The Securities and Exchange Board of India (Sebi) has proposed significant governance reforms for market infrastructure institutions (MIIs), including relaxed director eligibility rules and standardised requirements for four key management roles. According to reports from The Economic Times and ETBFSI, the regulator announced these changes on Wednesday through a consultation paper aimed at widening access to expertise while strengthening technology, cybersecurity, compliance and risk management across MIIs. The market regulator cited practical difficulties faced by MIIs in finding suitable candidates for director positions, particularly Public Interest Directors, under the existing provisions as a key driver behind these proposed changes. Sebi noted that it had received representations that the existing provisions were "very restrictive," making individuals on the board of a company ineligible for appointment as directors on an MII governing board even when they were "very remotely related" to the associates of the company that may be a TM, CM or DP. As per The Economic Times, the current rules have made it difficult for MIIs to find suitable candidates, particularly for public interest director positions.
Sebi has proposed extending the existing carve-out for directors of public financial institutions and public-sector banks to directors of companies with well-diversified shareholding, where such companies have associates that are trading members (TMs), clearing members (CMs) or depository participants (DPs). The regulator has suggested defining well-diversified shareholding as a structure where no shareholder, other than public sector shareholders, individually or together with persons acting in concert, directly or indirectly holds 10% or more stake, control or voting rights. Under current rules, no trading member or clearing member, or their associates and agents, can be on the governing board of a recognised stock exchange or recognised clearing corporation. The regulator noted that conglomerates and holding companies may have multiple subsidiaries operating with Chinese walls, with little or no interference in their operations from one another, but existing rules disqualify individuals simply because a completely separate subsidiary within their parent group operates as a trading member, clearing member, or depository participant. Sebi emphasized that there was a need to review the regulation to encourage the flow of expertise and talent into MIIs.
Sebi has proposed extending the IT and cybersecurity framework of Market Infrastructure Institutions (MIIs) to their subsidiaries to strengthen regulatory oversight over evolving business structures. As per The Economic Times, while MIIs are governed by Sebi and operate in compliance with its IT and cybersecurity frameworks, the applicability and regulatory jurisdiction of these frameworks are not explicitly defined over their subsidiaries. The proposal is part of a consultation paper issued on September 11, with public comments due by October 2. The move comes as Sebi highlighted that there could be a case for MIIs to take services of their subsidiaries to carry out certain activities, with these subsidiaries potentially needing to operate in close coordination with the parent MII and use shared technology infrastructure, applications, market data or other critical IT resources. "As MIIs continue to diversify their business models through subsidiaries, extending the applicability of the framework would ensure that the regulatory framework remains aligned with the evolving market structure," Sebi said in its consultation paper. Under the proposal, the IT and cybersecurity framework applicable to the parent MII will also apply to any subsidiary undertaking activity that directly contributes to that MII's domain, handling data that the MII is supposed to handle or sharing infrastructure with the MII. The regulator noted that with rising reliance on digital systems, the threat of cyberattacks has also increased, and attackers are using advanced technologies to exploit security gaps and gain unauthorised access to organisational data.
In a separate proposal, Sebi has proposed a Standard Operating Procedure (SOP) prescribing qualification, experience, skill-set and certification requirements for the Chief Technology Officer (CTO), Chief Information Security Officer (CISO), Compliance Officer (CO) and Chief Risk Officer (CRiO) of MIIs. These key management personnel are crucial to the functioning of MIIs, which are public infrastructure utilities for the capital markets and also function as first-line regulators. Under the proposed framework, MIIs must establish standard operating procedures (SOPs) for these roles based on inputs from relevant statutory committees. The regulator emphasized that these roles are crucial to ensuring technological resilience, cyber-security, compliance and risk management, with these considerations taking primacy over commercial considerations. While the governing board of an MII currently approves the appointment, reappointment, termination and acceptance of resignation of these KMPs, there is no standardised framework prescribing the qualification, experience, skill-set and certification required for each role. The proposed SOP would be approved by the governing board of the MII, taking into account inputs from relevant statutory committees, with for the CTO and CISO, inputs would be taken from the Standing Committee on Technology (SCOT), for the Compliance Officer, inputs would come from the Regulatory Oversight Committee (ROC), while the Risk Management Committee (RMC) would provide inputs for the CRiO.
The proposed changes would be made to the Securities Contracts (Regulation) (Stock Exchanges and Clearing Corporations) Regulations, 2018, and the Securities and Exchange Board of India (Depositories and Participants) Regulations, 2018. As reported by ETBFSI, the proposals were considered by Sebi's Secondary Market Advisory Committee (SMAC) at its meeting held on April 16-17, 2026. The regulator has also proposed that vacancies in these key positions be filled expeditiously, with positions to be filled within three months from the date they become vacant. Where a vacancy is anticipated, the MII would plan for it in advance to avoid any gap. Sebi has also sought public views on whether MIIs should appoint deputies for these key positions to ensure continuity, with the proposed framework including advance planning requirements whenever a vacancy is anticipated. The public consultation period has been extended to October 2 for the cybersecurity framework extension proposals, providing stakeholders with additional time to provide feedback on these evolving regulatory requirements.
