SEBI (Intermediaries) Regulations, 2008

What this chapter covers

This chapter carries 6 per cent of the III-A examination.

LEARNING OBJECTIVES. After studying this chapter, you should know about:

• Obligations of Intermediaries.
• Inspection and other disciplinary proceedings for intermediaries.
• Actions in case of default by members.
• Code of conduct for intermediaries.
• Fit and Proper Criteria.
• ODR Framework introduced by SEBI.
• Compliance relating to Cyber Security Framework.
• Compliance relating to Artificial Intelligence and Machine Learning.

6.1 Introduction

The SEBI (Intermediaries) Regulations, 2008 were notified in the official gazette on 26th May 2008. These regulations have 6 chapters and 4 schedules.

Who is an intermediary? The starting point is a person mentioned in sub-section 2 clauses (b) and (ba) of section 11, sub-section (1) and (1A) of section 12 of the SEBI Act, 1992. The definition then adds some names and leaves out others.

Four inclusions, four exclusions. The asset management company is in. The mutual fund itself is out. A foreign portfolio investor is in. A foreign venture capital investor is out.

6.2 General obligations

(1) An intermediary shall provide the Board with a certificate of its compliance officer on the 1st April of each year. The certificate confirms two things:

• a. the compliance by the intermediary with all the obligations, responsibilities and the fulfilment of the eligibility criteria on a continuous basis under these regulations and the relevant regulations.
• b. that all disclosures made as prescribed by SEBI.

(2) Each intermediary shall prominently display a photocopy of the certificate at all its offices including branch offices.

(3) The intermediary shall also prominently display the name and contact details of the compliance officer to whom a complaint may be made in the event of any investor grievance.

(4) The intermediary shall maintain such books, accounts and records as specified in the relevant regulations.

(5) The intermediary shall make endeavours to redress investor grievances promptly but not later than forty-five days of receipt thereof and when called upon by the Board to do so it shall redress the grievances of investors within the time specified by the SEBI.

Forty-five days for a grievance. SEBI can also set its own deadline.

(6) The intermediary shall maintain records regarding investor grievances received by it and redressal of such grievances.

(7) The intermediary shall at the end of each quarter of a Financial Year ending on 31st March upload information about the number of investor grievances received, redressed and those remaining unresolved beyond three months of the receipt thereof by the intermediary on the website specified by SEBI.

Quarterly upload, flagging anything unresolved beyond three months.

Responsibility for artificial intelligence

Many firms now use AI tools. Who answers when they go wrong? The rule is clear. Any person regulated by the Board who uses artificial intelligence and machine learning tools and techniques, either designed by it or procured from third-party technology service providers, irrespective of the scale and scenario of adoption of such tools for conducting its business and servicing its investors, shall be solely responsible:

• a) for the privacy, security and integrity of investors' and stakeholders' data including data maintained by it in a fiduciary capacity throughout the processes involved.
• b) for the output arising from the usage of such tools and techniques it relies upon or deals with.
• c) or the compliance with applicable laws in force.

"Solely responsible" is the key phrase. Two more phrases close every escape route. It does not matter if the tool was designed by it or procured from third-party technology service providers. It does not matter what the scale and scenario of adoption is. Buying the tool from a vendor moves no blame to the vendor.

A breach attracts action under Chapter V of these regulations. That is the enquiry and cancellation machinery.

What counts as such a tool? It is any application or software program or executable system or a combination thereof. It may be offered by the person regulated by the Board to investors/stakeholders or used internally by it. The purpose may be to facilitate investing and trading or to disseminate investment strategies and advice or to carry out its activities including compliance requirements.

Offered outward or used internally — both are covered.

Compliance officer and code of conduct

An intermediary is required to appoint a compliance officer. His job is to monitor compliance with:

• the Act, rules, regulations, notifications, guidelines, circulars and orders made or issued by SEBI, or the Central Government.
• the rules and regulations and bye-laws of the concerned stock exchanges or the SRO, where applicable.

There is one exception. The intermediary may not appoint compliance officer if it is not carrying on the activity of the intermediary. The officer must report in writing. The compliance officer shall report to the intermediary or its board of directors in writing, of any material non-compliance by the intermediary.

An intermediary and its directors, officers, employees and key management personnel shall continuously abide by the code of conduct specified in the Schedule III of SEBI (Intermediaries) Regulations.

The third review question follows — all employees, directors and others must adhere to the code. True.

6.3 Inspection

Under regulation 19, four duties:

1. Produce records. It shall be the duty of every director, proprietor, partner, trustee, officer, employee and any agent of an intermediary which is being inspected, to produce to the inspecting authority such books, accounts, records including telephone records and electronic records and documents in his custody or control. They must also furnish to the inspecting authority with such statements and information relating to its activities within such time as the inspecting authority may require.

Note "telephone records and electronic records" — the duty is not limited to ledgers.

2. Give access. The intermediary shall allow the inspecting authority to have reasonable access to the premises occupied by such intermediary or by any other person on its behalf and also extend reasonable facility for examining any books, records... and also provide copies of documents or other material which in the opinion of the inspecting authority are relevant.

3. Answer questions. The inspecting authority shall, in the course of inspection, be entitled to examine or record statements of any principal officer, director, trustee, partner, proprietor or employee.

4. Help. It is the duty of every director, proprietor, trustee, partner, officer and employee of such intermediary to give to the inspecting authority all assistance which the inspecting authority may reasonably require.

6.4 Action in case of default

What happens when an intermediary breaks the rules? The trigger is a failure to comply with any of the conditions of registration or a breach of any of the provisions of the securities laws (i.e. SEBI Act or SCRA or Depository Act or rules and regulations made thereunder) or directions, instructions or circulars issued thereunder.

Then, in terms of Regulation 24(2), the Executive Director shall appoint an officer not below the rank of a Division Chief, as a designated authority. The Executive Director may, at his discretion, appoint a bench of 3 officers each of whom will not be below the rank of Division Chief.

And a safeguard: no officer who has conducted an investigation or inspection in respect of the alleged violation can be appointed as a designated authority.

The investigator cannot be the judge.

The procedure runs step by step.

The designated authority shall issue a notice to a person against whom an enquiry has been initiated, to show cause as to why the action, as contemplated against such person, should not be recommended.

The notice shall specify the period (not exceeding 21 days) within which a written reply should be submitted along with documentary evidence, if any.

Every notice shall specify the contravention alleged to have been committed by notice by indicating the provisions of the securities laws or the direction or the order of the SEBI which are alleged to have been contravened.

There shall be annexed to the notice copies of documents relied upon by SEBI along with the extracts of relevant portions of the reports containing the findings arrived at in an inquiry, investigation or inspection, if any.

The designated authority may grant a request for inspection of documents.

The designated authority shall grant an opportunity of personal hearing and issue or cause to issue a notice scheduling a date for hearing.

What if the noticee stays silent or does not turn up? If the noticee does not reply to the notice or fails to appear on the scheduled date of hearing and the designated authority is satisfied that sufficient opportunity has been given to the noticee, the designated authority may conclude the proceedings after recording the reasons for doing so, on the basis of the material available on record. Silence does not stop the case.

6.4.1 Recommended measures

After considering material available on record and the reply, the designated authority may by way of a report, recommend the following measures:

• (i) Disposing of the proceedings without adverse action.
• (ii) Cancellation of certificate of registration.
• (iii) Suspension of certificate of registration for a specified period.
• (iv) Prohibition of the noticee from taking up any new assignment or contract or launch a new scheme for such period as may be specified.
• (v) Debarment of an officer of the noticee from being employed or associated with any registered intermediary or other person associated with the securities market for such period as may be specified.
• (vi) Debarment a branch or an office of the noticee from carrying out activities for such period as may be specified.
• (vii) Issuance of a regulatory censure to the noticee.

Seven options, graded from doing nothing to cancelling the registration. Note that (v) and (vi) do not hit the whole firm. They target an individual officer or a branch.

The designated authority shall endeavour to submit the report within 120 days from the date of receipt of reply to the notice or date of personal hearing whichever is later.

6.4.2 The order

The report now goes to a second officer, the competent authority. Regulation 27 specifies on receipt of the report containing measures by the designated authority, the competent authority shall cause to forward a copy of the report submitted by the designated authority. It must also call upon the noticee to make a submission, in writing, as to why measures recommended by the designated authority should not be taken. The noticee shall submit not exceeding twenty-one days from date of service, written submission along with documentary evidence.

A second chance to be heard, at the order stage.

The competent authority can also send the case back. After considering the submission of the noticee, the competent authority may if deemed fit, for records to be recorded it in writing, remit the matter to the designated authority to enquire afresh or to further enquire and resubmit the report.

When a personal hearing is given at this stage: the competent authority may grant an opportunity of personal hearing where the designated authority has recommended cancellation of certificate of registration or the competent authority is of the prima facie view that it is a fit case for cancellation.

Cancellation — the gravest measure — earns an extra hearing.

Then comes the order. After considering the facts and circumstances of the case, material on record and the written submission, if any, the competent authority shall endeavour to pass an appropriate order within 120 days from the date of submission or personal hearing, whichever is later.

6.4.3 Common order

The competent authority may pass a common order in respect of a number of noticees where the subject matter in question is substantially the same or similar in nature.

The fourth review question answers Yes.

6.4.4 Special procedure

A separate, faster route applies to:

• (a) the stock broker or a clearing member... that such stock broker or clearing member has been expelled as its member by all the stock exchange(s) or the clearing corporation(s).
• (b) a depository participant whose depository participant agreement has been terminated by the depository(ies) — by all the depository(ies) where the participant was admitted.
• (c) a person found to have made claim(s) of return or performance in respect of or related to a security or securities, unless otherwise permitted by SEBI.
• (d) a person which fails to pay the fees.
• (da) A person which fails to meet the specified criteria of minimum net worth or the minimum liquid net worth requirements; meet the criteria for minimum revenue generation from permitted activities; [or] transfer activities... to a separate business unit.
• (e) a person not traceable at its physical address and email address available in the records of SEBI.
• (f) a person which has failed to submit periodic reports to the Board for three consecutive periods.
• (g) a person which has admitted to have violated any of the provisions of the securities laws.

The procedure is compressed. The noticee must reply within twenty-one calendar days from the date of receipt of the notice, only through a written response. This can be extended for the reasons to be recorded... within a further period not exceeding fifteen calendar days. After that, the door shuts. No further opportunity beyond the timelines specified... shall be allowed.

The competent authority shall endeavor to pass an order within twenty-one calendar days from receipt of the submissions or expiry of the time granted.

And crucially: no opportunity of personal hearing shall be granted while disposing of the proceedings initiated under this regulation.

Written submissions only, no hearing. Why? These grounds are largely plain facts, such as expulsion or untraceability. There is little to argue about.

Before passing the order, the competent authority may require the noticee to satisfy SEBI on:

• Arrangements made for maintenance and preservation of records.
• Redressal of investor grievances.
• Transfer of records, funds or securities of its clients.
• Arrangements made for ensuring continuity of service to the clients.
• Defaults or pending action, if any.
• Other conditions in the interest of investors.

On cancellation, the noticee must forthwith:

• Return to the Board the certificate of registration so cancelled and not represent itself to be a holder of the certificate.
• Cease to carry on any activity in relation to which the certificate had been granted.
• Transfer its activities to another person holding a valid certificate... or allow its clients or investors to withdraw or transfer their securities or funds... without any additional cost to such client or investor.
• Make provisions as regards any liability incurred or assumed by it.
• Deal with records and client money as directed.

"Without any additional cost" — the client must not pay for the intermediary's failure.

Publication. A copy of the order goes to the noticee. It also goes to the relevant stock exchange(s) or the clearing corporation(s) or the depository(ies) for uploading on their websites. And it is uploaded on the website of SEBI.

6.4.5 Surrender

An intermediary may surrender the certificate of registration by making a request to the SEBI. SEBI may ask to be satisfied on the same five matters:

• Records.
• Redressal of investor grievances.
• Transfer of records, funds or securities of its clients.
• Continuity of service.
• Defaults or pending action.

SEBI may also impose such conditions upon the intermediary as it deems fit for protection of the investors or its clients or the securities market.

6.4.6 Effects

On debarment or suspension, the person must:

• Not undertake any new assignment or contract or launch any new scheme. During the period of such debarment or suspension it shall cease to carry on any activity.
• Let clients withdraw or transfer their securities or funds... without any additional cost.
• Make provisions as regards liability incurred.
• Deal with records and client money as directed.

On surrender or cancellation, the same duties apply. Two more are added: return the certificate of registration so cancelled to SEBI and transfer its activities to another person holding a valid certificate.

The difference is the return of the certificate. Suspension is temporary. Cancellation and surrender are final.

Service of notice — Regulation 34. A notice can be served:

• By hand delivery to the concerned person or duly authorized agent.
• By delivery at address available on the records of SEBI... by registered post acknowledgement due or by speed post or by such courier service or by electronic mail service or by any other means of transmission which affords a record of delivery.
• In case of stock broker or a sub-broker or a depository participant through the concerned stock exchange or depository.
• Failing all of these, by affixing the same on the door or some other conspicuous part of the premises.

And every order passed shall be put on the website of SEBI.

6.4.7 Directions

SEBI can also give directions. It may act for three reasons: in the interest of the securities market, in the interest of the investors or for the purpose of securing the proper management of any intermediary. It may issue necessary direction including but not limited to:

a) directing the intermediary or other persons associated with securities market to refund any money or securities collected from the investors under any scheme or otherwise, with or without interest.

The first review question tests exactly this — True.

b) directing the intermediary or other persons... not to access the capital market or not to deal in securities for a particular period or not to associate with any intermediary or with any capital market-related activity.

c) directing the recognized stock exchange concerned not to permit trading in the securities or units issued by a mutual fund or collective investment scheme.

d) directing the recognized stock exchange concerned to suspend trading in the securities or units.

e) any other direction which SEBI may deem fit and proper in the circumstances of the case.

With natural justice built in: before issuing any directions, SEBI shall give a reasonable opportunity of being heard to the persons concerned. In case of any interim direction, SEBI shall give a reasonable opportunity of hearing to the persons concerned after passing the direction, without any undue delay.

Hearing before an ordinary direction; hearing promptly after an interim one.

6.5 Code of conduct

I. Investors/Clients. Every intermediary shall make all efforts to protect the interests of investors and shall render the best possible advice to its clients having regard to the client's needs and the environments and his own professional skills.

II. High Standards of Service. The intermediary and its key management personnel, employees, contractors and agents shall in the conduct of their business, observe high standards of integrity, dignity, ethics and professionalism. And all professional dealings shall be affected in a prompt, effective and efficient manner.

III. Conflict of Interest. An intermediary shall avoid conflict of interest and make adequate disclosure of his interest. It shall put in place a mechanism to resolve any conflict-of-interest situation... or where any conflict of interest arises, shall take reasonable steps to resolve the same in an equitable manner.

IV. Compliance and Corporate Governance. This covers:

• Good corporate policies and governance.
• No fraudulent and manipulative transactions.
• No unfair competition which is likely to harm the interests of the other intermediaries or the investors.
• Continuity in data and record-keeping... and that the data and records are not lost or destroyed.
• An up-to-date backup... always available for electronic records.

Four things an intermediary must not be party to, instrumental in or indulge in:

• (a) Creation of a false market for securities listed or proposed to be listed on any stock exchange in India.
• (b) Price rigging or manipulation of prices.
• (c) Passing of any unpublished price sensitive information... to any person or intermediary.
• (d) Any activity for distorting market equilibrium or which may affect the smooth functioning of the market or for personal gain.

And a knowledge duty. An intermediary need to maintain an appropriate level of knowledge and competency. It must abide by the provisions of any Act, regulations, circulars and guidelines of the Central Government, the Reserve Bank of India (RBI), SEBI, the stock exchanges or any other applicable statutory or self-regulatory or other body.

Fit and proper criteria

The applicant or intermediary shall meet the 'fit and proper criteria'. These include:

• a) the competence and capability in terms of infrastructure and manpower requirements.
• b) the financial soundness, which includes meeting the net worth requirements.

To whom it applies:

• a) the applicant or the intermediary.
• b) the principal officer, the directors or managing partners, the compliance officer and the key management persons by whatever name called.
• c) the promoters or persons holding controlling interest or persons exercising control over the applicant or intermediary, directly or indirectly.

Unlisted entities go further. In case of an unlisted applicant or intermediary, any person holding twenty percent or more voting rights, irrespective of whether they hold controlling interest or exercise control, shall be required to fulfil the 'fit and proper person' criteria.

Twenty per cent, whether or not it amounts to control.

The first criterion is character: integrity, honesty, ethical behaviour, reputation, fairness and character of the person.

Then eleven disqualifications — the person must not have:

• i) criminal complaint or information under section 154 of the Code of Criminal Procedure, 1973... filed against such person by the Board and which is pending.
• ii) charge sheet... filed against such person by any enforcement agency in matters concerning economic offences and is pending.
• iii) an order of restraint, prohibition or debarment... passed against such person by the Board or any other regulatory authority or enforcement agency in any matter concerning securities laws or financial markets and such order is in force.
• iv) recovery proceedings... initiated by the Board against such person and are pending.
• v) an order of conviction... passed against such person by a court for any offence involving moral turpitude.
• vi) any winding up proceedings... initiated or an order for winding up... passed.
• vii) such person has been declared insolvent and not discharged.
• viii) such person has been found to be of unsound mind by a court of competent Jurisdiction and the finding is in force.
• ix) such person has been categorized as a wilful defaulter.
• x) such person has been declared a fugitive economic offender.
• xi) any other disqualification as may be specified by the Board from time to time.

The consequences:

Where any person has been declared as not 'fit and proper person' by an order of the Board, such a person shall not be eligible to apply for any registration during the period provided in the said order or for a period of five years from the date of effect of the order, if no such period is specified.

Five years by default. And the second review question follows. A person not found fit and proper cannot obtain registration.

A pending show cause notice also blocks an application. If any notice to show cause has been issued for proceedings under these regulations or under section 11(4) or section 11B of the Act against the applicant or any other person referred in clause (2), then such an application shall not be considered for grant of registration for a period of one year from the date of issuance of such notice or until the conclusion of the proceedings, whichever is earlier.

One year, or the end of the proceedings, whichever is earlier.

Associates are not automatically tainted: any disqualification of an associate or group entity... shall not have any bearing on the 'fit and proper person' criteria of the applicant or intermediary unless the applicant or intermediary or any other person referred in clause (2), is also found to incur the same disqualification.

Two cure periods. The firm gets time to fix the problem.

If any person as referred in sub-clause (b) of clause (2) fails to satisfy the 'fit and proper person' criteria, the intermediary shall replace such person within thirty days from the date of such disqualification failing which the 'fit and proper person' criteria may be invoked against the intermediary.

If any person as referred in sub-clause (c) of clause (2) fails to satisfy the... criteria, the intermediary shall ensure that such person does not exercise any voting rights and that such person divests their holding within six months.

Thirty days to replace an officer. Six months for a shareholder to divest, with voting suspended meanwhile.

And the criteria are continuous: the 'fit and proper person' criteria shall be applicable at the time of application of registration and during the continuity of registration.

Verification of past risk and return metrics

Regulation 16D — applicability. It applies only to Investment Advisers, Research Analysts, Algo Providers empaneled with a recognised stock exchange, and intermediaries permitted by SEBI to provide the services of Investment Advisers, Research Analysts and Algorithmic Trading.

An algo provider is a person empaneled with a recognised stock exchange for providing the facility of algorithmic trading services.

Regulation 16E. Those persons shall be permitted to make claim of returns or performance in the form of risk and return metrics, which have been verified by a credit rating agency recognized by SEBI to carry out the activity of a Past Risk and Return Verification Agency, in the manner SEBI specifies.

A performance claim must be independently verified. Note who verifies: a credit rating agency recognised for the purpose.

Regulation 16F allows SEBI to act on a violation, including action under Chapter V.

6.6 Online Dispute Resolution and cyber resilience

The existing route has three steps.

1. Any investor having a complaint can first approach the stock exchange for resolution of the complaint.
2. If not satisfied, lodge a complaint with the SCORES.
3. After exhausting these avenues, any complainant who is not satisfied, may opt for the arbitration mechanism of the exchanges.

Stock exchanges and depositories, together known as 'Market Infrastructure Institutions' (MIIs), have a robust and time-bound grievance redressal process. The current mechanism caters to disputes between stock brokers and their clients.

What SEBI added. It has strengthened the existing mediation/conciliation and arbitration mechanism administered by the MIIs. It also extended the mechanism to the resolution of complaints against all intermediaries in the Indian securities market. SEBI has directed the MIIs to establish a common Online Dispute Resolution (ODR) portal. The ODR portal harnesses online conciliation and online arbitration.

From brokers alone to all intermediaries.

Who may use it? It covers disputes between Investors/Clients (including institutional/corporate clients) and listed companies (including their registrar and share transfer agents) or any of the specified intermediaries/regulated entities in securities market, and either side may refer any unresolved issue of any service requests / service-related complaints.

The cyber security and resilience guidelines for MIIs:

Maintain offline, encrypted backups of data and regularly test these backups at least on a quarterly basis in order to ensure confidentiality, integrity and availability. Also explore retaining spare hardware in an isolated environment in order to rebuild systems. This is for when operating from both the Primary Data Centre (PDC) and Disaster Recovery Site (DRS) is not feasible.

Regularly conduct business continuity drills in a bid to check the readiness of the organization and the effectiveness of the existing security controls at the ground level to deal with ransomware attacks.

Conduct regular vulnerability scanning to identify and address vulnerabilities, especially those on internet-facing devices in order to limit the attack surface. Also implement a cybersecurity user awareness and training programme which includes guidance on how to identify and report suspicious activity.

Multi Factor Authentication (MFA) for all services. Why so strict? Because MIIs are systematically important institutions since they provide the infrastructure necessary for the smooth functioning of the securities market.

6.7 AI and ML compliance

SEBI has also directed the market Intermediaries to meet prescribed reporting and disclosure requirements regarding the Artificial Intelligence and Machine Learning (AI & ML) applications and systems offered and used by them.

Case 6.1: SEBI v Vrise Securities

On an allegation of dabba trading, SEBI directed the exchanges to inspect. During an onsite inspection on June 11, 2014, NSE Exchange officials observed that Jatin was operating the terminal of Vrise. The location of the said terminal was not reported to Exchange by Vrise. The inspection team visited the premises on June 12, 2014. However, Jatin being an employee of Vrise refused to accept the inspection letter and denied access to inspection officials.

As per NSE records Jatin was a CTCL dealer for Opera House (pin code 400004) premise however was operating the terminal from Borivali (pin code 400092).

The findings. First, Vrise operated pro-account from the trading terminal which was not located from its functional corporate office and which was not uploaded to Exchange as mandated in various circulars. Second, Vrise failed to extend co-operation to NSE inspecting officials during the course of the inspection and failed to exercise control over branch operations.

The designated authority recommended prohibition from registering new clients for one year.

One argument was rejected outright. Vrise said the NSE had already penalised it. SEBI relied on the well settled principle of law that multiple proceedings for the same set of violations and hence contention of Vrise that it is a one-off incident, NSE has already penalised for the same violation, they have taken corrective steps does not have any merit.

Exchange action does not bar SEBI action.

The order. It was passed under section 19 of SEBI Act, 1992 read with regulation 28(2) of SEBI (Intermediaries Regulation), 2008. Vrise was prohibited from registering new fresh clients for a period of 6 months from the date of order i.e., January 08, 2020. That was half what the designated authority had recommended.

The chapter's review questions confirm four points:

• It is True that SEBI may direct an intermediary to refund money or securities collected from investors, with or without interest.
• A person not found fit and proper cannot obtain a registration certificate.
• It is True that all employees, directors and others must adhere to the code of conduct.
• A common order may be passed where the subject matter is substantially the same or similar.