SEBI's CSCRF: The One Clause That Already Requires a Cryptographic Inventory in India

Of everything on India's country page, this is the one requirement most likely to be missed by a compliance team scanning for "PQC regulation," because it doesn't come from a PQC-specific circular at all. It's one clause inside SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), a broad, general-purpose cybersecurity circular for the securities market that happens to already require post-quantum readiness.

The circular and its clause

SEBI issued the CSCRF as circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 on 20 August 2024, under section 11(1) of the SEBI Act 1992. The quantum provision sits in a call-out box — "Box Item 7: Cybersecurity and Quantum Computing," at pages 59 to 60 — inside Section 2.2 on risk assessment. Its operative text reads:

"To mitigate these risks, REs shall focus on the following indicative measures: 1. REs shall maintain an inventory of cryptographic assets, prioritizing critical assets for Post Quantum Cryptography (PQC) migration, and assess their IT infrastructure capabilities."

The drafting deserves attention, because it pulls in two directions at once: entities "shall focus" on measures the same sentence calls "indicative." Each of the six sub-items then uses "shall." Placement matters too — this is a box, not one of the circular's numbered Standards.

A firmer requirement sits in the Standards themselves. Section 2.2 (ID.RA) states that risk assessment "including post-quantum risks" is to be carried out periodically, with no softening qualifier, and Section 2.1 (ID.AM) requires that encryption methods "shall be mapped and inventoried" across IT systems and network resources. If you are citing SEBI on post-quantum obligations, those two lines are the stronger ground.

No deadline for PQC migration, no named algorithm standard, and no CBOM format is specified. In fact the circular never uses the term CBOM at all: its five references to a bill of materials are all to Software Bill of Materials. But this is binding on a defined population of regulated entities, which is what distinguishes it from a committee's mandate or a technical guideline.

Who it actually applies to

SEBI's regulated entities under the CSCRF are organized into five tiers: Market Infrastructure Institutions (stock exchanges, depositories, and clearing corporations, the largest and most systemically important), Qualified REs, Mid-size REs, Small-size REs, and Self-certification REs, with obligations scaled by tier. A subsequent amending circular dated 30 April 2025 moved KYC Registration Agencies (KRAs) from the Market Infrastructure Institution tier down to the Qualified RE tier, an adjustment to who carries the framework's heavier obligations, though the underlying cryptographic-inventory clause itself doesn't appear to have changed.

It's already been amended twice, and SEBI has spelled out what the clause actually requires

The CSCRF isn't a static, one-time circular. SEBI has issued clarifications on 30 April 2025 and further technical clarifications on 28 August 2025, both published directly on sebi.gov.in. This is worth knowing if you're relying on the original August 2024 text: check for the amendments before treating the original circular as the complete, current picture.

Compliance timelines also moved. A circular of 30 June 2025 extended them by two months, "till August 31, 2025 to all REs, except Market Infrastructure Institutions (MIIs), KYC Registration Agencies (KRAs), and Qualified Registrars to an Issue and Share Transfer Agents (QRTAs)" — that last group never received the extension and stayed on the original schedule. That date has now passed, so CSCRF is in force for everyone it covers.

SEBI's own FAQ document (11 June 2025) goes further than the base circular, directly addressing "the expected approach for maintaining an inventory of cryptographic assets and prioritizing critical assets for Post-Quantum Cryptography (PQC) migration." Regulated entities are told to identify and document all assets using cryptographic mechanisms, including data in transit and at rest, communication channels, and authentication systems, and the inventory must record what cryptography is used, by which application, for what purpose, including keys, certificates, and algorithms. Prioritization for PQC migration should be based on risk assessment, asset criticality, information sensitivity, and threat exposure. This is real operational detail beyond the circular's one-sentence requirement, confirmed directly from SEBI's own FAQ text, not secondhand reporting.

Why this matters more than its length suggests

A requirement tucked into a box inside a general cybersecurity circular is easy to under-rate. But it is binding today rather than pending a committee report, and it attaches to a defined, tiered population with SEBI's existing enforcement mechanisms behind the broader framework. RBI's Q-SAFE committee is still producing its recommendation; CERT-In's Technical Guidelines use imperative language but cite no legal basis at all.

SEBI is no longer alone, though. On 6 April 2026, IRDAI issued its Information and Cyber Security Guidelines 2026, whose Control 110 asks whether an organisation "maintain[s] an up-to-date inventory of its cryptographic assets to ensure preparedness for transition to postquantum cryptographic environments." That control applies to every category of insurance entity with no threshold exemption, and it appears in the auditors' report annexure — so unlike SEBI's box item, it is checked by an external auditor. India now has two binding sectoral cryptographic-inventory requirements, and the insurance one is arguably drafted more firmly than the securities one.

How this fits with India's other regulators

See the India country page for how this tracker weighs SEBI's clause against IRDAI's audited control, CERT-In's more detailed but legally unanchored guidelines, and RBI's still-pending Q-SAFE roadmap.

Sources: SEBI CSCRF circular, full text (20 August 2024) — Box Item 7 at pp. 59–60; CSCRF landing page; Extension of compliance timelines (30 June 2025); Clarifications to CSCRF (30 April 2025); Technical clarifications to CSCRF (28 August 2025); SEBI CSCRF FAQ, Question 13 (11 June 2025); IRDAI Information and Cyber Security Guidelines 2026.