Why in the News
The Securities and Exchange Board of India (SEBI) has introduced an IT Resilience Index (ITRI) to assess the technological robustness of Market Infrastructure Institutions (MIIs), meaning stock exchanges, depositories and clearing corporations. The index responds to growing global concern about outages and cyberattacks at systemically important financial market infrastructure. It follows comparable resilience frameworks already adopted by regulators in the United Kingdom, the European Union, the United States, Singapore, Hong Kong and Australia. The tension is between certifying resilience on paper through a scored index and ensuring MIIs make the operational investment the index is meant to incentivise.
What does the ITRI assess?
- Nine weighted parameters: The index scores each market infrastructure institution across nine parameters covering system uptime, cyber-incident preparedness, disaster recovery capability and related technology governance measures.
- Comparative design: SEBI has drawn on resilience frameworks used by regulators in the United Kingdom, the European Union, the United States, Singapore, Hong Kong and Australia in constructing the index.
Why has SEBI shifted from compliance-checking to a quantitative resilience score for MIIs?
- Systemic-risk trigger: Rising technological dependence in capital markets means even minutes of disruption at an MII can affect millions of investors and billions of rupees in trades.
- Regulatory foundation: SEBI’s 2015 circular first classified MIIs as systemically important, mandating a robust cybersecurity framework.
- Boardroom shift: Retail participation through online platforms, algorithmic trading volumes, and faster settlement cycles have made technology reliability inseparable from market efficiency.
- Global first: ITRI is among the first attempts by any regulator to design a resilience barometer as measurable as capital adequacy is for banks.
How does ITRI’s weighting structure reflect SEBI’s risk-prioritisation approach?
- Nine-parameter design: ITRI rests on nine parameters, each weighted by a systemic-risk hierarchy, with sub-parameters to be defined by the Industry Standards Forum of MIIs.
- Highest-weighted parameters: Availability and security carry the highest weight, at 20% each, as the first line of defence for market functioning.
- Recovery-focused weighting: Business Continuity and Reliability carries 10% weight, reflecting a regulatory shift from preventing failures to absorbing shocks and recovering quickly.
- Growth-risk calibration: Scalability carries only 5% weight, reflecting SEBI’s view that rapid market growth does not yet pose an immediate stability risk.
- Early Warning System: MIIs will build an Early Warning System to detect parameter deterioration before it causes performance issues or disruptions.
What do global resilience frameworks show about the alternatives to a single numeric index?
- United Kingdom — FCA/PRA: Operational resilience rules require institutions to identify important business services and demonstrate recovery capability from severe shocks, without a single numeric score.
- European Union — DORA: The Digital Operational Resilience Act functions as a regulatory rulebook rather than a numerical scorecard.
- United States: No single resilience index exists for exchanges; technology resilience is embedded into general regulatory oversight instead.
- Singapore — Monetary Authority of Singapore: Technology risk guidelines are considered particularly relevant to India given comparably high digital financial penetration and large retail investor bases.
- Hong Kong: Cyber resilience assessment frameworks use measurable maturity levels, making them the closest structural parallel to SEBI’s numeric approach.
Can a single numeric score capture resilience across MIIs with different technology architectures?
- Architecture heterogeneity: Stock exchanges, clearing corporations and depositories operate different technology architectures and functions, raising doubts about a common index applying uniformly.
- Weight uncertainty: Questions remain on the statistical estimation of the assigned weights, finalised through Technical Advisory Committee discussions rather than validated outage data.
- Provisional status: The current weights are a starting framework that SEBI may have to refine using actual outage data, cyber incidents and stress tests.
- Pace mismatch: Technology risks evolve faster than regulatory frameworks, making the index vulnerable to obsolescence even as it is being implemented.
- Investment burden: Building automated monitoring systems, continuous testing and redundant infrastructure requires substantial investment from MIIs.
Back2Basics: Market Infrastructure Institutions (MIIs)
- MIIs are the entities that provide the trading, clearing and settlement backbone of the securities market: stock exchanges, depositories and clearing corporations.
- They are classified as systemically important, since their failure or compromise can disrupt trading and settlement across the entire market rather than a single participant.
- SEBI regulates MIIs under the SEBI (Stock Exchanges and Clearing Corporations) Regulations and the SEBI (Depositories and Participants) Regulations.
Conclusion
SEBI’s ITRI converts technology resilience from a compliance checklist into a quantitative, weighted score, a model most global regulators have not attempted. Whether this scoring approach works depends on unresolved questions: the statistical basis of the weights, the comparability of a single index across MIIs with different architectures, and whether a high score actually translates into faster recovery during an actual technology shock. Until validated against real incident data, ITRI remains a measurement framework rather than a proven resilience guarantee.
“[2015, GS2, 12 marks] For achieving the desired objectives, it is necessary to ensure that the regulatory institutions remain independent and autonomous. Discuss in the light of the experiences in recent past.”