SEBI CSCRF compliance: what fintechs and their vendors need to know

SEBI issued its Cybersecurity and Cyber Resilience Framework in August 2024, replacing a patchwork of earlier circulars with one framework for its regulated entities. Two years on, I still meet fintech founders who think it's a document for exchanges and depositories.

If you're a SEBI regulated entity of any size, CSCRF is already a live obligation, and if you sell technology to one, you should prepare as though it applies to you, because your client's compliance depends on yours.

I've worked on CSCRF along with RBI and IRDAI programs for financial services companies, and the vendor side is where most of the surprises come from.

Who it applies to

CSCRF covers SEBI regulated entities including market infrastructure institutions, stock brokers, depository participants, mutual funds and asset management companies, portfolio managers and others. Entities are grouped into categories, from market infrastructure institutions and qualified regulated entities down to mid size, small size and self certification entities, and the obligations scale with the category.

The compliance dates were extended more than once during 2025, mainly to give smaller entities time. For most categories those dates have now passed, which means auditors and SEBI inspections will be asking for evidence, not plans.

What it requires

The framework is organised around cyber resilience goals and the familiar functions of governance, identification, protection, detection, response and recovery. In practice that means a board approved cybersecurity policy, a defined governance structure, an asset inventory, access controls, vulnerability assessment and penetration testing, security monitoring, incident response and reporting, and periodic cyber audits by auditors meeting SEBI's criteria.

Larger entities have heavier expectations, including their own security operations capability and a cyber capability index. Smaller entities can rely on shared arrangements such as a market SOC offered through the exchanges.

Why vendors are in scope

CSCRF expects regulated entities to manage risks from their third party service providers. A broker whose trading platform, client onboarding or data storage sits with a fintech vendor can't simply exclude that vendor. It has to assess it, write security requirements into the contract and keep evidence.

If you build software for brokers, wealth platforms or AMCs, your next renewal will likely include a CSCRF security schedule, audit rights and incident reporting commitments. If you've ever signed a client's security annex assuming nobody would check it, this is the framework under which they'll check.

The vendor is often the last to learn it was ever in scope.

Where to start

Confirm your category, or your client's category if you're a vendor. Map CSCRF requirements against what you already have; if you hold ISO 27001, much of the governance and many controls carry over. Close the India specific gaps, such as CERT-In's six hour incident reporting and 180 day log retention, which sit alongside CSCRF. Prepare the evidence your clients' auditors will ask for before they ask.

Indian regulators tend to be an add on in global compliance tools. In Steppe, SEBI publications are already watched by the regulatory change engine, and CSCRF is on the roadmap as a framework in its own right, next to ISO 27001 and SOC 2, so a SEBI requirement and an ISO control can share the same evidence without being forced into each other's shape.

A regulator's framework reaches past the entities it names, and CSCRF reaches every vendor in a broker's technology stack.