SEBI CSCRF for Custodians: AUC Tiers & CCI Obligations

Custodians, the entities that hold and safeguard securities on behalf of investors, are classified under CSCRF purely by Assets Under Custody (AUC). The framework uses a three-tier model with two thresholds, and at the top end custodians inherit the full Qualified RE obligation set including CCI self-assessment.

AUC-tiered classification

Tier	AUC (INR crores)
Qualified RE	≥₹10,00,000 Cr (₹10 Lakh Cr)
Mid-size	₹1,00,000 – <₹10,00,000 Cr
Small-size	<₹1,00,000 Cr

There is no Self-cert tier and no exclusion category. Every custodian registered with SEBI is in scope; the only variable is tier.

What changes at each threshold

Obligation	Small-size	Mid-size	Qualified RE
VAPT	Annual	Annual	Annual (half-yearly if CII)
Cyber Audit	Annual	Annual	Half-yearly
Red Teaming	Not required	Not required	Half-yearly
Threat Hunting	Not required	Not required	Quarterly
Cyber Drill	Annual	Annual	Half-yearly
CCI Assessment	Not required	Not required	Self-assessment annually
ISO 27001	Not required	Not required	Recommended
IT Committee	Optional	Mandatory (quarterly + expert)	Mandatory (quarterly + expert)
CISO	Designated officer	Designated officer	Direct MD/CEO; ≥CTO/CIO
HSM	Risk-assessed alternative	Risk-assessed alternative	Mandatory
M-SOC	Mandatory (own-SOC carve-out)	Eligible	Eligible
RTO / RPO	Per CCMP	Per CCMP	2 hr / 15 min

The ₹1,00,000 Cr threshold (Mid-size) activates the mandatory IT Committee with external cyber expert and moves M-SOC from mandatory to eligible. The ₹10,00,000 Cr threshold (QRE) activates the full Qualified RE suite: half-yearly cyber audits, red teaming, threat hunting, CCI self-assessment, dedicated CISO, HSM mandate, and IOSCO-aligned RTO/RPO.

The CCI obligation for QRE custodians

At QRE tier, custodians must complete a Cyber Capability Index (CCI) self-assessment annually. CSCRF Annexure-K defines CCI as a structured self-assessment against NIST CSF 2.0 control domains. The output is a maturity snapshot, not a pass/fail score, and the IT Committee uses it to track cyber resilience posture year-over-year.

Per the Aug 2025 clarifications (CIR/2025/119), CCI remains self-assessment for QREs. No third-party assessment requirement applies; that obligation stays with MIIs.

DDP: the highest-of-DP-and-Custodian rule

Designated Depository Participants (DDPs) are a hybrid entity type. Per CSCRF §2, DDP classification is the highest of DP and Custodian categorisation. If a DDP has:

• DP classification: Qualified RE (always QRE for non-broker DPs)
• Custodian AUC: ₹80,000 Cr (Small-size)

The DDP classification is QRE. The DP tier wins.

This rule can work both ways. If the custodian AUC is large enough to drive QRE classification independently, the DDP inherits QRE regardless of the DP classification.

Practical steps

1. AUC is your classification basis. Confirm your current AUC as reported to SEBI. Classification is at the start of each financial year.

2. If approaching Mid-size (₹1,00,000 Cr AUC). Stand up the IT Committee (mandatory, quarterly, external expert). Move M-SOC from mandatory to eligible status.

3. If approaching QRE (₹10,00,000 Cr AUC). Prepare for half-yearly cyber audits, red-teaming, threat hunting, CCI self-assessment, dedicated CISO, HSM deployment, and 2-hr/15-min RTO/RPO targets. This is a multi-quarter compliance ramp, so start before crossing the threshold.

4. CCI: prepare your first self-assessment. Running a dry-run CCI self-assessment ahead of any audit maps your NIST CSF maturity and identifies gaps before the formal submission.

FAQ

Does custodian tier depend on the number of clients or folios?

No. Custodian classification is purely AUC-based. Client count and folio count are not tier-driving metrics for custodians.

Are foreign custodians (FPI custodians) in CSCRF scope?

Registered custodians are in scope, whether domestic or foreign. Foreign Portfolio Investors (FPIs) and Foreign Venture Capital Investors (FVCIs) themselves are excluded from CSCRF entirely.

What if my custodian AUC crosses the Mid-size threshold mid-year?

Classification is at the start of the financial year. Mid-year threshold crossings activate the new tier at the start of the next FY. However, CSCRF expects regulated entities to be "substantially compliant", so a pre-emptive ramp is recommended.

Content current as of 2026-05-06.