IT Resilience Index for Market Infrastructure Institutions (MIIs)

CIRCULAR HO/47/18/11(1)2026-MRD-TPD1/I/19509/2026 August 24, 2026 To, All Stock Exchanges All Clearing Corporations All Depositories (Except AMC Repo Clearing Ltd.) Dear Sir/ Madam,

Subject: IT Resilience Index for Market Infrastructure Institutions (MIIs) A. Background

1. IT systems of Market Infrastructure Institutions (MIIs) form backbone of smooth and uninterrupted functioning of Securities market and are fundamental to ensuring its orderly, efficient and uninterrupted functioning. Any disruption, degrading in performance or compromise of these systems may adversely impact critical market operations and pose risks to the trust in the securities market.

2. Accordingly, it is imperative that MIIs ensure the availability, reliability, performance and cyber resilience of their IT systems through robust governance, proactive monitoring and timely corrective measures, so that the securities market continues to operate in a fair, transparent and efficient manner.

3. In order to discharge their role of performance monitoring and ensure timely service delivery to market participants, a framework covering oversight of resilience of IT systems, identifying emerging weaknesses at early stage and initiation of timely corrective measures, has been formulated.

B. IT Resilience Index (ITRI) for MIIs

4. Pursuant to discussion with SEBI’s Technical Advisory Committee (TAC) and Consultation paper dated March 25, 20261, it is decided to create an index that would capture well-functioning and resilience of IT systems of the MII.

1 Consultation Paper on Framework of IT Resilience Index for Market Infrastructure Institutions (MIIs).

Page 1 of 45. Following system-driven framework for computation of ITRI is stipulated for MIIs:

5.1. ITRI shall measure the robustness of Critical Systems of MIIs as defined at Clause 9.1.2.3 of Master Circular dated December 30, 2024 for Stock Exchanges and Clearing Corporations, Clause 4.31.2.3 of Master Circular dated December 03, 2024 for Depositories, and Clause 16.4.3(c) of Master

Circular dated August 04, 2023 for Commodity Derivatives Segment. The scope shall also include other systems feeding / related to such Critical Systems.

5.2. The parameters of computing ITRI and their weightages shall be as follows:

Sr. No. Parameters Weightage

1. Availability 20

2. Security 20

3. Integrity 10

4. Governance 10

5. Reliability and Monitoring 10

6. Business Continuity 10

7. Modularity and Flexibility 10

8. Scalability 5

9. Others (such as Incident handling, etc.) 5 TOTAL 100

5.3. The Industry Standards Forum (ISF) of MIIs constituted by SEBI shall finalize sub-parameters and detailed measurement criteria for each parameter of ITRI (mentioned at Para 5.2 above) by November 30, 2026.

5.4. MIIs shall compute ITRI on a half-yearly basis within a period of 60 days from the end of each half-year and submit the comparative analysis of two consecutive half-years (on a rolling basis) and corrective actions taken (or Page 2 of 4proposed to be taken), to their Standing Committee on Technology (SCOT) and the Governing Board.

5.5. The MIIs shall ensure that the computation of ITRI shall be system-driven, i.e., ITRI would be computed automatically from IT systems (or data extracted from such systems) without manual intervention. This is stipulated with the objective of ensuring that computation of ITRI remains non-discretionary and fool proof.

In case any of the parameters of ITRI could not be computed automatically from IT systems and necessitates manual intervention, MII shall carry out manual data retrieval only after prior discussion of such exceptions with their SCOT.

5.6. The ISF shall also formulate baseline parameters, acceptable threshold scores as well as the SOP for calculating ITRI along with an objective system-driven scoring methodology. This is with the intention of having comparability across MIIs.

5.7. The aforesaid framework would function as a self-operating model requiring MIIs to periodically compute the ITRI and provide insights to their Governing Boards on overall health of IT systems and areas of improvements C. Early Warning System through ITRI

6. MIIs shall develop an Early Warning System to detect possible deterioration in any of the parameters of ITRI leading to possible performance issue, slowness etc. in their systems and framework to remedy these.

D. Continuous Monitoring of Service Delivery to Market Participants

7. At present, MIIs are stipulated2 to continuously monitor the performance of processes / applications and utilization of its system resources at each IT component level to enable the MIIs to do early detection of any possible performance issue, slowness etc.

8. It is further stipulated that MIIs shall build systems providing continuous visibility in to service delivery to market participants. Such systems shall include consolidated 2 SEBI Circular dated December 10, 2024 on “Revised Guidelines for Capacity Planning and Real Time Performance Monitoring framework of Market Infrastructure Institutions (MIIs)” Page 3 of 4dashboards that will assist in monitoring system/application performance and continuous service delivery as well as any deviation / anomalies thereof.

9. MIIs shall also formulate SOPs with regard to para 8 above to monitor availability of systems and continuity of service delivery to all market participants and flag any disruption / deviation thereof.

E. Implementation Time

10. The implementation timeline for operationalization of the ITRI framework by MIIs shall be as follows-

10.1. MIIs have already implemented the beta version of the ITRI framework. MIIs shall operationalize the aforesaid ITRI framework including Early Warning System and Real Time Monitoring of Service Delivery by February 28, 2027.

10.2. The detailed Standard Operating Procedures (SOP) in this regard, after finalization of sub-parameters by ISF (para 5.3 and 5.6) shall be submitted to SEBI after review by SCOT of MIIs by January 31, 2027.

10.3. The first submission of ITRI computation under this framework shall be for the half-year ending March 31, 2027.

11. MIIs are required to take necessary steps to put in place systems for implementation of this Circular, including necessary amendments to the relevant bye-laws, rules and regulations, if any.

12. This Circular is being issued in exercise of powers conferred under Section 11(1) of the Securities and Exchange Board of India Act, 1992 and to protect the interests of investors in securities and to promote the development of, and to regulate the securities market.

Yours faithfully, Darshil D. Bhatt Deputy General Manager Division of Policy and Development – 4 Market Regulation Department +91-22-26449735

Email: darshilb@sebi.gov.in Page 4 of 4