Comprehensive Guide to SEBI’s New IT Resilience Index (ITRI) Framework for Market Infrastructure Institutions
The digital transformation of the Indian financial landscape has positioned technology as the absolute cornerstone of market operations. Market Infrastructure Institutions (MIIs)—comprising Stock Exchanges, Clearing Corporations, and Depositories—handle millions of transactions daily. Any technological glitch, performance degradation, or cyber-attack can severely disrupt market equilibrium and erode the confidence of market participants.
Recognizing the indispensable nature of robust technological infrastructure, the regulatory authority has introduced a stringent, quantifiable mechanism to evaluate and ensure system stability. Through SEBI Circular No. HO/47/18/11(1)2026-MRD-TPD1/I/19509/2026 issued on August 24, 2026, a formalized IT Resilience Index (ITRI) has been mandated for all MIIs (excluding AMC Repo Clearing Ltd.). This directive, rooted in the powers granted under Section 11(1) of the Securities and Exchange Board of India Act, 1992, marks a paradigm shift from reactive troubleshooting to proactive technological governance.
The Genesis and Objective of the ITRI Framework
The foundation of this regulatory overhaul traces back to the consultation paper released on March 25, 2026, which proposed a structured methodology to gauge the technological health of MIIs. The primary objective is to guarantee that the fundamental IT systems governing the securities market remain highly available, resilient to cyber threats, and capable of handling extreme operational stress.
Just as an assessee is required to maintain meticulous financial records and undergo rigorous audits to ensure compliance, MIIs are now obligated to subject their technological infrastructure to continuous, automated scrutiny. The ITRI serves as a diagnostic tool, providing Governing Boards and regulatory bodies with a clear, objective snapshot of an institution's technological robustness.
Scope of Applicability: Defining Critical Systems
The ITRI framework does not merely apply to peripheral applications; it targets the very nerve center of market operations. The evaluation will strictly measure the robustness of "Critical Systems" as previously defined in the regulatory framework:
- Clause 9.1.2.3 of the Master Circular dated December 30, 2024, applicable to Stock Exchanges and Clearing Corporations.
- Clause 4.31.2.3 of the Master Circular dated December 03, 2024, governing Depositories.
- Clause 16.4.3(c) of the Master Circular dated August 04, 2023, concerning the Commodity Derivatives Segment.
Furthermore, the mandate explicitly states that any ancillary systems or data feeds that interact with or supply information to these Critical Systems are also enveloped within the scope of the ITRI assessment.