SEBI MII Subsidiary Cyber-Security Consultation 2026: Applicability Tests, 2 October Deadline and Startup Vendor Checklist
SEBI’s proposal looks beyond the regulated parent to subsidiaries that support core functions, handle MII data or share IT infrastructure. Fintech vendors should map their exposure now.
Direct answer
SEBI published a consultation paper on 11 September 2026 proposing that the IT and cyber-security framework applicable to Market Infrastructure Institutions should also apply to qualifying subsidiaries. The purpose is to address technology, data and operational risk that can sit outside the parent MII even when systems and functions are interconnected.
Read the official SEBI consultation page and use SEBI’s official public-comments portal for the live proposal and response process. The Best CS Firm In India compliance rule here is to separate proposal from law: prepare evidence and submit feedback now, but implement binding changes against the final SEBI instrument.
What SEBI is proposing
The proposal uses functional tests rather than assuming that every subsidiary creates the same risk. A subsidiary may come within scope if it performs activities connected with the MII’s core functions, handles data managed by the MII, or shares IT infrastructure with the MII. The consultation also discusses a proportionate exemption route for a subsidiary meeting only the infrastructure-sharing test, supported by compensatory controls and SEBI consideration.
| Proposed test | Evidence to review | Likely startup relevance |
|---|---|---|
| Supports core MII functions | Service catalogue, process maps, contracts and operating procedures | Technology, clearing, settlement, surveillance or data-service platforms |
| Handles MII-managed data | Data inventory, flows, classifications, access logs and retention rules | Cloud, analytics, security, regtech and managed-service vendors |
| Shares IT infrastructure | Network diagrams, tenant architecture, identity systems and shared applications | Infrastructure, SaaS, hosting, SOC and integration providers |
Who should assess the proposal?
- Stock-exchange, clearing-corporation and depository subsidiaries.
- Fintech, regtech, market-data and surveillance product teams working with MIIs.
- Cloud, SOC, cyber-security, software, infrastructure and managed-service vendors.
- Boards, CTOs, CISOs, compliance officers and risk teams of affected entities.
- Investors diligencing businesses whose largest customers are securities-market institutions.
Action plan before the 2 October 2026 deadline
- Download and read the official consultation paper and identify each proposal applicable to your structure.
- Create a legal-entity and service map showing what each subsidiary does for the parent MII.
- Map data, infrastructure, privileged access, critical vendors and incident escalation across entities.
- Compare existing controls with the MII IT and cyber-security framework, system-audit, incident-reporting and BCP-DR expectations identified in the proposal.
- Quantify implementation gaps, cost, sequencing and areas where proportionality is needed.
- Submit evidence-backed comments through SEBI’s official portal by the stated deadline.
- Track the final circular or framework and maintain a decision log before changing compliance representations.
Documents and controls to keep ready
| Document or control | Why it matters | Owner |
|---|---|---|
| Applicability assessment | Records which proposed test is met and the supporting facts | Legal/compliance |
| Data-flow and asset register | Shows systems, data owners, locations, interfaces and criticality | CISO/technology |
| Access and identity matrix | Identifies privileged users and shared authentication dependencies | IT/security |
| Incident-response matrix | Sets severity, escalation, evidence preservation and reporting owners | CISO/compliance |
| BCP-DR and test evidence | Demonstrates recovery objectives, alternate arrangements and test results | Operations/technology |
| Vendor risk files | Connects contracts, audit rights, security obligations and subcontractors | Procurement/legal |
| Board oversight records | Shows review, risk acceptance, budgets and remediation accountability | Board secretariat |
Founder impact for fintech and technology vendors
A startup may not be the regulated subsidiary, but the proposal can still influence customer due diligence and contract requirements. Expect deeper questions on architecture segregation, audit access, incident notification, subcontractors, recovery testing, source-code control, data location and exit assistance. Vendors should avoid claiming “SEBI compliant” unless they can identify the exact applicable instrument and evidence.
Free Weekly Newsletter
Subscribe to BSA startup funding alerts
- Every Sunday, all Indian startup funding alerts in one place
- Monthly funding report on the last day of the month
- Free, concise, founder-focused, and easy to unsubscribe
Get the complete Indian startup funding roundup in your inbox, covering deals, sectors, investor moves, and founder readiness notes from the week.
Built for founders, investors, CFOs, and advisors
No spam. Unsubscribe anytime.
Mistakes to avoid
- Calling the consultation a final rule.
- Assessing only the subsidiary’s name or shareholding instead of its functions, data and infrastructure.
- Ignoring shared identity, cloud, monitoring or backup services.
- Submitting comments without cost, control and operational evidence.
- Leaving vendor contracts silent on incidents, audit, BCP-DR, data return and subcontractors.
Founder / Business Takeaway
Use the consultation window to build an entity-service-data map and a control-gap register. Even before the final framework, this work improves enterprise sales readiness, customer assurance and investor diligence for market-infrastructure technology providers.
Suggested internal links
FAQ
Is SEBI’s MII-subsidiary cyber-security proposal already binding?
No. It is a consultation paper published on 11 September 2026. Teams should prepare and track the final framework rather than describe the proposal as current law.
Which subsidiaries may fall within the proposed scope?
The consultation focuses on subsidiaries that support an MII’s core functions, handle data managed by the MII, or share IT infrastructure with the MII.
What is the public-comment deadline?
SEBI’s consultation materials invite comments by 2 October 2026 through the official public-comments process.
