CAPITAL OVER OPERATIONAL RESILIENCE: ANALYSING SEBI 2026 CUSTODIAN GUIDELINES

This piece is authored by Haren Digga of third-year, B.A., LL.B (Hons.) at the NALSAR University of Law.

The Securities and Exchange Board of India (“SEBI”) amended its SEBI (Custodian) Regulations, 1996 in September 2025. Recently, in March 2026, SEBI issued new guidelines via a circular to strengthen the Custodian’s regulations. Section 11(2)(ba) of the SEBI Act, 1992 empowers SEBI to regulate the working of Custodians, and Sections 9(f) and 13 of the amended Regulations empower SEBI to make regulations to protect investors' interests and the securities market.

This article argues that SEBI's diagnosis is right, but its remedy is mismatched. The 2026 framework treats custodial risk as primarily a capital problem, even though operational and technological risk is the greater vulnerability. The result is a regime that raises entry barriers without proportionately addressing the failure mode it should be most worried about.

NEED FOR AMENDMENT

Custodians facilitate the functioning of the market by keeping investors’ assets safe and handling the settlement process. The custodian's role becomes more important after the reduction of the settlement cycle to T+1. As per SEBI’s consultation paper, the assets under custody (“AUC”) of all custodians has increased from ₹2.70 lakh crore in 2002 to ₹278.50 lakh crore in 2024, at a Compound Annual Growth Rate (“CAGR”) of around 23%. Transactions executed by institutional investors constitute a significant proportion of turnover in the equity cash segment.

During 2023-24, foreign portfolio investors (“FPIs”) contributed 14.8% of turnover in the cash segment at the National Stock Exchange of India Limited (“NSE”). The 23% CAGR in AUC far outpaces India's economic growth, which grew at a rate of approximately 7.5%, indicating that custodial risk has become systemic rather than peripheral. SEBI’s intervention was necessary to prevent any failure in India’s financial ecosystem.

KEY REGULATORY CHANGES

First, the Amendment introduced separate strategic business units (“SBUs”) for custodians. Regulation 9 of the Amendment empowers the Custodians to carry out activities rendering financial services, in addition to providing Custodian services. As per clause 2.1.2 of the circular, Custodians (except banks) need to maintain different SBUs for financial services falling under the purview of SEBI. A Custodian offering both regulated and unregulated services cannot share clients’ information across different services, which reduces cross-selling efficiency, thereby balancing investor protection and business convenience. Although this reduces cross-selling revenue, the diversification gains discussed below outweigh that loss, so the net revenue effect is positive.

Second, the Amendment introduced Regulation 19B, which inserts responsibilities and obligations for Custodians. Clause 5 of the circular introduced a risk management policy which necessitates Suspicious Transaction Reporting (“STR”) to Financial Intelligence Unit (“FIU”), governance structure, and a framework for winding-up custodians. These steps will help improve custodians’ services while protecting investors’ interests. The Disaster Recovery Site (“DRS”) requirement is particularly significant for T+0 settlement.

Third, Regulation 7(1) of the Amendment increased the flat capital requirement for custodians from ₹50 crore to ₹75 crore. An increase in the capital requirement by just 50% can't justify the growth of AUC by 23%, and is poorly calibrated even on capital adequacy terms. This is worth contrasting with the United Kingdom (“UK”), where the FCA's regime sets a graduated Permanent Minimum Requirement starting at £150,000 for firms safeguarding client assets and rising to £750,000 for firms dealing on own account, with capital scaled to the scale of the business, rather than a single fixed figure.

IMPACT ON STAKEHOLDERS

First, as per clause 2.2.1, custodians need to ensure adequate control mechanisms, such as Chinese walls or need-to-know principles, to protect investors' sensitive information. Clause 5.2.5 also requires custodians to maintain adequate resources and safeguards to protect investors' data. Clause 2.1.3 provides that custodians shall disclose details of their unregulated financial services to their clients. This disclosure enables investors to assess risks, thereby enhancing transparency and trust.

Second, Regulation 9(f) of the Amendment allows custodians to carry out financial activities outside SEBI’s regulatory purview. This helps the custodians provide unregulated financial services by using two different SBUs, thereby generating more revenue, making their operations more stable and profitable, and reducing the risk of winding-up due to lack of funds. Clause 2.2 also empowers custodians to share their resources and infrastructure across other financial services undertaken by them, which will help in the smooth operation of their regulated and unregulated financial services.

Third, clause 5.2.1 states that custodians shall devise a clear risk management policy which encompasses all relevant risks that may have to be borne for the custodian’s activities; Clause 5.2.4 further provides that the risk management framework shall have measures for reporting suspicious transactions to the FIU and monitoring alerts from the depositories. As per the SEBI annual report of the year 2024-25, the AUC of custodians for FPIs has increased by 6.1% to ₹73.8 lakh crore as compared to last year. With this enormous growth in the securities market, governance and risk management regulations are essential to govern and improve daily operations.

ISSUES IN REGULATION

I. Does the ₹75 crore capital requirement solve the right risk?

SEBI assumes that higher capital is equivalent to higher resilience. But capital alone did not protect the world's largest custody bank, BNY Mellon International from being fined £126 million by the FCA, for failing to maintain entity-specific records of client assets and allowing custody assets to be commingled with firm funds. BNY Mellon's balance sheet dwarfs anything SEBI's ₹75 crore threshold could screen for, yet the failure was operational. A capital-based approach that equates net worth with resilience overlooks the distinct governance, record-keeping, and technological vulnerabilities Custodians can suffer regardless of capital adequacy. More capital cushions losses after a failure; it does little to prevent the systems and controls failures that cause one.

II. Whether a capital hike is actually an issue for custodians?

Technological advancement requires substantial time and investment to replace existing systems and maintain new ones, which are some of the main challenges faced by custodians today. For a large custodian, this cost is marginal, but for a small player, it can be existential. India’s 1.2x transaction load requirement and disaster recovery mandates (clause 5.5.2) are steps in the right direction. SEBI is not blind to operational risk, but it leads with capital as the safety tool, layered on top of the capital hike that burdens new entrants while doing nothing to address tech-driven failures seen in Europe.

THE PROPORTIONALITY PROBLEM

The Supreme Court’s (“SC”) proportionality reasoning in Internet and Mobile Association of India v. RBI can be used in this case. The Court held that a restriction broader than necessary to achieve its stated regulatory objective cannot stand simply because the objective itself is legitimate. The Court invoked the four-pronged test and faulted the RBI for failing to demonstrate harm to regulated entities and overlooking less intrusive alternatives. The current capital hike has a similar problem. Firstly, SEBI's objective, custodial resilience against the growth in AUC and the transition to faster settlement cycles, is legitimate. Secondly, capital helps in absorbing losses, but it cannot prevent operational failures like BNY Mellon’s. Thirdly, a fixed capital requirement is not calibrated to the operational risks highlighted by the AUC data and the circular’s operational provisions. Where SEBI has already deployed risk-specific mechanisms, a blunt capital increase excluding small custodians is difficult to justify as least restrictive means. Fourthly, these benefits are outweighed by higher entry barriers and market concentration, while technological risk stays largely unaddressed. The end is legitimate; the means are disproportionate.

WAY FORWARD

SEBI's goal is to take effective and efficient steps to make markets safer and more organised, as stated by the SC in SEBI v. Sahara India Real Estate Corporation Ltd (Paragraph no.118). The Court read SEBI’s investor-protection mandate purposively, as a special statute with preventive powers, which legitimises the objective but leaves the means open to proportionality review. However, without corrective measures, SEBI risks moving from a competitive custodian market to a concentrated one with high technological compliance costs and capital requirements.

To address this, the following measures are proposed:

1. Replace the ₹75 crore requirement with a slab system based on the AUC of different custodians. This aligns capital with actual risk and preserves space for smaller custodians, as under the UK FCA framework. SEBI initially would have preferred a flat capital threshold for administrative simplicity, but slabs offer equal certainty.

   
   

2. Mandate the 1.2x transaction load capacity over some period to test the custodian’s resilience under such conditions, with a regulatory sandbox allowing smaller custodians to test shared disaster recovery infrastructure through an approved utility provider, subject to logical segregation of each Custodian’s records, separate access controls and SEBI audits, so that the utility does not recreate BNY Mellon’s commingling failure.

   
   

3. SEBI should publish and review a yearly Custodians Concentration Index such as the Herfindahl-Hirschman Index, based on AUC. The U.S. Merger Guidelines could be used as a baseline for analysing market concentration. If only top custodians control the majority of the market for several consecutive years, SEBI must review entry barriers and consider relaxing capital or tech requirements for new entrants.

   
   

4. SEBI should require Custodians to conduct practical simulations of new technological systems and processes annually with FPIs and depositories, moving from paper compliance to demonstrable capability, thereby reducing the likelihood of operational failures.

By adopting these, SEBI can preserve the resilience benefits of the guidelines while reducing the chances of unintended consequences in the markets. The goal should be a custodian’s ecosystem that is both stable and competitive, rather than one being at the expense of the other.