SEBI Introduces IT Resilience Index for Market Infrastructure Institutions

The Securities and Exchange Board of India has issued a fresh circular on 24 August 2026 introducing an IT Resilience Index for Market Infrastructure Institutions, or MIIs. The measure is significant because stock exchanges, clearing corporations and depositories sit at the operational core of India’s securities market, and their technology systems must remain available, secure and recoverable even under stress.

What SEBI has changed

SEBI’s August 24 circular moves the IT Resilience Index, commonly referred to as ITRI, from consultation into the regulator’s live circular framework. SEBI had first published a detailed consultation paper on 25 March 2026 after discussions with Market Infrastructure Institutions and its Technical Advisory Committee. The consultation proposed a system-driven index that could measure the health and robustness of critical technology systems using a common set of parameters and weightages.

The official August 24 listing confirms that SEBI has now issued the circular titled “IT Resilience Index for Market Infrastructure Institutions (MIIs)”. The underlying framework is intended to give MII management, oversight committees and governing boards a repeatable way to assess technology resilience, identify weak areas and track corrective action over time.

Which institutions are covered

The framework is directed at Market Infrastructure Institutions. In SEBI’s consultation design, this covered stock exchanges, clearing corporations and depositories. The proposed index was designed to measure the robustness of critical systems identified in SEBI’s existing master circulars, while also bringing within scope other systems that feed or relate to those critical systems.

That makes the framework broader than a simple uptime score. It is intended to look across the technology environment supporting market operations rather than only at a single trading or settlement application.

Nine resilience dimensions were built into the framework

SEBI’s consultation framework set out nine parameters with a total weight of 100. Availability and security carried the highest proposed weightage at 20 each. Integrity, governance, reliability and monitoring, business continuity, and modularity and flexibility carried 10 each. Scalability carried 5, while other areas such as incident handling accounted for the remaining 5.

This structure is relevant for audit, risk, technology and compliance teams because it treats resilience as a combination of operational availability, cyber defence, governance, monitoring and recoverability rather than as one isolated control metric.

Half-yearly computation and board-level review

In the framework published for consultation, MIIs were required to compute ITRI on a half-yearly basis within 60 days from the end of each half-year. A comparative analysis of two consecutive half-years, together with observations of the relevant oversight committee or governing board and details of corrective actions taken or proposed, was to be submitted to SEBI within 90 days from the end of the half-year.

The consultation also emphasised that the index should, to the extent possible, be system-driven and automatically computed from IT systems or extracted system data rather than depend on manual intervention. The stated objective was to make the measure more objective, non-discretionary and comparable.

Standardisation through the Industry Standards Forum

SEBI’s earlier framework assigned the Industry Standards Forum of MIIs an important implementation role. The forum was expected to finalise sub-parameters, measurement criteria, baseline parameters, acceptable threshold scores, a standard operating procedure and an objective scoring methodology. The aim was to make scores comparable across different MIIs instead of allowing each institution to create an entirely different internal measurement approach.

The March proposal had also stated that MIIs had already implemented a beta version of the index and contemplated the first submission for the half-year ending 30 September 2026. Compliance teams should therefore read the final August 24 circular closely for the operative implementation dates, any changes from the consultation draft and the exact reporting requirements now applicable.

Why this matters for finance, audit and compliance professionals

Although the circular is technology-focused, its implications extend into governance, internal audit, operational risk and regulatory compliance. Technology resilience can affect trading continuity, settlement, depository operations, client service and the integrity of market data. A formal index also creates a recurring evidence trail that boards and oversight committees may use to monitor weaknesses and remediation.

For internal audit and assurance teams at affected institutions, practical readiness may include mapping critical and supporting systems, validating the quality of data feeding the index, checking governance over score computation, reviewing incident and business-continuity metrics, and confirming that corrective actions are formally tracked. Finance and risk teams should also understand whether resilience investments or remediation programmes arising from the framework have budget, vendor or operational implications.

What teams should do now

- Obtain and review SEBI’s final August 24 circular against the March 25 consultation draft.

- Confirm the exact systems and entities covered by the final framework.

- Map current availability, security, continuity, monitoring and incident-handling metrics to the ITRI parameters.

- Check governance for half-yearly computation, board or oversight review and regulatory submission.

- Identify any gap between current technology-risk reporting and the standardised ITRI methodology.

SEBI’s August 24 circular makes IT resilience a more structured regulatory measurement issue for India’s core securities-market infrastructure. The key development is not merely the creation of another technology score: it is the move toward a common, system-driven and periodically governed framework that allows resilience to be measured, compared and acted upon. MIIs and their audit, risk, compliance and technology teams should now work from the final circular and verify the operative timelines and detailed measurement requirements.

Useful official links

Consultation Paper PDF - Framework of IT Resilience Index for MIIs

Key takeaway

This is a fresh SEBI circular dated August 24, 2026 that converts a previously consulted framework into a live regulatory development affecting core securities-market infrastructure.