SEBI CSCRF for Non-individual Investment Advisers
Non-individual Investment Advisers inherit their tier from the other SEBI registration they hold, rather than being measured on this one.
IAs not registered in another SEBI category → exempt. Otherwise highest of other categories. Reporting authority is BSE Ltd (5 yrs from 25-Jul-2024).
Classification
What decides the tier for a Non-individual Investment Adviser
A non-individual Investment Adviser does not get a tier of its own. If the firm holds another SEBI registration, it takes the tier that registration carries; if it does not, the framework does not reach it. Supervision for advisers moved to a single administering body, which also determines where the resulting reports are filed.
Are you registered with SEBI in another category (broker, AMC, etc.)?
Some answers put a Non-individual Investment Adviser outside CSCRF entirely. The wizard states the exact threshold and shows the exemption alongside the result.
Scope
What a CSCRF VAPT has to reach at a Non-individual Investment Adviser
Advisers hold a concentrated picture of a client's finances: holdings, income, goals and risk appetite, all of it directly useful for social engineering against the client and against the intermediaries they deal with. Where the firm also acts in another registered capacity, the advisory systems usually share identity, network and staff with it, so a boundary drawn on paper does not exist in practice.
Cyber audit covers 100% of critical systems and a 25% sample of the rest, so what you classify as critical decides how much of the estate gets tested.
Where the framework does apply, the advisory estate is the scope:
- The advisory platform and any client-facing portal or application
- Risk profiling and suitability records
- Model portfolio and recommendation distribution
- Client onboarding, KYC and agreement execution
- Fee collection paths
- The systems belonging to the other registered activity, which is what sets the tier in the first place
Where this goes wrong
Reading the inheritance rule as an exemption
A firm registered in another category takes that category's tier, and it may be materially heavier than the adviser treatment. Determine the other registration's classification first: it sets the testing and reporting obligations, and the advisory systems are pulled into that scope alongside the systems belonging to the other registered activity.
Submission
Where a Non-individual Investment Adviser files, and by when
Reports go to BSE Ltd. The Apr 2025 clarification (CIR/2025/60 §2.4.1) moved Investment Advisers and Research Analysts to BSE Ltd as reporting authority, from BASL and SEBI respectively.
Within 1 month
Report submitted
The VAPT report is filed within a month of the activity completing, after your IT Committee has approved it where one is mandated, together with the MD/CEO declaration the format requires.
Within 3 months
Findings closed
Closure runs from submission, graded by criticality. Anything still open at three months needs IT Committee approval to stay open and has to be closed before the next cycle starts.
Within 5 months
Revalidation complete
Revalidation runs from completion of the VAPT, not from submission, so a cycle started late in the year rarely leaves room to finish it.
Plan the cycle at the start of the financial year, not backwards from the deadline. No audit period may be left unaudited because a category changed mid-year: an unaudited stretch has to be pulled into the current cycle.
How we help
CERT-In empanelled, and the report is written for the submission
We run the VAPT and cyber-audit scope your tier requires, and the report is mapped to the CSCRF control set so it can be filed as written.
Verified against the source circulars as of 3 August 2026.
FAQ
Common questions
These are the questions we are asked most often about this category.
Talk to our team