SEBI's Cybersecurity and Cyber Resilience Framework, known as CSCRF, came through a circular dated 20 August 2024 and was clarified on 30 April 2025. A research analyst or investment adviser registered with SEBI in no other capacity is exempt from it. That does not end the IT work, because all RAs and IAs must still give a half-yearly SaaS advisory undertaking.
The short answer
If you are registered with SEBI only as an RA or only as an IA, CSCRF does not apply to you. If you hold other SEBI registrations as well, you follow the CSCRF requirements of the highest category among those registrations and report to BSE. Either way, every RA and IA must give the half-yearly SaaS advisory undertaking.
Where the rule comes from
CSCRF was issued by circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated 20 August 2024. Circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/60 dated 30 April 2025 clarified its application, in paras 2.3 to 2.4.1. The master circulars of 6 February 2026 carry this through in paras 8, 24 and 30 for RAs and paras 5, 27 and 31.1 for IAs.
| Situation | CSCRF position |
|---|---|
| Registered only as RA or only as IA | Exempt from CSCRF |
| RA or IA with other SEBI registrations | Follow the highest category of those registrations and report to BSE |
| Every RA and IA | Half-yearly SaaS advisory undertaking |
The SaaS advisory undertaking
All RAs and IAs must report compliance with the CERT-In SaaS advisory every half year, using the prescribed undertaking text. The circulars do not set an exact due date, so fix your own dates in the compliance calendar and keep a copy of each undertaking filed.
Before signing, list the software services you use for client data, research, advice, payments and communication, and confirm each one against the advisory. A short register of these services also helps when you update the AI disclosure in client terms.
Client data duties that apply anyway
Even without CSCRF, the AI rule makes RAs and IAs solely responsible for the security, confidentiality and integrity of client data. Records, including KYC and communication with clients and prospects, must be kept for at least five years. A breach or loss of those records is a compliance problem whether or not CSCRF applies.
Digital accessibility
A separate SEBI circular of August 2025 requires annual compliance on accessibility audits of all digital platforms, given to BSE within 30 days of each financial year end. The next due date under that circular is 30 April 2027. Websites and apps used by clients fall within it.
A practical IT policy for an exempt RA or IA
An exempt firm still benefits from a short, written IT and information security policy that an auditor can read. It also gives you a single place to record your CSCRF position, the SaaS undertaking dates and the accessibility filing for each year.
- Record your CSCRF position and the reason, such as single registration
- List the SaaS and AI tools in use and the data each one holds
- Note where client data is stored
- Set access controls and a review date for staff accounts
- Diarise the half-yearly SaaS undertaking and the accessibility filing
When your position changes
Taking on another SEBI registration changes the answer, because CSCRF then applies at the highest category among your registrations. Revisit the IT policy whenever your registrations change. For help keeping checks like these on a schedule, XDQ Labs offers XDQ xAgents for RAs and IAs (/product/xfintech-agents/). This guide is general information, not legal or investment advice. Confirm with your compliance officer.
Frequently asked questions
Is a SEBI research analyst exempt from CSCRF?
Yes, if it is registered with SEBI only as a research analyst. An RA holding other SEBI registrations follows the CSCRF requirements of the highest category among those registrations and reports to BSE.
Does CSCRF apply to investment advisers?
Not to an IA registered with SEBI in no other capacity. The position comes from the CSCRF circular of 20 August 2024 as clarified by the circular of 30 April 2025, paras 2.3 to 2.4.1.
What is the SaaS undertaking for RAs and IAs?
A half-yearly undertaking reporting compliance with the CERT-In SaaS advisory, using prescribed text. All RAs and IAs must give it, even when exempt from CSCRF. The circulars do not set an exact due date.
Do RAs and IAs need an accessibility audit?
Yes. Under a SEBI circular of August 2025, they give BSE annual compliance on accessibility audits of all digital platforms within 30 days of each financial year end. The next due date is 30 April 2027.
Sources
- Master Circular for Research Analysts, 6 February 2026, SEBI, 2026
- Master Circular for Investment Advisers, 6 February 2026, SEBI, 2026
- SEBI circular on accessibility of digital platforms, August 2025, SEBI, 2025
- SEBI (Research Analysts) Regulations, 2014, amended up to 10 October 2026, SEBI, 2026
- SEBI (Investment Advisers) Regulations, 2013, amended up to 25 November 2025, SEBI, 2025
- RAASB and IAASB enlistment portal, BSE Limited, 2026
