Safeguarding Sensitive Data: SEBI’s Mandate for Fiduciaries’ Digital Compliance

Key Takeaways:

- SEBI mandates fiduciaries to maintain a structured digital database (SDD) for UPSI handling.

- The SDD must include details of UPSI, individuals sharing information, and recipients with unique identifiers.

- Robust internal controls, time-stamping, and audit trails are required to ensure data integrity.

- Compliance with SDD requirements promotes transparency and prevents insider trading.

- Fiduciaries, including auditors, law firms, and consultants, must adhere to these regulations.

Commentary

India’s market regulator, SEBI, has issued comprehensive guidelines for fiduciaries handling unpublished price-sensitive information (UPSI). The advisory emphasizes the importance of maintaining a structured digital database (SDD) to ensure transparency and prevent the misuse of confidential data.

Under the SEBI (Prohibition of Insider Trading) Regulations, 2015, fiduciaries, including professional firms such as auditors, law firms, analysts, insolvency professionals, consultants, and banks, are collectively referred to as entities assisting or advising listed companies. These entities play a crucial role in handling sensitive information and are now required to implement stringent measures to safeguard UPSI.

The SDD, a digital repository, must meticulously record the nature of UPSI, the individuals sharing the information, and the recipients of such data. Notably, the database must include unique identifiers, such as Permanent Account Numbers (PANs) or other authorized identifiers, for all parties involved. This comprehensive record-keeping ensures accountability and enables effective monitoring of information flow.

To maintain the integrity of the SDD, SEBI has mandated that the database be maintained internally, with robust internal controls and checks. Time-stamping and audit trails are essential components of these controls, ensuring that any tampering or unauthorized access is promptly detected and addressed.

The responsibility for implementing and overseeing these measures lies with the Chief Executive Officers, Managing Directors, or analogous persons within listed companies, intermediaries, and fiduciaries. They are tasked with establishing adequate and effective internal control systems to ensure compliance with SEBI regulations and prevent insider trading activities.

Failure to comply with these regulations can result in severe consequences, including regulatory action and potential legal implications. As such, fiduciaries are advised to prioritize adherence to the SDD requirements and foster a culture of transparency and accountability within their organizations.

By implementing these measures, SEBI aims to create a level playing field for all market participants, promoting investor confidence and ensuring the fair dissemination of information. Fiduciaries play a pivotal role in upholding these principles and safeguarding the integrity of the securities market.

FAQs

Q1: Why is the SDD requirement important for fiduciaries?

A1: The SDD requirement ensures that fiduciaries maintain a comprehensive record of UPSI handling, promoting transparency and preventing insider trading activities. It holds fiduciaries accountable for the proper management and dissemination of sensitive information.

Q2: What information must be included in the SDD?

A2: The SDD must contain details of the UPSI, individuals sharing the information, recipients of the information, and their unique identifiers (such as PANs).

Q3: Can the SDD be outsourced or managed externally?

A3: No, SEBI mandates that the SDD be maintained internally by the fiduciary, with robust internal controls and checks to ensure data integrity and prevent tampering.

Q4: Who is responsible for implementing and overseeing the SDD compliance measures?

A4: The Chief Executive Officers, Managing Directors, or analogous persons within listed companies, intermediaries, and fiduciaries are responsible for establishing effective internal control systems to ensure compliance with SEBI regulations, including the SDD requirements.

Q5: What are the potential consequences of non-compliance?

A5: Failure to comply with the SDD requirements and SEBI regulations can result in regulatory action and potential legal implications for fiduciaries.

Key Precedents

The SEBI (Prohibition of Insider Trading) Regulations, 2015, introduced the concept of controlling the sharing of UPSI through a structured digital database (SDD). Regulation 3(5) mandates the maintenance of an internal SDD containing details of UPSI, individuals sharing the information, and recipients, along with their unique identifiers like PANs.

Regulation 9A(1) outlines the responsibility of CEOs, Managing Directors, or analogous persons to establish effective internal controls for compliance with SEBI regulations, including the SDD requirements.

SEBI’s FAQs, released on March 31, 2023, clarified that the SDD requirement under Regulation 3(5) applies to fiduciaries handling UPSI in the course of business operations. Regulation 9A(2)(d) and Schedule C of the Regulations provide specific guidelines for maintaining the SDD by fiduciaries.