i. SEBI, on April 30, 2025, issued a Circular clarifying aspects
of Cyber Security and Cyber Resilience Framework
(‘CSCRF') for SEBI regulated entities
(‘REs'). Key highlights are as
follows:
(a) the category of REs will be decided at the beginning of the
financial year (‘FY'), based on data
of the previous FY. Once the category is decided, the RE will
remain in the same category throughout the FY, irrespective of any
changes in parameters during the FY.
(b) categorisation for compliance with CSCRF will be undertaken
at the investment manager level, instead of the AIF. The criteria
and thresholds are reproduced below:
| Criteria |
Qualified REs |
Mid-size REs |
Small-size REs |
