Coming out with fresh guidelines, Sebi on Monday asked market infrastructure institutions to begin operations from disaster recovery sites within 45 minutes of a disruption to critical systems, including trading.
They come after the National Stock Exchange (NSE), India's largest, shut down for nearly four hours late last month. Traders and investors said lack of proper communication caused losses.
Meanwhile, NSE submitted its detailed root cause analysis (RCA) to Sebi’s technical advisory committee.
“Post halting of trading on NSE, we considered all the available alternatives on hand, including invocation of DR, to decide on the course of action that would bring up the market at the earliest with least disruption to market participants and post evaluation, a decision was taken to bring up the systems at the primary site. NSE regularly tests its DR readiness in line with Sebi regulations wherein quarterly drills are conducted and live trading sessions from DR site are conducted twice a year," NSE said in a press statement.
To be sure, NSE has a primary data centre at its headquarters in Mumbai’s BKC. It also maintains a near disaster recovery (NDR) site nearby at Kurla and a disaster recovery (DR) site in Chennai.
In a circular, Sebi said that with advancement in technology and improved automation of processes, it was felt that the extant framework needs to be re-examined with a view to reducing the time period specified for moving from Primary Data Centre (PDC) to Disaster Recovery Site (DRS).
The watchdog has come out with a new framework for Business Continuity Plan (BCP) and Disaster Recovery (DR) of Market Infrastructure Institutions (MIIs) -- stock exchanges, clearing corporations and depositories.
In the event of disruption of any one or more of the 'critical systems', the MII would, within 30 minutes of the incident, declare that incident as 'disaster' and take measures to restore operations including from DRS within 45 minutes of the declaration of 'disaster', Sebi said.
The new guidelines should be implemented within 90 days, the Securities and Exchange Board of (India) said.
Critical systems for an exchange or clearing corporation would include trading, risk management, collateral management, clearing and settlement and index computation while critical systems' for a depository shall include systems supporting settlement process and inter-depository transfer system.
MIIs have to ensure that the Recovery Point Objective (RPO) -- the maximum tolerable period for which data might be lost due to a major incident -- would be 15 minutes.
Solution architecture of PDC and DRS should ensure high availability, fault tolerance, no single point of failure, zero data loss, and data and transaction integrity, Sebi said.
"Any updates made at the PDC should be reflected at DRS/ NS (Near Site) immediately (before end of day) with head room flexibility without compromising any of the performance metrics," Sebi said.
MIIs would have to develop systems that do not require configuration changes at the end of trading members/ clearing members/ depository participants for switchover from the PDC to DRS.
Further, MIIs would have to test such switchover functionality by conducting unannounced live trading from its DRS for at least one day in every six months. Unannounced live trading from DRS of MIIs need to be done at a short notice of 45 minutes, Sebi said.
With regards to DR drills, Sebi said such drills should be conducted on a quarterly basis. In case of exchanges and clearing corporations, these drills should be closer to real life scenario (trading days) with minimal notice to DRS staff involved.
During the drills, the staff based at PDC should not be involved in supporting operations in any manner. The drill should include running all operations from DRS for at least one full trading day.
According to Sebi, 'live' trading sessions from DR site need to be scheduled for at least two consecutive days in every six months. Such live trading sessions from the DRS need to be organised on normal working days.
The BCP-DR policy document should be periodically reviewed at least once in six months and after every occurrence of disaster.
E
Click here to read the Mint ePaperMint is now on Telegram. Join Mint channel in your Telegram and stay updated with the latest business news.