2025-11-22
The Securities and Exchange Board of India issued the Third Amendment Regulations, 2025, to further amend the Depositories and Participants Regulations, 2018, effective thirty days from publication. The regulations mandate the appointment of executive directors to head specific verticals and introduce new statutory roles for Chief Technology Officers and Chief Information Security Officers with defined risk management responsibilities. Additionally, the amendments clarify the appointment conditions for managing directors and expand their defined roles and responsibilities regarding depository governance and compliance.
SECURITIES AND EXCHANGE BOARD OF INDIA NOTIFICATION Mumbai, the 21st November, 2025
SECURITIES AND EXCHANGE BOARD OF INDIA (DEPOSITORIES AND PARTICIPANTS) (THIRD AMENDMENT) REGULATIONS, 2025
F. No. SEBI/LAD-NRO/GN/2025/275.—In exercise of the powers conferred by section 30 of the Securities and Exchange Board of India Act, 1992 (15 of 1992) read with section 25 of the Depositories Act, 1996 (22 of 1996), the Board hereby makes the following regulations to further amend the Securities and Exchange Board of India (Depositories and Participants) Regulations, 2018 namely, —
These regulations may be called the Securities and Exchange Board of India (Depositories and Participants) (Third Amendment) Regulations, 2025.
They shall come into force on the thirtieth day from the date of their publication in the Official Gazette.
In the Securities and Exchange Board of India (Depositories and Participants) Regulations, 2018, —
I. in regulation 24, (1) in sub-regulation (1), i. in clause (b), the word and symbol “and,” shall be omitted; ii. in clause (c), the symbol “.” shall be substituted with the word and symbols “; and,”; iii. after clause (c), the words and symbols “(d) executive directors:” shall be inserted. (2) in sub-regulation (7), after the words “managing director”, the words “and executive directors” shall be inserted;
II. in regulation 26, (1) in the title, after the word “Appointment” and before the words “of managing director”, the words and symbol “, role and responsibilities” shall be inserted; (2) in clause (c) of sub-regulation (4), after first proviso, the following second proviso shall be inserted, namely, - “Provided further that the managing director may, with the prior approval of the governing board of the depository, be appointed as: a) non-executive director on the board of a company registered under section 8 of the Companies Act, 2013; b) non-executive director on the board of an unlisted government company not engaged in any commercial activity; c) chairperson or member (non-executive capacity) of the governing board of an educational institution established by the Central Government, the State Government, a government company, or a statutory body; or d) chairperson or member (non-executive capacity) of the governing board of a university established or incorporated by or under a Central Act or a State Act.” (3) after sub-regulation (7), the following sub-regulation shall be inserted namely, - “(8) The roles and responsibilities of the managing director shall include the following: a) management of the whole of the affairs of the depository; b) ensure that the depository complies with the provisions of all applicable acts, rules and regulations, circulars, guidelines or directions issued thereunder from time to time; c) ensure that the functions under Vertical 1 and Vertical 2 of the depository, as provided in Fourth Schedule of these regulations, are performed in the interest of the securities market and are guided by public interest, without having any revenue-oriented objectives. d) be responsible for the overall risk management of the depository; and e) ensure that the depository has adequate infrastructure and systems in place for its efficient functioning at all points of time.”
III. after regulation 26 and before regulation 27, the following regulation shall be inserted namely, - “Appointment, role and responsibilities of executive director 26A. (1) Every depository shall appoint two executive directors as key management personnel who shall head Vertical 1 and Vertical 2 respectively and the depository may, at its discretion, appoint an executive director to head Vertical 3, as referred to in Fourth Schedule of these regulations. (2) The stature of executive directors shall be similar to that of the managing director. (3) The process of appointment, renewal of appointment and termination of services of the executive directors shall be similar to that of the managing director as referred to in sub-regulations (1), (2), clauses (a) and (b) of (4), (5) and (6) of Regulation 26 of these regulations and subject to prior approval of the Board. (4) The tenure and maximum age limit of the executive directors shall be similar to that of the managing director as referred to in sub-regulation (3) of Regulation 26 of these regulations. (5) The executive director of a depository shall not serve on the board of any other company: Provided that the executive director of a depository may, with the prior approval of the governing board of the depository, be appointed on the board of a subsidiary of a depository. (6) The roles and responsibilities of executive directors of Vertical 1 and Vertical 2 shall include the following: a) management of whole of the affairs of their respective verticals; b) ensure that the functions under their respective verticals of the depository are operating in the interest of the securities market and are guided by public interest, without having any revenue oriented objectives; c) the executive director of Vertical 1 shall be responsible to ensure that adequate infrastructure and systems are in place for efficient function of the depository; and d) the executive director of Vertical 2 shall be responsible for the overall risk management of the depository.”
IV. after regulation 81A and before regulation 82, the following regulations shall be inserted, namely, - “Appointment, role and responsibilities of chief technology officer 81B. (1) Every depository shall appoint a chief technology officer to oversee and manage technology-related system design, infrastructure, and operations. (2) The role and responsibilities of the chief technology officer shall include the following: (a) manage risks in all information technology related functions; (b) formulate the information technology policy and the information technology risk management framework; and (c) resolution and mitigation of observations arising from technology audits.”
“Appointment, role and responsibilities of chief information security officer 81C. (1) Every depository shall appoint a chief information security officer to assess, identify, and mitigate cybersecurity risks associated with the functioning of depository and respond to cybersecurity incidents. (2) The role and responsibilities of the chief information security officer shall include the following: (a) establish appropriate standards and controls; (b) direct the establishment and implementation of processes and procedures as per the cybersecurity and cyber resilience policy approved by the governing board of the depository; and (c) cyber security initiatives including planning, developing, maintaining, reviewing and implementation of Information Security Policies.”
AMIT PRADHAN, Executive Director [ADVT.-III/4/Exty./491/2025-26]
Footnote:
Uploaded by Dte. of Printing at Government of India Press, Ring Road, Mayapuri, New Delhi-110064 and Published by the Controller of Publications, Delhi-110054.