SEBI CSCRF for Non-individual Investment Advisers
Your tier is inherited from your other SEBI registration, not measured on this one.
IAs not registered in another SEBI category → exempt. Otherwise highest of other categories. Reporting authority is BSE Ltd (5 yrs from 25-Jul-2024).
Classification
What decides a Non-individual Investment Adviser's tier
A non-individual Investment Adviser does not get a tier of its own. If the firm holds another SEBI registration, it takes the tier that registration carries; if it does not, the framework does not reach it. Supervision for advisers moved to a single administering body, which also determines where the resulting reports are filed.
Are you registered with SEBI in another category (broker, AMC, etc.)?
Some answers put a Non-individual Investment Adviser outside CSCRF entirely. The wizard states the exact threshold and shows the exemption alongside the result.
Scope
What a CSCRF VAPT has to reach at a Non-individual Investment Adviser
Advisers hold a concentrated picture of a client's finances — holdings, income, goals and risk appetite — which is directly useful for social engineering against the client and against the intermediaries they deal with. Where the firm also acts in another registered capacity, the advisory systems usually share identity, network and staff with it, so a boundary drawn on paper does not exist in practice.
Cyber audit covers 100% of critical systems and a 25% sample of the rest, so what is classified as critical is a scoping decision with consequences rather than a labelling exercise.
Where the framework does apply, the advisory estate is the scope:
- The advisory platform and any client-facing portal or application
- Risk profiling and suitability records
- Model portfolio and recommendation distribution
- Client onboarding, KYC and agreement execution
- Fee collection paths
- The systems belonging to the other registered activity, which is what sets the tier in the first place
Where this goes wrong
Reading the inheritance rule as an exemption
It is the single most consequential misreading on this page. A firm registered in another category does not get the adviser's lighter treatment; it takes the other category's tier, and that tier may be materially heavier. Determine the other registration's classification first — that answer, not this page, decides your obligations.
Submission
Where a Non-individual Investment Adviser files, and by when
Reports go to BSE Ltd. The Apr 2025 clarification (CIR/2025/60 §2.4.1) moved Investment Advisers and Research Analysts to BSE Ltd as reporting authority, from BASL and SEBI respectively.
Within 1 month
Report submitted
The VAPT report is filed within a month of the activity completing, after your IT Committee has approved it where one is mandated, together with the MD/CEO declaration the format requires.
Within 3 months
Findings closed
Closure runs from submission, graded by criticality. Anything still open at three months needs IT Committee approval to stay open and has to be closed before the next cycle starts.
Within 5 months
Revalidation complete
Revalidation runs from completion of the VAPT, not from submission — which is why a cycle started late in the year rarely leaves room to finish it.
Plan the cycle at the start of the financial year rather than against the deadline. No audit period may be left unaudited because a category changed mid-year: an unaudited stretch has to be pulled into the current cycle.
How we help
CERT-In empanelled, and the report is written for the submission
We run the VAPT and cyber-audit scope your tier requires, and the deliverable is written to be filed — mapped to the CSCRF control set rather than handed over as a generic findings list that someone then has to translate.
Verified against the source circulars as of 3 August 2026.