SEBI Proposes IT Resilience Index to Enhance Market Infrastructure Oversight

Why It Matters

The ITRI creates a standardized, data‑driven gauge of IT health, helping regulators spot systemic vulnerabilities before they trigger market disruptions. It also pushes MIIs toward stronger cyber‑risk governance, aligning India’s market infrastructure with global best practices.

Key Takeaways

• SEBI introduces IT Resilience Index for market infrastructure
• Index weights availability and security each at 20%
• MIIs must report semi‑annual scores within 60 days
• Industry Standards Forum will set scoring thresholds
• First ITRI reporting due September 2026

Pulse Analysis

India’s securities market is increasingly dependent on complex digital platforms, making cyber‑risk a material threat to market stability. SEBI’s proposal for an IT Resilience Index reflects a broader regulatory shift toward proactive oversight of technology infrastructure, mirroring moves by the U.S. SEC and European regulators. By codifying resilience metrics, the regulator aims to move beyond ad‑hoc audits, providing continuous, quantifiable insight into how well exchanges, clearing corporations and depositories can withstand outages, attacks, or data integrity breaches.

The ITRI framework assigns the highest weights—20 % each—to system availability and security, underscoring their critical role in uninterrupted trading and settlement. Secondary factors such as integrity, governance, reliability, business continuity, modularity, flexibility and scalability each carry 10 % weight, creating a balanced scorecard that captures both preventive controls and recovery capabilities. An Industry Standards Forum, comprising technology experts and market participants, will finalize sub‑parameters and thresholds, ensuring the index remains technically rigorous yet operationally feasible. Automation of data collection is mandated to reduce subjectivity, and MIIs must submit half‑yearly scores within 60 days, followed by a comparative analysis to SEBI within 90 days.

For market participants, the ITRI promises greater transparency and comparability across institutions, enabling investors and counterparties to assess the operational soundness of their counterparties. It also incentivizes MIIs to invest in modern, modular architectures and robust incident‑response processes, potentially lowering systemic risk premiums. While implementation costs and the need for consistent data quality pose challenges, the index aligns India’s market infrastructure with international resilience standards, fostering confidence among global investors and supporting the country’s ambition to be a leading digital capital market hub.