SEBI CSCRF Compliance for Stock Brokers: 6 Critical Rules | Osto<\/title>\n<meta name=\"description\" content=\"SEBI CSCRF compliance for stock brokers explained: tier thresholds, the QSB half-yearly rule, SOC and VAPT duties, six-hour reporting, and the audit cycle.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">SEBI CSCRF compliance for stock brokers turns on two things: your tier and whether you are a Qualified Stock Broker. This guide explains which rules apply to your firm, what the core obligations are, and how to meet them without a large security team.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>10 min read<\/span><span class=\"dot\"><\/span><span>SEBI Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>SEBI CSCRF compliance for stock brokers is set by a two-parameter rule, your client count or trading volume, whichever puts you in the higher CSCRF tier. Brokers below both a client and a volume threshold are exempt. The core duties are governance, a Security Operations Centre, VAPT, six-hour incident reporting to SEBI, and a CERT-In empanelled audit. The critical twist: a Qualified Stock Broker must run VAPT and cyber audit half-yearly, not annually, whichever category it otherwise falls into.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What applies to brokers<\/a><\/li>\n <li><a href=\"#tier\">How your tier is decided<\/a><\/li>\n <li><a href=\"#obligations\">The core obligations<\/a><\/li>\n <li><a href=\"#qsb\">The Qualified Stock Broker rule<\/a><\/li>\n <li><a href=\"#multi\">If you are also RBI-regulated<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What SEBI CSCRF compliance for stock brokers means<\/h2>\n <p>SEBI CSCRF compliance for stock brokers means meeting the Cybersecurity and Cyber Resilience Framework that the <a href=\"https:\/\/www.sebi.gov.in\/\" target=\"_blank\" rel=\"noopener\">Securities and Exchange Board of India<\/a> applies across the securities market, as it lands specifically on broking firms. CSCRF replaced the older broker-specific cyber circulars with one standardised framework, and it treats a broker’s trading platform, client-facing applications, and back-office systems as critical systems to be governed, monitored, tested, and audited. For a broker, this is now a board-level, evidence-based obligation, not an IT afterthought.<\/p>\n\n <h2 class=\"sec\" id=\"tier\">How your tier is decided<\/h2>\n <p>The first step is working out which standard applies to you, because it is proportionate to your size and there is a genuine exemption at the bottom.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Who is covered<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Thresholds, tiers, and the QSB override<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Compliance depends on your size and your designation. A two-parameter rule decides your CSCRF tier, a small-broker exemption sits below it, and the Qualified Stock Broker label overrides your category for testing.<\/div>\n <svg viewBox=\"0 0 800 248\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"How a stock broker CSCRF tier and testing cadence are decided\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">How a broker’s obligations are decided<\/text>\n <rect x=\"16\" y=\"60\" width=\"240\" height=\"170\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <text x=\"40\" y=\"92\" fill=\"#0a6558\" font-size=\"14\" font-weight=\"800\">Below both thresholds<\/text>\n <line x1=\"40\" y1=\"104\" x2=\"232\" y2=\"104\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"40\" y=\"128\" fill=\"#4a5170\" font-size=\"12\">Under ~1,000 clients and<\/text>\n <text x=\"40\" y=\"146\" fill=\"#4a5170\" font-size=\"12\">under ~1,000 crore volume.<\/text>\n <text x=\"40\" y=\"172\" fill=\"#0a6558\" font-size=\"12\" font-weight=\"700\">Exempt from CSCRF<\/text>\n <text x=\"40\" y=\"194\" fill=\"#5b6178\" font-size=\"11\">Trip either one and you are in.<\/text>\n <rect x=\"280\" y=\"60\" width=\"240\" height=\"170\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"304\" y=\"92\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">In scope, by tier<\/text>\n <line x1=\"304\" y1=\"104\" x2=\"496\" y2=\"104\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"304\" y=\"128\" fill=\"#4a5170\" font-size=\"12\">Two-parameter rule: clients<\/text>\n <text x=\"304\" y=\"146\" fill=\"#4a5170\" font-size=\"12\">or trading volume, whichever<\/text>\n <text x=\"304\" y=\"164\" fill=\"#4a5170\" font-size=\"12\">puts you in the higher tier.<\/text>\n <text x=\"304\" y=\"192\" fill=\"#2b3596\" font-size=\"12\" font-weight=\"700\">Category sets the standard.<\/text>\n <rect x=\"544\" y=\"60\" width=\"240\" height=\"170\" rx=\"16\" fill=\"#1c267a\"\/>\n <text x=\"568\" y=\"92\" fill=\"#fff\" font-size=\"14\" font-weight=\"800\">Qualified Stock Broker<\/text>\n <line x1=\"568\" y1=\"104\" x2=\"760\" y2=\"104\" stroke=\"#39439a\" stroke-width=\"1\"\/>\n <text x=\"568\" y=\"128\" fill=\"#c3c9ee\" font-size=\"12\">A separate designation that<\/text>\n <text x=\"568\" y=\"146\" fill=\"#c3c9ee\" font-size=\"12\">overrides the category for<\/text>\n <text x=\"568\" y=\"164\" fill=\"#c3c9ee\" font-size=\"12\">testing.<\/text>\n <text x=\"568\" y=\"192\" fill=\"#8fa0e8\" font-size=\"12\" font-weight=\"700\">Half-yearly VAPT and audit.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>SEBI uses a two-parameter rule for brokers: your category is set by your number of clients or your trading volume, whichever places you in the higher tier. A broker below both thresholds, broadly under a client-count line and a trading-volume line, is exempt, but tripping either one brings you in. Above the exemption, your CSCRF category, from the lighter tiers up to Qualified regulated entity, sets how deep your obligations run. Because the category is re-fixed each April on the prior year’s data, a growing broker can move up a tier the next year, so plan ahead.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Either threshold is enough<\/div>The exemption needs you below both the client and the volume line. Cross just one, more clients or more turnover, and SEBI CSCRF compliance for stock brokers applies in full at your tier. A fast-growing broker should watch both numbers, not just headcount.<\/div>\n\n <h2 class=\"sec\" id=\"obligations\">The core obligations<\/h2>\n <p>Whatever your tier, a common set of controls defines the broker obligations. These formalise strong practice into mandatory, evidenced obligations.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">The obligations<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What brokers actually have to do<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Depth scales with tier, but a recognisable core runs through every broker in scope. These are the controls that make up broker compliance in day-to-day practice.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Core SEBI CSCRF obligations for stock brokers\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Core obligations for stock brokers<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"4\" width=\"18\" height=\"13\" rx=\"2\"\/><path d=\"M8 21h8M12 17v4\"\/><path d=\"M7 12l2.5-3 2 2L15 8\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Governance<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Technology and cyber committee<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"4\" width=\"18\" height=\"14\" rx=\"2\"\/><path d=\"M6 14l3-4 2 2 3-5 4 7\"\/><path d=\"M8 21h8\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">SOC monitoring<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">In-house or managed, real-time<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"7\"\/><path d=\"M12 2v4M12 18v4M2 12h4M18 12h4\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">VAPT<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">On trading and back-office<\/text><text x=\"652\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">systems<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Six-hour reporting<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Incidents to the SEBI portal<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"9\" r=\"6\"\/><path d=\"M9 13.5L8 21l4-2 4 2-1-7.5\"\/><path d=\"M9.5 9l1.8 1.8L15 7.5\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">CERT-In audit<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Empanelled auditor, tier-based<\/text><text x=\"394\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">cadence<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 3h8l4 4v14a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1z\"\/><path d=\"M14 3v4h4\"\/><path d=\"M8 13h8M8 16h5\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">IR and records<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Tested drills, records kept five<\/text><text x=\"652\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">years<\/text><\/svg>\n \n<\/div>\n\n <p>In practice that means governance through a technology and cyber committee, a Security Operations Centre for continuous monitoring, whether built in-house or consumed as a managed service, a vulnerability assessment and penetration testing programme across your trading and back-office systems, cyber incident reporting to SEBI within six hours, a cyber audit by a CERT-In empanelled organisation, and documented incident-response plans tested through drills, with records retained for around five years. A structured <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">VAPT programme<\/a> is usually the fastest way to evidence the testing pillar.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">It is an evidence model now<\/div>CSCRF shifted from guidance to an evidence-based audit model. For a broker, every control, drill, and report has to produce an artefact on a schedule. Compliance is demonstrated by a series of dated deliverables, not asserted at a single moment.<\/div>\n\n <h2 class=\"sec\" id=\"qsb\">The Qualified Stock Broker rule<\/h2>\n <p>Here is the single most important nuance for brokers, and the one most often missed.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Cadence<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Regular broker versus Qualified Stock Broker<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">One rule catches brokers out more than any other: the Qualified Stock Broker designation changes how often you test, no matter which CSCRF category you sit in.<\/div>\n <svg viewBox=\"0 0 800 236\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Testing cadence for regular brokers versus Qualified Stock Brokers\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Testing cadence: regular broker vs QSB<\/text>\n <rect x=\"30\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.6\"\/>\n <text x=\"60\" y=\"100\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">Most brokers<\/text>\n <line x1=\"60\" y1=\"112\" x2=\"356\" y2=\"112\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"60\" y=\"138\" fill=\"#4a5170\" font-size=\"12\">Annual VAPT and cyber audit,<\/text>\n <text x=\"60\" y=\"158\" fill=\"#4a5170\" font-size=\"12\">on the cadence set by their<\/text>\n <text x=\"60\" y=\"178\" fill=\"#4a5170\" font-size=\"12\">CSCRF category.<\/text>\n <rect x=\"420\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.6\"\/>\n <text x=\"450\" y=\"100\" fill=\"#0a6558\" font-size=\"14\" font-weight=\"800\">Qualified Stock Brokers<\/text>\n <line x1=\"450\" y1=\"112\" x2=\"746\" y2=\"112\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"450\" y=\"138\" fill=\"#4a5170\" font-size=\"12\">Half-yearly VAPT and cyber<\/text>\n <text x=\"450\" y=\"158\" fill=\"#4a5170\" font-size=\"12\">audit, whichever CSCRF<\/text>\n <text x=\"450\" y=\"178\" fill=\"#0a6558\" font-size=\"12\" font-weight=\"700\">category they otherwise fall in.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>A Qualified Stock Broker is a separate designation, created under a 2023 circular rather than under CSCRF, given to the largest and most systemically important brokers. It overrides your CSCRF category for testing purposes: a Qualified Stock Broker must run VAPT and cyber audit on a half-yearly basis, regardless of which CSCRF category it would otherwise fall into. Most other brokers test annually on their category cadence. If your firm is a Qualified Stock Broker, building your compliance calendar around an annual cycle is a mistake that an inspection will catch.<\/p>\n\n <h2 class=\"sec\" id=\"multi\">If you are also regulated by the RBI<\/h2>\n <p>Many broking groups also hold an NBFC licence, and there is relief here. SEBI’s Principle of Exclusivity and Equivalence lets a genuinely equivalent programme under another regulator satisfy the corresponding CSCRF requirement. In practice, the RBI’s six-monthly vulnerability assessment can meet or exceed the CSCRF VAPT minimum, provided the scope covers the SEBI-regulated systems and the work is done by a CERT-In empanelled auditor. That lets a dual-regulated broker run one coherent testing programme rather than two, an efficient way to approach compliance for brokers that are also NBFCs. The key is that a scan alone will not do, and our guide on <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-vs-vulnerability-scanning\/\">VAPT versus vulnerability scanning<\/a> explains why.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to SEBI CSCRF compliance for stock brokers<\/h2>\n <p>Meeting all of this, governance, a SOC, VAPT on the right cadence, six-hour-ready incident reporting, and audit-ready evidence, is a heavy lift for a broking firm without a large security team. Assembling it from separate tools and consultants is slow and hard to keep current. The efficient path is a single platform that runs the security work and organises the evidence together.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups and lean financial teams. It runs VAPT across your trading and back-office systems, correlates security events for monitoring and fast incident reporting, supports incident-response readiness, and keeps organised, audit-ready evidence, mapped across the SEBI CSCRF expectations, the RBI framework, DPDP, and 200+ frameworks on one platform. Meeting the framework at a continuously-evidenced standard, without building a large security function, is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Meet SEBI CSCRF compliance for stock brokers without a big team.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups and lean financial teams. Run VAPT, stand up monitoring, and keep audit-ready evidence on the right cadence, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>Does CSCRF apply to all stock brokers?<\/summary><p>Not all. Brokers below both a client-count and a trading-volume threshold are exempt. Trip either threshold and the framework applies, at the tier set by whichever parameter is higher.<\/p><\/details>\n <details><summary>How is a broker’s CSCRF tier decided?<\/summary><p>By a two-parameter rule, your number of clients or your trading volume, whichever puts you in the higher tier. The category is re-fixed each April on the previous year’s data, so a growing broker can move up a tier the next year.<\/p><\/details>\n <details><summary>What is a Qualified Stock Broker under CSCRF?<\/summary><p>A separate designation for the largest, most systemically important brokers, created under a 2023 circular. It overrides the CSCRF category for testing: a Qualified Stock Broker runs VAPT and cyber audit half-yearly, not annually.<\/p><\/details>\n <details><summary>What is the incident reporting timeline for brokers?<\/summary><p>Brokers must report cyber incidents to the SEBI incident reporting portal within six hours of detection. The clock runs from detection, so continuous monitoring through a SOC is essential.<\/p><\/details>\n <details><summary>Who can conduct a broker’s CSCRF audit?<\/summary><p>Only a CERT-In empanelled information-security auditing organisation. The audit covers governance, control testing, VAPT reconciliation, SOC effectiveness, vendor risk, and SBOM, annually for most brokers and half-yearly for Qualified Stock Brokers.<\/p><\/details>\n <details><summary>My broking firm is also an NBFC. Do I run two programmes?<\/summary><p>Often not. SEBI’s Exclusivity and Equivalence principle lets an equivalent RBI programme satisfy the corresponding CSCRF requirement, so one well-scoped testing programme by a CERT-In empanelled auditor can serve both, provided it covers the SEBI-regulated systems.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>SEBI CSCRF Compliance for Stock Brokers: 6 Critical Rules | Osto SEBI CSCRF compliance for stock brokers turns on two\u2026<\/p>\n","protected":false},"author":8,"featured_media":1263,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[654,494],"class_list":["post-1262","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-sebi-compliance-for-brokers","tag-sebi-cscrf-compliance-for-stock-brokers"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1262","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1262"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1262\/revisions"}],"predecessor-version":[{"id":1264,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1262\/revisions\/1264"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1263"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1262,"date":"2026-09-14T12:53:12","date_gmt":"2026-09-14T12:53:12","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=1262"},"modified":"2026-09-14T12:53:12","modified_gmt":"2026-09-14T12:53:12","slug":"sebi-cscrf-compliance-brokers","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/sebi-cscrf-compliance-brokers\/","title":{"rendered":"SEBI CSCRF Compliance for Stock Brokers: A Complete Guide"},"content":{"rendered":"\n\n\n\n\n\nSEBI CSCRF Compliance for Stock Brokers: 6 Critical Rules | Osto<\/title>\n<meta name=\"description\" content=\"SEBI CSCRF compliance for stock brokers explained: tier thresholds, the QSB half-yearly rule, SOC and VAPT duties, six-hour reporting, and the audit cycle.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">SEBI CSCRF compliance for stock brokers turns on two things: your tier and whether you are a Qualified Stock Broker. This guide explains which rules apply to your firm, what the core obligations are, and how to meet them without a large security team.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>10 min read<\/span><span class=\"dot\"><\/span><span>SEBI Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>SEBI CSCRF compliance for stock brokers is set by a two-parameter rule, your client count or trading volume, whichever puts you in the higher CSCRF tier. Brokers below both a client and a volume threshold are exempt. The core duties are governance, a Security Operations Centre, VAPT, six-hour incident reporting to SEBI, and a CERT-In empanelled audit. The critical twist: a Qualified Stock Broker must run VAPT and cyber audit half-yearly, not annually, whichever category it otherwise falls into.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What applies to brokers<\/a><\/li>\n <li><a href=\"#tier\">How your tier is decided<\/a><\/li>\n <li><a href=\"#obligations\">The core obligations<\/a><\/li>\n <li><a href=\"#qsb\">The Qualified Stock Broker rule<\/a><\/li>\n <li><a href=\"#multi\">If you are also RBI-regulated<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What SEBI CSCRF compliance for stock brokers means<\/h2>\n <p>SEBI CSCRF compliance for stock brokers means meeting the Cybersecurity and Cyber Resilience Framework that the <a href=\"https:\/\/www.sebi.gov.in\/\" target=\"_blank\" rel=\"noopener\">Securities and Exchange Board of India<\/a> applies across the securities market, as it lands specifically on broking firms. CSCRF replaced the older broker-specific cyber circulars with one standardised framework, and it treats a broker’s trading platform, client-facing applications, and back-office systems as critical systems to be governed, monitored, tested, and audited. For a broker, this is now a board-level, evidence-based obligation, not an IT afterthought.<\/p>\n\n <h2 class=\"sec\" id=\"tier\">How your tier is decided<\/h2>\n <p>The first step is working out which standard applies to you, because it is proportionate to your size and there is a genuine exemption at the bottom.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Who is covered<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Thresholds, tiers, and the QSB override<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Compliance depends on your size and your designation. A two-parameter rule decides your CSCRF tier, a small-broker exemption sits below it, and the Qualified Stock Broker label overrides your category for testing.<\/div>\n <svg viewBox=\"0 0 800 248\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"How a stock broker CSCRF tier and testing cadence are decided\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">How a broker’s obligations are decided<\/text>\n <rect x=\"16\" y=\"60\" width=\"240\" height=\"170\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <text x=\"40\" y=\"92\" fill=\"#0a6558\" font-size=\"14\" font-weight=\"800\">Below both thresholds<\/text>\n <line x1=\"40\" y1=\"104\" x2=\"232\" y2=\"104\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"40\" y=\"128\" fill=\"#4a5170\" font-size=\"12\">Under ~1,000 clients and<\/text>\n <text x=\"40\" y=\"146\" fill=\"#4a5170\" font-size=\"12\">under ~1,000 crore volume.<\/text>\n <text x=\"40\" y=\"172\" fill=\"#0a6558\" font-size=\"12\" font-weight=\"700\">Exempt from CSCRF<\/text>\n <text x=\"40\" y=\"194\" fill=\"#5b6178\" font-size=\"11\">Trip either one and you are in.<\/text>\n <rect x=\"280\" y=\"60\" width=\"240\" height=\"170\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"304\" y=\"92\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">In scope, by tier<\/text>\n <line x1=\"304\" y1=\"104\" x2=\"496\" y2=\"104\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"304\" y=\"128\" fill=\"#4a5170\" font-size=\"12\">Two-parameter rule: clients<\/text>\n <text x=\"304\" y=\"146\" fill=\"#4a5170\" font-size=\"12\">or trading volume, whichever<\/text>\n <text x=\"304\" y=\"164\" fill=\"#4a5170\" font-size=\"12\">puts you in the higher tier.<\/text>\n <text x=\"304\" y=\"192\" fill=\"#2b3596\" font-size=\"12\" font-weight=\"700\">Category sets the standard.<\/text>\n <rect x=\"544\" y=\"60\" width=\"240\" height=\"170\" rx=\"16\" fill=\"#1c267a\"\/>\n <text x=\"568\" y=\"92\" fill=\"#fff\" font-size=\"14\" font-weight=\"800\">Qualified Stock Broker<\/text>\n <line x1=\"568\" y1=\"104\" x2=\"760\" y2=\"104\" stroke=\"#39439a\" stroke-width=\"1\"\/>\n <text x=\"568\" y=\"128\" fill=\"#c3c9ee\" font-size=\"12\">A separate designation that<\/text>\n <text x=\"568\" y=\"146\" fill=\"#c3c9ee\" font-size=\"12\">overrides the category for<\/text>\n <text x=\"568\" y=\"164\" fill=\"#c3c9ee\" font-size=\"12\">testing.<\/text>\n <text x=\"568\" y=\"192\" fill=\"#8fa0e8\" font-size=\"12\" font-weight=\"700\">Half-yearly VAPT and audit.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>SEBI uses a two-parameter rule for brokers: your category is set by your number of clients or your trading volume, whichever places you in the higher tier. A broker below both thresholds, broadly under a client-count line and a trading-volume line, is exempt, but tripping either one brings you in. Above the exemption, your CSCRF category, from the lighter tiers up to Qualified regulated entity, sets how deep your obligations run. Because the category is re-fixed each April on the prior year’s data, a growing broker can move up a tier the next year, so plan ahead.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Either threshold is enough<\/div>The exemption needs you below both the client and the volume line. Cross just one, more clients or more turnover, and SEBI CSCRF compliance for stock brokers applies in full at your tier. A fast-growing broker should watch both numbers, not just headcount.<\/div>\n\n <h2 class=\"sec\" id=\"obligations\">The core obligations<\/h2>\n <p>Whatever your tier, a common set of controls defines the broker obligations. These formalise strong practice into mandatory, evidenced obligations.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">The obligations<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What brokers actually have to do<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Depth scales with tier, but a recognisable core runs through every broker in scope. These are the controls that make up broker compliance in day-to-day practice.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Core SEBI CSCRF obligations for stock brokers\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Core obligations for stock brokers<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"4\" width=\"18\" height=\"13\" rx=\"2\"\/><path d=\"M8 21h8M12 17v4\"\/><path d=\"M7 12l2.5-3 2 2L15 8\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Governance<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Technology and cyber committee<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"4\" width=\"18\" height=\"14\" rx=\"2\"\/><path d=\"M6 14l3-4 2 2 3-5 4 7\"\/><path d=\"M8 21h8\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">SOC monitoring<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">In-house or managed, real-time<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"7\"\/><path d=\"M12 2v4M12 18v4M2 12h4M18 12h4\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">VAPT<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">On trading and back-office<\/text><text x=\"652\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">systems<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Six-hour reporting<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Incidents to the SEBI portal<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"9\" r=\"6\"\/><path d=\"M9 13.5L8 21l4-2 4 2-1-7.5\"\/><path d=\"M9.5 9l1.8 1.8L15 7.5\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">CERT-In audit<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Empanelled auditor, tier-based<\/text><text x=\"394\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">cadence<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 3h8l4 4v14a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1z\"\/><path d=\"M14 3v4h4\"\/><path d=\"M8 13h8M8 16h5\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">IR and records<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Tested drills, records kept five<\/text><text x=\"652\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">years<\/text><\/svg>\n \n<\/div>\n\n <p>In practice that means governance through a technology and cyber committee, a Security Operations Centre for continuous monitoring, whether built in-house or consumed as a managed service, a vulnerability assessment and penetration testing programme across your trading and back-office systems, cyber incident reporting to SEBI within six hours, a cyber audit by a CERT-In empanelled organisation, and documented incident-response plans tested through drills, with records retained for around five years. A structured <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">VAPT programme<\/a> is usually the fastest way to evidence the testing pillar.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">It is an evidence model now<\/div>CSCRF shifted from guidance to an evidence-based audit model. For a broker, every control, drill, and report has to produce an artefact on a schedule. Compliance is demonstrated by a series of dated deliverables, not asserted at a single moment.<\/div>\n\n <h2 class=\"sec\" id=\"qsb\">The Qualified Stock Broker rule<\/h2>\n <p>Here is the single most important nuance for brokers, and the one most often missed.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Cadence<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Regular broker versus Qualified Stock Broker<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">One rule catches brokers out more than any other: the Qualified Stock Broker designation changes how often you test, no matter which CSCRF category you sit in.<\/div>\n <svg viewBox=\"0 0 800 236\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Testing cadence for regular brokers versus Qualified Stock Brokers\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Testing cadence: regular broker vs QSB<\/text>\n <rect x=\"30\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.6\"\/>\n <text x=\"60\" y=\"100\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">Most brokers<\/text>\n <line x1=\"60\" y1=\"112\" x2=\"356\" y2=\"112\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"60\" y=\"138\" fill=\"#4a5170\" font-size=\"12\">Annual VAPT and cyber audit,<\/text>\n <text x=\"60\" y=\"158\" fill=\"#4a5170\" font-size=\"12\">on the cadence set by their<\/text>\n <text x=\"60\" y=\"178\" fill=\"#4a5170\" font-size=\"12\">CSCRF category.<\/text>\n <rect x=\"420\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.6\"\/>\n <text x=\"450\" y=\"100\" fill=\"#0a6558\" font-size=\"14\" font-weight=\"800\">Qualified Stock Brokers<\/text>\n <line x1=\"450\" y1=\"112\" x2=\"746\" y2=\"112\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"450\" y=\"138\" fill=\"#4a5170\" font-size=\"12\">Half-yearly VAPT and cyber<\/text>\n <text x=\"450\" y=\"158\" fill=\"#4a5170\" font-size=\"12\">audit, whichever CSCRF<\/text>\n <text x=\"450\" y=\"178\" fill=\"#0a6558\" font-size=\"12\" font-weight=\"700\">category they otherwise fall in.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>A Qualified Stock Broker is a separate designation, created under a 2023 circular rather than under CSCRF, given to the largest and most systemically important brokers. It overrides your CSCRF category for testing purposes: a Qualified Stock Broker must run VAPT and cyber audit on a half-yearly basis, regardless of which CSCRF category it would otherwise fall into. Most other brokers test annually on their category cadence. If your firm is a Qualified Stock Broker, building your compliance calendar around an annual cycle is a mistake that an inspection will catch.<\/p>\n\n <h2 class=\"sec\" id=\"multi\">If you are also regulated by the RBI<\/h2>\n <p>Many broking groups also hold an NBFC licence, and there is relief here. SEBI’s Principle of Exclusivity and Equivalence lets a genuinely equivalent programme under another regulator satisfy the corresponding CSCRF requirement. In practice, the RBI’s six-monthly vulnerability assessment can meet or exceed the CSCRF VAPT minimum, provided the scope covers the SEBI-regulated systems and the work is done by a CERT-In empanelled auditor. That lets a dual-regulated broker run one coherent testing programme rather than two, an efficient way to approach compliance for brokers that are also NBFCs. The key is that a scan alone will not do, and our guide on <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-vs-vulnerability-scanning\/\">VAPT versus vulnerability scanning<\/a> explains why.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to SEBI CSCRF compliance for stock brokers<\/h2>\n <p>Meeting all of this, governance, a SOC, VAPT on the right cadence, six-hour-ready incident reporting, and audit-ready evidence, is a heavy lift for a broking firm without a large security team. Assembling it from separate tools and consultants is slow and hard to keep current. The efficient path is a single platform that runs the security work and organises the evidence together.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups and lean financial teams. It runs VAPT across your trading and back-office systems, correlates security events for monitoring and fast incident reporting, supports incident-response readiness, and keeps organised, audit-ready evidence, mapped across the SEBI CSCRF expectations, the RBI framework, DPDP, and 200+ frameworks on one platform. Meeting the framework at a continuously-evidenced standard, without building a large security function, is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Meet SEBI CSCRF compliance for stock brokers without a big team.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups and lean financial teams. Run VAPT, stand up monitoring, and keep audit-ready evidence on the right cadence, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>Does CSCRF apply to all stock brokers?<\/summary><p>Not all. Brokers below both a client-count and a trading-volume threshold are exempt. Trip either threshold and the framework applies, at the tier set by whichever parameter is higher.<\/p><\/details>\n <details><summary>How is a broker’s CSCRF tier decided?<\/summary><p>By a two-parameter rule, your number of clients or your trading volume, whichever puts you in the higher tier. The category is re-fixed each April on the previous year’s data, so a growing broker can move up a tier the next year.<\/p><\/details>\n <details><summary>What is a Qualified Stock Broker under CSCRF?<\/summary><p>A separate designation for the largest, most systemically important brokers, created under a 2023 circular. It overrides the CSCRF category for testing: a Qualified Stock Broker runs VAPT and cyber audit half-yearly, not annually.<\/p><\/details>\n <details><summary>What is the incident reporting timeline for brokers?<\/summary><p>Brokers must report cyber incidents to the SEBI incident reporting portal within six hours of detection. The clock runs from detection, so continuous monitoring through a SOC is essential.<\/p><\/details>\n <details><summary>Who can conduct a broker’s CSCRF audit?<\/summary><p>Only a CERT-In empanelled information-security auditing organisation. The audit covers governance, control testing, VAPT reconciliation, SOC effectiveness, vendor risk, and SBOM, annually for most brokers and half-yearly for Qualified Stock Brokers.<\/p><\/details>\n <details><summary>My broking firm is also an NBFC. Do I run two programmes?<\/summary><p>Often not. SEBI’s Exclusivity and Equivalence principle lets an equivalent RBI programme satisfy the corresponding CSCRF requirement, so one well-scoped testing programme by a CERT-In empanelled auditor can serve both, provided it covers the SEBI-regulated systems.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>SEBI CSCRF Compliance for Stock Brokers: 6 Critical Rules | Osto SEBI CSCRF compliance for stock brokers turns on two\u2026<\/p>\n","protected":false},"author":8,"featured_media":1263,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[654,494],"class_list":["post-1262","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-sebi-compliance-for-brokers","tag-sebi-cscrf-compliance-for-stock-brokers"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1262","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1262"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1262\/revisions"}],"predecessor-version":[{"id":1264,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1262\/revisions\/1264"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1263"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}