Business Continuity Planning and DR Drills for Stock Brokers — What Auditors Check
Stock brokers with a minimum client base must establish Business Continuity Planning and Disaster Recovery Site arrangements. The framework requires stock brokers to put in place a comprehensive BCP-DR policy document outlining standard operating procedures to be followed in the event of any disaster. This article explains what auditors check, the frequency of DR drills, and the key requirements for BCP-DR compliance.
The Regulatory Basis
The BCP-DR requirements for stock brokers are specified in SEBI Circular SEBI/HO/MIRSD/TPD-1/P/CIR/2022/160 dated November 25, 2022 (as revised on January 9, 2026) and the Master Circular for Stock Brokers. Stock brokers with a minimum client base across the exchanges shall mandatorily establish business continuity / DR set up.
Key BCP-DR Requirements
BCP-DR Policy Document
Stock brokers shall put in place a comprehensive BCP-DR policy document outlining standard operating procedures to be followed in the event of any disaster. A suitable framework shall be put in place to constantly monitor health and performance of critical systems in the normal course of business. The BCP-DR policy document shall be periodically reviewed to minimize incidents affecting the business continuity.
Geographic Separation
The DRS shall preferably be set up in different seismic zones. In case, due to any reasons like operational constraints, such a geographic separation is not possible, then the Primary Data Centre (PDC) and DRS shall be separated from each other by a distance of at least 250 kilometers to ensure that both of them do not get affected by the same natural disaster.
DR Drills / Live Trading
Specified stock brokers shall conduct DR drills / live trading from DR site. DR drills / live trading shall include running all operations from DRS for at least 1 full trading day. The frequency of DR drill / live trading from DR site shall be decided by stock exchanges in consultation with specified stock brokers.
Responsible Teams
Stock brokers shall constitute responsible teams for taking decisions about shifting of operations from primary site to DR site, putting adequate resources at DR site, and setting up mechanism to make DR site operational from primary data center etc.
One-to-One Correspondence
Hardware, system software, application environment, network and security devices and associated application environments of DRS and PDC shall have one-to-one correspondence between them. Adequate resources shall be made available at all times to handle operations at PDC or DRS.
Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
Stock exchanges in consultation with stock brokers shall decide upon:
- Recovery Time Objective (RTO): The maximum time taken to restore operations from DRS after declaration of Disaster.
- Recovery Point Objective (RPO): The maximum tolerable period for which data might be lost due to a major incident.
Replication Architecture
Replication architecture, bandwidth and load consideration between the DRS and PDC shall be within stipulated RTO and the whole system shall ensure high availability, right sizing, and no single point of failure. Any updates made at the PDC shall be reflected at DRS immediately.
What Auditors Check
The System Auditor, while covering the BCP-DR as a part of mandated annual System Audit, shall check:
- The preparedness of the stock broker to shift its operations from PDC to DRS.
- Documented results and observations on DR drills conducted by the stock brokers.
- Whether the BCP-DR policy is comprehensive and periodically reviewed.
- Whether DR drills are conducted as per the prescribed frequency.
- Whether the DRS and PDC have one-to-one correspondence.
ISO Certification
Specified stock brokers shall obtain ISO certification as may be specified by stock exchanges from time to time in the area of IT and IT enabled infrastructure / processes of the stock brokers.
Rationalisation Based on Broker Size
The requirements for capacity planning, software testing, and DR drill have been rationalised based on the size of the stock brokers and their technology dependency. Smaller brokers may have less stringent requirements.
How We Help
At Anuj Desai & Associates, we help stock brokers develop and implement BCP-DR policies, conduct DR drills, and ensure compliance with SEBI's requirements. If you need assistance with BCP-DR compliance, reach out to our regulatory compliance desk.