BSE, NSE come out with guidelines on tech glitches

Leading stock exchanges BSE and NSE have put out comprehensive guidelines for handling technical glitches at members' end in order to prevent disruptions.

Under the new framework, members will have to pay Rs 20,000 per day in case of failure to report the incident to the exchanges within the required timeline, BSE and NSE said in separate circulars.

The guidelines outline technology infrastructure and system requirements that a member should put in place to prevent any incident of business disruption resulting from technical glitches.

Also, the guidelines prescribe a Standard Operating Procedures (SOP) for reporting of technical glitches by members, handling business disruption, management of such business disruption, including declaration of disaster and framing of provisions for disciplinary action in case of non-compliance in reporting or inadequate management of business disruption.

Technical glitches include malfunction in hardware, software or any products and services provided by members.

The exchanges said members with a client base of more than 50,000 unique registered clients across all bourses will be required to mandatorily establish a business continuity plan or disaster recovery set up to ensure that there is well-defined continuity plan in case of such business disruptions.

The move will ensure that there is continuity of business and stability in operations of members in case of any technical glitches, so that interest of investors and market at large is not adversely impacted, the circulars issued on Wednesday noted.

With regards to reporting requirements, the exchanges have asked members to intimate them about the incident within two hours from the start of the glitch.

Besides, a preliminary incident report will be submitted to the exchange within T+1 day of the incident (T being the date of the incident).

The report will include the date and time of the incident, its details, effect and the immediate action taken.

Further, Root Cause Analysis (RCA) of the issue will have to be submitted within 21 working days.

With respect to timeline for setting up the Business Continuity Planning (BCP)/Disaster Recovery (DR), BSE and NSE said members having 50,000 unique registered clients (across all segments/exchanges) need to comply with the requirements within 12 months.

Those related to internal policy for technical glitch and preventive recovery -- pertaining to system control, network integrity, backup and recovery -- need to be completed by March 2022.

In case of failure to report the incident to the exchange (non-submission of preliminary report and/or RCA), members will be liable to pay a fine of Rs 20,000 for each working day after the due date specified, the exchanges said.In case of repeated instances of non-compliance on two or more occasions, appropriate disciplinary action will be initiated, after following due process and providing opportunity of a hearing, they added.

In the event that members fail to move to DR site within the time specified, appropriate disciplinary action will be initiated by the exchanges.

In July, the Securities and Exchange Board of India (Sebi) had issued a detailed framework for penalising market infrastructure institutions (MIIs), which include stock exchanges, clearing corporations and depositories, for technical glitches.

Photograph: Arko Datta/Reuters