Asia Reg & Microstructure Wrap
Tuesday, 2026-07-21 · covering the last ~24 hours
India
SEBI
SEBI fines CDSL ₹1 crore over 2022 malware attack and settlement-system lapses. An adjudication order made public 20 July penalises Central Depository Services (India) Ltd ₹90 lakh under the SEBI Act and ₹10 lakh under the Depositories Act, over cybersecurity failures behind the November 2022 malware incident that infected 135 of CDSL's 547 servers and disrupted settlement, corporate-action and inter-depository-transfer systems for roughly 47–54 hours. SEBI found CDSL had not classified the compromised internet-facing server as a "critical asset," had weak password controls and inadequate real-time intrusion monitoring, and failed to meet backup-site resumption timelines — despite SEBI having flagged similar gaps in August 2022, before the attack. CDSL handles roughly 83 million demat accounts (about 70% of India's total), so this is a market-infrastructure resilience finding rather than a trading-rule change; the order itself does not appear to alter any current cyber-resilience circular. SEBI's own order was not yet locatable in the enforcement-orders index at time of writing; best available account below. Reuters via Yahoo Finance
No other new SEBI circulars or consultation papers on trading, derivatives, or settlement mechanics in this window. The AIF investor-consent consultation flagged in earlier editions closes for comment today (21 July); no SEBI decision or extension has been published yet.
Exchanges (NSE/BSE)
No material new NSE or BSE circulars in this window beyond routine settlement-calendar and stock-specific surveillance (ASM/ESM/GSM) updates — nothing bearing on trading structure, derivatives, or settlement mechanics.
RBI, IFSCA & other
No material RBI items specific to equity markets or FPIs this window (recent RBI news concerns FCNR(B) deposit-swap deadlines and forex inflows, outside this wrap's scope). No new IFSCA circulars or consultation papers confirmed; its GIFT City direct-listing consultation (comments due 3 August) remains the latest open item.
Rest of Asia — Developed Markets
A quiet window: no material new regulatory or market-structure announcements from Japan (JFSA, JPX/TSE), Hong Kong (SFC, HKEX), Singapore (MAS, SGX RegCo), Australia (ASIC, ASX) or New Zealand (FMA, NZX) beyond items already covered in prior editions and routine notices.
Rest of Asia — Emerging Markets
Also quiet: no new circulars or structural rule changes from China (CSRC, SSE/SZSE, Stock Connect), South Korea (FSC/FSS, KRX), Taiwan (FSC, TWSE/TPEx), Thailand (SEC, SET), Indonesia (OJK, IDX), Malaysia (SC, Bursa) or the Philippines (SEC, PSE) in this window. Korea's single-stock leveraged-ETF stress episode (FSC's 16 July package of listing suspensions and tighter margin rules) continues to generate investor-impact reporting, but that is market commentary on an already-covered regulatory action, not a new rule.
Industry & broker notes
Nothing distinct from freely available broker/industry commentary this window beyond the items above.
Informational only — summaries of public regulatory sources; not advice.