Every CSCRF conversation eventually turns to "who else is doing this?" and "what does my peer look like?" The answer requires knowing the SEBI RE ecosystem in numbers. This lesson gives you the map. Understanding the ecosystem is not just intellectual curiosity — it is operational leverage. Knowing your tier, knowing your peers, and knowing the audit-firm capacity that serves your peer group informs your compliance budget, your vendor negotiation posture, and your Board-briefing narrative. A CISO who says "we are one of 15 Qualified REs in the depository-participant category" carries more conviction than one who says "we are compliant with CSCRF" without context.
The ecosystem population as of September 2026
The SEBI Regulated Entity ecosystem has grown roughly 8-12 percent since CSCRF came into force, driven primarily by IA/RA reforms and by AIF/PMS category expansion. The population is not evenly distributed across CSCRF tiers: the vast majority of REs by count sit in Small-size or Self-Certification, a modest population in Mid-size, several hundred in Qualified RE, and the same seven MIIs at the top of the pyramid that predated CSCRF. Practitioner reading: if you are CISO at a Qualified RE, your peer group numbers in the hundreds; if you are at a Mid-size RE, several thousand peers; the audit-firm capacity story is very different for each tier.
Market Infrastructure Institutions (7)
The top of the pyramid. Under CSCRF, MIIs are the highest tier of obligation. They must operate a dedicated in-house 24×7 SOC, submit half-yearly third-party CCI assessments to a minimum score of 71, and have full-time CISOs reporting to MD/CEO.
- Stock exchanges (2): National Stock Exchange of India (NSE), BSE (formerly Bombay Stock Exchange)
- Clearing corporations (3): NSE Clearing Limited (NCL), Indian Clearing Corporation Limited (ICCL, for BSE), MCX Clearing Corporation Limited
- Depositories (2): National Securities Depository Limited (NSDL), Central Depository Services (India) Limited (CDSL)
The MII cluster's shared audit vendor and consultation dynamic
The seven MIIs share a small pool of CERT-In empanelled specialised cyber auditors qualified to conduct MII-scale audits. Roughly six audit firms dominate MII audit engagements (KPMG, Deloitte, EY, PwC, plus two specialist Indian firms). This shared vendor pool produces informal cross-MII benchmarking through the audit-firm consultation channel (auditor learns something at MII A and applies the pattern at MII B). Practitioner reading: peer-benchmarking data flows informally through the audit-firm layer even where SEBI does not publish it. Cultivate a working relationship with your audit firm's engagement partner as a source of peer-benchmarking intelligence.
Qualified Registrar and Share Transfer Agents (2)
QRTAs. Historically treated at MII intensity by SEBI.
- KFin Technologies
- Computer Age Management Services (CAMS)
KYC Registration Agencies (5, moved to Qualified RE Apr 2025)
- CDSL Ventures Limited (CVL)
- NSDL Database Management Limited (NDML)
- DOTEX International
- CAMS Investor Services
- Karvy Data Management Services (Karvy-KRA)
Plus KFin's new KRA registration IN/KRA/007/2025.
Registered intermediaries — indicative counts
From the SEBI Sep 2025 Bulletin and adjacent industry data (all figures approximate as of August 2026):
- Stock brokers: ~4,900+ SEBI-registered, ~350 active on NSE
- Depository participants: 300+
- Asset Management Companies (mutual funds): 45+
- Portfolio Managers: 400+
- Registered Investment Advisers: 967 (SEBI proposed to grow this in Aug 2024 with relaxed entry norms)
- Research Analysts: ~1,500
- Alternative Investment Funds: ~1,000+ across three categories
- Merchant bankers: ~200+
- Mutual fund distributors: 2.7 lakh+
- Credit rating agencies: 6
- Debenture trustees: ~30
The IA and RA reforms of 2024 and their CSCRF interaction
SEBI's 20 August 2024 relaxation of Investment Adviser and Research Analyst entry norms is expected to expand both populations materially over 2025-2027. New IAs and RAs enter directly into the Mid-size or Self-Certification tier depending on their scale metric. The expansion has a downstream implication for CSCRF ecosystem enforcement: audit-firm capacity for CERT-In empanelled cyber audits is finite, and a rapid expansion of the addressable base can create audit-slot scarcity. Practitioner action: for a growing IA or RA, book audit slots 6-9 months ahead of the fiscal-year audit window, especially in the March-June period.
The Custodians population and the FPI overlay
Custodians (Deutsche Bank Custody Services, HDFC Bank Custody, ICICI Bank Custody, Kotak Custody, SBI-SG Global Securities Services, Standard Chartered Bank Custody, Stock Holding Corporation of India) sit at the intersection of SEBI and RBI regulation because they hold custody of Foreign Portfolio Investor assets. CSCRF applies at Qualified RE tier for the largest custodians. RBI cybersecurity framework applies to the banking-parent side. Practitioner design at custodian CISOs: run one integrated cyber programme that satisfies both SEBI Qualified RE and RBI banking obligations, using CSCRF Principle of Equivalence to reduce duplicate audit burden.
The regulatory hierarchy under CSCRF
Every RE has a defined reporting chain for compliance filings:
- SEBI → MII (for MIIs, KRAs, QRTAs — direct reporting to SEBI)
- SEBI → Exchange → Broker (for brokers, who report CSCRF compliance to NSE / BSE, not directly to SEBI)
- SEBI → Depository → DP (for depository participants, who report to NSDL / CDSL)
- SEBI → AMC (for mutual funds, direct)
- SEBI → PMS / IA / RA (direct)
But incident reports go via the SEBI Incident Reporting portal + CERT-In in parallel, regardless of reporting chain [L4-C1]. This is the practitioner rule: CSCRF compliance follows the chain; incidents jump the chain.
Where your entity likely sits
Practitioner readers of this course are typically CISOs, DPOs, Heads of IT Risk or Heads of Cyber Compliance at:
- NSE, BSE, NSDL, CDSL (MII CISOs) — expect ₹1.5-3.5 crore comp; Group CISO / Head-InfoSec title; direct MD/CEO reporting
- KFin, CAMS (QRTA CISOs) — similar band
- Angel One, Zerodha, Groww, HDFC Securities, ICICI Securities (Qualified RE brokers) — ₹80 lakh - ₹2 crore comp
- Large mutual funds (SBI MF, HDFC MF, ICICI Prudential MF, Nippon India MF, Axis MF) — Qualified RE band
- Mid-size PMS, RIA firms — Mid-size RE band; ₹35-70 lakh comp; often VP-InfoSec or SVP-InfoSec title rather than "CISO"
Cross-referencing the ecosystem to the CCI submission chain
The CCI submission mechanism (Module 2) runs through the reporting hierarchy: MIIs submit CCI to SEBI; QRTAs and KRAs submit to SEBI directly; large brokers submit via NSE/BSE; DPs submit via NSDL/CDSL; AMCs submit to SEBI directly; PMS and IAs and RAs submit via their sub-registration authority or directly per category. Understanding the specific submission chain for your entity is a prerequisite for the CCI workflow. Practitioner check: confirm your reporting chain with your compliance team in Q1 of every fiscal year and note it in your CSCRF register so the CCI submission does not run into administrative confusion at the filing window.
The SEBI CSCRF-CCI Working Group ecosystem
SEBI convenes periodic industry consultations through a CSCRF-CCI Working Group with representation from MIIs, large REs, industry bodies (AMFI, APMI, ANMI), and CERT-In. Consultation outputs (draft clarifications, FAQs, control-catalogue updates) circulate through this group before publication. CISOs at Qualified REs can influence framework evolution by engaging with their industry body's representative on the Working Group; direct SEBI engagement typically routes through MII CISO forums.
Why the ecosystem map matters for your programme
Three practical uses:
- Peer benchmarking. SEBI does not publish RE-level CCI scores, but auditor networks share peer bands informally. Knowing who your peers are lets you request peer benchmarks from your CERT-In empanelled auditor.
- Vendor negotiation. M-SOC vendors serve tiers of clients. Naming your peers signals your expected commercial band.
- Regulatory dialogue. When SEBI holds industry consultations on CSCRF revisions, participation happens through industry bodies (BSE-BOI, NSE-ICCL member forums, AMFI, APMI). Knowing your place in the ecosystem lets you engage the right forum.