HDFC Securities Pays Rs65 Lakh to Settle SEBI Case on Failure in Critical IT Systems, DR and Cybersecurity Policies

HDFC Securities Ltd (HDFC Sec) paid Rs65 lakh to market regulator Securities and Exchange Board of India (SEBI) for settling multiple regulatory violations related to the broker's information technology (IT) systems, disaster recovery mechanism and cybersecurity.

SEBI issued a show cause notice (SCN) to HDFC Sec on 8 August 2024, accusing the company of several breaches. These include the failure to generate alerts for the current capacity utilisation of critical assets beyond 70% in the company's IT policies. The company was also found not to have implemented the log analytics and monitoring application (LAMA) system for 47 out of 52 servers during the inspection period.

Additionally, HDFC Sec did not conduct a full trading day disaster recovery (DR) drill every quarter. SEBI also flagged the company's inadequate cybersecurity and cyber resilience policies and the incomplete categorisation of critical applications and servers for identifying critical and non-critical assets.

In response to these findings, HDFC Sec filed a settlement application on 8 August 2024. Based on this application, the internal committee (IC) recommended a settlement amount of Rs65 lakh, which was communicated to HDFC Sec's authorised representative.

HDFC Sec then submitted revised terms, which were in line with the IC recommendations. The high-powered advisory committee (HPAC) reviewed the application on 24 December 2024 and the panel of whole-time members (WTMs) approved the settlement amount on 5 February 2025. On 4 March 2025, HDFC informed SEBI about the settlement payment.

"However, it is important to note that this settlement order does not affect SEBI's right to take further action if HDFC Sec is found to have failed to make full and true disclosures, violated any undertakings or waivers, or if there are discrepancies in the settlement terms," the SEBI order says.