Structured digital database

Insider trading cases used to fail on a simple problem: nobody could prove who knew what, and when. The structured digital database exists to remove that excuse. It is a register, kept inside the organisation, of every occasion on which unpublished price sensitive information changed hands.

The obligation sits with the board of directors, or the head(s) of the organisation, of every person required to handle unpublished price sensitive information. That wording is wider than "listed company" on purpose — a merchant banker running an IPO, a law firm drafting the offer document, an auditor, a valuer: each of them handles UPSI, so each of them keeps a database.

It was inserted by the SEBI (Prohibition of Insider Trading) (Amendment) Regulations, 2022, with effect from November 1, 2024.

What goes in. Three things, for every instance:

• the nature of the unpublished price sensitive information;
• the names of the persons who have shared the information;
• the names of the persons with whom the information was shared — together with the Permanent Account Number, or any other identifier authorised by law where a PAN is not available.

How it must be kept. Two hard constraints. The database shall not be outsourced — it is maintained internally. And it must carry adequate internal controls and checks such as time stamping and audit trails to ensure non-tampering. A shared spreadsheet that anyone can edit afterwards satisfies neither.

For how long. Preserved for not less than eight years after completion of the relevant transactions. And if SEBI sends any information about an investigation or enforcement proceeding, the relevant entries are preserved till the completion of those proceedings — the eight years stop being the ceiling.

Why the entries exist at all. UPSI may be communicated for legitimate purposes, performance of duties or discharge of legal obligations, on a need-to-know basis. Where a board of directors forms an informed opinion that a proposed transaction is in the company's best interests, the UPSI must be disseminated to be made generally available at least two trading days prior to the transaction being effected. The board must also require the parties receiving it to execute confidentiality and non-disclosure agreements, and those parties must not otherwise trade while in possession of it.

A listed mid-cap plans a Rs 900 crore qualified institutions placement at an indicative Rs 412 a share — about 2.18 crore shares. Before the board approves it on 15 March 2026, the information is UPSI.

The merchant banker's structured digital database for the mandate reads, in part:

Fourteen individuals cross the wall before the announcement. Fourteen rows, each with two PANs, each time-stamped, none of it on an outsourced platform.

The preservation arithmetic is the part candidates get wrong. Allotment completes on 28 April 2026, so "completion of the relevant transactions" is April 2026 and the entries must survive to April 2034 — eight years after completion, not eight years after the row was written. If SEBI opens an investigation in 2031, those rows stay until that proceeding ends, whenever that is.

And one entry is not a sharing record at all: on 11 March the board formed the view that a pre-marketing conversation with two anchor institutions was in the company's interests. Because of that, the relevant UPSI had to be made generally available at least two trading days before the conversation was acted on, and both institutions had to sign confidentiality and non-disclosure agreements first.

Chapter 2, section 2.3.7 (SEBI (Prohibition of Insider Trading) Regulations, 2015) is where this sits, immediately after the legitimate-purpose provisions of Regulation 3. Expect factual questions on the eight-year preservation, on the fact that the database cannot be outsourced, and on what must be recorded — the PAN requirement is the detail most often dropped from an answer.

Expect also the pairing with two trading days: where the board decides a transaction in the company's best interest requires UPSI to be shared, the information must be made generally available at least two trading days before the transaction is effected.

• Eight years from completion of the transaction, not from the entry. A row written in March 2026 for a deal completing in April 2026 runs to April 2034.
• An investigation overrides the eight years. On receipt of information from SEBI about investigation or enforcement, the relevant entries are preserved till those proceedings complete.
• It cannot be outsourced. Not to a vendor, not to a cloud compliance service — maintained internally, with internal controls.
• Both sides are recorded. Who shared and who received, with PAN — a one-sided log of recipients is not compliant.
• The duty is not only on listed companies. It falls on the board or heads of every person required to handle UPSI, which squarely includes merchant bankers, legal counsel and auditors.
• Time stamping and audit trails are named requirements, not good practice. "Non-tampering" is the standard the regulation sets.
• Do not confuse the database with the Chinese Wall. The wall stops information moving; the database records it when it legitimately does. See Chinese Wall.