What AI/ML disclosure obligations does Section 2.9 of SEBI's Master Circular for Depositories 2024 create?

SEBI Master Circular for Depositories (SEBI/HO/MRD/MRD-PoD-1/P/CIR/2024/168, December 3, 2024), Section 2.9 — Reporting for Artificial Intelligence (AI) and Machine Learning (ML) — consolidates and formalizes the AI/ML disclosure obligation that originated in NSDL Circular NSDL/POLICY/2023/0142 into a binding SEBI Master Circular obligation. Section 2.9 creates three distinct AI governance obligations for depository participants: (1) Mandatory quarterly AI/ML reporting: every depository participant (DP) — every entity registered with NSDL or CDSL to provide demat account services — must submit an AI/ML Reporting Form via SEBI's e-PASS portal on a quarterly basis. The Reporting Form requires the DP to catalogue each AI/ML application and system in use: its name, its purpose (demat account onboarding, settlement processing, compliance surveillance, investor service automation, fraud detection, internal operations), and its deployment status (in development, testing, production). This is not a narrative disclosure — it is a structured data submission that SEBI's examination teams can query across all DPs; (2) Annual AI/ML report: in addition to quarterly submissions, DPs must submit an annual AI/ML systems report within three months of the financial year end. The annual report provides a comprehensive year-end view of AI/ML deployment and is used by SEBI for sector-level AI risk assessment; (3) NIL reporting mandatory: a DP that does not currently use any AI/ML systems is not exempt from reporting — it must submit a NIL return on both the quarterly and annual schedule. This design ensures SEBI has complete coverage of the DP sector's AI footprint, not just voluntary disclosures from early AI adopters.

What AI systems must depository participants report under SEBI's e-PASS AI/ML disclosure obligation?

The SEBI Master Circular Section 2.9 reporting obligation covers 'AI and Machine Learning applications and systems' — a broad scope that captures AI across all DP operational functions, not just client-facing AI. Five categories of AI/ML systems that DPs commonly operate and must report: (1) Client onboarding AI: AI used for eKYC verification, document OCR, identity matching, and account activation — now standard across NSDL and CDSL participant banks and brokers. AI eKYC systems that compare ID document photographs, PAN data, and Aadhaar-based biometric verification are within scope; (2) Fraud detection and surveillance AI: AI monitoring of demat account activity for unauthorized transactions, account takeover indicators, suspicious delivery instruction patterns, and pledge-versus-account-balance anomalies. This is among the highest-risk AI in the DP sector; (3) Settlement and custody operations AI: AI used for automated settlement matching, corporate action processing, and dividend/bonus entitlement calculation. AI errors in corporate action processing can affect thousands of beneficial owners simultaneously; (4) Investor service automation: AI-based investor query handling (chatbots, AI-driven statement generation, AI grievance classification). These systems interact directly with retail investors and must be reported; (5) Internal compliance and regulatory AI: AI used by the DP for its own compliance monitoring — surveillance of DP staff, regulatory reporting generation, or AI-driven risk management. All of these fall within the Section 2.9 reporting scope regardless of whether the AI was developed in-house or procured from a third-party vendor.

How does the SEBI e-PASS AI/ML reporting obligation interact with SEBI's broader AI governance framework for depositories?

The Section 2.9 e-PASS reporting obligation is the disclosure layer of SEBI's AI governance framework for depositories — but it interacts with three other SEBI AI governance obligations that create the full compliance stack: (1) SEBI AI/ML Responsible Usage Framework 2025: the Responsible Usage of AI/ML Guidelines (June 2025 consultation, August 2026 final circular) apply to depositories as SEBI-registered intermediaries. NSDL and CDSL are explicitly within scope as market infrastructure institutions. The Responsible Usage Framework creates kill-switch, human oversight, and senior management accountability obligations for depository AI — complementing the Section 2.9 inventory disclosure requirement with governance obligations for each disclosed system; (2) SEBI Cyber Security Framework for Market Infrastructure Institutions: depositories must comply with SEBI's Cyber Security and Cyber Resilience Framework, which includes provisions for AI-specific threats including adversarial inputs and AI system compromise. The Cyber Security Framework governs the security of AI systems disclosed under Section 2.9; (3) DPDP Act 2023 intersection: depository participants process significant personal data — PAN, Aadhaar, bank account details, transaction history — through AI systems. AI used for client onboarding, fraud detection, and investor services involves processing personal data. DPDP Act 2023 requires purpose-specific consent and data minimisation for AI processing of personal data. A DP that processes investor data through AI for purposes beyond the stated purpose of their account agreement faces DPDP Act exposure; (4) SEBI examination integration: the e-PASS AI/ML data feeds directly into SEBI's inspection preparation. Inspection teams can compare a DP's quarterly AI/ML reports against its operational AI footprint — a DP that operates AI systems not disclosed in its e-PASS submissions faces a specific compliance gap the inspection will identify.

What AI governance gap exists between SEBI's depository AI/ML reporting requirement and actual DP practice?

India's depository sector includes over 1,000 registered DPs — ranging from large broker-DPs (Zerodha, Angel One, ICICI Securities), bank-DPs (SBI, HDFC Bank, Axis Bank), to smaller regional broker-DPs with a few thousand clients. The AI governance gap is acute in four areas: (1) Vendor AI visibility: most smaller DPs use their broker's core platform or their CBS (core banking system) for demat operations — systems that may contain AI features the DP does not know are operating. A DP that uses a trading platform with embedded AI-based fraud detection but has not identified that AI in its e-PASS submission is non-compliant regardless of intent; (2) NIL return compliance: many DPs assume that because they have not explicitly deployed an AI system, they are exempt from reporting. The NIL return requirement means no DP is exempt — every DP must make an affirmative quarterly submission. DPs that have not submitted e-PASS returns since the obligation was established have a compliance backlog; (3) Annual submission timing: the annual AI/ML report must be filed within three months of financial year end (i.e., by June 30). DPs that treat this as an IT/systems task rather than a compliance obligation often miss the deadline or submit incomplete inventories; (4) Scope confusion: DPs frequently misclassify AI-adjacent tools (rule-based fraud screening, automated compliance checklist software, OCR document processing without ML) as either inside or outside the reporting scope. SEBI's e-PASS form requires systems that use machine learning or artificial intelligence methods — pure rule-based systems without statistical learning components are typically outside scope, but many DPs either over-report rule-based systems or under-report AI-adjacent systems where the ML component is embedded in a vendor platform.

AI Governance · SEBI · Depository Participants · NSDL · CDSL · AI Disclosure · India BFSI

SEBI Master Circular for Depositories 2024 Section 2.9 AI Governance: Mandatory Quarterly AI/ML Disclosure via e-PASS, NSDL CDSL AI Model Inventory and Demat Account AI Reporting India

SEBI Master Circular for Depositories (SEBI/HO/MRD/MRD-PoD-1/P/CIR/2024/168, December 3, 2024) Section 2.9 — "Reporting for Artificial Intelligence (AI) and Machine Learning (ML)" — creates mandatory quarterly AI/ML system disclosure for ALL depository participants via SEBI's e-PASS portal, plus an annual submission within 3 months of financial year end. DPs must catalogue every AI/ML application in use: name, purpose, deployment status. NIL returns mandatory even if no AI deployed. Applies to NSDL, CDSL, and all 1,000+ registered DPs — brokers, banks, and regional intermediaries providing demat account services. Zero global competitor coverage.

Zytra Research Team · December 2024 · 11 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

India's depository sector holds demat accounts for over 15 crore investors — every listed equity, bond, and mutual fund unit in dematerialized form passes through NSDL or CDSL. Depository Participants operate the client-facing layer: account opening, delivery instructions, pledge management, corporate action processing. AI runs through all of it — eKYC AI, fraud detection AI, automated service AI. SEBI's Master Circular Section 2.9 is the formal accounting: every AI/ML system operating in the DP sector must now be disclosed to SEBI quarterly.

The e-PASS reporting obligation is structurally similar to a model inventory requirement — but it is a regulatory disclosure, not an internal governance tool. The data flows to SEBI's examination teams, where it becomes the baseline against which inspection findings are assessed. A DP whose quarterly e-PASS reports show zero AI systems, but whose operations visibly use AI tools, faces a specific non-disclosure problem at inspection.

The NIL Return Trap

Section 2.9's NIL return requirement — every DP must file even if it has no AI systems — is operationally significant because it removes the passive compliance option. A DP that has never submitted an e-PASS AI/ML return cannot claim it was compliant by not deploying AI. It was non-compliant by not submitting NIL returns. This creates a compliance backlog for every DP that has not been filing since the obligation was established.

SEBI Depository AI/ML Governance Checklist

☐ e-PASS AI/ML quarterly submissions: all quarterly returns filed since obligation established; no missed quarters; NIL returns filed for periods with no AI/ML systems in use
☐ Annual AI/ML report: filed within 3 months of financial year end (by June 30); comprehensive inventory of all AI/ML systems operational during the year
☐ AI/ML system inventory: all AI/ML applications catalogued — name, purpose (onboarding, fraud detection, settlement, investor services, compliance), deployment status; vendor-embedded AI identified through vendor inquiry
☐ Scope assessment: AI-adjacent tools assessed for ML classification; rule-based vs ML-based systems correctly classified; vendor platforms queried for embedded AI features
☐ SEBI Responsible Usage Framework alignment: kill-switch, human oversight, senior management accountability confirmed for AI/ML systems disclosed in e-PASS (per SEBI AI/ML Framework 2025)
☐ DPDP Act AI processing consent: investor personal data processed through AI covered by DPDP Act consent; purpose limitation for AI use beyond stated account purpose
☐ SEBI inspection readiness: e-PASS submission records, AI/ML system documentation, scope assessment rationale — packaged for SEBI depository inspection