Author name: CBCL

[By Anoushka Das, Dhaval Bothra & Arya Vansh Kamrah] The authors are students of SLS Pune.   Introduction The Securities and Exchange Board of India (SEBI) has recently released its circular dated August 20, 2024, detailing a cyber security framework for its Regulated Entities (REs) in light of the rapid increase in technological developments in the securities market. The integration of technology into the securities market poses a double-edged sword, which may expose the players in the market to cyber risks and cyber incidents. While the integration of technology brings efficiency and innovation, it simultaneously exposes market participants to potential cyber threats, including data breaches, ransomware attacks, and fraudulent activities. SEBI, after due consultation with the stakeholders, has prudently formulated a framework via its circular to meet its six cyber security goals for combating cybercrime, i.e., governance, identification, protection, detection, response, and evolution. SEBI has outlined a robust scheme designed to safeguard stakeholders from the complex and evolving cybersecurity threats facing the securities market.  Key Highlights of the Framework Under this framework, SEBI has categorized the REs into five categories based on the extent of operations, trade volume, number of clients, etc.  In pursuance of SEBI’s focus on cybersecurity and cyber resilience, the market regulator has framed the following guidelines in accordance with its cybersecurity functions:  Governance: SEBI has mandated that all REs continuously allocate and communicate clear roles and responsibilities related to cybersecurity risk management. Additionally, it has introduced the Cyber Capability Index (CCI) as a tool to assess and monitor the cybersecurity progress of Market Infrastructure Institutions and Qualified REs  Identification:  REs are mandated to identify and classify critical systems according to their operational importance and sensitivity. This includes periodic IT risk assessments and prioritizing responses based on current threats and vulnerabilities.  Protection: REs must ensure that a robust authentication and access policy is in place with due log collection and documentation. Moreover, SEBI has enumerated a list of guidelines, including audits, vulnerability assessment and penetration testing, and security solutions that need to be mandatorily implemented.   Detection: The REs are mandated to institute a Security Operations Centre (SOC), either internally or via third parties, and ensure that the functional efficacy of the same is measured on a half-yearly or yearly basis based on the category it belongs to.   Response: The REs must compulsorily formulate a Cyber Crisis Management Plan (CCMP), and in the event of any incident, a Root Cause Analysis (RCA) must be conducted to understand the root cause of the incident.   Recovery: SEBI in its circular has provided an indicative recovery plan based on which REs must document a comprehensive plan for response and recovery from cyberattacks.   Evolution: SEBI has mandated that the REs must formulate “adaptive and evolving” controls to tackle vulnerabilities. The circular takes cognizance of the ever-evolving nature of technology and its role in the securities market and undertakes to evolve with the changing times by making updates to the circular as and when the need arises. This forward-looking approach leaves enough room for the framework to evolve while making a sufficient attempt at tackling the pre-existing problems.   Implementation of the CSCRF SEBI has phased the implementation of CSCRF compliance based on the categories in which the REs fall. The implementation date for the six categories of REs that already have circulars in place is January 1, 2025, while for REs to which the CSCRF measures are being extended for the first time, the implementation date is April 1, 2025. The market regulator has considered the challenges that first-time compliance imposes on regulators and has allowed a relaxed timeline to accommodate these difficulties.  A robust monitoring mechanism further underscores the efficacy of the framework. The CSCRF has divided the compliance reporting between two authorities. For Security Brokers and Depository Participants classified as Qualified REs, the reporting authority will be the relevant stock exchange or depository. For MIIs and the remaining Qualified REs, SEBI will serve as the reporting authority. While CSCRF does not provide for obligations of the REs in case of non-compliance of the implementation dates, SEBI has power under the SEBI Act, 1992, to impose penalties on REs that fail to comply with its directives and frameworks.  Analysing the Impact of the Framework The REs are now burdened with the additional responsibility of adhering to the cybersecurity measures outlined in the circular. On one hand, the compliance requirements and strengthened governance structures may bolster investor confidence in the securities market. Complying with the CSCRF framework can help the REs align with international cybersecurity standards and enhance their reputation and credibility in the global market. The rigorous standards may drive innovation in cybersecurity technology and solutions as REs look for efficient methods to fulfil compliance without compromising productivity.   However, on the other hand, the framework is likely to compel the REs to overhaul their internal systems, procedures and infrastructure to meet the new cybersecurity standards. The additional list of compliances would result in significant expenses for the REs. Smaller REs could face considerable challenges in complying with the CSCRF standards. This may further lead to a competitive disadvantage and an increased dependency on larger institutions for cybersecurity and cyber resilience support. Moreover, the lack of regulation regarding external SOCs leads to a regulatory gap and creates uncertainty with respect to the obligations of REs that opt for third-party SOCs, in case of non-compliance with CSCRF standards.   The circular is a progressive step in addressing the cybersecurity issues prevalent in the market. However, the effectiveness of the circular can only be adjudged upon observing the cooperation of the REs and the diligent monitoring of market players against the established standards once implementation begins.  Recommendations The CSCRF aims to ensure uniformity of cybersecurity guidelines for all REs. However, the framework may not fully address the unique challenges faced by different categories, potentially leading to compliance issues and security gaps. For example, while the CSCRF’s cybersecurity controls are crucial for market safety, they are resource-intensive, especially for smaller REs, which may struggle with the

[By Debarchita Pradhan] The author is a student of National Law School of India University, Bangalore.   Introduction Put simply, insider trading means trading by a person in a company’s securities while he/she has some secret price-sensitive information that is not generally available to the public. However, there have been substantial issues regarding whether the information is generally available to all.   In the recent case concerning allegations of insider trading in Future Retail Ltd. (FRL) scrip, the Securities Appellate Tribunal (SAT) opined that if the information is published in media, then it would cease to be unpublished and would be considered generally available. However, it was the last opportunity to form such an opinion because later, the amendment to the SEBI (Prohibition of Insider Trading) Regulations, 2015 (hereby referred to as “2015 Regulations”) excluded “unverified event or information reported in print or electronic media’ from the definition of “generally available information” (hereby referred to as GAI).   The paper argues that this amendment is too restrictive and would further disincentivize the investors rather than protect them. It would first, give a brief overview of the jurisprudence around information being generally available under insider trading law. Secondly, it would provide the repercussions that may flow from the recent amendment. Thirdly, it will provide a pragmatic alternative to the amendment. Fourthly, the paper will conclude.  Chapter I: Development of the idea of “generally available information” Presently, in the 2015 Regulations, an insider is defined to be someone who is either a connected person or one who possesses unpublished price-sensitive information (UPSI). In the SEBI (Prohibition of Insider Trading) Regulations, 1992 (hereby referred to as “1992 Regulations”), the definition of “unpublished price-sensitive information” provided that for information to be UPSI, it should not be generally known or published by the company. The use of “or” indicates that information can be generally known in ways other than the publication by the company itself. This rationale was visible in the order passed in Hindustan Lever Ltd v. SEBI1, where it was observed that expectations regarding an event, being already in the media, were considered to be generally known. Later, through an amendment in 2002, the definition of “unpublished” was given. It provided that information would be considered unpublished if it is not “published by the company or its agents. This indicates that for the information to be generally available, it needs to be made available by the company itself. So, the 2002 amendment was narrower than the 1992 Regulations with regards to the meaning of generally available information.   Later, a High-Level Committee was appointed under the chairmanship of Justice N.K. Sodhi to review the 1992 Regulations and further provide a draft for the 2015 Regulations.  In these regulations, GAI is separately defined.  It is broader than the 2002 amendment since the only condition required for information to be generally available is that it should be available to the public in a non-discriminatory manner. This broader view was recently evident in the ruling given by SAT in the Future Corporate Resources Pvt. Ltd. (FCRPL) v. SEBI. The SAT opined that the information doesn’t need to be only from the company itself to be considered as generally available. The same logic was also followed in previous cases that arose after the 2015 Regulations. However, later through an amendment to the definition of GAI on 18 May 2024, “unverified event or information reported in print or electronic media” were excluded from its ambit.   Chapter II: Repercussions That Follow [A] Ignoring the Channel When holding someone accountable for insider trading, especially if they are not directly connected but are said to have used undisclosed price-sensitive information (UPSI) for trading, it’s important to consider whether there is any evidence about how the accused received this information and from whom. In many cases where SEBI has omitted this requirement, the SAT has come down heavily on it. For instance, in Shruti Vora and Ors. v. SEBI, the question was whether a “forwarded as received” WhatsApp message regarding the quarterly financial results of a Company, before the company’s official publication, would amount to a UPSI. In this case, the SEBI admitted that despite their thorough investigation, they could not find the original leakage of the information. On such admission, the SAT rightly condemned SEBI for downplaying the requirement of establishing a linkage between the source of UPSI and the person alleged to have possession of UPSI before pinning liability on anyone. Similarly, in Samir C. Arora v. SEBI, SAT held that SEBI has the burden to provide concrete evidence showing that the accused actually received the UPSI from a source. However, the recent amendment closes the doors for inquiring whether there was any such linkage or where an un-connected person has received the UPSI from. No matter the existence of any such linkage, if a person, alleged to be an insider, trades while possessing information published only in unverified media, he may still be liable. This is particularly concerning when such liabilities require a higher degree of proof than a normal civil suit.  [B] Reducing assistance for investors: The above issue is further concerning when the conditions for information to be UPSI as well as that of disclosures of UPSI is already lowered. Nowhere in the Regulations, it is mentioned that the UPSI should be only concrete information. In the Satyam Computer case, the AO had clarified that not only concrete decisions, but any information (including proposals, etc.), which if published is likely to materially affect the price of securities of a company, would constitute price-sensitive information (PSI). Further, in the K.K. Maheswari case, the AO reiterated that PSI would include “any information”, i.e., not only a ‘final decision’ but would include the probable and most likely event. So, UPSI can include proposals or just mere possibilities of an event.  Now, as per Schedule A of the 2015 Regulations, there should be prompt public disclosure of UPSI no sooner than “credible and concrete information” comes into being to make such information generally

[By Siddharth Melepurath] The author is a student of National Law University Odisha.   Introduction Recently, the Securities and Exchange Board of India (“SEBI”) released a consultation paper in which it proposed measures to curb speculative activity in Futures and Options (“F&O”) trading. Speculative trading involves taking guesses at the direction in which the market will go and trying to make money from an unexpected market volatility. SEBI note that a lot of speculative activity happens on the day of contract expiry, particularly in the last hour, which happens to be the most volatile time as compared to other days. Such speculative activity causes unnatural alterations to the actual value of companies, leading to instability in the secondary market.   There are three major objectives with which SEBI has taken this measure – first, to protect the interests of retail investors, second, to promote stability in the derivative market and third, to ensure sustained capital formation from the derivatives market. This post aims to analyse the implications of this move for the derivative market and to evaluate whether it effectively fulfils the rationale behind it or not.  Background The market regulator had conducted a study in January 2023, titled “Analysis of Profit and Loss of Individual Traders dealing in Equity F&O segment”, which showcased that over 89% of individual traders in the equity F&O segment incurred losses in 2022. Data shows that the share of volume in derivative trading has risen from 2% in 2018 to 41% in 2024. According to the Economic Survey of 2023-2024, this increase in retail participation is due to ‘gambling instincts’ among the retail traders, since it holds potential for outsized gains.   The impact of such speculative trading is two-fold. First, it may lead to large-scale price fluctuations, especially caused when speculators buy or sell large quantities of derivatives. Second, it may infuse a large number of investors into the market, creating market price bubbles, or escalation in the underlying value of assets. Consequently, it may severely impact market stability, especially due to the large volume of retail traders incurring losses.  In view of all this, SEBI had created an Expert Working Group (“EWG”) to examine and suggest measures to ensure stability in the derivatives market and to protect investors by improving risk metrics. SEBI’s Secondary Market Advisory Committee (“SMAC”) reviewed these recommendations, pursuant to which SEBI proposed these measures for the index derivatives segment. This move also comes in the backdrop of the Government hiking the Securities Transaction Tax (STT) to 0.1% in options and 0.2% in futures, up from 0.0625% and 0.0125% respectively.  Analysing the proposals: What has changed? SEBI has recommended 7 broad changes to the existing framework, some of which directly impact retail investors trading in the secondary market. Two primary changes – increasing the minimum contract size for index derivatives and rationalisation of weekly index products are aimed at reducing speculation and have a direct impact on retail traders.  Currently, the minimum contract size for index derivatives stands between 5 lakhs and 10 lakhs. SEBI has now proposed to increase this in two phases, with the first phase being 15 lakhs to 20 lakhs and the second phase subsequently being increased to 20 lakhs to 30 lakhs bracket. This measure, which SEBI terms ‘reverse sachetization’, has been done in light of the high risk that derivatives markets pose, and to reduce the leverage that retail traders currently have.   While it is definitely an effective strategy to counter speculative trading, it also impacts beginner options traders entering the market with lower amounts and also leads to an increase in margins. This will also impact in a large-scale decrease in volume, with investors moving out of the market, possibly shifting to the primary market or even outside the primary market. Dabba trading, an illegal form of trading which is executed outside SEBI-recognised stock exchanges is also expected to become popular, in view of investor exits caused by the move. However, it is pertinent to note that SEBI has maintained its position with respect to the equity cash market – stating that there will be no restrictions in the intraday equity cash market as of now.  Further, SEBI notes that due to expiry of weekly contracts almost on all 5 trading days of the week, there exists a lot of speculative trading in the secondary market. Exchange data shows that there is increased volatility on expiry day which leads to a lot of speculative activity. Therefore, as a direct measure to curb this speculation, SEBI has suggested fewer weekly expiries. While this move would counter speculative behaviour by creating a systematic secondary market, it results in the market becoming relatively less liquid. This, in turn, directly impacts discount brokers and stock exchanges catering to retail traders, who benefit from the liquidity rates in the market. Although the regulator has only aimed at reducing the hyperactive trading on the expiry day and has tried to ensure that there is no restriction on trading, market-making or hedging, it will inadvertently affect the volumes in these exchanges due to large-scale exits.   Implications of the move The earlier model of normal-price, high volume has now been replaced by a more stabilised high-price, low volume in the options segment of the derivative market. The extreme price movements, often caused by traders engaging in speculative activity are mitigated through these measures. These measures also reduce the chances of heavy losses incurred by retail investors. Therefore, there is a pressing need to have a threshold to allow investors into derivative markets, which this move has only partially done.  While this move will aid retail traders in the market, who, as per SEBI statistics are incurring losses and contributing to market instability, there are some concerns which the proposed measures pose. One may argue that SEBI has proposed to protect the interests of retail investors by flushing most of them out of the market. However, these measures are expected to have a direct impact on premiums, which will be forced to have