SEBI Cybersecurity Framework: Powerful Market Rule Changes
Crazyrites Editorial Team
September 12, 2026
SEBI Cybersecurity Framework Gets Fresh Attention
SEBI cybersecurity framework: India’s capital market regulator, the Securities and Exchange Board of India (SEBI), is considering important changes aimed at strengthening technology security in the securities market and improving the recently introduced Closing Auction Session (CAS).
The SEBI cybersecurity framework proposal focuses on extending the IT and Cyber Security Framework applicable to Market Infrastructure Institutions (MIIs) to their subsidiaries. Separately, SEBI has proposed changes to the CAS system and the way derivatives settlement prices are calculated on expiry days.
These developments are important because India’s financial markets now depend heavily on technology, digital systems, data networks, and automated trading. At the same time, the introduction of CAS has created questions about how closing prices interact with derivatives settlement.
Therefore, SEBI’s latest proposals are aimed at improving the market without removing the broader regulatory direction.
SEBI published its consultation paper on the cybersecurity framework for MII subsidiaries on September 11, 2026. The regulator has also been reviewing the CAS system after its introduction in the equity cash segment.
Key Changes at a Glance
| Area | Proposed Change | Main Objective |
|---|---|---|
| Cybersecurity | Apply MII IT and cyber framework to subsidiaries | Stronger technology protection |
| Market infrastructure | Greater security oversight | Reduce technology-related risks |
| Closing Auction Session | Review of CAS-related mechanisms | Better price discovery |
| Derivatives settlement | Two proposed settlement options | Reduce expiry-day uncertainty |
| Indicative index values | Proposed changes during CAS | Avoid misleading signals |
| Order changes | Possible restrictions on cancellations | Improve auction stability |
| Public feedback | Consultation process | Gather market participant views |
What Is the SEBI Cybersecurity Framework Proposal?
The SEBI cybersecurity framework proposal deals with the technology and cyber-risk environment surrounding Market Infrastructure Institutions.
MIIs play a central role in India’s securities market. They include institutions such as stock exchanges, clearing corporations, and depositories. Their systems process large amounts of trading, settlement, and investor-related information.
Because of this role, technology failures or cyber incidents can potentially affect a large number of market participants.
SEBI already has an IT and Cyber Security Framework for MIIs. The new consultation paper examines how this framework can also apply to subsidiaries of these institutions.
According to SEBI’s official listing, the consultation paper is specifically titled “Applicability of IT and Cyber Security Framework of MIIs to their Subsidiaries.”
The proposal is therefore focused on creating stronger and more consistent technology controls across the wider MII structure.
Why Cybersecurity Matters for Financial Markets
SEBI cybersecurity framework: Modern stock markets operate almost entirely through digital systems.
Orders are submitted electronically. Trading information moves through computer networks. Clearing and settlement depend on technology. Investors also use digital platforms to monitor portfolios and execute transactions.
As a result, cybersecurity is no longer only an IT department issue.
A serious technology problem could affect market operations, data protection, business continuity, and investor confidence.
The SEBI cybersecurity framework approach reflects this changing environment. By looking at subsidiaries as part of the wider risk structure, the regulator can seek more consistent security standards.
This does not mean that every cyber incident can be prevented. Instead, stronger controls can help organizations identify risks earlier, respond to incidents more effectively, and recover important services when problems occur.
Why MII Subsidiaries Are Important
A large financial institution can have multiple subsidiaries or connected entities that perform different functions.
If the main organization has strong cybersecurity controls but a connected subsidiary has weaker systems, attackers may look for that weaker point.
This is one reason regulators around the world increasingly focus on third-party and connected-system risks.
The SEBI cybersecurity framework proposal could help create a more unified approach to technology security within MII groups.
The consultation process is also important because market infrastructure organizations can provide practical feedback about how such rules should work in real operating environments.
SEBI can then consider those views before finalizing any changes.
SEBI Also Reviews the Closing Auction Session
SEBI cybersecurity framework: Alongside the cybersecurity proposal, SEBI is also reviewing the operation of the Closing Auction Session.
The CAS was introduced in the equity cash segment from August 3, 2026. The system was designed to improve closing price discovery through an auction process.
However, the new system has raised concerns about its interaction with derivatives settlement, particularly on expiry days.
SEBI has therefore proposed possible changes to the settlement mechanism rather than simply abandoning CAS.
This distinction is important.
The regulator has indicated that CAS will remain, while adjustments can be considered to improve the way different parts of the market work together.
Two Options for Derivatives Settlement
SEBI’s latest proposal includes two possible approaches for determining settlement prices for index and stock derivatives on expiry days.
The first option is a Blended VWAP approach.
Under this proposal, the calculation would combine trading activity from the final 30 minutes of the Continuous Trading Session with the 10-minute Closing Auction Session.
The second option would use a Closing Trade Session VWAP, effectively separating the CAS from expiry-day derivatives settlement for a period.
These alternatives are intended to address concerns about the interaction between the new closing auction process and derivatives pricing.
Why Expiry Days Need Special Attention
Expiry days can see unusually high trading activity in derivatives.
Futures and options contracts are settled according to specified rules, and the settlement price can have a direct impact on the financial outcome for market participants.
When a new closing auction process is introduced, its timing and price discovery mechanism need to work smoothly with derivatives settlement.
The SEBI cybersecurity framework and CAS proposals may appear unrelated at first. However, both reflect the same broader regulatory goal: making India’s market infrastructure more reliable, transparent, and resilient.
One proposal focuses primarily on technology and cyber risk, while the other focuses on market structure and price discovery.
Proposed Changes to Indicative Prices
Another important part of the CAS review involves indicative values displayed during the auction.
SEBI has proposed withholding indicative index close levels during the auction because such values may not always represent an actual traded price.
The regulator has also considered continuing to provide the indicative equilibrium price for individual stocks.
This difference matters because investors may interpret displayed numbers as meaningful market prices even when those numbers are still part of an auction calculation.
Reducing confusion around such information could help market participants make better decisions.
Possible Changes to Order Cancellations
SEBI has also proposed restrictions related to order cancellations and modifications during the auction.
One proposal would limit order cancellations beyond a specified level linked to the reference price.
The purpose is to reduce the possibility of excessive order changes during a sensitive period.
The regulator is also considering changes to the post-closing auction window and other aspects of market timing.
These changes are still proposals, so market participants will have an opportunity to provide feedback before any final decision is made.
What Does This Mean for Investors?
For ordinary investors, the immediate impact may not be dramatic.
Most long-term investors are unlikely to notice major changes in their day-to-day investing activity simply because of the CAS review.
However, investors should understand that the closing price of a stock can be important for portfolio valuation, index calculations, derivatives, and other market functions.
The proposed changes are mainly intended to improve the process rather than create unnecessary disruption.
The SEBI cybersecurity framework proposal could also benefit investors indirectly by strengthening the technology environment behind market operations.
Better security controls can support stronger business continuity and help protect important systems and information.
What Does This Mean for Traders?
Active traders, especially those involved in derivatives, may have more direct interest in the CAS proposals.
Changes to expiry-day settlement calculations can influence how traders manage positions close to expiry.
The two proposed settlement methods could produce different outcomes depending on trading conditions during the final part of the market session.
Therefore, traders and brokers will likely study the consultation paper carefully.
At the same time, it is important to remember that SEBI has not yet finalized every proposed change.
Why SEBI Is Taking a Consultation Approach
SEBI’s consultation process allows market participants to provide feedback before regulatory changes are finalized.
This is especially useful for complicated market systems because rules can have different effects on exchanges, brokers, clearing corporations, institutional investors, retail investors, and technology providers.
For the SEBI cybersecurity framework, feedback can help identify practical challenges in applying MII security requirements to subsidiaries.
For CAS, feedback can help the regulator understand how proposed settlement and timing changes could affect trading activity.
SEBI’s recent consultation activity shows that the regulator is using this process across several areas of India’s financial markets.
The Bigger Picture for India’s Markets
India’s stock market has grown rapidly, and its technology infrastructure has expanded alongside it.
Trading volumes, digital participation, algorithmic systems, online investing, and derivatives activity have all increased the importance of reliable market infrastructure.
This makes cybersecurity and market design equally important.
The SEBI cybersecurity framework proposal addresses the security side of this equation.
The CAS review addresses the market-structure side.
Together, these developments show that regulation is increasingly focused not only on investor protection but also on the technology and processes that support the entire market.
Analysis: Stability Is the Main Goal
The most important point is that SEBI does not appear to be moving away from technology-driven market development.
Instead, the regulator is trying to improve the systems after observing how they work in practice.
The CAS review is a good example.
SEBI introduced the auction system to improve closing price discovery. After observing its interaction with derivatives markets, the regulator is now considering adjustments.
That approach allows the market structure to evolve without necessarily reversing the original policy objective.
Similarly, the SEBI cybersecurity framework proposal recognizes that cyber risk can extend beyond a primary institution to its connected entities.
Stronger security standards across the wider MII ecosystem could therefore become an important part of market resilience.
What Happens Next?
The next step is the consultation process.
Market participants can study SEBI’s proposals and submit their feedback. The regulator will then consider the responses before deciding whether changes are required and what final form those changes should take.
For CAS, SEBI has invited comments on the proposed adjustments, with the consultation process running into early October.
For the cybersecurity proposal, stakeholders will also have an opportunity to respond to the consultation paper.
The final rules may therefore differ from the proposals currently under discussion.
Conclusion
SEBI’s latest proposals show how India’s financial market regulation is adapting to a rapidly changing digital environment.
The SEBI cybersecurity framework proposal could strengthen technology and cyber controls across MII subsidiaries, while the proposed CAS changes aim to improve closing price discovery and reduce uncertainty around derivatives settlement.
For investors, these changes are mainly about creating a safer and more stable market environment. For traders and market institutions, they could bring adjustments to how closing auctions, settlement prices, and trading processes operate.
Importantly, these are proposals being discussed through SEBI’s consultation process. The final framework will depend on feedback from market participants and the regulator’s assessment.
Overall, the direction is clear: stronger technology protection, better market processes, and greater attention to how different parts of India’s financial system work together. These steps can help support a market environment that remains efficient, transparent, and resilient as digital trading continues to expand.
Sources
- SEBI — Consultation Paper on Applicability of IT and Cyber Security Framework of MIIs to their Subsidiaries
- SEBI — Reports and Consultation Papers
- Reuters — Reporting on SEBI’s proposed changes to derivatives settlement and CAS.
- Economic Times — Reporting and analysis of SEBI’s proposed CAS framework changes.
- Financial Express — Reporting on CAS, F&O settlement and proposed trading change
