Cloud Adoption Framework for SEBI-Regulated Entities — Compliance Considerations

SEBI has prescribed a framework for adoption of cloud services by regulated entities, highlighting key risks and mandatory control measures. The framework, introduced through SEBI Circular SEBI/HO/ITD/ITD_VAPT/P/CIR/2023/033 dated March 6, 2023, sets clear expectations for how regulated entities must secure cloud workloads, applications, and data. This article explains the compliance considerations, including data localization, security controls, and contractual obligations.

The Regulatory Basis

The framework for adoption of cloud services by SEBI regulated entities was introduced on March 6, 2023. The major purpose of this framework is to highlight the key risks, and mandatory control measures which REs need to put in place before adopting cloud computing. The cloud framework is a principle-based framework which covers Governance, Risk and Compliance (GRC), selection of Cloud Service Providers (CSPs), data ownership and data localization, due-diligence by REs, security controls, legal and regulatory obligations, DR & BCP, and vendor lock-in risk.

Scope and Applicability

The framework applies to:

• Stock Exchanges.
• Clearing Corporations.
• Depositories.
• Stock Brokers through Exchanges.
• Depository Participants through Depositories.
• Asset Management Companies (AMCs) / Mutual Funds (MFs).
• Qualified Registrars to an Issue and Share Transfer Agents.
• KYC Registration Agencies (KRAs).

Key Compliance Considerations

Principle 1: Governance, Risk and Compliance

• Cloud Governance: The RE shall have a Board-approved governance model / strategy for cloud computing.
• Cloud Risk Management: A comprehensive risk management should be undertaken to continually identify, monitor, and mitigate risks.
• Compliance and Legal Aspects: The RE shall have policies, processes, etc. in place to ensure compliance with applicable legal and regulatory requirements.

Principle 2: Selection of Cloud Service Providers

• The storage / processing of data should be done within the MeitY empaneled CSPs' data centers holding valid STQC audit status.
• For PaaS and SaaS services, RE shall choose only those CSPs which utilize the underlying infrastructure of MeitY empaneled CSPs.

Principle 3: Data Ownership and Data Localization

• Data Ownership: The RE shall retain the complete ownership of all its data and logs, encryption keys, etc. residing in cloud.
• Data Localization: The data should reside / be processed within the legal boundaries of India.
• The CSP shall provide visibility to RE as well as SEBI into CSP's infrastructure and processes.

Principle 4: Responsibility of the Regulated Entity

• The RE is solely accountable for all aspects related to the cloud services adopted by it.
• There shall be an explicit and unambiguous delineation / demarcation of responsibilities with respect to all activities between the RE and CSP.
• The RE shall be held accountable for any violation.

Principle 5: Due Diligence by the Regulated Entity

• REs should evaluate the need, implications (financial, regulatory, etc.), risks, benefits, etc. of adopting cloud computing.
• A proper due diligence process should be established to assess the capabilities and suitability of a cloud service provider.

Principle 6: Security Controls

• Vulnerability Management and Patch Management: RE shall ensure that CSP has a vulnerability management process in place.
• Monitoring: RE shall ensure that CSP has adequate security monitoring solutions in place.
• Incident Management: RE shall ensure that the CSP has incident management processes in place.
• Multi-Tenancy: In a multi-tenant cloud architecture, RE shall ensure that CSP has taken adequate controls to ensure data isolation.
• Encryption and Key Management: Data-at-rest encryption, data-in-motion encryption, and data-in-use encryption shall be adopted. "Bring Your Own Key" (BYOK) approach shall be adopted wherever applicable.

Principle 7: Contractual and Regulatory Obligations

• A clear and enforceable cloud service provider engagement agreement should be in place.
• The contractual terms shall include provisions for audit and information access rights to the RE as well as SEBI.
• The agreement shall include provisions for termination of contract and appropriate exit strategies.

Principle 8: BCP, Disaster Recovery & Cyber Resilience

• The RE shall assess its BCP framework and ensure compliance with this cloud framework.
• RE shall develop a viable and effective contingency plan to cope with situations involving a disruption / shutdown of cloud services.

Principle 9: Vendor Lock-In and Concentration Risk Management

• RE shall assess its exposure to CSP lock-in and concentration risks.
• RE shall explore the option of cloud-ready and CSP agnostic solutions.
• Exit strategies shall be developed considering pertinent risk indicators, exit triggers, exit scenarios, possible migration options, etc.

Transition Period

• New Cloud Onboarding: The framework shall come into force with immediate effect for all new or proposed cloud onboarding assignments / projects.
• Existing Cloud Services: REs currently availing cloud services shall ensure compliance within 12 months from the date of issuance.
• Milestone-based Updates: REs must provide milestone-based updates on implementation progress.

How We Help

At Anuj Desai & Associates, we help stock brokers and other regulated entities understand and comply with the cloud adoption framework, develop cloud governance policies, and ensure compliance with SEBI's requirements. If you need assistance with cloud adoption compliance, reach out to our regulatory compliance desk.