Introduction

SEBI CSCRF applies to all regulated entities but differentiates requirements by entity tier. Market Infrastructure Institutions face the highest requirements. Qualified Regulated Entities, defined by thresholds including trading volume, assets under management, number of clients, and systemic importance, face enhanced requirements above the baseline that apply to Mid-size and Small REs. Understanding which tier your organisation falls into and what the enhanced requirements mean technically is the starting point for a compliant CSCRF implementation.

Most capital markets entities approaching SEBI CSCRF compliance focus on the baseline requirements that apply across all tiers. The Qualified RE tier, which covers the largest brokers, fund managers, and infrastructure participants in Indian capital markets, faces additional requirements in specific sub-categories that are frequently underestimated during initial compliance planning.

The enhanced requirements for Qualified REs are not fundamentally different controls from the baseline. They are the same control categories, identity management, access governance, privileged access, monitoring, and audit evidence, applied with greater depth, more frequent review cycles, and more granular evidence requirements. The difference is in the operating effectiveness standard: a Qualified RE with quarterly access reviews and annual privileged access certifications satisfies the enhanced standard. A Mid-size RE with annual reviews for both satisfies the baseline.

This blog covers what the Qualified RE tier designation means, which CSCRF sub-categories have enhanced requirements for this tier, and what those enhanced requirements mean technically for IAM implementation.

Understanding the Qualified RE Tier

SEBI CSCRF classifies regulated entities into tiers based on systemic importance and operational scale. The classification determines which guideline levels within each sub-category apply to the entity.

Tier classification criteria

The Qualified RE designation applies to entities that exceed defined thresholds across metrics including: average daily turnover for brokers, assets under management for fund managers, number of active clients, and the entity’s role in settlement or clearing infrastructure. Entities that exceed these thresholds are subject to enhanced requirements in addition to the baseline requirements that apply to all tiers.

Market Infrastructure Institutions, covering stock exchanges, clearing corporations, and depositories, face the highest requirements across all sub-categories. Qualified REs face the next level. Mid-size and Small REs face the baseline requirements.

Self-assessment obligation

SEBI CSCRF requires that each regulated entity assess its tier classification and implement the corresponding requirements. The self-assessment is not a one-time exercise: entities whose scale changes over time must reassess their tier classification periodically and update their implementation accordingly.

For Qualified REs, the tier designation creates a compliance programme that is more demanding than the baseline in specific, identifiable areas. Planning and resourcing the programme requires understanding which areas have enhanced requirements and what they add beyond the baseline.

Enhanced Identity Management Requirements for Qualified REs

PR.AA.S1 identity management requirements have enhanced guideline levels for Qualified REs that go beyond the baseline lifecycle management controls.

Enhanced user registration and authorisation

For Qualified REs, PR.AA.S1’s enhanced guidelines require more formal role definition processes, more granular access provisioning controls, and more frequent review of access entitlements for high-risk user categories.

The baseline PR.AA.S1 requirements cover unique user identification, lifecycle management, and dormant account controls. The Qualified RE enhanced requirements add: formalised role matrices documenting which roles are authorised for which system access, structured access provisioning workflows with multi-step approval for high-sensitivity access, and more frequent access reviews for users with access to trading systems and client data.

Enhanced access governance

Identity and Access Governance requirements for Qualified REs include more comprehensive SoD rule sets covering capital markets-specific conflict categories. The baseline SoD requirements prevent generic conflicting role combinations. The enhanced requirements for Qualified REs specifically address capital markets conflicts: front-office trading access combined with back-office settlement authority, client account management combined with fund transfer authorisation, and compliance oversight combined with the activities being overseen.

For Qualified RE fund managers and brokers, the capital markets SoD rule set is more specific and more extensive than a generic SoD implementation. The rules engine must define and enforce the specific conflict combinations that create fraud and manipulation risk in capital markets operations.

How Akku addresses enhanced identity requirements

Akku’s IGA module supports configurable SoD rule sets that can be extended to cover capital markets-specific conflict categories. The role matrix documentation, multi-step approval workflows for sensitive access, and configurable review cadences per user population satisfy the enhanced Qualified RE identity management requirements.

Enhanced Privileged Access Requirements for Qualified REs

The privileged access requirements for Qualified REs under PR.AA.S10 through S12 are more detailed than the baseline, reflecting the higher systemic risk of privileged access at large capital markets entities.

Enhanced session governance

For Qualified REs, the enhanced PR.AA.S11 requirements add: more detailed session request justifications specifying the specific operational task to be performed, shorter maximum JIT session durations for access to trading and settlement infrastructure, more frequent approval workflow reviews to ensure approvers are current and appropriate, and real-time monitoring requirements with defined response timelines for anomalous session activity.

The session duration limits for Qualified RE access to critical trading infrastructure are typically shorter than for general privileged access: a two-hour maximum session for production trading system access rather than an eight-hour working day session. The shorter duration limits reduce the blast radius of a compromised or misused privileged session.

Enhanced session recording requirements

For Qualified REs, session recording coverage requirements extend to all access paths to systems classified as critical, not only SSH and database sessions. Web application sessions to trading platforms, order management systems, and client portals require session recording at the activity level.

The forensic search capability for Qualified RE session recordings must support more granular queries: not only searching by command string or SQL query text but by specific action types, such as order submission, account modification, or configuration change, across the session recording history.

Enhanced privileged access review cadence

For Qualified REs, privileged access review campaigns must run at a higher frequency than the baseline. Quarterly reviews for all privileged entitlements, with monthly reviews for the highest-risk privileged accounts covering trading system administration, is the enhanced standard that SEBI examinations at Qualified REs assess.

Enhanced Monitoring Requirements for Qualified REs

DE.CM continuous monitoring requirements have enhanced specifications for Qualified REs that require more sensitive detection thresholds and shorter response timelines.

Enhanced authentication anomaly detection

For Qualified REs, PR.AA.S7’s proportionality requirement applies with greater specificity. Trading platform access requires the highest authentication assurance in the entity’s environment. Anomaly detection thresholds for authentication events to trading systems must be more sensitive than for other systems: geographic anomalies, new device access, and time-of-day deviations should trigger step-up challenges at lower deviation levels for trading platform access than for lower-sensitivity systems.

The response timeline for authentication anomaly alerts is also enhanced for Qualified REs. Where baseline entities may have a 24-hour investigation SLA for anomaly alerts, Qualified REs should have a same-day investigation SLA for alerts involving trading system access.

Enhanced on-demand log access

GV.OC.S2(G3)’s on-demand log access requirement for Qualified REs requires faster response times and more granular log coverage than the baseline. Where a baseline entity might satisfy the requirement with a structured log export producible within two business days, a Qualified RE examination request may require a response within a single business day for the most critical log categories.

The log granularity for Qualified REs must extend to trading activity logs where these are captured through the IAM infrastructure: order submission events, account access events, and configuration change events must be queryable alongside authentication and session records in the centralised audit trail.

How Akku addresses enhanced monitoring requirements

Akku’s Adaptive MFA supports configurable anomaly detection thresholds per application or system category. Trading platform access can be configured with more sensitive thresholds than internal administrative systems. The centralised audit trail with structured JSON and CSV export satisfies the on-demand access requirement across all log categories within the IAM infrastructure’s scope.

Enhanced Audit Evidence Requirements for Qualified REs

SEBI CSCRF examination practice at Qualified REs reflects the higher systemic importance of these entities. Examinations are more thorough, sample larger populations, and assess operating effectiveness over longer periods than examinations at smaller entities.

Longer evidence retention

For Qualified REs, the implicit evidence retention expectation for SEBI examination purposes extends to two years for authentication event logs and three years for privileged session recordings covering trading system access. These extended retention periods reflect the higher regulatory scrutiny and the longer investigation timelines that market integrity incidents may require.

More comprehensive sampling

SEBI examinations at Qualified REs sample larger populations from longer periods. Where a baseline examination might sample 10 provisioning events from the last six months, a Qualified RE examination might sample 25 events from the last 12 months. The evidence infrastructure must be capable of producing complete, structured records for any sampled event without gaps.

Real-time evidence availability

For Qualified REs, the on-demand evidence production standard implies faster response than the baseline. Evidence requests for specific sessions, specific users, or specific time windows should be producible within the same business day rather than within two business days. The infrastructure must support ad-hoc queries across the full retention window without pre-preparation.

Assessing Your Tier and Planning Your Implementation

The Qualified RE tier classification creates a compliance programme that requires explicit planning beyond the baseline CSCRF implementation.

Tier assessment

The first step is confirming whether your entity meets the Qualified RE thresholds. The thresholds cover trading volume, client count, and AUM. Entities near the threshold should assess conservatively: an entity that might qualify in a high-volume quarter should plan for Qualified RE requirements rather than assuming baseline requirements will apply.

Gap assessment against enhanced requirements

For entities that are or may be Qualified REs, the gap assessment must specifically address the enhanced requirements in PR.AA, DE.CM, and GV.OC. The gap assessment should identify: current review cadences versus enhanced cadence requirements, current session governance depth versus enhanced session requirements, current monitoring sensitivity versus enhanced threshold requirements, and current log retention versus enhanced retention expectations.

Implementation prioritisation

The highest-priority enhanced requirements for Qualified REs are typically: shorter JIT session durations for trading system access, more sensitive anomaly detection thresholds for trading platform authentication, quarterly privileged access review cycles, and extended log retention for trading system sessions. These address the highest-risk access scenarios in the capital markets context and are most likely to be the focus of SEBI examination scrutiny.

Diagnostic Questions

Has your organisation formally assessed whether it meets the Qualified RE thresholds under SEBI CSCRF, and has the assessment been documented and reviewed in the last 12 months?

For privileged access to trading systems and settlement infrastructure, are JIT session durations configured with the shorter limits appropriate for Qualified RE requirements, or do they use the same limits as general privileged access?

Does your anomaly detection configuration apply more sensitive thresholds for authentication events to trading platforms than for lower-sensitivity internal applications, and is there a documented threshold configuration for each system tier?

Are privileged access reviews for trading system administrators running on a quarterly cadence with documented evidence from each cycle, or on an annual cadence that satisfies only the baseline requirement?

Does your evidence retention for trading system session recordings extend to the enhanced period appropriate for Qualified RE examination scrutiny, and can you produce any session recording from within that retention window on the same business day of a SEBI request?

CTAs

See how Akku addresses SEBI CSCRF Qualified RE requirements across enhanced identity governance, privileged access controls, monitoring, and audit evidence for capital markets entities.

Book a conversation with the Akku team to assess your current implementation against SEBI CSCRF requirements for your entity tier.

FAQs

How does a capital markets entity determine whether it qualifies as a Qualified RE under SEBI CSCRF?

The Qualified RE classification is based on thresholds covering trading volume, assets under management, number of active clients, and systemic importance. The specific threshold values are defined in the SEBI CSCRF framework document. Entities should assess their metrics against these thresholds across the most recent period and classify conservatively where they are near the threshold. SEBI may also designate specific entities as Qualified REs based on their systemic role in settlement or clearing infrastructure regardless of volume thresholds. Entities uncertain about their classification should seek guidance from their SEBI compliance function or seek clarification directly from SEBI.

What are the most significant practical differences between Mid-size RE and Qualified RE compliance requirements?

The most significant practical differences are in review cadence, session governance depth, and monitoring sensitivity. Qualified REs must run access reviews more frequently, typically quarterly rather than annually, for users with access to critical trading infrastructure. Session durations for privileged trading system access must be shorter. Anomaly detection thresholds must be more sensitive for trading platform authentication. Log retention periods are longer. Evidence production must be faster in response to examination requests. The underlying controls are the same, but the operating depth and evidence density required are materially higher.

Does a broker that was a Mid-size RE in previous years automatically become a Qualified RE if its trading volume exceeds the threshold in the current year?

Yes. The tier classification is based on current metrics, not historical status. An entity that exceeds the Qualified RE thresholds must implement the enhanced requirements applicable to that tier. The transition from Mid-size to Qualified RE creates a compliance programme gap that must be closed: the enhanced access review cadences, session governance requirements, and monitoring configurations must be implemented, and the evidence infrastructure must begin generating enhanced evidence from the point of classification change. There is no automatic grace period, though SEBI may provide implementation timelines for entities newly crossing the threshold.

Can Akku’s platform be configured differently for Qualified RE versus Mid-size RE requirements, or does it apply the same configuration to all entities?

Akku’s platform is fully configurable to the requirements of each entity tier. JIT session duration limits can be configured per application or system category, allowing shorter limits for trading system access and standard limits for lower-sensitivity systems. Anomaly detection thresholds are configurable per application, supporting more sensitive thresholds for trading platform authentication. Access review campaign cadences are configurable per user population, supporting quarterly campaigns for privileged users and annual campaigns for standard users simultaneously. Log retention periods are configurable to meet the extended requirements appropriate for Qualified RE examination scrutiny.

How does the Qualified RE enhanced requirement for capital markets SoD rules differ from a standard SoD implementation?

A standard SoD implementation prevents generic conflicting role combinations: access provisioning and access certification, payment initiation and payment approval, system change implementation and change approval. Capital markets SoD for Qualified REs requires an additional layer of capital markets-specific conflict rules: front-office trading access combined with back-office settlement authority, client account management combined with fund transfer authorisation, market surveillance access combined with trading desk access, and compliance monitoring combined with the trading activities being monitored. These conflict combinations create specific manipulation and insider dealing risks that are particular to capital markets operations and require rules tailored to the entity’s operational structure.

What evidence should a Qualified RE be able to produce for a SEBI examination of their enhanced privileged access controls?

A SEBI examination of Qualified RE privileged access controls typically covers: session request and approval records for all privileged trading system sessions in the examination period, showing the specific operational justification for each session. Session recordings for sampled sessions showing activity at the keystroke or query level. JIT session duration records showing that sessions terminated at the configured limit or earlier. Quarterly privileged access review records covering all privileged trading system entitlements with timestamped certification or revocation decisions. Real-time monitoring capability demonstration showing live session visibility and termination capability. Authentication anomaly alert records for the examination period with investigation documentation.