SEBI CSCRF for AMCs & Mutual Funds: AUM-Tiered Classification & Qualified RE Obligations

Asset Management Companies (AMCs) and Mutual Funds hold a central place in the Indian securities market, and the scale of the public money they manage pushes the larger ones into CSCRF's most demanding tier. The framework classifies AMCs on Assets Under Management (AUM) alone: three tiers, and one threshold separating standard obligations from the Qualified RE burden.

Here is what an AMC compliance officer needs for FY 2026-27.

AMC tier classification: pure AUM

Per CSCRF master circular §2, AMC classification is the simplest in the framework, running on a single metric across three tiers:

Tier	AUM (INR crores)
Qualified RE	≥₹1,00,000 Cr (₹1 Lakh Cr)
Mid-size	₹10,000 – <₹1,00,000 Cr
Small-size	<₹10,000 Cr

There is no Self-cert tier and no exclusion category for AMCs. Every AMC is in scope whatever its size; only the tier varies.

The AUM used for classification is the prior financial year's figure, assessed at the start of each financial year (per CSCRF §2).

The ₹1 Lakh Cr line: what changes at QRE

Crossing ₹1,00,000 Cr AUM changes most of what CSCRF requires:

Obligation	Small-size AMC	Mid-size AMC	QRE AMC
VAPT	Annual	Annual	Annual (half-yearly if CII)
Cyber Audit	Annual	Annual	Half-yearly
Red Teaming	—	—	Half-yearly
Threat Hunting	—	—	Quarterly
Cyber Drill	Annual	Annual	Half-yearly
CCI Assessment	—	—	Self-assessment annually
ISO 27001	—	—	Recommended
IT Committee	Optional	Quarterly + external expert	Quarterly + external expert
CISO	Designated officer	Designated officer	Direct MD/CEO line; grade ≥ CTO/CIO
HSM	Risk-assessed alternative	Risk-assessed alternative	Mandatory
M-SOC	Mandatory (own-SOC carve-out)	Eligible	Eligible
RTO / RPO	Per CCMP	Per CCMP	2 hr / 15 min

Two things change at Mid-size: the IT Committee becomes mandatory, meeting quarterly with an external cyber expert, and M-SOC moves from mandatory to eligible. The move to QRE is the heavy one: half-yearly audits, red teaming, threat hunting, CCI, dedicated CISO, HSM, and IOSCO-aligned RTO/RPO targets.

ISO 27001: voluntary for QRE AMCs

Per the August 2025 technical clarifications (CIR/2025/119), ISO 27001 is now recommended, not mandatory, for Qualified REs, including AMCs above ₹1 Lakh Cr AUM. It remains mandatory for MIIs only.

Annex A of ISO 27001 still overlaps substantially with the CSCRF control catalogue. For many QRE AMCs, certifying to ISO 27001 produces much of the CSCRF control evidence, particularly in the Govern, Protect, and Respond+Recover domains.

Mid-size AMCs: the IT Committee

At ₹10,000 Cr AUM, the IT Committee becomes mandatory. Per CSCRF, the committee must:

• Meet quarterly
• Include at least one external independent cybersecurity expert
• Review and approve the cyber resilience posture
• Oversee the CCI self-assessment (if applicable)
• Ratify the annual cyber policy review

For AMCs at the upper end of the Mid-size range (₹60,000–99,000 Cr AUM), the sensible move is to prepare before QRE obligations apply: stand up red-teaming cadences, threat-hunting capability, and a direct-report CISO.

Small-size AMCs: M-SOC is mandatory

For AMCs with <₹10,000 Cr AUM, the M-SOC mandate is the primary operational obligation. Per CSCRF §4.5 + Annexure-M, Small-size REs must onboard to the Market SOC (operated by NSE and BSE) unless they operate their own SOC and submit functional efficacy reports annually.

The May 2026 AI Advisory item 6c reinforces this: "All eligible REs (not onboarded with any M-SOC) shall expedite the onboarding."

M-SOC onboarding is a 4–6 week exercise: log-source inventory, SIEM integration, alert-triage workflow design, and SOAR playbook configuration. Start early.

The AI Advisory: AMCs are in scope

The 19 RE categories addressed by the May 2026 AI Advisory include Mutual Funds and AMCs. If your AMC uses or is evaluating AI/LLM tools in operations or customer-facing products, Annexure-A items 2 (AI-based VA tools), 7 (AI-aware risk scenarios), and 10 (long-term AI plan) apply in parallel with your CSCRF obligations.

Practical next steps

1. Confirm your tier. AUM is the only metric, but getting the ₹10,000 Cr or ₹1,00,000 Cr boundary wrong leaves you working to the wrong set of obligations.

2. If you are approaching Mid-size or QRE. Don't wait for the financial-year reclassification. Stand up the required capabilities (IT committee, CISO, half-yearly cadences) in advance so you are compliant from day one of the new tier.

3. Small-size AMCs: prioritise M-SOC. It is the binding obligation at this tier, and onboarding delays are the most common compliance gap.

4. QRE AMCs: build the CCI self-assessment. The Cyber Capability Index is a structured self-assessment against NIST CSF 2.0, submitted annually and cross-checked by your auditor.

How Security Brigade helps

We have delivered VAPT, cyber audits, red-teaming, and CISO/advisory engagements for AMCs from Small-size sub-₹10,000 Cr firms to QREs managing lakh-crore portfolios. Use our free SEBI Compliance Wizard to classify your AMC in 2 minutes.

FAQ

Is the AMC tier recalculated every year?

Yes. Per CSCRF §2, classification is decided at the start of each financial year based on prior-year AUM. An AMC that crosses ₹10,000 Cr AUM in FY 2026-27 will be reclassified as Mid-size at the start of FY 2027-28.

What if my AMC manages multiple mutual fund schemes?

AUM is aggregated across all schemes managed by the AMC, not per-scheme.

Does the ₹1 Lakh Cr threshold include debt funds?

Yes. Total AUM includes equity, debt, hybrid, and liquid fund AUM as reported to SEBI.

Are AMC subsidiaries classified separately?

If the subsidiary is a separately registered AMC with SEBI, it is classified independently based on its own AUM.

Content current as of 2026-05-06.