SEBI Fines CDSL ₹1 Crore Over Unpatched Vulnerabilities, Data Loss Prevention Gaps and Pledge Lapses

India's markets regulator has fined Central Depository Services (India) Ltd (CDSL) ₹1 crore under Section 15HB of the SEBI Act, partly for cybersecurity failures found in an inspection of the 2023-24 financial year. The adjudication order is dated 30 October and gives the depository 45 days to pay. It cites an earlier penalty of ₹1 crore imposed on 20 July as a prior default.

The cyber findings SEBI upheld

Adjudicating officer Jai Sebastian found that CDSL's measures to stop unauthorised transmission of data "were not completely implemented": 24 of its endpoints weren't connected to its data loss prevention (DLP) tool. The charges rest on SEBI's cyber and resilience circulars of July 2015, March 2021 and May 2022.

Patching was slow. CDSL didn't close vulnerabilities within the three months SEBI stipulates, and one flagged in a KPMG cyber risk assessment in August 2023 was fixed after a seven-month delay. Its vulnerability assessment and penetration testing (VAPT) left gaps too: SEBI found no VAPT reports for critical applications such as eDIS and AuditWeb, and no source code review.

During one disaster recovery drill, SIEM logs were still being collected at the primary data centre.

The officer weighed CDSL's later fixes but pointed to "the systemic importance of a depository". The rest of the case is about operations: CDSL didn't tell depository participants why pledges were rejected, and it unfroze an entire client unpaid securities account instead of only the securities specified, LiveLaw reports.

What was dropped

The officer gave CDSL the benefit of the doubt on a repeated TLS 1.1 finding and found no breach of the baseline security standards clause or of the recovery-time rules for mock drills. CDSL had argued the findings were "routine supervisory findings with no allegation of unfair dealing or any unlawful gain".

The fine comes out of the inspection, not a new incident. The show-cause notice did cite CDSL's malware incident of 18 November 2022, which CDSL told the officer came from weaknesses in peripheral system configuration, not from flaws in its application code.