Stock exchanges will face penalties for tech glitches: Sebi

Stock exchanges and other market infrastructure institutions as well as their top officials are liable to face penalties for lapses in handling and recitfying technical glitches, with Sebi putting in a place a stricter compliance system driven by "financial disincentives".

The markets watchdog has come out with a detailed Standard Operating Procedure (SOP) for Market Infrastructure Institutions (MIIs) less than five months after a technical glitch halted trading at the country's largest bourse NSE for nearly four hours.

There will be a "financial disincentives" structure for MIIs -- stock exchanges, clearing corporation and depositories -- for any business disruption beyond pre-defined time, according to a circular issued on Monday.

Under the structure, MIIs will have to pay in the range of Rs 1 lakh each working day to Rs 2 crore for flouting SOP while managing director (MD) and chief technology officer (CTO) of the MIIs concerned will have to cough up 10 per cent of their respective annual pay.

The penalties will be subject to various timelines specified by Sebi with respect to declaration as well as rectification of technical glitches at the MIIs.

MIIs will also attract penalties in case there is a delay in submitting a comprehensive Root Cause Analysis (RCA) report about a technical glitch.

The move will encourage MIIs to constantly monitor the performance and efficiency of their systems and upgrade  their systems to avoid any possibility of technical glitches and restart their operations expeditiously in the event of such disruption, Sebi said.

There have been instances of technical glitches impacting trading activities, including the one on February 24 this year due to which trading at the National Stock Exchange (NSE) was halted for nearly four hours.

"With increasing dependence on technology, as the operations and functioning of MIIs are fully automated right from order entry to order matching to trade confirmation leading up to clearing and settlement of trades, the instances of technical glitches at MIIs, leading to business disruption, have been occurring, despite various mechanisms stipulated by Sebi," the regulator noted.

To avoid technical glitches, Sebi has suggested that MIIs should have Business Continuity Planning, disaster recovery policies and system audit processes in place.

Considering the criticality of smooth functioning of systems of MIIs as any disruption adversely impacts all classes of investors, market participants as well as the credibility of the securities market, Sebi said that specifying a pre-defined threshold for downtime of systems of MIIs becomes desirable.

"For any downtime or unavailability of services, beyond such pre-defined time, there is a need to ensure that 'Financial Disincentive' is paid by the MIIs as well as managing director (being the executive head in-charge of all the day to day operations) and chief technology officer (being the executive head in-charge of technology) of the MII," it added.

With regard to incidents resulting in business disruption, Sebi said MIIs will have to submit information of technical glitch on immediate basis but not later than two hours from the time of occurrence of the glitch to the regulator.

This is subject to the condition that glitches of the nature of a disaster will be reported immediately upon declaration of the disaster.

MIIs will also have to submit a preliminary report within 24 hours of the occurrence of the glitch.

Further, they have to submit a Comprehensive Root Cause Analysis (RCA) report and corrective action taken to address the technical glitch within 21 days of the incident.

Such a report will be submitted to Sebi after placing the same before the Standing Committee on Technology (SCOT) and the governing board of the MII and confirming compliance with their observations.

RCA submitted by a MII should include exact cause of the technical glitch, including root cause from vendors, if applicable, exact duration of the technical glitch, chronology of events, list of business processes or systems and time for which they were impacted, recommendations of SCOT or governing boards of the MII concerned.

In addition, RCA should include details of corrective/ preventive measures taken (or to be taken) by MII along with timelines and any other aspect relevant to the technical glitch.

As part of RCA, MIIs are required to demonstrate compliance with various requirements of the SOP.

RCA will also include details regarding time of incident, time when operations were restored and in the event of a disaster, time when disaster was declared.

All communication and information with regard to a technical glitch need to be shared by the MII with Sebi through a dedicated e-mail address.

When there is a delay in submission or submission of incomplete/ inadequate RCA by a MII, Sebi said a financial disincentive of Rs 1 lakh per working day will be paid by the MII for each working day of delay.

In case, MIIs failed to timely address a technical glitch, such institutions need to cough up a financial disincentive in the range of Rs 2-25 lakh per working day.

As per the SOP, in the event of disruption of any one or more of the 'critical systems', a MII will have to, within 30 minutes of the incident, declare that incident as 'disaster'.

In case of delay in declaration of disaster beyond the timeline, Sebi said MIIs will have to pay 10 per cent of average of standalone net profit for previous two financial years or Rs 2 crore, whichever is higher.

Besides, MD and CTO of the MII concerned have to pay 10 per cent each of their annual pay (both fixed and variable components) for the financial year when the disaster occurred.

The penalty will also be levied on MD and CTO and MII if such infrastructure institution fail to restore operations of 'critical systems' including from Disaster Recovery Site within 45 minutes of declaration of disaster.

If an MII fails to restore operations of critical systems including from Disaster Recovery Site within three hours from the occurrence of the disaster,  additional financial disincentive need to be paid by them.

The financial disincentives when triggered automatically under pre-defined conditions, will be credited to the Investor Protection Fund / Core Settlement Guarantee Fund maintained by the MII, Sebi said.

In the event of any business disruption, which is not required to be declared as 'disaster', if a MII fails to restore normalcy of operations within 75 minutes to 3 hour of the incident, Sebi said such MIIs need to pay Rs 50 lakh and Rs 1 crore need to be paid for beyond 3 hours of the incident.

Further, a MII will have to submit a compliance report within 90 days of occurrence of disaster or business disruption to Sebi providing details of financial disincentive as per the SOP and the date when the amount was credited to the funds.

With regard to 'financial disincentive' on the MD/CTO of the MII arising out of the variable pay component, the compliance report will be submitted within 30 days of determination of variable pay of the concerned officials for the financial year when the disaster occurred.

In respect of the requirement of payment of financial disincentive by officials of the MII (MD and CTO), the MII will have to insert a suitable clause in the terms of appointment of these officials or in the internal code of conduct of the MII to comply with the financial disincentive requirements.

Photograph: Shailesh Andrade/Reuters