Chapter 6: SEBI (Intermediaries) Regulations, 2008

The SEBI (Intermediaries) Regulations, 2008 were notified on May 26, 2008 to create a harmonized regulatory architecture across all market intermediaries. While intermediary-specific regulations govern technical details (such as net worth), the Intermediaries Regulations provide a unified framework for registration, inspection, and enforcement.

The 'Fit and Proper Person' Mandate (Schedule II)

Registration as an intermediary is a privilege contingent upon continuous adherence to the Fit and Proper Person criteria under Schedule II:

+-----------------------------------------------------------------------------------+
|                   CRITERIA FOR 'FIT AND PROPER PERSON' (Schedule II)              |
+-----------------------------------------------------------------------------------+
| 1. FINANCIAL INTEGRITY: Sound solvency, clean credit history, absence of default. |
| 2. MORAL CHARACTER: Honesty, ethical behavior, truthfulness, and transparency.    |
| 3. REPUTATION & RECORD: Absence of regulatory sanctions, convictions, or censure. |
| 4. COMPETENCE & QUALIFICATIONS: Educational standards, NISM compliance, staff.    |
+-----------------------------------------------------------------------------------+

Statutory Disqualifications under Schedule II

An applicant or intermediary is automatically deemed not 'fit and proper' if:

• It or its whole-time directors, key managerial personnel (KMPs), or promoters have been convicted of an offence involving moral turpitude or economic fraud;
• An order of insolvency, winding-up, or liquidation has been passed;
• Declared a Wilful Defaulter by the RBI or a Fugitive Economic Offender;
• Restrained or debarred from securities market access by SEBI or any other financial sector regulator (RBI, IRDAI, PFRDA);
• A charge sheet has been filed by a law enforcement agency in matters involving economic fraud or national security.

Chapter III of the Intermediaries Regulations establishes foundational compliance duties that apply across all market intermediaries.

Key Statutory Obligations

1. Appointment of Compliance Officer (Regulation 14):
   • Every intermediary shall appoint a Compliance Officer to monitor compliance with the Act, rules, regulations, notifications, guidelines, and circulars issued by SEBI or the Central Government.
   • The compliance officer must report any material non-compliance in writing directly to the Board of Directors.
2. Maintenance of Records and Inspection Access:
   • Intermediaries must maintain books of accounts, client registration dossiers, risk disclosure documents, and electronic audit trails for a minimum of five (5) to eight (8) years.
   • Must provide unhindered access to SEBI-authorized inspection officers.
3. Investor Grievance Redressal:
   • Must maintain an active infrastructure to resolve investor complaints channeled through SEBI's SCORES 2.0 platform within 21 calendar days.
   • Must participate in the SMART ODR (Online Dispute Resolution) portal for institutional conciliation and arbitration.
4. Supervision of Artificial Intelligence (AI) and Machine Learning (ML):
   • Intermediaries utilizing automated algos, AI-driven advisory engines, or automated execution bots must maintain continuous human oversight.
   • Must submit quarterly disclosures to stock exchanges detailing the scope, safety controls, and risk management of deployed AI/ML algorithms.

Chapter V of the Intermediaries Regulations establishes a two-tier disciplinary process designed to ensure natural justice before any punitive sanction is imposed.

The Two-Tier Disciplinary Architecture

+-----------------------------------------------------------------------------------+
|                        SEBI DISCIPLINARY PROCEEDING FLOW                          |
+-----------------------------------------------------------------------------------+
| 1. AUDIT / INSPECTION REPORT: Identifies material defaults or non-compliance.     |
|         |                                                                         |
|         v                                                                         |
| 2. DESIGNATED AUTHORITY (DA) APPOINTMENT (Executive Director level)               |
|    - Issues Show Cause Notice (SCN) specifying alleged regulatory contraventions  |
|    - Allows 21 days for written response and grants personal hearing              |
|         |                                                                         |
|         v                                                                         |
| 3. DA RECOMMENDATION REPORT: Submits findings to the Designated Member (DM).      |
|    - May recommend: Suspension, Cancellation, Market Debarment, or Censure.       |
|         |                                                                         |
|         v                                                                         |
| 4. DESIGNATED MEMBER (Whole-Time Member of SEBI) ADJUDICATION                     |
|    - Issues second SCN enclosing the DA Report                                    |
|    - Evaluates supplementary submissions and conducts final personal hearing      |
|    - Passes Final Quasi-Judicial Order under Section 12(3) / Regulation 27        |
+-----------------------------------------------------------------------------------+

Statutory Sanctions

• Suspension of Certificate: Prohibits the intermediary from taking on new clients or executing new transactions for a specified period (e.g., 3 months to 2 years). Existing open trades are wound down under exchange supervision.
• Cancellation of Certificate: The intermediary's registration is permanently revoked, and its market access is terminated.
• Common Order (Regulation 34A): Where multiple regulated entities within the same corporate group share common promoters and systemic violations occur across multiple licenses, the Designated Member may pass a single unified order covering all group intermediaries.

Regulatory inspections test whether an intermediary's actual operations conform to statutory regulations and investor protection mandates.

Inspection Process Lifecycle

+-----------------------------------------------------------------------------------+
|                        REGULATORY INSPECTION LIFECYCLE                            |
+-----------------------------------------------------------------------------------+
| 1. NOTICE & PIQ: Issuance of Inspection Notice with Pre-Inspection Questionnaire  |
| 2. ON-SITE / REMOTE SCRUTINY: Verification of trade logs, ledgers & bank balances |
| 3. EXIT INTERVIEW: Inspectors discuss preliminary factual findings with management|
| 4. INSPECTION REPORT: Detailed report categorizing technical vs serious violations|
| 5. INTERMEDIARY RESPONSE: Detailed point-by-point reply within 21 days            |
| 6. REMEDIATION / ENFORCEMENT: Corrective Action Plan (CAP) or Administrative SCN  |
+-----------------------------------------------------------------------------------+

Critical Verification Areas during Intermediary Inspections

• Segregation of Funds: Verifying that client bank accounts are strictly segregated from the intermediary's own proprietary account and that client funds are never used for proprietary trading.
• Pledging of Client Securities: Inspecting whether client securities were pledged with clearing corporations strictly for meeting that specific client's margin obligations, using the mandatory client-specific margin pledge system.
• Contract Notes & Timestamps: Confirming that contract notes are digitally generated and emailed within 24 hours of trade execution, bearing valid audit logs and digital signatures.
• KYC & Client Due Diligence: Reviewing customer onboarding files, in-person verification (IPV) records, Aadhaar offline XML verification, and periodic risk categorization updates.

In modern interconnected markets, operational resilience and cybersecurity are critical regulatory priorities. SEBI's comprehensive Cybersecurity and Cyber Resilience Framework (CSCRF) governs all registered intermediaries and MIIs.

The Five Strategic Cybersecurity Goals

The framework is structured around five strategic cybersecurity pillars:

1. Anticipate: Vulnerability management, continuous threat intelligence integration, and rigorous attack surface assessments.
2. Withstand: Architectural segregation of trading networks, multi-factor authentication (MFA) across all administrative access, and strict role-based access controls (RBAC).
3. Contain: Automated endpoint detection and response (EDR), network micro-segmentation, and firewalls preventing horizontal breach propagation.
4. Recover: Immutable, off-site air-gapped data backups, Disaster Recovery Sites (DRS) with low Recovery Point Objective (RPO) and Recovery Time Objective (RTO).
5. Evolve: Mandatory periodic Red-Teaming, external Vulnerability Assessment and Penetration Testing (VAPT), and lessons-learned implementation.

Key Regulatory Mandates for Intermediaries

• Chief Information Security Officer (CISO): Every designated intermediary must appoint a qualified, dedicated CISO reporting to the Board/Audit Committee.
• Six-Hour Incident Reporting: Any cybersecurity breach, ransomware incident, or unauthorized system compromise must be reported to SEBI and CERT-In within six (6) hours of detection.
• Periodic Audits: Intermediaries must conduct comprehensive cybersecurity audits through CERT-In empaneled auditing organizations at least once or twice annually, depending on tier classification.