SEBI released a Consultation Paper on June 22, 2026, proposing draft circulars on Trading Software & Technology for Stock Exchanges and Common IT provisions for Market Infrastructure Institutions (MIIs). The paper seeks public comments and aims to standardise technology governance, software procurement, cybersecurity frameworks, and IT risk management across exchanges, clearing corporations, and depositories. It consolidates existing fragmented IT guidelines into unified, enforceable circulars applicable to all MIIs under SEBI's regulatory jurisdiction.

Market Infrastructure Institutions (MIIs) — comprising Stock Exchanges, Clearing Corporations, and Depositories — form the backbone of India's securities market. Any technology failure or cybersecurity breach at these entities can trigger systemic risk, disrupt settlement cycles, and erode investor confidence. SEBI has historically issued IT-related guidelines in a piecemeal fashion through circulars, advisories, and inspection findings. The June 2026 consultation paper marks a consolidation exercise: two draft circulars seek to create a single, comprehensive technology governance framework.

The first draft circular specifically targets Stock Exchanges and their trading software — covering areas like algorithm testing, software change management, disaster recovery, co-location services, and vendor risk management. The second draft circular addresses Common IT provisions applicable to all MIIs, standardising requirements on cybersecurity policies, data localisation, cloud adoption, business continuity planning (BCP), and IT audit frameworks.

For SEBI Grade A aspirants, this is significant because it sits at the intersection of Capital Markets regulation and Technology governance — a growing area of SEBI's supervisory focus since the 2021 NSE co-location scandal and the 2022 SEBI guidelines on Cyber Security and Cyber Resilience. The consultation approach itself reflects SEBI's regulatory philosophy of stakeholder engagement before binding circulars. Questions may test the scope of MIIs, the rationale for consolidation, or the specific IT risk components being regulated.