SEBI Fines Jainam Broking ₹7 Lakh Over Client-Fund, KYC, Reporting and Cybersecurity Lapses
The Securities and Exchange Board of India has imposed a total monetary penalty of ₹7 lakh on Jainam Broking Limited after an adjudication proceeding covering client-fund controls, regulatory reporting, KYC data, trading-terminal records and cybersecurity requirements. SEBI published the adjudication order on September 2, 2026.
The order is relevant beyond the penalty amount because the cited lapses span several control layers that brokerage finance, compliance, internal-audit and technology teams routinely manage. The findings reported from the order include movement of money between client and proprietary bank accounts without adequate supporting documentation, inaccurate submissions to exchanges, client-data mismatches and deficiencies in cybersecurity governance.
Client and proprietary fund movements came under scrutiny
According to a same-day report of the SEBI order, the inspection examined transfers between client bank accounts and the broker's own bank accounts during one inspection period. Jainam Broking transferred about ₹30,052.15 crore from client accounts to its own accounts and about ₹33,261.22 crore in the reverse direction, producing a net movement of roughly ₹3,209.07 crore from the broker's own accounts towards client accounts.
The broker argued that there was no mutualisation of client funds because the net flow was towards client accounts and payout obligations had been met. SEBI's reported finding, however, focused on the regulatory conditions governing transfers between client and proprietary accounts and the absence of adequate supporting documents explaining the movements.
SEBI also identified reporting and funding-control lapses
The reported inspection findings included incorrect reporting of margin utilised for positions of credit-balance clients on four sample dates in February 2022, involving ₹47.13 lakh. The broker attributed this to a back-office system error, but the regulator's position was that a system issue did not remove the intermediary's responsibility to make accurate regulatory submissions.
Another finding concerned additional exposure to clients whose debit balances remained unpaid beyond the prescribed period. Out of 75 cases examined, nine cases involving funded amounts of ₹59.69 lakh were reported as exceeding the applicable requirement.
KYC and client-master mismatches were substantial
The inspection also identified data-quality issues between the broker's Unique Client Code records and its back-office systems. The reported mismatches included 3,104 email IDs, 823 mobile numbers and 530 cases in which both email IDs and mobile numbers did not match. KRA-related details for 13 clients were also reported as not having been updated within the prescribed period or as still being under process.
For compliance teams, these findings highlight a recurring regulatory risk: customer information cannot be treated as a one-time onboarding dataset. Client-master data used across KYC, exchange reporting, surveillance and communication systems needs periodic reconciliation so that one system does not drift away from another.
Bank-balance and supervision reporting also featured in the order
SEBI was reported to have found an under-reporting of bank balance by ₹50.88 lakh in a weekly enhanced-supervision report as of September 30, 2022. Discrepancies were also found in client-level ledger balances for 20 clients out of 177,383 reported balances, and user details for 11 trading terminals were stated to have been incorrectly reported.
Risk-based supervision reporting was another area of concern. The same-day report states that brokerage figures for the period ending March 2022 were not reported on the required basis, including a ₹39.44 crore shortfall in the NSE brokerage figure relative to what SEBI said should have been reported.
Cybersecurity weaknesses formed a separate compliance theme
The adjudication findings reported by Moneylife also included several technology-control gaps: absence of the required STQC certification for the trading and back-office vendor, incomplete vulnerability assessment and penetration testing coverage of critical IT assets, non-registration with CERT-In, failure to share CISO details with CERT-In and absence of a Security Operations Centre.
The broker said it had conducted VAPT exercises and had taken corrective steps. It also stated that a CISO was appointed in December 2023 and that an SOC was under development. SEBI nevertheless treated the applicable cybersecurity requirements as having not been complied with during the relevant period.
How the ₹7 lakh penalty was structured
SEBI imposed ₹5 lakh under Section 15HB of the SEBI Act and ₹2 lakh under Section 23D of the Securities Contracts (Regulation) Act, taking the total to ₹7 lakh. In assessing the matter, the regulator was reported to have noted that no quantifiable disproportionate gain or unfair advantage was established and that the exact monetary loss to investors or clients could not be determined from the material available. Corrective measures and the absence of a client complaint on record were also noted.
Practical takeaway for intermediaries and auditors
The order shows why broker compliance needs integrated controls rather than separate checklists for finance, KYC, regulatory reporting and technology. Firms should reconcile client and proprietary bank movements with documentary support, validate exchange submissions against source systems, periodically compare UCC and back-office client data, test supervision reports before filing, and treat cybersecurity evidence such as VAPT scope, CERT-In requirements and vendor certifications as auditable compliance records.
The official SEBI order page dated September 2, 2026 should be consulted for the operative adjudication record and final legal wording.
Official source: View the official source document
Key takeaway
Fresh same-day SEBI enforcement order with multiple quantified compliance findings across client funds, data quality, regulatory reporting and cybersecurity.
