Common Irregularities observed during inspection by Exchange

1

Authorised person (AP) related

Authorised Person (AP) is engaged in receiving or paying funds from/to clients and other individuals/entities.

Authorised Persons (APs) influencing clients and doing unauthorized trading by taking user ID and Password from the clients.

Authorised Person (AP) seeking authorization from clients to trade on their behalf.

Authorised Persons (APs) trading in client’s account with focus on generating brokerage.

Email-ID/Mobile number of Authorised Person (AP) mapped to the clients in UCC records.

Inspection of Authorised Persons (APs) not undertaken by the Trading Member as per prescribed requirements.

Issuance of advertisements/promotional material/ performance claims or solicitation content by Authorised Person (AP) through print, digital, or social media without prior approval of the Exchange through the Trading Member

Non maintenance of pre trade confirmations or order placement evidence of the clients mapped with Authorised Person (AP)

Authorised Person (AP) is offering fixed/periodic/assured returns and indulging in mis-selling/Profit Sharing / Account Handling / Unauthorized PMS.

Terminals of the Authorised Person (AP) are not found at the location reported to the Exchange.

Terminals situated at the place of inspection were not operated by registered Authorised Person (AP) or employee of the AP.

Notice Board, Authorised Person (AP) approval letter, SEBI Registration Certificate of Trading member, Do’s and Don’ts, Investor Charter, etc., not displayed at the AP’s office. Complaint register is not maintained at AP’s office

Non-Reporting/Incorrect reporting of clients mapped to Authorised Persons (APs)

1

Bank transfers related

Non permissible transfer of funds between USCNBA, DSCNBA and any other bank account of the Trading Member

Member has not changed the nomenclature as Up Streaming Client Nodal Bank Account (USCNBA) and Down Streaming Client Nodal Bank Account (DSCNBA) of all such accounts which hold clients’ funds

Member has not wound up all the existing "client unpaid securities accounts"

2

Demat related

Member has not undertaken tagging of DP accounts as required

3

KYC related

Non-maintenance of client registration documents containing all the prescribed mandatory documents and all fields are not properly filled up.

Contravening clauses incorporated in client registration documents

Copy of duly completed Client Registration Documents was not delivered to the client within 7 days and free of charge.

Member has not complied with the SEBI Circular Ref. No. SEBI/HO/MIRSD/DOP/CIR/P/2020/73 dated April 24, 2020 regarding "Clarification on KYC Process and Use of Technology for KYC" while online onboarding of clients.

Trading member has not informed to existing clients about Most Important Terms and Conditions (MITC)

Trading Member has not taken acknowledgement on Most Important Terms and Conditions (MITC) from new clients.

Non upload of the KYC data with CKYC in respect of individual accounts opened

4

Maintenance of records by the Trading member

Member has not kept appropriate evidence in respect of the order placed by their clients.

Trading Member has not maintained the evidence of payout requests received from the clients (other than Settlement) for part payment of credit balance clients

Non-Maintenance of Register of Securities, Holding Statement, Bank Book and Client Ledger in the prescribed standard format

Trading member has not taken latest documentary evidence in support of financial information provided by the client in derivative segment.

Non-maintenance of Register of complaints

Well documented risk management policy is not maintained.

5

Margin Trading Facility (MTF) related

Adequate margins have not been collected by the Member in the form of cash and cash equivalent or Group I equity shares with appropriate hair cut.

Member has not adhered to Exposure Limits while granting the Margin trading facility.

Member has provided margin trading facility in other than the Group 1 securities.

Trading Member has incorrectly reported Daily margin trading file (MTR file).

6

Margin/settlement related

Incorrect reporting of margin collection from clients to the Exchange

Non-Settlement of client funds

Non-issuance/ delay in issuance of Daily Margin Statement to clients

Issuance of Daily Margin Statement to clients with incorrect/incomplete details

Member has made pay-out of funds to clients in excess of their available credit balances.

Material discrepancies in the retention statement sent to the clients

Trading member has not sent an intimation including the details about the transfer of funds to clients by SMS & email at the time of running account settlement of funds.

Non-issuance / delay in sending of retention statement/ statement of accounts at the time of settlement of client accounts.

Transfer of funds to clients towards running account settlement not undertaken using electronic modes

Member has passed on the penalty levied on account of short collection of upfront margins to client

7

Other areas

Discrepancy in computation of Net-worth

Non-display of Notice Board & SEBI registration certificate at the inspection location

Trading member has not captured the IP (Internet Protocol) address (from where the orders are originating) for all IBT/ STWT orders.

Information about the grievance redressal mechanism is not displayed at all the offices of the Member for the information of the investors.

Delay in issue of Contract notes to the clients

Trading Member has allowed trading in the account of a minor.

Invocation of client securities in excess of debit balance of the clients

8

Reporting of data to the Exchange

Incorrect data submitted by the Member towards Risk Based Supervision (RBS)

Member has incorrectly reported the data towards "Segregation and Monitoring of Collateral at Client Level" to Clearing Member/Clearing Corporation

Member has not reported the opening /closure of their Bank/ DP accounts to the Exchange within the prescribed timelines

Member has incorrectly reported the data towards the Settlement of Running Account of Clients Funds lying with Trading Members

9

Terminal related

Terminals situated at the place of inspection were not operated by employee, partner/proprietor/Director(s), registered authorized persons (AP) or employee of an AP.

Terminals observed at the inspection location were not as per the information reported to the Exchange.

Error in upload/ non-upload of terminal details to the Exchange

10

UCC related

Trading Member has not marked clients as inactive in the UCC database

Mobile Numbers and E mail Ids of clients are not uploaded in the UCC database as per the details provided by the client in the client registration documents

Common email id and/or mobile number uploaded for multiple clients not belonging to same family as prescribed in SEBI Circular Ref. no. CIR/MIRSD/15/2011 August 2, 2011 and SEBI Circular Ref. no. SEBI/HO/MIRSD/MIRSD-PoD1/P/CIR/2024/169 dated December 3, 2024

11

Upstreaming of client's funds

Member has not ensured that all the clients clear credit balances are upstreamed to the clearing corporation within the specified timelines

Member has not ensured that: -

i) Clients clear credit balances retained with TM are on account of justifiable reasons.

ii) Justifiable reasons of clear credit balances reported in the segregation file as “Retained with TM” or “Retained with CM” are incorrectly reported to Clearing Corporation (CC)

iii) Clients clear credit balances reported as “Retained with TM” or “Retained with CM” are available in USCNBA/DSCNBA/Settlement Account of the Stock Brokers /Clearing Members and/or in transit to the CC.

12

Cybersecurity related

Cyber Security and Cyber Resiliency Policy not approved

Identification and classification of critical assets in Risk/Asset Register not being as per the Exchange's requirements.

Two Factor authentication not enabled/enabled but not validated on important systems, used for both trading and administration.

Inadequate Password policy.

Configuration of DLP in Monitoring mode instead of prevention mode leading to inadequate configuration.

Non integration of all assets under Firewall and SOC, logs not retained/stored for required period and review logs not done.

Improper delineation of roles and responsibilities for employees/ vendor resources with respect to privileged accesses or access/ usage of systems and networks.

Generic IDs having privileged access without proper ownership.

Web filtering configurations do not have an extensive coverage for filtering out malicious/unauthorised websites.

Powershell, command prompt and script enabled on endpoints without any business requirement / approval.

Whitelisting of ports/ open ports not as per business requirements.

Encryption practices partially/not implemented for data at rest.

13

VAPT Related

Non coverage of all the broad areas in the VAPT scope (APIs, Mobile application, web application, Wi-Fi) not as per Exchange guidelines.

Non implementation of appropriate rate limits and throttling of requests for functionalities such as OTP generation and emails.

Usage of obsolete version of applications even after updated/upgraded version are available.