What AI governance obligations does SEBI's December 2025 MII strengthened governance circular create for stock exchanges and depositories?

SEBI Circular HO/47/12/11(5)2025-MRD-POD3/I/196/2025 (December 12, 2025, effective December 20, 2025) implements amendments to the SECC Regulations 2018 and D&P Regulations 2018 notified in the Official Gazette of India on November 21, 2025. It creates the institutional governance architecture for technology and AI oversight at India's Market Infrastructure Institutions — a structural requirement that precedes and enables all operational AI governance requirements. Four core AI governance obligations: (1) Functional independence of the Chief Technology Officer (CTO): the CTO must have functional independence from business units — meaning the CTO's technology decisions, including AI/ML system architecture and deployment decisions, cannot be subordinated to revenue-generating business interests. This is a structural safeguard against AI systems being deployed without adequate governance review because business units have urgency or commercial pressure. The CTO reports independently on technology governance, AI system risks, and technology operational integrity; (2) Functional independence of the Chief Information Security Officer (CISO): the CISO must operate independently from both business units and the CTO's line management — creating a separate accountability channel for cybersecurity and AI security risks. AI-related cybersecurity risks (AI system vulnerabilities, adversarial attacks on AI models, AI-accelerated threat patterns) are reported independently through the CISO channel without business-unit filtering; (3) Technology audits under the Chief Risk Officer (CRiO): all technology audits — including audits of AI/ML systems, model risk, algorithmic trading systems, and surveillance technology — are placed under the Chief Risk Officer rather than the technology department. This creates an independent review function: the AI systems being audited are not audited by the function that built and operates them. The CRiO's technology audit scope covers AI model performance, AI system controls, and AI-related risk exposures; (4) Two Executive Director positions with institutional separation: one ED heads Critical Operations and Technology (covering exchange/depository operations, trading systems, AI-driven surveillance, technology infrastructure); the second ED heads Regulatory, Compliance, Risk, and Investor Grievances (covering governance, AI risk oversight, regulatory reporting). This ED-level separation ensures that the business/technology function and the oversight/compliance function cannot override each other at the executive level — a structural check on AI deployment decisions.

Which entities does SEBI's MII governance circular apply to, and what is the phased implementation timeline?

SEBI's MII Strengthened Governance Circular applies to eight entities that operate India's critical market infrastructure: (1) Stock exchanges: National Stock Exchange (NSE), BSE Limited (Bombay Stock Exchange), Metropolitan Stock Exchange of India (MSE) — the three recognized stock exchanges under the SECC Regulations 2018; (2) Clearing corporations: NSE Clearing Limited (NSCCL), Clearing Corporation of India Limited (CCIL), BSE Clearing Limited, Indian Clearing Corporation Limited (ICCL) — the entities that manage the settlement, margin, and default fund infrastructure; (3) Depositories: National Securities Depository Limited (NSDL), Central Depository Services (India) Limited (CDSL) — the two depositories holding equity and debt securities in dematerialized form for 11+ crore demat accounts. Phased implementation timeline: the circular mandates appointment of two Executive Director positions on a phased basis — the first ED must be in place within 6 months of the circular's effective date (i.e., by June 20, 2026); the second ED within 9 months (i.e., by September 20, 2026). CTO and CISO functional independence and technology audit under CRiO are to be implemented in parallel with the ED appointment timeline. The September 2026 SEBI consultation paper on Standard Operating Procedures for CTO/CISO/CRiO appointments (including minimum AI/ML technical qualification requirements for these roles) will further specify the governance standards expected for these independent oversight functions.

How does the SEBI MII governance circular relate to SEBI's AI/ML Technology Roadmap working group for market infrastructure?

SEBI announced in January 2026 (Press Release PR No. 02/2026) the constitution of an AI/ML Technology Roadmap working group for India's market infrastructure, chaired by Prof. D.B. Phatak of IIT Bombay. The working group is developing 5-year and 10-year technology vision documents covering AI/ML, distributed ledger technology (DLT), cloud infrastructure, and quantum-safe cryptography for India's stock exchanges, clearing corporations, and depositories. The December 2025 MII Governance Circular is the institutional foundation that makes the Technology Roadmap actionable: (1) Governance architecture enables roadmap execution: a working group can produce an AI/ML roadmap, but without an independent CTO, an independent CISO, and technology audits under the CRiO, there is no institutional structure for executing the roadmap with appropriate oversight. The governance circular creates the organizational conditions under which an ambitious AI/ML technology roadmap can be implemented with accountability; (2) CTO independence is prerequisite for roadmap authority: the AI/ML roadmap will require AI system deployment decisions that may face business-unit resistance (cost, timeline, operational disruption). A functionally independent CTO can implement roadmap directives without subordination to business-line pressure. Without the governance circular's independence requirement, the roadmap would be advisory rather than executable; (3) CRiO technology audit creates roadmap accountability: the Technology Roadmap's AI/ML implementation milestones need independent verification. Technology audits under the CRiO provide the independent confirmation that AI systems deployed per the roadmap actually function as specified — closing the loop between roadmap ambition and audit-verified delivery; (4) AI/ML expertise in CTO/CISO/CRiO appointments: SEBI's September 2026 consultation on appointment standards explicitly includes AI/ML technical expertise as a qualification criterion for these roles — confirming that the governance architecture is specifically designed to enable AI/ML oversight, not just general technology governance.

What is the difference between the SEBI MII governance circular's AI oversight obligations and the SEBI Clearing Corporation AI governance already published?

The SEBI Clearing Corporation AI governance post covers operational AI — the AI and ML tools used in actual clearing and settlement operations: margin models, default fund sizing, real-time position monitoring, stress testing. The December 2025 MII Governance Circular covers governance architecture — the institutional structure responsible for overseeing those AI operations. The distinction is between the first-order question ('what AI does the clearing corporation use?') and the second-order question ('who oversees the AI the clearing corporation uses, and are they structurally independent enough to provide genuine oversight?'). Three specific differences: (1) The clearing corporation AI post addresses: which AI tools are in use, what risks they manage, what disclosure and validation obligations apply, how SEBI imposes accountability for AI-driven risk models. The governance circular addresses: whether the CTO overseeing those AI tools has functional independence from the exchange's trading revenue function; whether the CISO's AI security assessments can be suppressed by business units; whether technology audits of AI systems are conducted by an independent CRiO rather than the technology department that built the systems; (2) The governance circular applies to the institutional structure of stock exchanges and depositories in addition to clearing corporations — it has a broader MII scope; (3) The governance circular's implementation timeline (6-9 month phased ED appointments) creates a compliance gap analysis requirement: MIIs that have not completed the ED appointments by the specified deadlines are in breach of their SECC/D&P Regulation obligations, not just advisory guidance non-compliance. Compliance teams at NSE, BSE, NSDL, and CDSL should verify appointment status against the December 2025 circular's phased deadlines.

AI Governance · SEBI · MII · NSE · BSE · NSDL · CDSL · CTO Independence · CISO · Technology Oversight · India BFSI

SEBI MII Strengthened Governance Circular December 2025: CTO and CISO Functional Independence from Business Units, Technology Audits Under Chief Risk Officer and Two-Executive-Director Separation as Institutional AI Oversight Architecture for NSE, BSE, NSDL, CDSL and All 8 India Market Infrastructure Institutions

SEBI Circular HO/47/12/11(5)2025-MRD-POD3/I/196/2025 (December 12, 2025, effective December 20, 2025, amending SECC Regulations 2018 and D&P Regulations 2018) creates the institutional governance architecture for AI oversight at India's 8 Market Infrastructure Institutions — NSE, BSE, MSE, NSE Clearing, CCIL, BSE Clearing, ICCL, NSDL, and CDSL. CTO must have functional independence from business units — AI deployment decisions cannot be subordinated to trading revenue interests. CISO reports AI security risks independently. All technology audits (including AI/ML system audits) placed under the Chief Risk Officer, not the technology department. Two Executive Director positions separate Critical Operations/Technology from Regulatory/Compliance/Risk — the first ED required by June 20, 2026, the second by September 20, 2026. Governance architecture foundation for SEBI's AI/ML Technology Roadmap working group (Prof. Phatak, IIT Bombay). Distinct from SEBI Clearing Corporation AI governance post (operational AI) — this covers governance architecture. Zero global competitor coverage.

Zytra Research Team · December 2025 · 11 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

Most AI governance discussions at market infrastructure institutions focus on the AI systems themselves — what models are in use, what risks they manage, what happens when they fail. SEBI's December 2025 circular asks an earlier question: who oversees the people building and deploying those AI systems, and do they have enough structural independence to provide genuine oversight?

The three independence requirements — functional independence for the CTO, functional independence for the CISO, technology audits under the CRiO rather than the technology department — address the fundamental conflict of interest in AI governance at commercially-driven infrastructure operators. Without structural independence, technology oversight becomes a formality. With it, governance becomes an institutional check with real authority.

The ED Appointment Deadline Risk

The phased ED appointment requirement (first ED by June 20, 2026; second by September 20, 2026) is an SECC/D&P Regulation compliance obligation, not merely governance guidance. MIIs that have not completed the required appointments by the specified deadlines are in breach of their regulatory obligations under the amended Regulations. Compliance teams should verify appointment status against the December 2025 circular's phased deadlines and flag any breach for board-level attention and SEBI engagement.

SEBI MII Governance AI Oversight Compliance Checklist

☐ CTO functional independence: CTO reporting line confirmed as functionally independent from business units; AI/ML deployment authority documented as not subordinate to trading revenue or business-line interests
☐ CISO functional independence: CISO reporting line confirmed as independent from business units and CTO line management; AI security risk reporting channel verified as unfiltered
☐ Technology audit under CRiO: AI/ML system audit mandate transferred to or confirmed under CRiO; AI model audit scope includes model performance, controls, and AI-related risk exposures
☐ ED appointments: first ED (Critical Operations and Technology) appointed by June 20, 2026; second ED (Regulatory/Compliance/Risk) appointed by September 20, 2026; appointment status documented and board-reviewed
☐ CTO/CISO/CRiO appointment standards: SEBI September 2026 consultation on appointment SOPs tracked; AI/ML technical expertise requirement for these roles documented in appointment process
☐ AI/ML Technology Roadmap: SEBI Prof. Phatak working group roadmap outputs tracked; institutional governance architecture confirmed as ready to execute roadmap AI/ML deployment milestones with CTO/CRiO oversight
☐ SEBI inspection readiness: governance circular compliance documentation (independence mandates, ED appointments, technology audit transfer to CRiO) packaged for SEBI inspection