CSCRF is a scaled framework. What a MII must do is not what a mid-size mutual fund must do. The five-tier categorisation is therefore the single most consequential decision under CSCRF. Get it right and you have a proportionate compliance programme. Get it wrong and you either over-invest by ten times or under-invest and get flagged in your next SEBI inspection. Categorisation is not a self-selected posture; it is a fact-driven determination based on your entity type, your scale metrics, and your business complexity. SEBI publishes the ladder in the CSCRF master circular Annexure and refines it through the April 2025 clarifications. Every RE CISO should complete a formal categorisation memo at the start of every fiscal year, sign it off with the Chief Compliance Officer, and file it in the accountability register.
The pre-CSCRF categorisation legacy
Before CSCRF, SEBI ran category-specific cybersecurity circulars: the 2015 Mutual Fund Cyber Framework, the 2018 Brokers Cyber Framework, the 2019 Depositories Framework, the 2020 KRA Framework. Each had its own scope, timelines, and obligations. CSCRF consolidates these into a single framework with the five-tier categorisation replacing the entity-type distinctions of the legacy circulars. For CISOs who worked at Regulated Entities before August 2024, the transition required re-reading a familiar-seeming framework with a new structural lens. For CISOs new to the sector, learn CSCRF directly; the legacy circulars are historical background rather than operational reference.
The five tiers
| Tier | Who | CCI required? | Audit cadence |
|---|---|---|---|
| MII | Stock exchanges (NSE, BSE), clearing corporations (NCL, ICCL, MCX Clearing), depositories (NSDL, CDSL) [L3-C1] | Yes, minimum 71 (Manageable); half-yearly third-party | Twice a year |
| Qualified RE | QRTAs (KFin, CAMS), KRAs (5 — moved from MII in Apr 2025), large brokers, large mutual funds, large depository participants, large custodians | Yes, minimum 61 (Developing); annual self-assessment | Twice a year |
| Mid-size RE | AIFs, PMS, merchant bankers, debenture trustees, credit rating agencies, RTAs, IAs and RAs above threshold | No | Once a year (twice if IBT or Algo) |
| Small-size RE | Below Mid threshold | No | Once a year |
| Self-Certification RE | Brokers < 1,000 clients AND < ₹1,000 crore annual trading volume (April 2025 clarifications) [L3-C2]. Very small IAs, RAs, similar | No | Exempt from periodic audit; VAPT-only + self-certification |
The Broker Exemption threshold (April 2025)
The 30 April 2025 clarifications introduced a dual-parameter test that carved out the smallest brokers from full CSCRF. A broker qualifies as Self-Certification only if it meets BOTH conditions:
- Fewer than 1,000 active clients, AND
- Annual trading volume below ₹1,000 crore
A broker that meets one condition but not the other falls into Small-size RE, not Self-Certification. Watch this in year-end reviews. A rapidly growing broker that crosses either threshold mid-year must re-categorise at the start of the next financial year.
The 1,000-crore threshold logic
The ₹1,000 crore annual trading volume threshold in the Broker Exemption was calibrated after industry consultation with the smallest 300+ registered brokers, of whom the median annual trading volume is well below the threshold. The threshold effectively carves out entities whose absolute risk contribution to the ecosystem is small even in the event of a compromise. Practitioner reading: if your broker is approaching the threshold but still qualifies, plan the transition to Small-size RE early; if you have already crossed, expect an audit-cadence and self-certification-versus-third-party-audit distinction that materially changes your compliance calendar.
The KRA reclassification (April 2025)
The 30 April 2025 clarifications moved KYC Registration Agencies (KRAs) from MII status to Qualified RE status. Five KRAs are affected: CVL, NDML, DOTEX, CAMS-KRA, and Karvy-KRA (plus KFin's new KRA registration IN/KRA/007/2025). Consequences of the move:
- CCI submission moves from half-yearly third-party to annual self-assessment.
- Minimum CCI drops from 71 to 61.
- The dedicated in-house 24×7 SOC requirement relaxes to permit M-SOC.
- Audit cadence remains twice a year (same as MII).
Practitioner check: your KRA-linked filings for FY 2024-25 may reference MII obligations. Filings from FY 2025-26 onwards align to Qualified RE. This transition is subtle but material for evidence packs.
Categorisation-driven CCI expectations
The CCI minimum score expectation differs by tier: MIIs must reach at least 71 (Manageable) with half-yearly third-party assessments; Qualified REs must reach at least 61 (Developing) with annual self-assessment; Mid, Small, and Self-Certification REs are exempt from CCI. The score bands are not aspirations; they are audit-checked thresholds. A Qualified RE that submits a CCI score of 55 without a documented improvement plan is treated by SEBI as inadequately positioned and can attract inspection scrutiny. Practitioner planning: know your target band based on your tier, plan the parameter-by-parameter path to that band, and refresh the plan annually.
How to categorise your entity
A three-step test:
- What type of entity are you? Broker, DP, MF, AMC, PMS, IA, RA, RTA, KRA, custodian, exchange, clearing corp, depository. This determines the applicable category ladder.
- What is your scale? Client count, AUM, trading volume, or the metric applicable to your entity type. Cross-check against the April 2025 clarifications and the categorisation annexure to the master circular.
- What is your business complexity? Do you offer Internet-Based Trading (IBT) or Algorithmic Trading (Algo)? If yes, your audit cadence moves to twice a year regardless of other Mid/Small categorisation.
Category placement is annual
Category placement is fixed at the start of the financial year using prior-year data. A Mid-size RE that grows into Qualified RE thresholds mid-year does not re-categorise until 1 April of the next financial year. This creates a planned window to build the additional obligations of the new tier.
Consequences of getting it wrong
Over-categorising (claiming Qualified RE when you are Mid-size): you spend money on obligations you do not owe. Under-categorising (claiming Mid-size when you are Qualified RE): SEBI inspection findings, potential SEBI Act §15HB penalty up to ₹1 crore per violation, and reputational damage that flows into the CCI in the next cycle.
The rule of thumb: when in doubt, up-categorise. It is cheaper to over-comply than to defend an under-categorisation in a SEBI inspection.
Category-transition planning
A Mid-size RE approaching Qualified RE thresholds should plan the category transition 6-12 months before the anticipated re-categorisation date. Key transition-planning items: (i) build a dedicated 24×7 SOC capability or contract an M-SOC to Qualified RE specifications; (ii) upgrade the CCI capability from no-CCI baseline to annual self-assessment reaching CCI 61 minimum; (iii) recruit or promote a full-time CISO if the current arrangement is a fractional or shared role; (iv) elevate cyber governance to a standing Board committee cadence; (v) build the audit-evidence pack expected of Qualified REs. Retro-fitting these obligations after re-categorisation is materially more expensive than planning ahead.
The IBT / Algo modifier
Internet-Based Trading and Algorithmic Trading are activity modifiers that increase audit cadence regardless of underlying category. A Mid-size broker offering IBT to retail customers moves to twice-a-year audit cadence rather than the once-a-year default for Mid. A Small broker offering Algo-based execution similarly moves up. The modifier reflects the elevated cyber-risk of trading platforms exposed to real-time internet traffic and algorithmic-decision-making surfaces. Practitioner design: if you offer IBT or Algo, plan for the elevated audit cadence and the associated evidence-pack refresh cycle.
Reading the Small-size and Self-Certification tiers correctly
The Small-size and Self-Certification tiers are not a compliance discount; they are a proportionate obligation set for genuinely small entities. Both tiers still owe: baseline security controls (access, backup, patching), incident reporting via the standard channels (SEBI + CERT-In), and the CSCRF principles-level obligations. What they are relieved of is the CCI submission (both), the twice-a-year audit cadence (both), the dedicated in-house 24×7 SOC (both), and for Self-Certification the periodic third-party audit itself. Practitioner design for a Small-size RE: focus resources on the baseline controls and evidence discipline; you cannot afford the sprawl of a Qualified RE compliance programme and CSCRF does not ask you to.
| Tier | Who | CCI minimum | Audit cadence | |
|---|---|---|---|---|
| MII | Tier | Stock exchanges, clearing corps, depositories (7 total) | 71 (Manageable), half-yearly third-party | Twice a year |
| Qualified RE | Tier | QRTAs, KRAs, large brokers/MFs/DPs/custodians | 61 (Developing), annual self | Twice a year |
| Mid-size RE | Tier | AIFs, PMS, merchant bankers, debenture trustees, RTAs | Not required | Annual (twice if IBT/Algo) |
| Small-size RE | Tier | Below Mid thresholds | Not required | Annual |
| Self-Certification | Tier | Brokers < 1,000 clients AND < Rs 1,000 cr volume | Not required | VAPT-only + self-cert |