Stock exchanges liable to face penalties for tech glitches: Sebi

New Delhi: Stock exchanges and other market infrastructure institutions as well as their top officials are liable to face penalties for lapses in handling and recitfying technical glitches, with Sebi putting in a place a stricter compliance system driven by "financial disincentives".

The markets watchdog has come out with a detailed Standard Operating Procedure (SOP) for Market Infrastructure Institutions (MIIs) less than five months after a technical glitch halted trading at the country's largest bourse NSE for nearly four hours.

There will be a "financial disincentives" structure for MIIs -- stock exchanges, clearing corporation and depositories -- for any business disruption beyond pre-defined time, according to a circular issued on Monday.

Under the structure, MIIs will have to pay in the range of Rs 1 lakh each working day to Rs 2 crore for flouting SOP while Managing Director (MD) and Chief Technology Officer (CTO) of the MIIs concerned will have to cough up 10 per cent of their respective annual pay. The penalties will be subject to various timelines specified by Sebi with respect to declaration as well as rectification of technical glitches at the MIIs.

MIIs will also attract penalties in case there is a delay in submitting a comprehensive Root Cause Analysis (RCA) report about a technical glitch.

The move will encourage MIIs to constantly monitor the performance and efficiency of their systems and upgrade their systems to avoid any possibility of technical glitches and restart their operations expeditiously in the event of such disruption, Sebi said.

There have been instances of technical glitches impacting trading activities, including the one on February 24 this year due to which trading at the National Stock Exchange (NSE) was halted for nearly four hours.

"With increasing dependence on technology, as the operations and functioning of MIIs are fully automated right from order entry to order matching to trade confirmation leading up to clearing and settlement of trades, the instances of technical glitches at MIIs, leading to business disruption, have been occurring, despite various mechanisms stipulated by Sebi," the regulator noted.

To avoid technical glitches, Sebi has suggested that MIIs should have Business Continuity Planning, disaster recovery policies and system audit processes in place.

Considering the criticality of smooth functioning of systems of MIIs as any disruption adversely impacts all classes of investors, market participants as well as the credibility of the securities market, Sebi said that specifying a pre-defined threshold for downtime of systems of MIIs becomes desirable.

"For any downtime or unavailability of services, beyond such pre-defined time, there is a need to ensure that 'Financial Disincentive' is paid by the MIIs as well as Managing Director (being the executive head in-charge of all the day to day operations) and Chief Technology Officer (being the executive head in-charge of technology) of the MII," it added.

With regard to incidents resulting in business disruption, Sebi said MIIs will have to submit information of technical glitch on immediate basis but not later than two hours from the time of occurrence of the glitch to the regulator.

This is subject to the condition that glitches of the nature of a disaster will be reported immediately upon declaration of the disaster.

MIIs will also have to submit a preliminary report within 24 hours of the occurrence of the glitch.

Further, they have to submit a Comprehensive Root Cause Analysis (RCA) report and corrective action taken to address the technical glitch within 21 days of the incident.

Such a report will be submitted to Sebi after placing the same before the Standing Committee on Technology (SCOT) and the governing board of the MII and confirming compliance with their observations.

RCA submitted by a MII should include exact cause of the technical glitch, including root cause from vendors, if applicable, exact duration of the technical glitch, chronology of events, list of business processes or systems and time for which they were impacted, recommendations of SCOT or governing boards of the MII concerned.

In addition, RCA should include details of corrective/ preventive measures taken (or to be taken) by MII along with timelines and any other aspect relevant to the technical glitch.

As part of RCA, MIIs are required to demonstrate compliance with various requirements of the SOP. RCA will also include details regarding time of incident, time when operations were restored and in the event of a disaster, time when disaster was declared.

All communication and information with regard to a technical glitch need to be shared by the MII with Sebi through a dedicated e-mail address.