• Adv Govind Bali
• Legal News
• August 25, 2026

SEBI Mandates IT Resilience Index and Early-Warning Systems for Market Infrastructure Institutions

Mumbai, 24 August 2026: The Securities and Exchange Board of India has prescribed an IT Resilience Index for stock exchanges, clearing corporations and depositories, together with early-warning and continuous service-delivery monitoring requirements.

A system-driven resilience score

The IT Resilience Index, or ITRI, will measure the robustness of critical systems and systems feeding or related to them. Its weighted parameters cover availability and security at 20 points each; integrity, governance, reliability and monitoring, business continuity, and modularity and flexibility at 10 points each; and scalability and other matters such as incident handling at five points each.

SEBI requires the computation to be automated from IT systems or data extracted from them, without manual intervention. Where a parameter cannot be computed automatically, manual data retrieval is permitted only after prior discussion of the exception with the institution’s Standing Committee on Technology.

Half-yearly governance review

Market Infrastructure Institutions must calculate the ITRI half-yearly within 60 days after each half-year ends. A rolling comparison of two consecutive half-years, along with corrective action taken or proposed, must go to the Standing Committee on Technology and the Governing Board.

The Industry Standards Forum of MIIs must finalise sub-parameters and measurement criteria by 30 November 2026, along with baseline parameters, acceptable threshold scores and an objective scoring methodology.

Early warnings and real-time visibility

MIIs must develop an early-warning system capable of detecting deterioration that may cause performance issues or slowness. They must also build consolidated dashboards providing continuous visibility into system and application performance, service delivery and deviations or anomalies, supported by standard operating procedures.

Implementation dates

The full ITRI framework, early-warning system and real-time service-delivery monitoring must be operational by 28 February 2027. Detailed SOPs, after review by the Standing Committee on Technology, are due to SEBI by 31 January 2027. The first ITRI submission will cover the half-year ending 31 March 2027.

Practical significance

The circular moves technology resilience from narrative assurance toward a comparable, repeatable and board-reviewed metric. Covered institutions will need reliable telemetry, automated evidence collection, threshold-based alerts and documented remediation governance.

Read the official SEBI circular and document.

This report is for legal information only and does not constitute legal advice.