Fristine Infotech
Book a session
Home/Blog/SEBI CSCRF Vendor Requirements
Financial Services & Regulation

What SEBI’s CSCRF actually requires from your technology vendors

We write this as an implementation partner to SEBI-regulated firms, not as a law firm. Verify with your compliance counsel.

CSCRF replaced SEBI’s earlier cybersecurity circulars and applies across regulated intermediaries: brokers, depository participants, AMCs, RTAs, portfolio managers and investment advisers, with obligations graded by entity category. Most of the commentary addresses what you must do. This post addresses the part that gets handled late: what it means for the vendors you depend on.

What applies to vendors, in practice

Data residency for regulatory data Where a vendor stores or processes regulatory data, Indian regions are required. Confirm the actual region, not the vendor's head office.
VAPT by CERT-In empanelled auditors Ask for the auditor's name and the report date. Companies are not "CERT-In certified". A vendor using that phrase is a signal.
SOC coverage Requirements vary by your category. Your vendor's logging has to feed whatever monitoring you're obliged to run.
Log retention Configure to your category's requirement, in India. CERT-In separately requires 180 days minimum.
Access control and audit trails On any vendor access to your systems, reviewed periodically.
Incident reporting Aligned to your obligations, including CERT-In's six-hour window, which your vendor's notification process must be fast enough to support.

The clauses to put in the contract

  1. Right to audit, for you and for SEBI, on-site where required
  2. Named subcontractors, with prior consent for changes affecting your data
  3. Processing locations, disclosed and restricted
  4. Incident notification within a defined window that lets you meet your own
  5. Log retention configured to your policy, not the vendor's default
  6. Exit and data portability, agreed at signing rather than at termination
  7. VAPT evidence provided on request, at defined frequency

The AI question CSCRF didn’t anticipate

SEBI’s position is that the regulated entity is responsible for the outputs of AI tools it deploys, including third-party tools. Read that against a language model in a regulated process and three requirements follow:

Decision-level logs, not access logs You need to know what the model was shown, what it produced, its confidence, its version, and who approved the outcome.
Evidence you assured yourself it works An evaluation suite over labelled real cases, re-run when the model or prompt changes, retained.
Documented accountability Who owns the output, who reviews exceptions, who authorises threshold changes. Written down before go-live.

The plain summary

CSCRF compliance is yours, not your vendor’s, but it’s unachievable if your vendor’s architecture, logging and contract terms don’t support it. Ask the seven contract questions above before selecting, not during your next examination.

Related

Book a working session