🧠 Food for thought

Implications, context, and why it matters.

SEBI readies AI oversight for 4,900+ intermediaries as CSCRF rules roll out

• The regulator oversees 4,900+ intermediaries across stock brokers, merchant bankers, portfolio managers, and investment advisors 1. India’s top 20 brokers serve over 35 million active clients 1.
• SEBI issued the Cybersecurity and Cyber Resilience Framework (CSCRF) in August 2024 2, then released technical clarifications in August 2025 3. The rules set mandatory cybersecurity standards for SEBI-regulated entities.
• The framework adds cyber audits, incident reporting protocols, and continuous monitoring rules 2.
• SEBI is preparing to use AI to rate entities by risk level. That signals tighter checks on higher-risk firms serving retail investors, instead of uniform oversight across all 4,900+ entities.

Regulatory technology (regtech) can take on compliance work for smaller SEBI intermediaries under AI oversight

• India has 192.4 million demat accounts (dematerialized securities accounts used by investors) 1, with 41.1 million added in 2024-25 1. Many smaller brokers and intermediaries lack cybersecurity teams to meet CSCRF duties 2.
• SEBI’s searchable intermediary registry (a public database of licensed entities) 4 helps vendors size demand for automated tools for portfolio managers, investment advisors, and mid-tier brokers.
• Many of these firms run on tight IT budgets while they remain subject to CSCRF 2, which boosts demand for affordable managed security service providers (MSSPs).
• Regtech firms can ship pre-packaged CSCRF tools with automated audit reports, control gap flags, and incident response workflows.