SEBI launches IT Resilience Index for stock exchanges, clearing corps and depositories
Synopsis
SEBI has introduced a 100-point IT Resilience Index for stock exchanges, clearing corporations, and depositories — with automated scoring, an Early Warning System, and a hard operationalisation deadline of 28 February 2027. It is the most structured technology governance mandate the regulator has issued for market infrastructure to date.
Key Takeaways
SEBI introduced the IT Resilience Index (ITRI) framework for Market Infrastructure Institutions (MIIs) on 24 August .
The index scores IT systems on a 100-point scale across nine parameters ; availability and security carry the highest weight at 20 points each .
MIIs must operationalise the ITRI framework and Early Warning System by 28 February 2027 .
ITRI scores will be computed automatically from IT systems without manual intervention.
Half-yearly ITRI reports, with comparative analysis of two consecutive periods, must be submitted to the Standing Committee on Technology (SCOT) and the Governing Board within 60 days of each half-year end.
A beta version of the framework is already in place across MIIs, making the transition an upgrade rather than a fresh start.
The Securities and Exchange Board of India (SEBI) on Monday, 24 August introduced an IT Resilience Index (ITRI) framework for Market Infrastructure Institutions (MIIs) — covering stock exchanges, clearing corporations, and depositories — to systematically measure and strengthen the robustness of their critical technology systems. The index scores IT performance on a 100-point scale across nine parameters, with a full operationalisation deadline of 28 February 2027.
How the Index Is Structured
Availability and security carry the highest weightage at 20 points each, reflecting their primacy in keeping markets running without interruption. Integrity, governance, reliability and monitoring, business continuity, and modularity and flexibility each account for 10 points. Scalability and other parameters — including incident handling — carry 5 points each.
Crucially, ITRI scores will be computed automatically from IT systems without manual intervention, reducing the risk of data manipulation or reporting bias.
Early Warning System and Real-Time Monitoring
SEBI has directed MIIs to develop an Early Warning System capable of detecting possible deterioration in any ITRI parameter before it cascades into performance issues, slowdowns, or outages. This is to be paired with Real-Time Monitoring of Service Delivery — both systems must be operationalised by 28 February 2027.
MIIs have already implemented a beta version of the ITRI framework, suggesting the transition to the full framework builds on existing groundwork rather than starting from scratch.
Reporting and Governance Requirements
Under the new norms, MIIs must compute the ITRI on a half-yearly basis, submitting results within 60 days of the close of each half-year. Each submission must include a comparative analysis of two consecutive half-years alongside corrective actions taken. Reports are to be placed before the institution's Standing Committee on Technology (SCOT) and the Governing Board.
This structured reporting cadence is designed to ensure that technology governance receives board-level attention rather than remaining siloed within IT departments.
Why SEBI Is Acting Now
SEBI's circular underscores that IT systems of MIIs 'form the backbone of smooth and uninterrupted functioning of the securities market.' Any disruption, performance degradation, or compromise of these systems, the regulator warned, 'may adversely impact critical market operations and pose risks to the trust in the securities market.'
This comes amid a broader global push by financial regulators to mandate technology resilience standards following high-profile outages at exchanges and payment infrastructure providers. India's securities market, which now regularly sees daily turnover exceeding ₹1 lakh crore in the cash and derivatives segments combined, has a heightened exposure to systemic IT risk.
What Comes Next
With the beta phase already underway, exchanges and depositories are expected to move swiftly toward full compliance. Industry observers note that the automated computation requirement will demand significant integration work between operational IT systems and reporting infrastructure. The 28 February 2027 deadline gives MIIs roughly 18 months to complete the build-out — a timeline that regulators appear to regard as adequate given the beta foundation already in place.
Point of View
Yet until now there was no standardised, regulator-mandated metric to track systemic IT health. The automated scoring requirement is the smartest design choice: self-reported IT metrics at financial institutions have a poor track record globally. The real accountability test, however, will be what SEBI does when an MII's ITRI score deteriorates — the circular sets up the measurement architecture but stops short of specifying enforcement consequences for underperformance. Without a published penalty or remediation escalation ladder, the index risks becoming a compliance checkbox rather than a genuine resilience driver.
NationPress
24 Aug 2026
Frequently Asked Questions
What is SEBI's IT Resilience Index (ITRI)?
The IT Resilience Index is a 100-point scoring framework introduced by SEBI to measure the robustness of critical IT systems at Market Infrastructure Institutions such as stock exchanges, clearing corporations, and depositories. It covers nine parameters including availability, security, integrity, and business continuity, and is computed automatically from IT systems without manual intervention.
Which institutions are covered under the ITRI framework?
The framework applies to Market Infrastructure Institutions (MIIs), which include stock exchanges, clearing corporations, and depositories operating in India's securities market. These are the core entities whose technology underpins daily trading and settlement operations.
What is the deadline for MIIs to implement the ITRI framework?
SEBI has directed MIIs to fully operationalise the ITRI framework — including the Early Warning System and Real-Time Monitoring of Service Delivery — by 28 February 2027. A beta version of the framework is already in place.
How often must MIIs report their ITRI scores?
MIIs are required to compute and report their ITRI scores on a half-yearly basis, submitting results within 60 days of the end of each half-year. Each report must include a comparative analysis of two consecutive half-years and the corrective actions taken, placed before the Standing Committee on Technology and the Governing Board.
Why has SEBI introduced the ITRI framework?
SEBI introduced the framework because IT systems of MIIs are foundational to the orderly and uninterrupted functioning of India's securities market. The regulator noted that any disruption or compromise of these systems could adversely impact market operations and erode investor trust — a risk it seeks to pre-empt through structured, early-stage monitoring.
