Outsourcing of activities, Business Continuity Plan (BCP) and Disaster Recovery (DR) and Cyber Security and Cyber Resilience framework - Limited Purpose Clearing Corporation (LPCC) - SEBI - SEBI/HO/MRD2/DCAP/CIR/P/227

CIRCULAR SEBI/HO/MRD2/DCAP/CIR/P/227 November 06, 2020 To, All Recognized Stock Exchanges All Recognized Clearing Corporations Dear Sir / Madam, Sub: Outsourcing of activities, Business Continuity Plan (BCP) and Disaster Recovery (DR) and Cyber Security and Cyber Resilience framework - Limited Purpose Clearing Corporation (LPCC) 1. The broad guidelines governing outsourcing of activities by Clearing Corporations have been prescribed by SEBI vide Circular SEBI/HO/MRD/DP/CIR/P/2017/101 dated September 13, 2017. 2. Further, guidelines for Business Continuity Plan (BCP) and Disaster Recovery (DR) have been prescribed by SEBI vide Circular SEBI/HO/MRD/DMS1/CIR/P/2019/43 dated March 26, 2019 and the framework for Cyber Security and Cyber Resilience has been prescribed vide Circular CIR/MRD/DP/13/2015 dated July 06, 2015 and Circular CIR/MRD/CSC/148/2018 dated December 07, 2018. 3. SEBI Board in its meeting held on September 29, 2020 permitted setting up of a Limited Purpose Clearing Corporation (LPCC) for clearing and settling repo transactions in debt securities and accordingly Securities Contracts (Regulation) (Stock Exchanges and Clearing Corporations) (Amendment) Regulations, 2020, have been notified on October 08, 2020 (SECC Amendment Regulations 2020). 4. Further, the LPCC has been permitted to enter into outsourcing agreements with existing Clearing Corporations for the purpose of using their core and critical IT support infrastructure / activities for running the core activities (transaction process, clearing and settlement) of the LPCC and related operations. 5. For the purpose of execution of repo in corporate bonds, LPCC shall enter into necessary agreements with the Stock Exchanges where it proposes to offer clearing / settlement of repo transactions and their associated Clearing Corporations for continuity purposes. 6. Additionally, the LPCC has been permitted to have arrangements with any of the existing Clearing Corporations for the purposes of putting in place a BCP and DR mechanism, and Cyber Security. 7. In view of the above, towards compliance with requirement under Regulation 7 of SECC Amendment Regulations 2020, the framework governing the outsourcing activities by the LPCC is placed at Annexure I . 8. The framework governing arrangements with existing Clearing Corporations for the purpose of BCP and DR, and Cyber Security is placed at Annexure II . 9. Stock Exchanges and Clearing Corporations, who enter into agreements with the LPCC, are directed to take necessary steps to put in place systems for implementation of the circular, including necessary amendments to the relevant bye-laws, rules, etc., if any. Stock Exchanges and Clearing Corporations are also advised to disseminate the provisions of this circular on their website. 10. In respect of the LPCC, the provisions of Circular SEBI/HO/MRD/DP/CIR/P/2017/101 dated September 13, 2017 , Circular CIR/MRD/DP/13/2015 dated July 06, 2015 , Circular CIR/MRD/CSC/148/2018 dated December 07, 2018 and Circular SEBI/HO/MRD/DMS1/CIR/P/2019/43 dated March 26, 2019 , stand modified to the extent as mentioned above. 11. This circular is available on SEBI website at www.sebi.gov.in under the categories Legal Framework Circulars . 12. This circular is being issued in exercise of powers conferred under Section 11 (1) of the Securities and Exchange Board of India Act, 1992 to protect the interests of investors in securities and to promote the development of, and to regulate the securities market. Yours faithfully, Amit Kapoor General Manager Market Regulation Department +91-22-2644 9374 [email protected] Annexure I 1. The LPCC is permitted to enter into outsourcing agreements with existing Clearing Corporations for the purpose of using their core and critical IT support infrastructure / activities for running the core activities (transaction process, clearing and settlement) of the LPCC and related operations. 2. For the purpose of execution of repo in corporate bonds, the LPCC shall enter into necessary agreements with Stock Exchanges and their associated Clearing Corporations (CCs) for continuity purposes. 3. The transactions would be executed on the platform of exchanges. As part of the risk management process, the LPCC would define the risk management parameters, such as eligible bonds ISINs, applicable margins, type of collateral, applicable haircuts, quantum of collateral, etc. Further, for the purpose of margin blocking, collateral management, pay-in and pay-out of funds and securities, separate bank and demat account would be opened by the LPCC. 4. For clearing and settlement of repo transactions based on the parameters defined by the LPCC, and other related processes / operations, the infrastructure of the existing CCs shall be used. For availing such facility / service, the LPCC shall enter into comprehensive outsourcing agreements with the existing CCs. a. Selection Process : The LPCC shall enter into outsourcing agreements with at least two existing CCs (Service Providers) so that there is complete redundancy and business continuity in place. The parameters for selection of Service Providers shall include at least the following parameters: i. Proven technology and capacity to handle volume ii. Experience of staff iii. Compliance with cyber security requirements iv. Speed of implementation with ability to adapt the existing segments / modules in place v. Ability to undertake software enhancement and customization as per LPCC requirements vi. Ongoing support b. Fees Charges: In determining the charges, amongst others, the following type of charges, shall be taken into account: i. Customization of systems based on time and material ii. Dedicated team for operations based on time and material iii. Platform fee based on negotiation and subject to SEBI approval Further, the existing transfer pricing between Stock Exchanges and CCs and interoperability charges shall also be taken into consideration. c. Role and Responsibility: The outsourcing agreements shall encompass the following underlying principles: i. The LPCC shall have the overall responsibility in respect of all the outsourced activities / operations. ii. Service Providers (SPs) themselves being MIIs, shall ensure that their platform, system and processes are in compliance with extant regulatory framework. iii. For any dispute vis-a-vis the investors / participants / constituents with respect to clearing and settlement, the LPCC shall be liable. iv. For any dispute with respect to trading in repo, the respective Stock Exchange shall be liable. v. For system failure, the LPCC shall be liable and appropriate financial disincentive qua the repo segment may be imposed. The LPCC may in turn provide for necessary liability clauses in the contractual agreement with the Service Provider. vi. Similarly, for any process failure, the LPCC shall remain liable, who may in turn provide for indemnity clauses in agreement with the Service Provider. vii. In the event of any inter-se service disputes, between the LPCC and the SPs, neither there can be any service disruption, nor any market disruption, during the pendency of the said inter-se service disputes. Further, contracts should provide sufficient financial disincentive against market disruption and both the LPCC and the SP shall remain committed to provide uninterrupted service to the market participants, irrespective of their inter-se disputes pending for resolution before the competent authorities. viii. There shall be no dilution in access of the regulator to the LPCC and its SPs in monitoring and inspecting the regulatory compliance by the LPCC and the SPs. For any violation of SEBI regulations the LPCC shall remain liable. 5. The LPCC shall handle the functions relating to risk management, rule setting viz. byelaws, rules, regulations and for the process of clearing and settlement, maintenance of SGF, decision making, default process, disciplinary proceedings, etc. Annexure II 1. In order to ensure compliance with the guidelines for Business Continuity Plan (BCP) and Disaster Recovery (DR), prescribed vide Circular SEBI/HO/MRD/DMS1/CIR/P/2019/43 dated March 26, 2019, LPCC is permitted to have arrangements with any of the existing Clearing Corporations who are in compliance with the existing regulatory BCP/DR requirements. However, for any issues / disputes arising on account of such arrangement, the LPCC shall be liable. Hence, the LPCC shall incorporate necessary provision into its agreement with the service providers for its BCP/DR arrangement with them. 2. Similarly, in order to ensure compliance with the requirements relating to Cyber Security and Cyber Resilience framework prescribed vide Circular CIR/MRD/DP/13/2015 dated July 06, 2015 and Circular CIR/MRD/CSC/148/2018 dated December 07, 2018, LPCC is permitted to have outsourcing arrangements for cyber security with any of the existing Clearing Corporations for the purposes of Cyber Security. For any issues / disputes arising on account of such arrangement, LPCC would be liable.