Cloud adoption offers significant benefits for portfolio managers, but it also presents compliance challenges. This article explains the cloud adoption framework and compliance considerations.
The Regulatory Framework
SEBI Cloud Services Framework
SEBI has developed a framework for adoption of cloud services by SEBI Regulated Entities. The framework aims to highlight key risks and mandatory control measures which regulated entities need to put in place before adopting cloud computing.
Key Areas Covered
The framework covers:
- Governance, Risk and Compliance (GRC)
- Selection of Cloud Service Providers (CSPs)
- Data ownership and data localization
- Due-diligence by regulated entities
- Security controls
- Legal and regulatory obligations
- DR & BCP
- Vendor lock-in risk
Compliance Considerations
Data Localisation
The framework provides guidelines for stock brokers and other SEBI regulated entities using cloud-based services such as Software-as-a-Service (SaaS) from Cloud Service Providers (CSPs).
Key Requirements:
- Retain complete ownership of your data, logs, etc. residing in the cloud
- Ensure localization of the data within legal boundaries of India
- Data encryption keys must remain within Indian jurisdiction
- Routing through foreign servers may breach data localization requirements
SEBI's Right of Access
The aim of the framework is to ensure SEBI's right to access regulated entities' data and SEBI's rights of search and seizure.
Cloud Service Provider Selection
Due Diligence:
- Assess CSP capabilities and security posture
- Verify compliance with regulatory requirements
- Evaluate financial stability and business continuity
Contractual Requirements:
- Clear data ownership provisions
- Data localization commitments
- Access rights for SEBI
- Security obligations
- Business continuity provisions
Security Controls
Data Protection:
- Encryption of data at rest and in transit
- Access controls
- Data segregation
Monitoring:
- Continuous security monitoring
- Incident detection and response
- Audit logging
Key Principles
Data Ownership
Regulated entities must retain complete ownership of their data, logs, etc. residing in the cloud.
Data Localization
Data must be localized within the legal boundaries of India.
Accountability
Regulated entities are accountable for ensuring subcontractors of Cloud Service Providers also comply with STQC/MeitY norms.
Security
Appropriate security controls must be implemented to protect data.
Implementation Considerations
Risk Assessment
Conduct a thorough risk assessment before adopting cloud services.
Vendor Due Diligence
Perform comprehensive due diligence on cloud service providers.
Contract Review
Ensure contracts address all regulatory requirements.
Ongoing Monitoring
Continuously monitor cloud service provider compliance.
Consequences of Non-Compliance
Regulatory Action
Non-compliance with cloud framework can result in enforcement action by SEBI.
Data Breach
Inadequate cloud security can lead to data breaches.
Expert Legal Guidance
Anuj Desai & Associates provides expert legal advisory services on cloud adoption compliance for portfolio managers. Our securities law experts help clients navigate the cloud framework, select compliant providers, and ensure regulatory compliance. Contact us for guidance on cloud adoption and other regulatory matters.