SEBI Circular

SEBI’s Guidelines on BCP and DR for QRTAs: A Brief Overview

The Securities and Exchange Board of India (SEBI) has been proactive in ensuring the stability and integrity of the securities market. A testament to this proactive approach is the recent circular addressed to all Qualified Registrar & Transfer Agents (QRTAs), emphasizing the importance of having robust Business Continuity Plans (BCP) and Disaster Recovery (DR) mechanisms in place. This article delves into the guidelines presented by SEBI and explains their significance.

Significance of QRTAs in Securities Market

Qualified RTAs, particularly those managing more than 2 Crore folios, are pivotal institutions in the securities market ecosystem. Their role isn’t just limited to managing investor records; they form the backbone of infrastructure that ensures the seamless and continuous functioning of the market. It is crucial for these systemically important institutions to be resilient and to have the ability to bounce back from potential disruptions.

Guidelines Overview

SEBI, in collaboration with its Technical Advisory Committee (TAC), has deemed it necessary to bolster the resilience of QRTAs. The guidelines revolve around:

• Ensuring organizational resilience and adequate documentation.
• Augmenting systems to achieve better Recovery Time Objective (RTO) and Recovery Point Objective (RPO).
• Enhancing the readiness through regular drills, both announced and unannounced.

Organizational Resilience and Documentation

3.1. Business Continuity Plan (BCP) and Disaster Recovery Site (DRS): QRTAs are required to set up BCP and a corresponding DRS to ensure the continuous flow of operations while preserving the integrity of data and transactions.

3.2. Manpower Competence at DRS/Near Site (NS): Personnel stationed at DRS or NS should be as competent as those at the Primary Data Centre (PDC). This ensures that, in case of emergencies, operations can transition smoothly without needing personnel from the PDC.

3.3. Incident and Response Team (IRT)/ Crisis Management Team (CMT): An IRT or CMT, overseen by the Managing Director (MD) or Chief Technology Officer (CTO) in the absence of the MD, should be constituted by all QRTAs. This team will shoulder the responsibility of officially declaring disasters, invoking BCP, and overseeing the shift from PDC to DRS.

3.4. Regular Review by Technology Committee: The BCP and DR policy, ratified by the board of QRTAs, should undergo quarterly reviews by the Technology Committee to ensure its effectiveness and relevance.

Configuration of DRS/NS with PDC

4.1. Necessity of Near Site (NS): In addition to the DRS, QRTAs should maintain a NS to guarantee zero data loss. Geographical considerations, such as different seismic zones, should guide the location of DRS. A minimum separation of 500 kilometres between the PDC and DRS is mandatory to minimize the risk of simultaneous impact.

4.2. Correspondence Between DRS and PDC: There should be a direct correlation in terms of hardware, software, and other technological aspects between DRS and PDC. This ensures operational continuity and minimizes potential mismatches during transitions.

4.3. Seamless Switchover Systems: Systems should be designed such that no configuration changes are required for switchover processes, especially at the end of AMCs or other regulatory entities.

Conclusion

The SEBI’s move to establish stringent guidelines for QRTAs’ Business Continuity Plan (BCP) and Disaster Recovery (DR) emphasizes its commitment to preserving the stability and reliability of India’s securities market. By ensuring that these entities are equipped to handle potential disruptions, SEBI is fortifying the very foundations of the market, thereby instilling confidence in investors and stakeholders alike. This progressive stance underscores the importance of preparedness and resilience in today’s volatile financial landscape.

PDF Embedder requires a url attribute