Registrar and Transfer Agents Regulations

What this chapter covers

Units 6 to 8 carry 25 marks between them — about 8 marks for this chapter.

LEARNING OBJECTIVES: After studying this chapter, you should know about: Guidelines for Outsourcing of RTA functions · SEBI (Registrars to an Issue and Share Transfer Agents) Regulations, 2025 · Enhanced Monitoring Guidelines for QRTAs · Cyber Security and Cyber Resilience Framework for QRTAs · System Audit Framework · Concept of Segregated Portfolios · Ultimate Beneficial Owners (UBO)

7.1 Guidelines under the LODR Regulations

SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, (LODR Regulations) provides detailed regulation and guidelines for the listed entities with regards to their listing obligations and disclosure requirements.

Who is covered: specified securities listed on main board or SME Exchange or Innovators Growth Platform · non-convertible securities · Indian depository receipts · securitised debt instruments · security receipts · units issued by mutual funds · any other securities as may be specified by SEBI.

LODR Regulations allows the listed entities to appoint a share transfer agent or manage the facility in-house. In case of in-house share transfer facility, as and when total number of holders of securities of the listed entities exceeds 1 lakh, the listed entity shall either register with SEBI as a Category II share transfer agent or appoint a SEBI registered Registrar to an issue and share transfer agent.

The listed entity should ensure that all activities related to share transfer facility are maintained either in-house or by a SEBI registered RTA.

One lakh holders is the trigger; one keeper, not two.

7.2 The SEBI (RTA) Regulations, 2025

SEBI (RTA) Regulations seeks to regulate the registration process, activities, general obligations and responsibilities of registrar to an issue and share transfer agents. These regulations govern the registration, capital adequacy, governance, and operational obligations that a Registrar to an Issue and Share Transfer Agent (RTA) must abide by.

Unified registration

Under the 2025 framework, the historical classification of RTAs into separate categories has been replaced with a Unified Registration system. This single certificate of registration authorizes an applicant to act as both a Registrar to an Issue, managing activities such as application processing and allotment in public offerings, and a Share Transfer Agent, responsible for maintaining the register of security holders and facilitating ongoing corporate actions for listed entities.

One certificate; both activities.

The definition

"Registrar to an issue and share transfer agent" means a body corporate or a division or unit of such body corporate, appointed to carry out the following activities- (i) for acting as an intermediary in connection with initial public offers, follow-on public offers, open offers, buy backs of securities, delisting offers, takeovers and such other issue or corporate action related activity as may be specified by SEBI or stock exchanges or depositories; (ii) for maintaining the records of holders of securities issued by such body corporate and to deal with all matters connected with transactions in such securities.

Registration, fees and net worth

No person shall act as a Registrar to an Issue and Share Transfer Agent unless it has obtained a certificate of registration from SEBI under these regulations.

The certificate of registration granted by SEBI, shall be valid unless it is suspended or cancelled by SEBI itself.

Valid indefinitely, subject to fees.

Conditions attached to the certificate

(a) the registrar to an issue and share transfer agent shall abide by the provisions of the Act and these regulations;

(b) ... shall obtain prior approval of SEBI in case of change in control;

(c) ... shall enter into a legally binding agreement with the body corporate or the person or group of persons for or on whose behalf it is acting... stating therein the allocation of duties and responsibilities;

(d) ... shall pay the fees for registration;

(e) ... shall maintain net worth requirements of fifty lakh rupees and above at all times during the period of validity of the certificate;

(f) ... shall take adequate steps for redressal of grievances of the investors within twenty-one calendar days of the date of the receipt of the complaint and keeping SEBI informed about the number, nature and other particulars of the complaints received and the manner in which such complaints have been redressed;

Twenty-one calendar days.

(g) ... shall immediately intimate SEBI in writing, if any information or particulars previously submitted to SEBI are found to be false or misleading in any material particular or if there is any material change in the information already submitted;

(h) ... shall provide services to listed or proposed to be listed companies on a stock exchange recognised by SEBI.

Unlisted company services

Where a registrar to an issue and share transfer agent is providing its services to unlisted companies, then —

(a) the services provided to unlisted companies shall be separate and segregated from all other services, through a separate business unit;

(b) such services provided to unlisted companies shall not come under regulatory jurisdiction of SEBI; and

(c) every registrar to an issue and share transfer agent shall make an appropriate disclaimer to that extent to the unlisted company.

And a transition period: an RTA already serving unlisted companies shall segregate such activities into a separate business unit within a period of eighteen months from the date of notification of these regulations.

Rejection and appeal

After considering an application if SEBI is of the opinion that a certificate should not be granted to the applicant, it may reject the application after giving the applicant a reasonable opportunity of being heard.

The decision of SEBI to reject the application shall be communicated to the applicant within thirty days of such decision, stating therein the grounds on which the application has been rejected.

The applicant may, being aggrieved... apply within a period of thirty days from the date of receipt of such intimation, to SEBI for reconsideration of its decision.

Thirty days to communicate; thirty days to seek reconsideration.

On fees: SEBI may on sufficient cause being shown permit the registrar... to pay such fees at any time before the expiry of six months from the date on which such fees becomes due. And on failure, SEBI may suspend the certificate, whereupon the registrar to an issue and share transfer agent shall cease to carry on any of his activity.

The broad heads

Application for Registration: evaluated on a. Available infrastructure b. Past experience c. Capital adequacy d. Integrity of partners and promoters e. Criteria for fit and proper person.

Five criteria.

Capital Adequacy Requirements: the net worth requirement of an applicant is not less than Rs. 50 lakhs. Net worth, for the purpose of this regulation, is defined as paid-up capital and free reserves in case of a body corporate and in case of partnership or proprietorship, it is value of the capital contributed and free reserves.

Obligations and Responsibilities: the R&T agent shall abide by the code of conduct · not act as R&T agent for an associate company · maintain proper books of accounts and records for a minimum period of 8 years · and appoint a compliance officer who shall ensure compliance with the regulations and shall report immediately and independently to SEBI any non-compliance observed by him. Compliance officer shall monitor the internal controls and place periodic reports before the Audit Committee or an equivalent body.

Box 7.1 — the code of conduct

Schedule III of SEBI (RTA) Regulations, 2025 provides a detailed Code of Conduct — thirty-one clauses. The most examinable:

1. ... shall maintain high standards of integrity in the conduct of its business.

The eighth sample question tests this — maintaining high standards of integrity is part of the code.

2. ... shall fulfill its obligations in a prompt, ethical and professional manner.

3. ... shall at all times exercise due diligence, ensure proper care and exercise independent professional judgment.

4. ... shall exercise adequate care, caution and due diligence before dematerialisation of securities by confirming and verifying that the securities to be dematerialized have been granted listing permission by the stock exchange/s.

5. ... shall always endeavor to ensure that - (a) inquiries from investors are adequately dealt with; (b) grievances of investors are redressed without any delay; (c) transfer of securities held in physical form and confirmation of dematerialisation / rematerialisation requests and distribution of corporate benefits and allotment of securities is done within the time specified under any law.

6. ... shall make reasonable efforts to avoid misrepresentation and ensure that the information provided to the investors is not misleading.

7. ... shall not reject the dematerialisation / rematerialisation requests on flimsy grounds. Such request could be rejected only on valid and proper grounds and supported by relevant documents.

8. ... shall avoid conflict of interest and make adequate disclosure of its interest.

9. ... shall put in place a mechanism to resolve any conflict of interest situation that may arise... or where any conflict of interest arises, shall take reasonable steps to resolve the same in an equitable manner.

10. ... shall make appropriate disclosure to the client of its possible source or potential areas of conflict of duties and interest.

11. ... shall not indulge in any unfair competition.

12. ... shall always endeavor to render the best possible advice to the clients having regard to their needs.

13. ... shall not divulge to other clients, press or any other person any confidential information about its clients... except with the approval / authorisation of the clients or when it is required to disclose the information under any law.

14. ... shall not discriminate amongst its clients, save and except on ethical and commercial considerations.

15. ... shall ensure that any change in registration status / any penal action taken by SEBI or any material change in financials... is promptly informed to the clients.

16. ... shall maintain the required level of knowledge and competency and abide by the provisions of the Act, rules, regulations, circulars and directions issued by SEBI... shall also comply with the award of the Ombudsman passed under SEBI (Ombudsman) Regulations, 2003.

17. ... shall co-operate with SEBI as and when required.

18. ... shall not neglect or fail or refuse to submit to SEBI or other agencies... such books, documents, correspondence, and papers.

19. ... shall ensure that SEBI is promptly informed about any action, legal proceeding etc. initiated against it in respect of any material breach or non-compliance.

20. ... shall take adequate and necessary steps to ensure that continuity in data and record keeping is maintained and that the data or records are not lost or destroyed. Further, it shall ensure that for electronic records and data, up-to-date back up is always available with it.

21. ... shall endeavor to resolve all the complaints against it... as quickly as possible.

22. (a) ... or any of its employees shall not render, directly or indirectly any investment advice about any security in the publicly accessible media, whether real-time or non-real-time, unless a disclosure of its long or short position in the said security has been made.

23. ... shall hand-over all the records/ data and all related documents which are in its possession... to the respective clients, within one month from the date of termination of agreement with the respective clients or within one month from the date of expiry/cancellation of certificate of registration... whichever is earlier.

One month, on the earlier of the two events.

24. ... shall not make any exaggerated statement, whether oral or written, to the clients either about its qualifications or capability.

25. ... shall ensure that it has satisfactory internal control procedures in place as well as adequate financial and operational capabilities which can be reasonably expected to take care of any losses arising due to theft, fraud and other dishonest acts, professional misconduct or omissions.

26. ... shall provide adequate freedom and powers to its compliance officer for the effective discharge of its duties.

27. ... shall develop its own internal code of conduct for governing its internal operations.

28. ... shall ensure that good corporate policies and corporate governance are in place.

29. ... shall ensure that any person it employs or appoints to conduct business is fit and proper and otherwise qualified.

30. ... shall be responsible for the acts or omissions of its employees and agents in respect of the conduct of its business.

31. ... shall not, in respect of any dealings in securities, be party to or instrumental for - (a) creation of false market; (b) price rigging or manipulation; (c) passing of unpublished price sensitive information.

The third sample question draws on clauses 9, 17 and 28 — conflict of interest mechanism, co-operation with SEBI and corporate governance are all in the code.

Inspection and default

The regulator, SEBI, may inspect the operations of an RTA either on receiving a complaint from an investor or otherwise to ensure compliance with the regulations. The R&T agent is required to provide all information and co-operation to enable the inspection.

SEBI shall initiate appropriate proceedings against RTAs who fail to comply with the relevant regulations/guidelines issued by SEBI. SEBI may suspend or even cancel the registration granted to an R&T agent in case of non-compliance... Such a penalty will be imposed only after holding an enquiry into the facts of the case and issuing a show cause notice to the R&T agent.

Enquiry and show cause notice first.

The regulatory sandbox

With the issuance of SEBI (Regulatory Sandbox) (Amendment) Regulations, 2020, SEBI has allowed exemptions from enforcement of SEBI (RTA) Regulations for promoting innovations relating to testing new products, processes, services, business models, etc. in live environment of regulatory sandbox in the securities markets. The exemption may be given to any person or class of persons from the operation of all or any of the provisions of RTA Regulations for a period not exceeding 12 months, subject to satisfying specified eligibility conditions.

Not exceeding 12 months.

7.3 Enhanced monitoring guidelines for QRTAs

Qualified RTAs are market intermediaries who service more than 2 crore folios. They are also referred to as the Critical Infrastructure Institutions (CII).

The second sample question tests this — QRTAs are also called Critical Infrastructure Institutions.

Given the large number of transactions handled by QRTAs, they are required to comply with enhanced monitoring requirements, through: adoption and implementation of internal policy framework and periodic reporting on — key risk areas · data security measures · business continuity · governance structures · measures for enhanced investor services, service standards and grievance redressal · insurance against risks, etc.

SEBI has advised QRTAs to formulate and implement a comprehensive policy framework, approved by the Board of Directors of QRTAs, based on the following aspects:

1. Risk Management Policy: a clear, thorough and a well-documented risk management policy, including an integrated and comprehensive view of risks... list of all relevant risks and systems, policies and procedures to identify, assess, monitor and manage the risks, responsibilities and accountability for risk decisions and decision-making process in crises and emergencies.

2. Business Continuity Plan: QRTAs shall maintain Business Continuity Plan (BCP) and Disaster Recovery Site (DRS) with a Near site situated at location other than primary processing location (off-site), which is capable to take over operations without disruption in case of any service failure at primary processing site. QRTAs shall have written policy, protocols, processes and controls for BCP and DRS.

The sixth sample question tests the purpose of a BCP — so that operations can resume after disruption.

3. Manpower at the DRS: the manpower deployed at DRS/ Near Site (NS) shall have the same expertise as available at PDC... such that DRS/NS can function at short notice, independently. QRTAs shall have sufficient number of trained staff at their DRS so as to have the capability of running live operations from DRS without involving staff of the PDC.

4. One-to-one correspondence: hardware, system software, application environment, network and security devices and associated application environments of DRS and PDC shall have one to one correspondence between them.

5. Manner of keeping records: integrity of automatic data processing systems maintained at all times, records accurate up to date... for investor servicing, precautions so records are not lost, destroyed or tampered with, and in the event of loss or destruction, ensure that sufficient back up of records is available at all times at a different place.

6. Wind-down Plan: every QRTA shall devise and maintain a wind-down plan. A 'wind-down plan' means a process or plan of action employed, for transfer of the entire operations of the QRTA to an alternative RTA/ QRTA registered with SEBI, that would take over the operations of the QRTA in scenarios such as erosion of net-worth of the QRTA or its insolvency or its inability to provide critical RTA operations or services.

Three triggers — net worth erosion, insolvency, inability to provide critical operations.

7. Data Access and Data Protection Policy: appropriate protocols, processes and controls for its activities and also for entities who wish to connect with the database of the QRTAs electronically.

8. Ensuring Integrity of Operations: minimum standards, protocol and procedures for smooth running of operations, to protect the investor data and maintain information security.

9. Scalable infrastructure: the Board of Directors (BoD) of QRTAs shall approve a policy framework for up-gradation of infrastructure and technology from time to time.

10. Board of Directors / Committees: the BoD shall seek reports on incidents having an impact on investor protection including data security breaches, and QRTAs shall have Committees of the Board of Directors including Audit Committee, Nomination and Remuneration Committee and IT Strategy Committee.

Three committees.

11. Investor Services and Service Standards:

QRTAs, servicing Mutual Funds investors, must have Investor Service Center in at least 100 cities based on investor population pertaining to the Mutual Funds clients they service. As regards servicing of corporate, REIT, InvIT investors, QRTAs shall maintain adequate investor service centers based on investor population.

At least 100 cities.

QRTAs shall have online capabilities for investor queries, complaints and their redressal, retrievable online through complaint reference number, e-mail id, mobile no. etc.

QRTAs, handling corporate registry functions, shall develop facility for providing services for managing Shareholders General Meetings including shareholders voting/ poll process and web streaming of all Annual General Meetings (AGMs) of all their listed client companies.

QRTAs must publish on its website, the service standards (eg: turnaround time for services rendered).

QRTAs should also carry out stakeholder/ investor satisfaction surveys annually, and the same should also be published on the website before March 31, every year.

12. Insurance against Risks: all QRTAs shall take adequate insurance for omissions and commissions, frauds by employee/s to protect the interests of the investors.

This enhanced reporting to be done in addition to the half-yearly periodic reporting done by RTAs as prescribed by SEBI.

7.4 Cyber Security and Cyber Resilience Framework for QRTAs

Rapid technological developments in securities market have highlighted the need for maintaining a robust cyber security and cyber resilience framework to protect the integrity of data and guard against breaches of privacy.

**The framework applies to QRTAs (servicing more than 2 crore folios).

CIA

Cyber-attacks and threats attempt to compromise the Confidentiality, Integrity and Availability (CIA) of the computer systems, networks and databases. Confidentiality refers to limiting access of systems and information to authorized users. Integrity is the assurance that the information is reliable and accurate. Availability refers to guarantee of reliable access to the systems and information by authorized users.

Cyber security framework includes measures, tools and processes that are intended to prevent cyber-attacks and improve cyber resilience. Cyber Resilience is an organization's ability to prepare and respond to a cyber-attack and to continue operation during, and recover from, a cyber-attack.

The fifth sample question tests the boundary — the framework is to identify, assess, and manage cyber security risk and to continue operations during a cyber attack. Catching the attacker and filing a police complaint is not part of it.

Five goals, six functions

i. Anticipate: Maintain a state of informed preparedness from adversary attacks.

ii. Withstand: Continue essential business functions at times of adversary attacks.

iii. Contain: In the event of cyber-attacks, localise containment of crisis and isolate trusted functions from untrusted ones to continue business operations.

iv. Recover: Restore business functions to the maximum extent, subsequent to adversary attacks.

v. Evolve: To change business functions and its supporting cyber capabilities to minimize adverse impacts of adversary attacks (actual or predicted).

These Cyber Resiliency goals have been linked with the following cybersecurity functions i.e Governance; Identity; Protect; Detect; Respond; Recover.

The Cyber security policy should encompass the principles prescribed by National Critical Information Infrastructure Protection Centre (NCIIPC) of National Technical Research Organisation (NTRO), Government of India, in the report titled "Guidelines for Protection of National Critical Information Infrastructure".

Other measures

Appointment of Chief Information Security Officer (CISO) who would be responsible to assess, identify and reduce cyber security risks, respond to incidents, establish appropriate standards and controls.

Constitution of an Incident Response Team (IRT) consisting of the Managing Director and Chief Technology Officer (CTO) of the QRTA which shall be responsible for actual declaration of a disaster and invoking the BCP.

Apart from DRS, all QRTAs shall have a Near Site (NS) to ensure zero data loss.

In case of a disruption of critical systems for more than 30 minutes, the QRTA shall declare a "disaster" and restore operations within 45 minutes either from primary site or DRS.

30 minutes to declare; 45 minutes to restore.

The Board of the QRTAs should constitute a Technology Committee comprising experts proficient in technology. This Technology Committee should, on a quarterly basis, review the implementation of the cyber security and cyber resilience policy.

QRTAs should establish a reporting procedure to facilitate communication of unusual activities and events to CISO or to the senior management in a timely manner.

QRTAs should define responsibilities of its employees, outsourced staff, and employees of vendors.

Cyber-attacks, threats, cyber-incidents and breaches experienced by QRTAs should be reported to SEBI within 6 hours of noticing / detecting such incidents. Such incidents should also be reported to Indian Computer Emergency Response team (CERT-In).

Six hours to SEBI, and also to CERT-In.

Quarterly reports containing information on cyber-attacks and threats experienced by QRTAs and measures taken to mitigate vulnerabilities... should be submitted to SEBI through email. These reports to be submitted within 15 days after the end of each quarter.

QRTAs should conduct periodic training programs to enhance awareness level among the employees and outsourced staff, vendors, etc.

Disaster Recovery Drills should be conducted on a quarterly basis with minimal notice to the concerned staff. During drills, staff from Primary site should not be involved in supporting operations from DRS.

The QRTA shall conduct live operations from DRS at least 1 days in every three months and 2 consecutive days every 6 months on normal working days.

QRTAs shall arrange to have its systems audited on an annual basis by an independent CISA/CISM qualified or equivalent auditor... and shall submit the report to SEBI along with the comments of the Board of QRTAs within three months of the end of the financial year.

QRTAs are mandated to conduct comprehensive cyber audit at least twice in a financial year.

7.5 Systems Audit Framework

Considering the importance of systems audit in technology driven asset management activity and to enhance and standardize the systems audit, SEBI has prescribed systems audit framework for the Mutual Funds/ Asset Management Companies (AMCs).

It encompasses the audit of systems and processes related to examination of integration of front office system with the back office system, fund accounting system for calculation of net asset values, financial accounting and reporting system for the AMC, unit-holder administration and servicing systems for customer service, funds flow process, system processes for meeting regulatory requirements, prudential investment limits and access rights to systems interface.

MFs/AMCs are responsible for ensuring that adequate and effective control environment exists over the IT systems in use for supporting business operations, including third parties' supporting operations like Register & Transfer Agents (RTAs), Fund Accountants, Custodians etc.

a. Master controls

Whether new schemes/ funds are created in the system through an automated maker checker mechanism and based on the Scheme Information Documentation (SID) and information received from authorized sources?

Whether new customer accounts are created and assigned schemes/ funds based on the agreement signed with the customers?

Whether access to create/ update/ delete any master data (Customer/ Scheme/ Securities/ Broker/ Subscriptions/ Redemptions etc.) is restricted only to the authorized individuals?

Whether changes to masters are performed through an automated maker checker mechanism?

Whether system has the capability to capture audit trails/ logs of all changes, updation, and activities performed?

Whether update of security prices is controlled and is updated only from authorized automated/ manual sources?

b. Investor servicing

Whether automated maker checker controls have been implemented for processing subscription and redemption requests?

Whether appropriate field level validations and mandatory checks are built in the system during subscription and redemption?

Whether the system has the capability to maintain the record of all types of transactions executed on behalf of the investor for specific scheme/ investment?

Whether the system has appropriate controls on brokerage computation and payouts?

c. Classification of Registered Entities

Registered Entities (REs) such as stock brokers, DPs, Investment Advisors, AIFs have been classified as Qualified RE, Mid size RE, Small RE and Self Certification RE based on various criteria such as client base, turnover, AUM and scope of services. RTAs are classified as QRTA based on the number of folios and must follow the Cyber Security and Cyber Resilience Framework (CSCRF) accordingly. RTAs with less than 100 clients are exempt from the guidelines of deploying a Security Operations Centre (SOC).

Four classes of RE; RTAs are classified by folios; under 100 clients means no SOC requirement.

7.6 Ultimate Beneficial Owner

The beneficial owner is defined as "the natural person or persons who ultimately own, control or influence a client and/or persons on whose behalf a transaction is being conducted, and includes a person who exercises ultimate effective control over a legal person or arrangement."

Identification of the beneficial owner of all investments, held except by individual investors, is necessary to prevent money laundering and ensure due diligence of KYC norms. Accordingly, the RTA (on behalf of the AMC) shall collect additional information to identify the ultimate beneficial owners (UBO) for any investment. The UBO requirements are not applicable to listed companies or subsidiaries of the same.

The fourth sample question tests the first sentence — identification of the beneficial owners prevents money laundering. The seventh tests the scope — UBO identification is required for all except individual investors.

Controlling ownership interest means ownership of/ entitlement to:

a) more than 10 percent of shares or capital or profits in case of a company;

b) more than 10 percent of the capital or profits in case of a partnership firm, an unincorporated association or body of individuals and

c) 10 percent or more interest in case of trust.

Note the wording: more than 10 percent for a company and a firm; 10 percent or more for a trust.

7.7 The RTA inter-operable platform

The inter-operable platform, developed jointly by all the RTAs, provides a user-friendly interface for:

(a) mutual fund transactions viz. purchase, redemption, switch etc.,

(b) initiation and tracking of service requests viz. change of email id/ contact number/ bank account details etc.,

(c) initiation and tracking of queries and complaints,

(d) accessing i. investment related reports such as mutual fund holdings, both in demat and standard Statement of Account, (RTAs and Depositories to share information among themselves to generate investment related reports) ii. transactions reports (including historic transactions), iii. capital gains/ loss report, iv. details of unclaimed dividend/ redemption etc.

The first sample question tests three of these four — mutual fund transactions, initiating service requests and accessing investment related reports are all provided.

The platform shall adopt the Cyber Security and Cyber Resilience Framework and comply with the guidelines for Business Continuity Plan (BCP) and Disaster Recovery (DR) issued by SEBI from time to time. All RTAs are jointly responsible for compliance of all related regulations including system audit and cyber security audit.

Jointly responsible — no single RTA can disclaim it.

The chapter's sample questions confirm that the inter-operable platform facilitates all of mutual fund transactions, service requests and investment related reports; that QRTAs are also referred to as Critical Infrastructure Institutions (CII); that the code of conduct requires all of a conflict-of-interest mechanism, co-operation with SEBI and corporate governance; that identification of beneficial owners prevents money laundering; that catching the attacker and filing a police complaint is not part of the cyber framework; that a BCP ensures operations can resume after disruption; that UBO identification is required for all except individual investors; and that maintaining high standards of integrity is part of the RTA code of conduct.