Custody Risk Overview of risks involved in custody

Custody Risk Overview of risks involved in custody and to protect Investors from Custody Risk Vishal Gajjar Assistant Vice President

Agenda § Indian Financial Market Overview § Custody Risk overview § Type of Risks § Risk mitigation measures 2

Indian Financial Market overview: Financial Market SEBI Stock Exchanges Depositories Brokers Participants Clients Trading account Clients Demat account 3

Segregated account Structure: Depositories Participants BO Account Participants CM Account BO Account CM Account 4

Custody Risk: § The risk of loss of securities held in custody of CSDs occasioned by the insolvency, negligence, fraud, inadequate record keeping or system failure of the CSD or of Participant. 5

Type of Risks: § Insolvency or Bankruptcy of CSD or Participant § System Break down, software malfunctions and cyber-attacks § Unauthorized access to data center or data lines (Hackers) § Frauds or errors / delays by CSD or Participants employees § Non-performance by third party service providers § Disruptions due to attacks, intrusions and natural disasters § Credit Risk (in case CSD deals in settlement of funds) § Insufficient investment in liquid net assets 6

Risk mitigation measures : § SMS/ Email Alert to investors § Account Statement by CSD directly to Clients § Direct access to account at CSD to end investors over internet and using mobile apps § Separate mobile number/ email id for the clients § Investor education programmes § Client positions computed at CSD in real time. Available to Participants and clients 7

Risk mitigation measures: § Debit/ Credit of Securities on Client’s or POA holders instructions only § Participants send individual end-investor instructions to CSD. No internalization § Audit Trail of each transaction is maintained at central system § Participant can only access CSD database § Mandating Concurrent and Internal Audit for Participants § Inspection of Participants by Depositories § Training of internal auditors & Participant staff and Mandatory Certified personnel, who provide important services to the investors 8

Risk mitigation measures: § Insurance coverage for NSDL & its Participants for possible risks related to their activities § Monitoring of the Aggregate Value of Securities of Stock Broker Participants § Alerts for Dormant accounts to Participants § Risk Based Supervision of Participants § Policy for closure of Participant (withdrawal / termination) 9

Risk mitigation measures: § Principles of Financial Market Infrastructures (PFMIs) § Policy for orderly winding down of Depositories § Risk Management Policy at the Depositories § Risk Committee to evaluate and assess the applicable risks § Annual System Audit of Depositories § Inspection of Depositories by Regulator (SEBI) § Cyber Security and Cyber Resilience framework of Depositories § No outsourcing of Depository operations activity § Whistle Blower Policy § Sufficient liquid net assets 10

Risk mitigation measures (IT): § Transmission of data is carried out in encrypted form § Daily reconciliation at account level, each transaction level as well as ISIN level § Capacity to handle five times the peak volume § Restricted access on a need to know basis § Creation or deletion of securities in the NSDL system can be carried out only by the Issuer/its R&T Agent who is connected to NSDL § Business Continuity Planning (BCP) § Disaster Recovery Site § System back up & Network redundancy § Certified for implementation of controls complying with ISO 27001: 2013 Information Security Management Standards 11

Thank you 12