New Delhi: Banks have reached out to the government, seeking a further extension to the deadline for implementing the Securities and Exchange Board of India's Cybersecurity and Cyber Resilience Framework, or CSCRF.
While the market regulator has already extended the deadline to April 1 from January 1, 2025, lenders are calling for a further extension until June, citing the need for more time to comply with the proposed provisions, people aware of the development said.
A representation was made to the finance ministry earlier this month, "requesting it to take up the issue with Sebi... Banks want the deadline extended to June," a senior bank executive said.
CSCRF is a set of guidelines issued by Sebi to strengthen cybersecurity of market participants, including stockbrokers, depositories, asset management companies, mutual funds, and other intermediaries. It mandates robust data protection and security protocols across areas including IT services, software-as-a-service (SaaS) solutions, hosted services, classification of data, audit for software solutions, applications, and products used by regulated entities (REs).
Banks-which operate in the securities market as brokers, investment bankers and other intermediary roles-have communicated to the government that some areas require a gap analysis study to identify and implement necessary measures, said the banker cited above.
Another banker said one of the biggest constraints is the data localisation issue, which has been put on hold for now.
Foreign banks, in particular, have raised concerns both with the Reserve Bank of India and Sebi, "seeking a more workable solution" for the issues, he said.
The banks expect other issues to be addressed as well, he added.
The framework was first announced through a circular issued on August 20, 2024.
The regulator said it felt the need for further consultations on the provisions of data localisation, based on feedback from stakeholders. "Accordingly, the guidelines and provisions with regard to data localisation have been kept in abeyance until further notification," it said.
Budget with ET
India, get ready for the modern warfare of tomorrow
Women, youth, farmers and poor can continue to be Budget 2025's ‘roti, kapda aur makan’
Modi govt has a key task in Budget 2025: Unlocking the PLI goldmine
A representation was made to the finance ministry earlier this month, "requesting it to take up the issue with Sebi... Banks want the deadline extended to June," a senior bank executive said.
CSCRF is a set of guidelines issued by Sebi to strengthen cybersecurity of market participants, including stockbrokers, depositories, asset management companies, mutual funds, and other intermediaries. It mandates robust data protection and security protocols across areas including IT services, software-as-a-service (SaaS) solutions, hosted services, classification of data, audit for software solutions, applications, and products used by regulated entities (REs).
Banks-which operate in the securities market as brokers, investment bankers and other intermediary roles-have communicated to the government that some areas require a gap analysis study to identify and implement necessary measures, said the banker cited above.
Another banker said one of the biggest constraints is the data localisation issue, which has been put on hold for now.
Foreign banks, in particular, have raised concerns both with the Reserve Bank of India and Sebi, "seeking a more workable solution" for the issues, he said.
The banks expect other issues to be addressed as well, he added.
The framework was first announced through a circular issued on August 20, 2024.
The regulator said it felt the need for further consultations on the provisions of data localisation, based on feedback from stakeholders. "Accordingly, the guidelines and provisions with regard to data localisation have been kept in abeyance until further notification," it said.
