SEBI publishes CSCRF as a single framework with the obligations varying by
category, which means the first question is not "what does it require" but
"which of us is it talking to". Teams that skip that step end up scoping against
the strictest reading and then negotiating backwards.
The five categories
| Category | Typical entity | Audit | Reporting |
|---|---|---|---|
| Market Infrastructure Institution | Exchanges, depositories | Annual, third-party | 6 hours |
| Qualified RE | Large brokers, large AMCs | Annual, third-party | 6 hours |
| Mid-size RE | Mid-tier intermediaries | Annual, may be internal | 6 hours |
| Small-size RE | Smaller intermediaries | Self-assessment | 6 hours |
| Self-certification RE | Smallest by turnover and clients | Self-assessment | 6 hours |
Deciding your category
- 1Identify your entity type in the SEBI schedule
The schedule names entity types explicitly. Start there, not with the control list.
- 2Pull the current thresholds
They are revised. Use the latest circular, and record which one you used.
- 3Check against the last four quarters
A single quarter above a threshold is not the test; sustained position is.
- 4Record the determination
Write down the category, the threshold, the date and who decided. This is the first thing an auditor asks for.
Nobody has ever been penalised for documenting how they reached a category. Plenty have been asked to explain a determination nobody wrote down.
- Entity type from the SEBI schedule
- Current thresholds from the latest circular
- Four quarters of your own figures
- A dated record of the determination
Category determination — record format
Entity type :
Threshold source : SEBI circular ref + date
Period assessed : Q_ FY__ to Q_ FY__
Figures :
Category :
Decided by : Date:What changes once you know
The control set expands with category, but the incident reporting clock does
not — it is six hours for everyone, measured from the point of noticing. If you
have not already mapped that against your other regulators, the incident
reporting deadlines are the place to start.
Yes. CSCRF consolidates the 2015 circulars and the guidance issued since, and supersedes them for entities in scope.
Yes, if you cross a threshold and stay across it. Reassess annually at minimum, and whenever the business changes materially.
Yes. The control set varies; the reporting clock does not.
Market Infrastructure Institutions and Qualified REs do. Below that it depends on category, and self-certification REs self-certify.
CSCRF category determination — record template
The record format above, as a form you can fill in and keep.
Facts last verified 6 Sept 2026
