The Securities and Exchange Board of India (SEBI) on May 02, 2022 has issued a circular on System and Network Audit of Market Infrastructure Institutions (MIIs) which supersedes the Circular no. SEBI/HO/MRD1/ICC1/CIR/P/2020/03 dated January 07, 2020.
The Circular will come into force with immediate effect.
Following are the highlights of the circular:
• Market Infrastructure Institutions (MIIs) are required to conduct System and Network Audit as per the framework enclosed as Annexure 1 (System and Network Audit Framework) and Terms of Reference (TOR) enclosed as Annexure 2 (Auditor Selection Norms).
• Market Infrastructure Institutions (MIIs) must undertake System and Network Audits in accordance with the framework in Annexure 1 (System and Network Audit Framework) and the Terms of Reference (TOR) in Annexure 2 (Terms of Reference (TOR) for System and Network Audit Program). Market Infrastructure Institutions (MIIs) must also keep a list of all applicable SEBI circulars, instructions, advices, and other documents relating to technology and their compliance, as per Annexure 3, (Format for monitoring compliance with SEBI circulars/guidelines/advisories related to Technology) which must be included in the scope of the System and Network Audit.
• Market Infrastructure Institutions (MIIs) must also submit information on exceptional major Non-Compliances (NCs)/minor NCs identified in the System and Network audit, using the format provided in Annexure 4 (Exception Observation Reporting Format), and categorically highlight those observations/NCs/suggestions identified in the System and Network audit (current and previous) that remain open.
• The Systems and Network audit Report including compliance with SEBI circulars/ guidelines and exceptional observation format along with compliance status of previous year observations shall be placed before the Governing Board of the Market Infrastructure Institutions (MIIs) and then the report along with the comments of the Management of the MII shall be communicated to SEBI within a month of completion of the audit.
• Market Infrastructure Institutions (MIIs) must also submit a joint declaration from the Managing Director (MD)/Chief Executive Officer (CEO) and Chief Technology Officer (CTO) along with the audit report, verifying a) the security and integrity of their IT systems. The overall network architecture, connection (including co-lo facility) and its linkage to the trading infrastructure are in compliance with SEBI's regulatory framework to offer fair, equal, transparent, and non-discriminatory treatment to all market participants. d) During the Audit period, an internal examination of Critical Systems, as defined in a SEBI circular dated March 22, 2021, was conducted, including a Failure Modes and Effects Analysis (FMEA).
*Disclaimer - Kindly find all the annexures in the provided link/document.
[Notification No. SEBI/HO/MRD1/MRD1_DTCS/P/CIR/2022/58]
