PASS Securities Operations and Risk Management Examination Difficulty: Beginner 2 Questions   5 min read
📌 Chapter 4.2 — COMPLIANCES AND REGULATORY REPORTING

Picture this: it is 2:30 PM on a volatile trading day, and your IT monitoring tool triggers an alert indicating unauthorized access attempts on your firm’s order management system. While the technical team scrambles to isolate the threat, your role as an operations or compliance officer is to initiate the regulatory clock. In the Indian securities market, cyber incidents are not merely internal IT glitches; they are reportable events that affect the structural integrity of the exchange ecosystem.

You are required to report any ‘cyber security incident’ to the CERT-In (Computer Emergency Response Team-In) and the respective stock exchange within six hours of noticing the event. Failing to act within this narrow window invites scrutiny that far outweighs the embarrassment of a technical breach.

Understanding these timelines is crucial because they serve as the first line of defense against systemic risk. When a broker experiences a disruption—be it a ransomware attack or a significant data leak—the primary concern of regulators like SEBI is the potential for market manipulation or the loss of sensitive client information. By adhering to the six-hour reporting rule, you ensure that the clearing corporation and exchanges can monitor for anomalous trade patterns that might have been spawned during the breach.

It is not enough to simply patch the server; the compliance trail must reflect that the breach was identified, communicated, and mitigated within the prescribed framework.

In your daily operations, this means that your Business Continuity Plan (BCP) must clearly define who is responsible for the reporting desk. I have seen instances where a firm delayed reporting because they were waiting for internal investigation results, which turned out to be a fatal compliance error. The rule mandates reporting based on the initial notice of the incident, not the conclusion of your firm’s internal forensic audit.

Think of this as similar to a margin call; the urgency is dictated by the potential to create a snowball effect across the clearing cycle. If you fail to communicate, you deprive the market of the intelligence needed to protect other participants.

Ultimately, your proficiency in handling these incident logs reflects your maturity as a risk professional. Whether you are dealing with a minor server outage or a sophisticated cyber-attack, the reporting mechanism is your safeguard against regulatory penalties. You are not just ‘fixing computers’; you are maintaining the trust that investors place in your firm’s infrastructure. Always prioritize the communication clock, ensuring your reporting follows the incident notice as closely as the trade settlement follows the pay-in.

Nuance

⚠️ Nuance
Candidates often confuse the six-hour reporting window with the quarterly VAPT submission or annual audit requirements. While routine security reviews are cyclical, cyber incident reporting is an immediate, reactive obligation triggered by the event itself. Never assume that ‘investigating first’ is a valid defense for delaying your notification to the exchange; regulators value transparency during the active phase of an incident above all else.

Check Your Understanding

Practice Question 1

A stock broker identifies a suspected cyber-attack involving unauthorized attempts to access its client database at 11:00 AM. By what time must the broker report this incident to the relevant Stock Exchange?

Practice Question 2

Which of the following best describes the reporting requirement for a broker regarding a cyber-security incident under SEBI/CERT-In guidelines?

This is a companion read for Section 4.2 — COMPLIANCES AND REGULATORY REPORTING from PASS Securities Operations and Risk Management Examination by Akhilesh Gururani, available on Amazon Kindle.

Copyright © 2026 `Akhilesh Gururani. All rights reserved.