SaaS-Based Solutions — SEBI's Advisory for Financial Sector Organisations Explained
SEBI has issued an advisory for financial sector organisations regarding Software as a Service (SaaS) based solutions, emphasising the need for complete protection and seamless control over critical systems. The advisory, issued through SEBI Circular SEBI/HO/MIRSD2/DOR/CIR/P/2020/221 dated November 3, 2020, was based on an advisory from the Indian Computer Emergency Response Team (CERT-In). This article explains the advisory and the compliance requirements.
The Regulatory Basis
The Ministry of Electronics & Information Technology, Government of India (MoE&IT) issued an advisory for Financial Sector organizations to improve their cyber Security Posture by availing Software as a Service (SaaS) based solution for managing their Governance, Risk & Compliance (GRC) functions. The advisory was forwarded to SEBI for bringing the same to the notice of financial sector organization.
Key Requirements of the Advisory
Complete Protection
Stock brokers are advised to ensure complete protection over the critical systems at their organizations. This includes:
- Continuous Monitoring: Through direct control and supervision protocol mechanisms.
- Data Security: Keeping the critical data within the legal boundary of India.
- Seamless Control: Ensuring seamless control over critical systems at all times.
Critical Data Protection
The advisory emphasises that critical data should be kept within the legal boundary of India. This means that:
- Data should not be stored or processed outside India.
- Data should be subject to Indian laws and regulations.
- Data should be accessible to Indian regulatory authorities.
Compliance Requirement
The compliance of the advisory shall be reported in the half yearly report by stock brokers to stock exchanges with an undertaking:
"Compliance of the SEBI circular for Advisory for Financial Sector Organizations regarding Software as a Service (SaaS) based solutions has been made."
Why the Advisory Matters
Increasing Cyber Threats
Financial sector organizations are increasingly targeted by cyber-attacks. SaaS-based solutions, while offering benefits, also introduce new risks if not properly managed.
Data Localisation
Keeping critical data within India ensures that it is subject to Indian laws and regulations, and accessible to Indian regulatory authorities.
Regulatory Oversight
The advisory ensures that financial sector organizations maintain adequate oversight over their SaaS-based solutions, even when the solutions are provided by third-party vendors.
How We Help
At Anuj Desai & Associates, we help stock brokers and other financial sector organisations understand and comply with the SaaS advisory, implement appropriate controls, and report compliance to stock exchanges. If you need assistance with SaaS compliance, reach out to our regulatory compliance desk.