QSB Risk Management Policy Requirements — What SEBI Expects in Writing

QSBs must devise a clear, well-documented risk management policy covering all relevant risks — from KYC failures to cyber-attacks. The policy must enable early identification and prevention of risk, assess the likely impact of probable risk events, and assign accountability to Key Managerial Personnel (KMP). This article explains what SEBI expects in writing, the surveillance obligations, and the half-yearly review requirements.

The Regulatory Basis

The risk management obligations for QSBs are specified in SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2023/24 dated February 06, 2023.

What the Risk Management Policy Must Cover

1. List of All Relevant Risks

The policy must encompass the following risks:

• KYC and Account Opening Risks: Submission of incomplete KYC forms, submission of fake information with an intention to commit frauds, and non-updation of information submitted as and when there is any change.
• Operational Risks: Faulty systems which can cause erroneous execution of orders from clients' account and/or unauthorized trading on behalf of the client and misutilization of client's sensitive information by any employee of the QSBs.
• Technology Risks: Technical glitches and cyber-attacks.
• General Risks: Fraud risk, credit risk, market risk, legal risk, reputation risk, and risk due to outsourcing of activities to third parties.

2. Objectives of the Risk Management Policy

The policy shall:

• Strive to address the root cause of the risks and try to prevent recurrence of such risks.
• Enable early identification and prevention of risk.
• Assess the likely impact of a probable risk event on various aspects of the functioning of the QSB such as impact on investors, financial loss to the QSB, impact on other stakeholders in the market, reputational loss etc., and lay down measures to minimize the impact of such event.
• Assign accountability and responsibility of Key Managerial Personnel (KMP) in the organization.

Surveillance of Client Behaviour

The risk management framework shall have measures for carrying out surveillance of client behaviour through:

• Analyzing the pattern of trading done by clients.
• Detection of any unusual activity being done by such clients.
• Reporting the same to stock exchanges.
• Taking necessary measures to prevent any kind of fraudulent activity in the market in terms of the regulatory requirements prescribed by SEBI and MIIs.

Ensuring Integrity of Operations

• QSBs shall maintain adequate human resources, systems, processes and procedures for seamless running of operations and protection of investor data.
• The staff of the QSBs shall be given the necessary resources and support to carry out their duties effectively and efficiently.
• QSBs shall train their employees at regular intervals in matters relating to the activities being handled by them.

Key Risk Officers

A CXO level officer shall be designated as responsible for managing key risks:

• Chief Compliance Officer: Responsible for all regulatory compliance related activities.
• Chief Information Security Officer (CISO): Responsible for all cyber security related activities.
• Chief Risk Officer: Responsible for overall risk management associated with functioning of the QSB.

Review and Reporting

• The risk management policy shall be reviewed on half-yearly basis by the QSB.
• A report in this regard shall be submitted by the risk management committee of the QSB to the stock exchange.
• The BoD/senior management shall view any recurrence of a particular incident seriously and take prompt and appropriate action including fixation of accountability.

How We Help

At Anuj Desai & Associates, we help QSBs draft comprehensive risk management policies, establish surveillance mechanisms, and ensure compliance with SEBI's requirements. If you need assistance with risk management compliance, reach out to our regulatory compliance desk.