Which SEBI CSCRF category are you in, and what it costs you
Work out your CSCRF category from the current thresholds, across every SEBI regulated entity type, with the obligations each category picks up and the amendments that changed the criteria.
Find your category
Pick your entity type and enter the one figure it turns on. The bands are shown in full either way, so the tool is readable as a reference even without entering anything.
The two parameters are applied independently and the higher categorisation applies. Qualified Stock Brokers designated under the February 2023 QSB circular are Qualified REs regardless.
| Category | Threshold |
|---|---|
| Exempt | Up to 1,000 |
| Self-certification | More than 1,000 and up to 10,000 |
| Small-size | More than 10,000 and up to 1 lakh |
| Mid-size | More than 1 lakh and up to 10 lakhs |
| Qualified | More than 10 lakhs |
| Category | Threshold |
|---|---|
| Exempt | Up to ₹1,000 crore |
| Self-certification | More than ₹1,000 crore and up to ₹10,000 crore |
| Small-size | More than ₹10,000 crore and up to ₹1,00,000 crore |
| Mid-size | More than ₹1,00,000 crore and up to ₹10,00,000 crore |
| Qualified | More than ₹10,00,000 crore |
Carve-out. A broker with less than ₹1,000 crore of clientele trading volume in a year *and* fewer than 1,000 total registered clients is exempt from CSCRF. Both limbs must be satisfied.
Changed since CSCRF v1.0. CSCRF v1.0 categorised brokers on active UCC client base and distinguished client-based from proprietary brokers. April 2025 replaced that table outright and the proprietary/client-based split no longer exists.
Indicative, and not legal advice. SEBI validates the category at the time of compliance submission through your reporting authority, and the thresholds are updated as and when required.
Every entity type and its threshold
CSCRF categorises on a different parameter for almost every entity type. Some take a fixed category, some derive it from another registration, and seven are excluded outright.
| Entity type | What decides the category | Source |
|---|---|---|
| Stock exchange, clearing corporation or depository (MII) | Always MII | CSCRF v1.0 |
| Stock broker | Number of total registered clients, and Clientele trading volume in a year | April 2025 clarification |
| Depository Participant | Follows the entity’s other SEBI registration | April 2025 clarification |
| Portfolio Manager | Assets under management | August 2025 technical clarification |
| Merchant Banker | Always Small-size | August 2025 technical clarification |
| Manager of an AIF or Venture Capital Fund | Sum of corpus of all AIFs, VCFs and their schemes managed by the manager | April 2025 clarification |
| Mutual Fund or Asset Management Company | Assets under management | CSCRF v1.0 |
| Custodian | Assets under custody | CSCRF v1.0 |
| Registrar to an Issue and Share Transfer Agent | Number of folios serviced | CSCRF v1.0 |
| KYC Registration Agency | Always Qualified | April 2025 clarification |
| Investment Adviser | Follows the entity’s other SEBI registration | April 2025 clarification |
| Research Analyst | Follows the entity’s other SEBI registration | April 2025 clarification |
| Designated Depository Participant | Follows the entity’s other SEBI registration | CSCRF v1.0 |
| Debenture Trustee | Always Self-certification | CSCRF v1.0 |
| Credit Rating Agency | Always Self-certification | CSCRF v1.0 |
| Collective Investment Scheme | Always Self-certification | CSCRF v1.0 |
| Banker to an Issue or Self-Certified Syndicate Bank | Excluded from CSCRF compliance | CSCRF v1.0 |
| FPI, FVCI, LPCC, QDP, REIT, InvIT or Vault Manager | Excluded from CSCRF compliance | CSCRF v1.0 |
Four entity types are worked through in full: a stock broker, a portfolio manager, a merchant banker, an AIF or VCF manager.
What has been re-categorised since August 2024
CSCRF has been amended three times in twelve months, and the amendments replace whole criteria rather than adjusting numbers. Two entity types have been re-categorised twice. This is where most stale advice comes from.
| Entity type | What changed |
|---|---|
| Stock broker | CSCRF v1.0 categorised brokers on active UCC client base and distinguished client-based from proprietary brokers. April 2025 replaced that table outright and the proprietary/client-based split no longer exists. |
| Depository Participant | CSCRF v1.0 categorised DPs as institutional (Qualified) or non-institutional (Mid-size). April 2025 replaced that test. |
| Portfolio Manager | Re-categorised twice. CSCRF v1.0 set four bands from ₹1,000 crore; April 2025 collapsed them to two either side of ₹3,000 crore; August 2025 replaced that with the three bands above. Both earlier tables are still widely quoted. |
| Merchant Banker | Re-categorised twice. CSCRF v1.0 made conglomerate/SIFI-linked MBs Qualified REs and issue-management MBs Mid-size; April 2025 dropped the conglomerate limb; August 2025 dropped the activity limb as well. |
| Manager of an AIF or Venture Capital Fund | CSCRF v1.0 categorised each AIF on its own AUM and each VCF on its own scheme corpus, in two separate tables. April 2025 clubbed them and moved the assessment to manager level. |
| KYC Registration Agency | CSCRF v1.0 treated KRAs at par with MIIs. April 2025 re-categorised them as Qualified REs. |
| Investment Adviser | CSCRF v1.0 excluded individual IAs and made non-individual IAs Small-size REs. April 2025 replaced that with the other-registration test. |
What each category picks up
The obligations below are the ones that vary by category. Every regulated entity also complies with the standards and mandatory guidelines that apply to all of them, so this is a difference table rather than the whole framework.
| Obligation | Applies to |
|---|---|
| Cyber Capability Index | MII, Qualified |
| ISO 27001 certification | MII, Qualified |
| Cyber risk management framework | MII, Qualified, Mid-size |
| IT Committee including an external cyber security expert | MII, Qualified, Mid-size |
| Red teaming exercise | MII, Qualified |
| SOC functional efficacy measurement | MII, Qualified |
| Market SOC onboarding | Small-size, Self-certification |
| Dedicated Hardware Security Module | MII, Qualified |
The Cyber Capability Index is the one worth reading twice. It binds only MIIs and Qualified REs, and the two are assessed differently: an MII commissions a third-party assessment half-yearly, while a Qualified RE self-assesses yearly. A third-party assessment and a self-report do not carry the same evidential weight.
The deadline, and who it never moved for
The principal compliance deadline reached 31 August 2025 through two extensions — three months in March 2025, then two further months in June. Both extensions expressly carved out three classes.
- Market Infrastructure Institutions
- KYC Registration Agencies
- Qualified Registrars to an Issue and Share Transfer Agents
For those three the original date never moved at all. Note also that KRAs were themselves re-categorised in April 2025, from being treated at par with MIIs to being Qualified REs — so a KRA reading guidance written against version 1.0 is reading the wrong row.
For the wider regulatory picture, read the CSCRF compliance guide, or work out your incident-reporting deadlines with the incident reporting clock.
This tool is indicative and is not legal advice. SEBI validates the category through your reporting authority at the time of compliance submission, and the circulars state that the criteria and thresholds continue to be updated as and when required. Every instrument cited here was verified against the issuing regulator's own notification on .
Questions this page answers
- How is a SEBI CSCRF category decided?
- On quantitative thresholds that differ by entity type — registered clients and trading volume for a stock broker, assets under management for a mutual fund or portfolio manager, assets under custody for a custodian, folios serviced for an RTA. Some entity types take a fixed category instead: every active Merchant Banker is Small-size, and KYC Registration Agencies are Qualified REs. Where an entity holds several registrations, the highest category applies.
- Can a SEBI regulated entity change CSCRF category during the year?
- No. SEBI is explicit that the category is decided at the beginning of the financial year on the previous financial year’s data, and the entity remains in that category for the whole year regardless of how the parameters move during it. A firm that grows across a threshold this year inherits the heavier standard next April, so a compliance plan built on the current category has a scheduled expiry date on it.
- What was the SEBI CSCRF compliance deadline?
- 31 August 2025, reached through two extensions from the original date — three months to 30 June 2025 in March 2025, then two further months in June 2025. Both extensions expressly carved out Market Infrastructure Institutions, KYC Registration Agencies and Qualified RTAs, so for those three the original deadline never moved at all.
- Which SEBI entities are exempt from CSCRF?
- Foreign Portfolio Investors, Foreign Venture Capital Investors, Limited Purpose Clearing Corporations, Qualified Depository Participants, REITs, InvITs and Vault Managers are excluded outright. So are stock brokers below both 1,000 registered clients and ₹1,000 crore of annual clientele trading volume, RTAs servicing fewer than 10,000 folios, inactive Merchant Bankers, Investment Advisers and Research Analysts not registered in any other capacity, and Debenture Trustees with no new listed-debt issuer client in three financial years.
- Does the Cyber Capability Index apply to every SEBI regulated entity?
- No. The CCI applies only to Market Infrastructure Institutions and Qualified REs. MIIs conduct a third-party assessment half-yearly; Qualified REs self-assess yearly. Mid-size, Small-size and Self-certification REs have no CCI obligation. The distinction matters evidentially as well as operationally — a third-party assessment and a self-report carry different weight in a supervisory conversation.