CSCRF category for a merchant banker
Work out your CSCRF category from the current thresholds, across every SEBI regulated entity type, with the obligations each category picks up and the amendments that changed the criteria.
What this case turns on
Merchant Bankers now have the simplest rule in CSCRF and the most amended one. Version 1.0 made conglomerate and SIFI-linked MBs Qualified REs and issue-management MBs Mid-size. April 2025 dropped the conglomerate limb. August 2025 dropped the activity limb too. Every active merchant banker is a Small-size RE, and an inactive one is exempt outright.
Merchant Banker: always a Small-size RE, with no threshold to calculate. Every active Merchant Banker — one that has undertaken any merchant banking activity in the relevant period — is a Small-size RE. Category no longer depends on issue-management activity or on being part of a conglomerate.
Carve-out. Inactive Merchant Bankers, meaning those that have undertaken no merchant banking activity in the relevant review period, are exempt from CSCRF.
Changed since CSCRF v1.0. Re-categorised twice. CSCRF v1.0 made conglomerate/SIFI-linked MBs Qualified REs and issue-management MBs Mid-size; April 2025 dropped the conglomerate limb; August 2025 dropped the activity limb as well.
Work out your own category
The tool below opens on this entity type. Enter your own figure to see which band you fall in and what that category obliges you to do.
Every active Merchant Banker — one that has undertaken any merchant banking activity in the relevant period — is a Small-size RE. Category no longer depends on issue-management activity or on being part of a conglomerate.
Carve-out. Inactive Merchant Bankers, meaning those that have undertaken no merchant banking activity in the relevant review period, are exempt from CSCRF.
Changed since CSCRF v1.0. Re-categorised twice. CSCRF v1.0 made conglomerate/SIFI-linked MBs Qualified REs and issue-management MBs Mid-size; April 2025 dropped the conglomerate limb; August 2025 dropped the activity limb as well.
What this category picks up
- Market SOC onboarding. Small-size and Self-certification REs are mandated to onboard to the Market SOC operated by BSE and NSE. Several narrow carve-outs apply below 100 clients — see the entity note.
What it does not
- Cyber Capability Index
- ISO 27001 certification
- Cyber risk management framework
- IT Committee including an external cyber security expert
- Red teaming exercise
- SOC functional efficacy measurement
- Dedicated Hardware Security Module
These are the obligations that vary by category. Every RE also complies with the standards and mandatory guidelines that apply to all of them — this is not the whole framework.
Indicative, and not legal advice. SEBI validates the category at the time of compliance submission through your reporting authority, and the thresholds are updated as and when required.
Take this away as an obligation checklist
Everything above is yours already. This is the version you can put in front of your team — the same result with your details on it, the owner columns your incident file needs, and the checklist attached. It opens here and lands in your inbox, so it is to hand when you actually need it rather than in a tab you closed.
For every other entity type, the amendment history, and the obligations each category picks up, see the full CSCRF category finder.
This page is indicative and is not legal advice. SEBI validates the category through your reporting authority at the time of compliance submission. Every instrument cited here was verified against the issuing regulator's own notification on .
Questions this page answers
- How is a SEBI CSCRF category decided?
- On quantitative thresholds that differ by entity type — registered clients and trading volume for a stock broker, assets under management for a mutual fund or portfolio manager, assets under custody for a custodian, folios serviced for an RTA. Some entity types take a fixed category instead: every active Merchant Banker is Small-size, and KYC Registration Agencies are Qualified REs. Where an entity holds several registrations, the highest category applies.
- Can a SEBI regulated entity change CSCRF category during the year?
- No. SEBI is explicit that the category is decided at the beginning of the financial year on the previous financial year’s data, and the entity remains in that category for the whole year regardless of how the parameters move during it. A firm that grows across a threshold this year inherits the heavier standard next April, so a compliance plan built on the current category has a scheduled expiry date on it.
- What was the SEBI CSCRF compliance deadline?
- 31 August 2025, reached through two extensions from the original date — three months to 30 June 2025 in March 2025, then two further months in June 2025. Both extensions expressly carved out Market Infrastructure Institutions, KYC Registration Agencies and Qualified RTAs, so for those three the original deadline never moved at all.
- Which SEBI entities are exempt from CSCRF?
- Foreign Portfolio Investors, Foreign Venture Capital Investors, Limited Purpose Clearing Corporations, Qualified Depository Participants, REITs, InvITs and Vault Managers are excluded outright. So are stock brokers below both 1,000 registered clients and ₹1,000 crore of annual clientele trading volume, RTAs servicing fewer than 10,000 folios, inactive Merchant Bankers, Investment Advisers and Research Analysts not registered in any other capacity, and Debenture Trustees with no new listed-debt issuer client in three financial years.
- Does the Cyber Capability Index apply to every SEBI regulated entity?
- No. The CCI applies only to Market Infrastructure Institutions and Qualified REs. MIIs conduct a third-party assessment half-yearly; Qualified REs self-assess yearly. Mid-size, Small-size and Self-certification REs have no CCI obligation. The distinction matters evidentially as well as operationally — a third-party assessment and a self-report carry different weight in a supervisory conversation.