/120 dated July 11, 2023 (Master circular for compliance with the provisions of the Securities and Exchange Board of India

134 Reference: SEBI Circular CIR/CFD/DIL/10/2012 dated August 28, 2012 & SEBI Circular CIR/CFD/DIL/6/2013 dated March 01, 2013

(Listing Obligations and Disclosure Requirements) Regulations, 2015 by listed entities)
3.8 Electronic Clearing System (ECS) facility
3.8.1 Use of ECS for refund in public/rights issues.135
For locations where facility of refund through ECS is available details of applicants shall be taken directly from the database of the depositories in respect of issues made completely in dematerialised form. Accordingly, DPs shall maintain and update on real time basis the MICR (Magnetic Ink Character Recognition) code of Bank branch of BOs and other bank details of the applicants in the database of depositories. This is to ensure that the refunds through ECS are made in a smooth manner and that there are no failed/wrong credits.
3.8.2 Updation of bank accounts details, MICR code and IFSC of bank branches by
Depository Participants (DPs)136
3.8.2.1 It has been informed by RBI that they have been receiving complaints from
managers to the issues that the funds routed through the electronic mode are getting returned by destination banks because of incorrect or old account numbers provided by beneficiary account holders.
3.8.2.2 RBI has stated that Investors will have to ensure through their DPs that
bank account particulars are updated in master record periodically, to ensure that their refunds, dividend payments etc. reach the correct account, without loss of time. RBI has also suggested incorporation of Indian Financial System Code (IFSC) of customer's bank branches apart from 9 digit MICR code; since IFSC of bank's branches is used for remittance through National Electronic Funds Transfer (NEFT).
3.8.2.3 It is advised that necessary action be taken in this matter to ensure that correct
account particulars of investors are available in the database of depositories.
3.9 Withdrawal by issuers from the depository137
3.9.1 As regards voluntary withdrawal by issuers from the depository, it is informed
that listed companies may not be allowed to withdraw from the depository system unless they delist their securities from the stock exchanges.
3.9.2 As regards companies under liquidation are concerned, it is informed that
deactivation of the ISIN may be only done in cases where companies have been liquidated. In other cases, where companies are being liquidated, deactivation of

135 Reference: SEBI Circular SEBI/MRD/DEP/Cir-3/06 dated February 21, 2006 & SEBI Circular SEBI/CFD/DIL/DIP/29/2008/01/02 dated February 1, 2008 136 Reference: SEBI Letter MRD/DEP/PP/123624 /2008 dated April 23, 2008 137 Reference: SEBI Letter MRD/DoP/NSDL/VM/ 162378 /2009 dated May 06, 2009

ISIN resulting in total freezing may not be desirable as it will disallow investors to hold shares in dematerialized form
3.10 Further issue of shares under Section 43 of Companies Act and the Companies (Share
Capital and Debentures) Rules, 2014138
In all cases of shares issued by companies under Section 43(a) (ii) of Companies Act 2013 and the Companies (Share Capital and Debentures) Rules, 2014, separate ISIN may be allotted to differentiate such shares from ordinary shares.
3.11 Redressal of investor grievances through SCORES platform139
Kindly refer SEBI Circular SEBI/HO/OIAE/IGRD/P/CIR/202 dated November 07, 2022 in respect of Master Circular on the redressal of investor grievances through the SEBI Complaints Redress System (SCORES) platform.
3.12 Streamlining issuance of SCORES Authentication for SEBI registered
intermediaries140
Kindly refer para titled ‘SCORES Authentication for intermediaries and MIIs’ of SEBI Circular SEBI/HO/OIAE/IGRD/P/CIR/202 dated November 07, 2022 (Master Circular on the redressal of investor grievances through the SEBI Complaints Redress System (SCORES) platform)
3.13 Clarification on applicability of regulation 40(1) of SEBI (Listing Obligations and
Disclosure Requirements) Regulations, 2015 to open offers, buybacks and delisting of securities of listed entities141 Kindly refer para titled ‘Tendering by shareholders holding securities in physical form’ of SEBI Circular SEBI/HO/CFD/PoD-1/P/CIR/2023/31 dated February 16, 2023 (Master Circular for Substantial Acquisition of Shares and Takeovers)
3.14 Streamlining the Process for Acquisition of Shares pursuant to Tender-Offers made
for Takeovers, Buy Back and Delisting of Securities142 Kindly refer para titled ‘Procedure for tendering of shares and settlement through stock exchange’ of SEBI Circular SEBI/HO/CFD/PoD-1/P/CIR/2023/31 dated February 16, 2023 (Master Circular for Substantial Acquisition of Shares and Takeovers)
3.15 Non-compliance with the Minimum Public Shareholding (MPS) requirements143

138 Reference: SEBI Letter MRD/DoP/MC/141442 /2008 dated October 17, 2008 139 Reference: SEBI Circular CIR/OIAE/1/2014 dated December 18, 2014 140 Reference: SEBI Circular SEBI/HO/OIAE/IGRD/CIR/P/2019/86 dated August 02, 2019 141 Reference: SEBI Circular SEBI/HO/CFD/CMD1/CIR/P/2020/144 dated July 31, 2020 142 Reference: SEBI Circular CFD/DCR2/CIR/P/2016/131 dated December 09, 2016 143 Reference: SEBI Circular CFD/CMD/CIR/P/2017/115 dated October 10, 2017

Kindly refer para titled ‘Non-compliance with the Minimum Public Shareholding requirements’ of SEBI Circular SEBI/HO/CFD/PoD2/CIR/P/2023/120 dated July 11, 2023 (Master circular for compliance with the provisions of the Securities and Exchange Board of India (Listing Obligations and Disclosure Requirements) Regulations, 2015 by listed entities)
3.16 Non-compliance with certain provisions of the SEBI (Listing Obligations and
Disclosure Requirements) Regulations, 2015 and the Standard Operating Procedure for suspension and revocation of trading of specified securities144 Kindly refer para titled ‘Non-compliance with certain provisions of the LODR Regulations and the Standard Operating Procedure for suspension and revocation of trading of specified securities’ of SEBI Circular SEBI/HO/CFD/PoD2/CIR/P/2023/120 dated July 11, 2023 (Master Circular for compliance with the provisions of the Securities and Exchange Board of India (Listing Obligations and Disclosure Requirements) Regulations, 2015 by listed entities)
3.17 Investor grievances redressal mechanism – Handling of SCORES complaints by stock
exchanges and Standard Operating Procedure for non-redressal of grievances by listed companies145 Kindly refer para titled ‘Handling of complaints by stock exchanges against certain listed companies’, ‘Action for failure to redress investor complaints by such listed companies’ & ‘Action after redressal of investor grievance by such listed companies’ of SEBI Circular SEBI/HO/OIAE/IGRD/P/CIR/202 dated November 07, 2022 (Master Circular on the redressal of investor grievances through the SEBI Complaints Redress System (SCORES) platform)
3.18 Automation of Continual Disclosures under Regulation 7(2) of SEBI (Prohibition of
Insider Trading) Regulations, 2015 - System driven disclosures146 Kindly refer para titled ‘Automation of Continual Disclosures under Regulation 7(2) of SEBI (Prohibition of Insider Trading) Regulations, 2015 -System driven disclosures’ of SEBI Circular SEBI/HO/ISD/ISD-PoD-2/P/CIR/2023/039 dated March 23, 2023 (Master Circular on Surveillance of Securities Market)
3.19 A Trading Window closure period under Clause 4 of Schedule B read with Regulation
9 of SEBI (Prohibition of Insider Trading) Regulations, 2015 (“PIT Regulations”) –

144 Reference: SEBI Circular SEBI/HO/CFD/CMD/CIR/P/2020/12 dated January 22, 2020 145 Reference: SEBI Circular SEBI/HO/OIAE/IGRD/CIR/P/2020/152 dated August 13, 2020 146 Reference: SEBI Circular SEBI/HO/ISD/ISD/CIR/P/2020/168 dated September 09, 2020 & SEBI Circular SEBI/HO/ISD/ISD/CIR/P/2021/578 dated June 16, 2021

Framework for restricting trading by Designated Persons (“DPs”) by freezing PAN at security level147 Kindly refer para titled ‘Trading Window closure period under Clause 4 of Schedule B read with Regulation 9 of PIT Regulations-Framework for restricting trading by Designated Persons (“DPs”) by freezing Permanent Account Number (PAN) at security level’ of SEBI Circular SEBI/HO/ISD/ISD-PoD-2/P/CIR/2023/039 dated March 23, 2023 (Master Circular on Surveillance of Securities Market)
3.20 Reconciliation of Share Capital Audit148
3.20.1 All the issuer companies shall subject themselves to a reconciliation of share capital
audit to be undertaken by a qualified Chartered Accountant or a Company Secretary, for the purposes of reconciliation of the total admitted capital with both the depositories and the total issued and listed capital. The audit shall cover the following aspects and certify among others:
3.20.1.1That the total of the shares held in NSDL, CDSL and in the physical form tally with the issued / paid-up capital. 3.20.1.2That the Register of Members (RoM) is updated. 3.20.1.3That the dematerialisation requests have been confirmed within 21 days and state the shares pending confirmation for more than 21 days from the date of requests and reasons for delay. 3.20.1.4The details of changes in share capital (due to rights, bonus, preferential issue, IPO, buyback, capital reduction, amalgamation, de-merger etc) during the quarter and certify in case of listed companies whether in-principle approval for listing from all stock exchanges was obtained in respect of all further issues.
3.20.2 The issuer companies shall submit the audit report on a quarterly basis within 30
days of the end of each quarter to the stock exchange/s where they are listed. Any difference observed in the admitted, issued and listed capital shall be immediately brought to the notice of SEBI and both the Depositories by the stock exchanges. This report shall also be placed before the Board of Directors of the issuer company.
3.20.3 Any non-compliance by the issuer company shall be viewed seriously and suitable
action shall be initiated under the Depositories Act, 1996 against the issuer company and its Directors.
3.21 Streamlining the Process of Public Issue of Equity Shares and convertibles149
3.21.1 Kindly refer SEBI Circular SEBI/HO/CFD/PoD-2/P/CIR/2023/00094 dated June
21, 2023 (Master Circular for Issue of Capital and Disclosure Requirements)

147 Reference: SEBI Circular SEBI/HO/ISD/ISD-SEC-4/P/CIR/2022/107 dated August 05, 2022 148 Reference: SEBI Circular D&CC/FITTC/CIR – 16/2002 dated December 31, 2002 and SEBI Circular CIR/MRD/DP/30/2010 dated September 06, 2010) 149 Reference: SEBI Circular SEBI/HO/CFD/DIL2/CIR/P/2018/138 dated November 01, 2018

3.21.2 Further the role of depositories in respect to the Process of Public Issue of Equity
Shares and convertibles is as follows:
3.21.2.1 Validation by Depositories
3.21.2.1.1 The details of investor viz. PAN, DP ID / Client ID, entered in the Stock
Exchange platform at the time of bidding, shall be validated by the Stock Exchange/s with the Depositories on real time basis.
3.21.2.1.2 Stock Exchanges and Depositories shall put in place necessary
infrastructure for this purpose.

SECTION-4: Depositories Related
4.1 Online Registration Mechanism and Filing system for Depositories150
4.1.1 In order to ease the process of application for recognition / renewal, reporting and
other filings in terms of Securities and Exchange Board of India (Depositories and Participants) Regulations, 2018 and other circulars issued from time to time, SEBI has introduced a digital platform for online filings related to Depositories.
4.1.2 All applicants desirous of seeking registration as a Depository in terms of
Regulation 3 of the Securities and Exchange Board of India (Depositories and Participants) Regulations, 2018, shall now submit their applications online, through SEBI Intermediary Portal at https://siportal.sebi.gov.in.
4.1.3 The applicants would be required to upload scanned copy of relevant documents
such as any declaration or undertaking or notarised copy of documents as may be prescribed in Securities and Exchange Board of India (Depositories and Participants) Regulations 2018, and keep hard copy of the same to be furnished to SEBI whenever required.
4.1.4 Further, all other filings including Annual Financial Statements and Returns,
Monthly Development Report, Rules, Bye-laws, etc.,shall also be submitted online.
4.1.5 The aforesaid online registration and filing system for Depositories is operational.
Recognised Depositories are advised to note the same for immediate compliance.
4.1.6 Link for SEBI Intermediary Portal is also available on SEBI website –
www.sebi.gov.in. In case of any queries and clarifications, users may refer to the manual provided in the portal or contact the SEBI Portal helpline on 022-26449364 or may write at portalhelp@sebi.gov.in.
4.2 Activity schedule for depositories for T+2 rolling Settlement151- As on date, the activity
schedule for settlement is as per SEBI circular SEBI Circular
SEBI/HO/MRD2/DCAP/P/CIR/2021/628 dated September 07, 2021 (i.e. T+1) . The activity
schedule for T+2 settlement is mentioned under Para 4.83.
4.3 Introduction of T+1 rolling settlement on an optional basis 152
4.3.1 SEBI, vide circular no. SMD/POLICY/Cir - /03 dated February 6, 2003, shortened
the settlement cycle from T+3 rolling settlement to T+2 w.e.f. April 01, 2003.
4.3.2 SEBI has been receiving request from various stakeholders to further shorten the
settlement cycle. Based on discussions with Market Infrastructure Institutions (Stock Exchanges, Clearing Corporations and Depositories), it has been decided to provide flexibility to Stock Exchanges to offer either T+1 or T+2 settlement cycle.

150 Reference: SEBI Circular SEBI/HO/MRD/DSA/CIR/P/2018/1 dated January 29, 2018 151 Reference: SEBI Circular DCC/FITTC/Cir-19/2003 dated March 4, 2003 and SEBI Circular MRD/DoP/SE/Dep/Cir-18/2005 dated September 2, 2005 152 Reference: SEBI Circular SEBI/HO/MRD2/DCAP/P/CIR/2021/628 dated September 07, 2021

4.3.3 Accordingly, a Stock Exchange may choose to offer T+1 settlement cycle on any of
the scrips, after giving an advance notice of at least one month, regarding change in the settlement cycle, to all stakeholders, including the public at large, and also disseminating the same on its website.
4.3.4 After opting for T+1 settlement cycle for a scrip, the Stock Exchange shall have to
mandatorily continue with the same for a minimum period of 6 months. Thereafter, in case, the Stock Exchange intends to switch back to T+2 settlement cycle, it shall do so by giving 1-month advance notice to the market.
4.3.5 Any subsequent switch (from T+1 to T+2 or vice versa) shall be subject to minimum
period and notice period as mentioned in Para 4.3.4 above.
4.3.6 There shall be no netting between T+1 and T+2 settlements.
4.3.7 The settlement option for security shall be applicable to all types of transactions in
the security on that Stock Exchange. For example, if a security is placed under T+1 settlement on a Stock Exchange, the regular market deals as well as block deals will follow the T+1 settlement cycle on that Stock Exchange.
4.3.8 The provisions of this circular shall come into force with effect from January 01,
2022.
4.4 Settlement of transactions in case of holidays153
4.4.1 Due to lack of uniformity of holidays and force majeure conditions which
necessitate sudden closure of one or more Stock Exchanges and banks in a particular state, result in situations where multiple settlements have to be completed by the Stock Exchanges on the working day immediately following the day(s) of the closure of the banks. Accordingly, the Stock Exchanges/Depositories are advised to follow the guidelines and adhere to the time line.
4.4.1.1 The Stock Exchanges shall clear and settle the trades on a sequential basis i.e., the
pay-in and the pay-out of the first settlement shall be completed before the commencement of the pay-in and pay-out of the subsequent settlement/s.
4.4.1.2 The cash/securities pay out from the first settlement shall be made available to
the member for meeting his pay-in obligations for the subsequent settlement/s.
4.4.1.3 Further, in-order to meet his pay-in obligations for the subsequent settlement, the
member may need to move securities from one depository to another. The Depositories shall, therefore, facilitate the inter-depository transfers within one hour and before pay-in for the subsequent settlement begins.
4.4.1.4 The Stock Exchanges/Depositories shall follow a strict time schedule to ensure
that the settlements are completed on the same day.
4.4.1.5 The Clearing Corporation/Clearing House of the Stock Exchanges shall execute
Auto DO facility for all the settlements together, so as to make the funds and the

153 Reference: SEBI Circular SEBI/MRD/Policy/AT/Cir- 19/2004 dated April 21, 2004

securities available with the member on the same day for all the settlements, thereby enabling the availability of the funds/securities at the client level by the end of the same day.
4.5 Deadline time for accepting non pay-in related instructions154
4.5.1 The depositories are advised that any overrun of the time specified for 'spot
delivery contract' in the SCRA would result in the contract becoming illegal under
section 16 of the SCRA (unless it is put through the stock exchange). The Rights and
Obligations of the BO and DP cannot add anything to or subtract anything from this position. However, it should be the responsibility of the DP to ensure that the client's contract is not rendered illegal on account of delayed execution of the delivery instruction.
4.5.2 Keeping the hardships to change all the existing Rights and Obligations of the BO
and DP to enforce the above into consideration, it is advised that suitable bye laws can be made under section 26(2)(e) and (d) of Depositories Act, 1996 for imposing such obligation on the DPs. Therefore, it is advised to amend/insert bye laws which should expressly provide that the DPs shall execute the non pay-in related instructions on the same day or on the next day of the instruction. Further, pending such amendment, suitable instructions may be issued to DPs to adhere to such time limit.
4.5.3 The above clause may be suitably incorporated in the Rights and Obligations of the
BO and DP while opening new accounts.
4.6 Approval of amendments to Bye Laws / Rules of Stock Exchanges and Depositories155
4.6.1 Depositories and exchanges shall submit the following information while seeking
SEBI approval for amendment to Bye Laws/ Rules/ Regulations and amendments thereto:
4.6.1.1 The objective/purpose of amendments.
4.6.1.2 Whether the amendment is consequential to any directive/circulars/
guidelines from SEBI/ Government and the details thereof.
4.6.1.3 Whether such amendments necessitate any consequential amendments to any
other Bye Laws/ Rules/ Regulations.
4.6.1.4 The proceedings of the Governing Board or Governing Council, as the case
may be, wherein these proposed amendments were approved by the Exchanges/ Depositories.
4.6.1.5 If documents other than Bye Laws/ Rules/ Regulations are sent for approval,
the justification and need for forwarding the same to SEBI, indicating whether it forms a part of any Bye Law/ Rule/ Regulation.

154 Reference: SEBI Letter MRD/VSS/ARR/ 12255/2004 dated June 10, 2004 155 Reference: SEBI Circular LGL/Cir-2/2003 dated February 19, 2003

4.6.2 Further, all Exchanges shall ensure that requests for dispensation of the
requirement of pre-publication shall be accompanied with proper justification and indicate how the public interest or interest of trade shall be served by such dispensation of pre-publication.
4.7 Periodical Report – Grant of prior approval to Depository Participants156
4.7.1 The Depositories shall submit a periodical report to SEBI regarding the following
changes, as per the format (Annexure 19) and in accordance with the guidelines given below:
4.7.1.1 Amalgamation, demerger, consolidation or any other kind of corporate
restructuring falling within the scope of Chapter XV of the Companies Act, 2013 or the corresponding provision of any other law for the time being in force;
4.7.1.2 Change in Director, including managing director/ whole-time director;
4.7.1.3 Change in shareholding not resulting in change in control;
4.7.1.4 Any other purpose as may be considered appropriate by the Depositories.
If there is no change during the relevant quarter, it shall be indicated in the report.
4.7.2 Guidelines to fill up the Annexure and sending the same to SEBI
4.7.2.1 A separate annexure shall be submitted for each "Type of change" as specified
in the format.
4.7.2.2 The report shall be signed by an authorized representative of the Depository
and the same shall be stamped.
4.7.2.3 The Depositories shall furnish the report to SEBI by 7th day of month following
the end of each quarter, starting with report for the quarter ending June 2011.
4.7.2.4 The report shall be submitted by e-mail at dp@sebi.gov.in. A hard copy of the
report shall also be submitted to SEBI.
4.8 Preservation of Records157
4.8.1 Depositories and Depository Participants (DPs) are required to preserve the
records and documents for a minimum period of 8 years.
4.8.2 Depositories and DPs shall preserve respective original forms of documents either
in physical form or an electronic record, copies of which have been taken by CBI, Police or any other enforcement agency during the course of their investigation till the trial is completed.
4.9 Participation as Financial Information Providers in Account Aggregator
framework158

156 Reference: SEBI Circular CIR/MIRSD/9/2011 dated June 17, 2011 157 Reference: SEBI Circular: MRD/DoP/DEP/Cir 20/2009 dated December 9, 2009 and SEBI/HO/MRD2/DDAP/CIR/P/2020/153 dated August 18, 2020 158 Reference: SEBI Circular SEBI/HO/MRD/DCAP/P/CIR/2022/110 dated August 19, 2022

4.9.1 An Account Aggregator (AA), is a Reserve Bank of India (RBI) regulated NonBanking Finance Company (NBFC) that facilitates retrieval or collection of financial
information, pertaining to a customer, from Financial Information Providers (“FIP”) on the basis of explicit consent of the customer. The financial information shared through the Account Aggregator is not stored by the AA and it shall not be the property of the AA. This information is not to be used in any other manner except for the purpose of providing it to the customer or consented Financial Information User (FIU). Thus, Account Aggregator facilitates consolidation, organization, presentation of the financial information to the customer or FIU based on the explicit consent of the customer.
4.9.2 RBI has issued Non-Banking Financial Company –Account Aggregator Master
Directions DNBR.PD.009/03.10.119/2016-17 dated September 02, 2016 for compliance by every Non-Banking Financial Company (NBFC-Account Aggregator) undertaking the business of AA.
4.9.3 Out of the list of entities mentioned as Financial Information Providers (FIPs) under
the Clause 3 (xi) of the Master Directions, the Asset Management Companies (AMCs) through their Registrar and Transfer Agents (RTAs) and the Depositories are inter-alia specified as Financial Information Providers (FIPs) for the purpose of sharing of information. Thus, hereinafter the Depositories and AMCs (through their RTAs) are referred as FIPs in the securities markets.
4.9.4 The FIPs in the securities market will provide the “Financial Information”, as
specified in Clause 3(ix) of the RBI Master Directions, to the customers and FIUs who furnish the consent artefact (electronic consent as defined in RBI Master Guidelines) through any of the Account Aggregators registered with RBI. Further, FIPs in securities market shall enter into a contractual framework with the AAs, and the same shall distinctly specify the following:
a.Rights and obligations of each party b.Modalities of Dispute Resolution mechanism
4.9.5 The FIPs in the securities markets shall share the “Financial Information”
pertaining to securities markets, through the AA only on receipt of a valid consent artefact from the customer through the Account Aggregator. The consent architecture is detailed under Clause 6 of the RBI Master Directions. Further, the FIPs in the securities markets shall also verify, through appropriate means, the following in the consent artefact:
a.validity of consent b. specified dates and usage; and
c. the credentials of the AA

4.9.6 Upon due verification of the consent artefact, the FIPs in the securities markets shall
digitally sign the financial information and securely transmit the same to the AA in accordance with the terms contained in the consent artefact.
4.9.7 All responses of the FIPs in the securities markets shall be in real time.
4.9.8 To enable these data flows, the FIPs in the securities markets shall:
a.implement interfaces that will allow an AA to submit consent artefacts, and authenticate each other, and would enable secure flow of financial information to the AA; b. adopt means to verify the consent including digital signatures, if any, contained in the consent artefact;
c. implement means to digitally sign the financial information that is shared by
them about the customers; d.maintain a log of all information sharing requests and the actions performed by them pursuant to such requests.
4.9.9 The FIPs in the securities markets are expected to adopt the technical specifications
published by ReBIT, as updated from time to time and adopt required Information Technology (IT) framework and interfaces to ensure secure data flows to AA. The technology should also be scalable to cover any other AA as may be specified by Reserve Bank of India in future.
4.9.10 There shall be adequate safeguards built in IT systems of FIPs in the securities
markets to ensure that it is protected against unauthorized access, alteration, destruction, disclosure or dissemination of records and data.
4.9.11 The FIPs in the securities markets shall also abide by the code of conduct as
specified in the SEBI regulations applicable to them, including redressal of grievances of the customers.
4.9.12 The FIPs in the securities markets shall continue to comply with all the regulatory
provisions under the SEBI Act, 1992, Depositories Act, 1996 and the regulations framed thereunder.
4.9.13 The provisions of this circular shall come into force with effect from August 19,
2022.
4.9.14 The participation of depositories as FIPs in the AA ecosystem shall not impact the
existing mechanism as per circular CIR/MRD/DP31/2014 dated November 12, 2014 of issuances of Consolidated Account Statement to the investors by depositories or AMCs/MF-RTAs providing consolidated information of the mutual fund investments and holdings of investors in demat accounts.
4.9.15 The Financial Information Providers (FIPs) in securities market must disclose
prominently on their websites the names of the Account Aggregators through which the FIP shares the information about assets held with respect to securities markets with the customers and Financial Information Users (FIUs).

4.10 Facilitating transaction in Mutual Fund schemes through the Stock Exchange
Infrastructure159
Kindly refer para titled ‘Facilitating transactions in Mutual Fund schemes through the Stock Exchange infrastructure’ of SEBI Circular SEBI/HO/IMD/IMD-PoD1/P/CIR/2023/74 dated May 19, 2023 (Master Circular for Mutual Funds)
4.11 Discontinuation of usage of pool accounts for transactions in units of Mutual Funds
on the Stock Exchange Platforms160
Kindly refer para titled ‘Discontinuation of usage of pool accounts for transactions in units of Mutual Funds on the Stock Exchange Platforms’ of SEBI Circular SEBI/HO/IMD/IMD-PoD-1/P/CIR/2023/74 dated May 19, 2023 (Master Circular for Mutual Funds)
4.12 RTA inter-operable Platform for enhancing investors’ experience in Mutual Fund
transactions / service requests 161
Kindly refer para titled ‘RTA inter-operable Platform for enhancing investors’ experience in Mutual Fund transactions/service requests’ of SEBI Circular SEBI/HO/IMD/IMD-PoD-1/P/CIR/2023/74 dated May 19, 2023 (Master Circular for Mutual Funds)
4.13 Pledge of Shares through depository system162
4.13.1 Section 12 of the Depositories Act, 1996 and Regulation 79 of the Securities and
Exchange Board of India (Depositories and Participants) Regulations, 2018 (“DP Regulations”) along with the relevant Bye Laws of the Depositories clearly enumerate the manner of creating pledge. It is felt that there is a need to communicate to the BOs that any procedure followed other than as specified under the aforesaid provisions of law shall not be treated as pledge.
4.13.2 In order to clarify the same, the depositories are advised to issue a communiqué to
the DPs advising them to inform BOs about the procedure for pledging of shares held in demat form as enumerated in the relevant sections of the Depositories Act, 1996 and DP Regulations. Depositories may also advise DPs that an off-market transfer of shares leads to change in ownership and cannot be treated as pledge.

159 Reference: SEBI Circular CIR/MRD/DSA/32/2013 dated October 04, 2013, SEBI Circular CIR/MRD/DSA/33/2014 dated December 09, 2014, SEBI Circular SEBI/HO/MRD/DSA/CIR/P/2016/113 dated October 19, 2016, SEBI Circular SEBI/HO/MRD1/DSAP/CIR/P/2020/29 dated February 26, 2020, SEBI Circular SEBI/IMD/CIR No. 11/183204/2009 dated November 13, 2009 and SEBI Circular CIR/IMD/DF/17/2010 dated November 09, 2010 160 Reference: SEBI Circular SEBI/HO/IMD/IMD-IDOF5/P/CIR/2021/635 dated October 4, 2021 161 Reference: SEBI Circular SEBI/HO/IMD/IMD-II DOF3/P/CIR/2021/604 dated July 26, 2021 162 Reference: SEBI Letter MRD/DoP/MAS – OW/16723/2010 dated August 17, 2010

Further, this issue may also be taken up in the investor awareness programs wherein the manner of creation of pledge can be effectively communicated to the BOs directly.
4.14 Margin obligations to be given by way of Pledge/ Re-pledge in the Depository
System163
Kindly refer para titled ‘Margin obligation to be given by way of Pledge/ Re-pledge in the Depository System’ of SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD1/P/CIR/2023/71 dated May 17, 2023 (Master circular for Stock Brokers) For the purpose of Section 41.4 of the above-mentioned circular, Depositories shall provide a separate pledge type viz. ‘margin pledge’, for pledging client’s securities as margin to the TM / CM.
4.15 Foreign investments in infrastructure companies in securities markets164
4.15.1 Pursuant to Government of India Policy, foreign investments in infrastructure
companies in the securities markets, namely Stock Exchanges, Depositories and Clearing Corporations shall be as under:
4.15.1.1 Foreign investment shall be allowed in such companies with a separate
FDI and FPI cap as per the prevailing policy of GoI;
4.15.1.2 FDI shall be allowed subject to specific prior approval (if any) as per the
FDI policy of GoI;
4.15.1.3 FPI shall be allowed only through purchases in the secondary market;
Clarification165 - In respect of exchanges that are not listed, FPIs purchase of shares of such exchanges can be through transactions outside of the exchange provided it is not an initial allotment. However, if the exchange is listed, transactions by FPIs should be done through the exchange.
4.15.1.4 FPI shall not seek and will not get representation on the Board of
Directors;
4.15.1.5 Foreign investors, including persons acting in concert, may hold equity
shares in a depository as per the limits specified under Regulation 21 (2) of the Securities and Exchange Board of India (Depositories and Participants) Regulation, 2018.

163 Reference: SEBI Circular SEBI/HO/MIRSD/DOP/CIR/P/2020/28 dated February 25, 2020, SEBI/HO/MIRSD/DOP/CIR/P/2020/88 dated May 25, 2020, SEBI/HO/MIRSD/DOP/CIR/P/2020/90 dated May 29, 2020, SEBI/HO/MIRSD/DOP/CIR/P/2020/143 dated July 29, 2020 and SEBI/HO/MIRSD/DoP/P/CIR/2022/44 dated April 04, 2022 164 Reference: SEBI Circular MRD/DSA/SE/Dep/Cust/Cir-23/06 dated December 22, 2006 165 Reference: SEBI Circular MRD/DSA/SE/Dep/Cust/CIR-30/08 dated October 23, 2008

4.15.2 The aforesaid limits for foreign investment in respect of recognised Stock
Exchanges shall be subject to 5% shareholding limit as prescribed under the Securities Contracts (Regulation) (Stock Exchanges And Clearing Corporations) Regulations, 2018.
4.16 Designated e-mail ID for regulatory communication with SEBI166
Depositories shall create a designated e-mail id for regulatory communication and inform it to SEBI. This e-mail id shall be exclusive and shall not be person-centric.
4.17 Designated e-mail ID for redressal of investor complaints167
4.17.1 Depositories and registered DPs shall designate an exclusive e-mail ID for the
grievance redressal division/compliance officer exclusively for registering investor complaints.
4.17.2 The designated email ID and other relevant details shall be prominently
displayed on the websites and in the various materials/pamphlets/advertisement campaigns initiated by the Depositories and DPs for creating investor awareness.
4.18 Redressal of complaints against Depositories through SEBI Complaints Redress
System (SCORES)168
4.18.1 The complaints received by SEBI against Depositories shall be electronically sent
through SCORES. Depositories are advised to view the pending complaints at http://scores.gov.in/admin and submit the Action Taken Report (ATR) along with supporting documents electronically in SCORES. Updation of action taken shall not be possible with physical ATRs. Hence, submission of physical ATR shall not be accepted for complaints lodged in SCORES.
4.18.2 The Depositories shall do the following:
4.18.2.1 Indicate a contact person in case of SCORES, who is an employee heading
the complaint services division/cell/department. Contact detail (i.e. phone no., email id, postal address) of the said contact person be made widely available for e.g. on the websites of Depositories.
4.18.2.2 Address/redress the complaints within a period of 21 calendar days upon
receipt of complaint and keep the Board informed about the number and the nature of redressal
4.18.2.3 Maintain a monthly record of the complaints which are not
addressed/redressed within 21 calendar days from the date of receipt of the complaint/information, alongwith the reason for such pendency.

166 Reference: SEBI Circular MIRSD/DPS- III/Cir-23/08 dated July 25, 2008 167 Reference: SEBI Circular MRD/DoP/Dep/SE/Cir-22/06 dated December 18, 2006 168 Reference: SEBI Circular CIR/MRD/ICC/16/2012 dated June 15, 2012

4.18.2.4 Upload/update the ATR on the SCORES. Failure to do so shall be
considered as non-redressal of the complaint and the complaint shall be shown as pending.
4.19 Limitation period for filing an arbitration reference169
The provisions dealing with mediation, conciliation and arbitration have been superseded with the introduction of Online Dispute Resolution (ODR) Mechanism. Kindly refer SEBI Circular SEBI/HO/OIAE/OIAE_IAD-1/P/CIR/2023/145 dated July 31, 2023 (Master circular for Online Resolution of Disputes in the Indian Securities Market)
4.20 Disclosure of investor complaints and arbitration details on Depository website170
4.20.1 Depositories shall disclose the details of complaints lodged by Beneficiary
Owners (BO’s)/investors against Depository Participants (DPs) on their website. The aforesaid disclosure shall also include details pertaining to penal action against the DPs.
4.20.2 The format for the reports for the aforesaid disclosure consists of the following
reports:
4.20.2.1 Report 1A: Complaints received against DPs during current year
4.20.2.2 Report 1B: Redressal of Complaints received against DPs during previous
year
4.20.2.3 Report 1C: Redressal of Complaints received against DPs during current year
4.20.2.4 Report 2A171
4.20.2.5 Report 2B172
4.20.2.6 Report 3A: Penal Actions against DPs during previous year
4.20.2.7 Report 3B: Penal Actions against DPs during current year
4.20.2.8 Report 4A: Redressal of Complaints lodged by investors against Listed
Companies during previous year
4.20.2.9 Report 4B: Redressal of Complaints lodged by investors against Listed
Companies during current year
4.20.3 Depositories are accordingly advised to

169 Reference: SEBI Circular CIR/MRD/DP/4/2011 dated April 7, 2011 170 Reference: SEBI Circular SEBI/MRD/ OIAE/ Dep/ Cir- 4/2010 dated January 29, 2010 171 Repealed by SEBI Circular SEBI/HO/OIAE/OIAE_IAD-1/P/CIR/2023/145 dated July 31, 2023 in respect of Master SEBI Circular for Online Resolution of Disputes in the Indian Securities Market. 172 Repealed by SEBI Circular SEBI/HO/OIAE/OIAE_IAD-1/P/CIR/2023/145 dated July 31, 2023 in respect of Master SEBI Circular for Online Resolution of Disputes in the Indian Securities Market.

4.20.3.1 disclose details as per the aforesaid reports in their website on a continuous
basis
4.20.3.2 update the aforesaid reports on a quarterly basis, except the Report 1A, which
shall be updated on a weekly basis
The provisions dealing with mediation, conciliation and arbitration have been superseded with the introduction of Online Dispute Resolution (ODR) Mechanism. Kindly refer SEBI Circular SEBI/HO/OIAE/OIAE_IAD-1/P/CIR/2023/145 dated July 31, 2023 (Master circular for Online Resolution of Disputes in the Indian Securities Market)

Report 1A: Complaints received against Depository Participants (DPs)# during current year: Updated on mmm dd yyyy (to be updated weekly) (In excel sheet) Sl. No. Details of Complaint Status of Complaint Date of Receipt Name of Complainant Type of Complaint* SEBI Ref. No. (if applicable Name of DP Status Status Date## Date of Filing Arbitration Name of Arbitrator(s) Date of Arbitration Award N

including against its authorized persons, employees, etc.

SEBI Master Circular for Depositories

including against its authorized persons, employees, etc.

Lineage: In force