SEBI's ITRI: A global first in measuring market tech resilience
India's capital market regulator, the Securities and Exchange Board of India (SEBI), has introduced a technology health scorecard for market infrastructure institutions (MIIs) such as stock exchanges, clearing corporations and depositories. Called the IT Resilience Index (ITRI), it aims to measure the robustness of their critical IT systems, moving beyond routine compliance checks to a quantified assessment of operational resilience.
The initiative is believed to be one of the first attempts globally by a regulator to design a quantitative resilience barometer for MIIs, conceptually similar to capital adequacy norms for banks. The index is expected to serve as a proactive tool to identify vulnerabilities before they escalate into systemic disruptions.
The move comes amid the rising technological dependence of Indian capital markets, where even a few minutes of disruption can affect millions of investors and billions of rupees in trades. The ITRI will gauge whether IT systems supporting trading, clearing, settlement and securities holding are capable of handling operational shocks, cyber threats, technical failures and sudden spikes in market activity.
The foundation for the index was laid in 2015, when SEBI classified MIIs as “systemically important” and mandated a robust cybersecurity framework for performing systemically critical functions. Since then, India’s securities market has undergone rapid digital transformation, with increased retail participation through online platforms, higher algorithmic trading volumes and faster settlement cycles. Market efficiency is now inseparable from technology reliability, making it a boardroom issue.
The proposed index shifts from a purely compliance-based approach to a quantitative risk-monitoring framework. It is built on nine parameters, each weighted according to a systemic-risk hierarchy. Availability and security have been given the highest weight at 20% each, as they represent the first line of defence for a financial market’s functioning. Business Continuity and Reliability carry a 10% weight, reflecting a regulatory shift from merely preventing failures to absorbing shocks and recovering quickly. Scalability is assigned a 5% weight, given that Indian markets are growing rapidly but do not pose an immediate stability risk.
The weights were assigned after discussions with SEBI’s Technical Advisory Committee, and the Industry Standards Forum of MIIs will further define detailed sub-parameters and measurement criteria. SEBI has acknowledged that the initial weights should be seen as a starting framework and may be refined using actual outage data, cyber incidents and stress tests. MIIs will also develop an Early Warning System (EWS) to detect any deterioration in ITRI parameters that could lead to performance issues, system slowness or other disruptions, and take remedial measures.
Globally, several jurisdictions have established operational resilience frameworks, though not always in the form of a single numerical index. The United Kingdom’s Financial Conduct Authority and Prudential Regulation Authority have implemented operational resilience rules requiring financial institutions to identify important business services, set disruption tolerances and demonstrate recovery from severe operational shocks. The European Union’s Digital Operational Resilience Act (DORA) is a comprehensive regulatory rulebook rather than a numerical scorecard. The United States does not have a similar single index.
SEBI’s ITRI is a pioneering attempt to institutionalise technology resilience as a measurable, board-level concern. It could serve as a global template for regulators seeking to strengthen market infrastructure against the growing threats of cyber attacks and operational failures. As India’s capital markets continue to integrate technology into every layer, the index will evolve, learning from real-world incidents and stress scenarios.
