Tool 2

CSCRF category for a portfolio manager

Work out your CSCRF category from the current thresholds, across every SEBI regulated entity type, with the obligations each category picks up and the amendments that changed the criteria.

In short
SEBI CSCRF sorts regulated entities into five categories — MII, Qualified, Mid-size, Small-size and Self-certification — on quantitative thresholds that differ by entity type. The category is fixed at the start of the financial year on the previous year’s data and held all year. Stock brokers, Portfolio Managers, Merchant Bankers, KRAs, AIF and VCF managers and Depository Participants have all been re-categorised since August 2024.

What this case turns on

Portfolio Managers have been re-categorised twice. CSCRF v1.0 set four bands from ₹1,000 crore; the April 2025 clarification collapsed them to two either side of ₹3,000 crore; the August 2025 technical clarification replaced that again with three bands topping out at Mid-size. Both superseded tables are still widely quoted. No Portfolio Manager is a Qualified RE under any version.

CategoryThreshold
Self-certification₹3,000 crore and below
Small-sizeMore than ₹3,000 crore and less than ₹10,000 crore
Mid-size₹10,000 crore and above
Assets under management

Carve-out. A Portfolio Manager in the self-certification band with fewer than 100 clients is exempt from the mandatory Market SOC requirement.

Changed since CSCRF v1.0. Re-categorised twice. CSCRF v1.0 set four bands from ₹1,000 crore; April 2025 collapsed them to two either side of ₹3,000 crore; August 2025 replaced that with the three bands above. Both earlier tables are still widely quoted.

Work out your own category

The tool below opens on this entity type. Enter your own figure to see which band you fall in and what that category obliges you to do.

Your registration
Enter a figure to see your category

No Portfolio Manager is a Qualified RE — the top band is Mid-size.

Assets under management
CategoryThreshold
Self-certification₹3,000 crore and below
Small-sizeMore than ₹3,000 crore and less than ₹10,000 crore
Mid-size₹10,000 crore and above

Carve-out. A Portfolio Manager in the self-certification band with fewer than 100 clients is exempt from the mandatory Market SOC requirement.

Changed since CSCRF v1.0. Re-categorised twice. CSCRF v1.0 set four bands from ₹1,000 crore; April 2025 collapsed them to two either side of ₹3,000 crore; August 2025 replaced that with the three bands above. Both earlier tables are still widely quoted.

Indicative, and not legal advice. SEBI validates the category at the time of compliance submission through your reporting authority, and the thresholds are updated as and when required.

For every other entity type, the amendment history, and the obligations each category picks up, see the full CSCRF category finder.

This page is indicative and is not legal advice. SEBI validates the category through your reporting authority at the time of compliance submission. Every instrument cited here was verified against the issuing regulator's own notification on .

Questions this page answers

How is a SEBI CSCRF category decided?
On quantitative thresholds that differ by entity type — registered clients and trading volume for a stock broker, assets under management for a mutual fund or portfolio manager, assets under custody for a custodian, folios serviced for an RTA. Some entity types take a fixed category instead: every active Merchant Banker is Small-size, and KYC Registration Agencies are Qualified REs. Where an entity holds several registrations, the highest category applies.
Can a SEBI regulated entity change CSCRF category during the year?
No. SEBI is explicit that the category is decided at the beginning of the financial year on the previous financial year’s data, and the entity remains in that category for the whole year regardless of how the parameters move during it. A firm that grows across a threshold this year inherits the heavier standard next April, so a compliance plan built on the current category has a scheduled expiry date on it.
What was the SEBI CSCRF compliance deadline?
31 August 2025, reached through two extensions from the original date — three months to 30 June 2025 in March 2025, then two further months in June 2025. Both extensions expressly carved out Market Infrastructure Institutions, KYC Registration Agencies and Qualified RTAs, so for those three the original deadline never moved at all.
Which SEBI entities are exempt from CSCRF?
Foreign Portfolio Investors, Foreign Venture Capital Investors, Limited Purpose Clearing Corporations, Qualified Depository Participants, REITs, InvITs and Vault Managers are excluded outright. So are stock brokers below both 1,000 registered clients and ₹1,000 crore of annual clientele trading volume, RTAs servicing fewer than 10,000 folios, inactive Merchant Bankers, Investment Advisers and Research Analysts not registered in any other capacity, and Debenture Trustees with no new listed-debt issuer client in three financial years.
Does the Cyber Capability Index apply to every SEBI regulated entity?
No. The CCI applies only to Market Infrastructure Institutions and Qualified REs. MIIs conduct a third-party assessment half-yearly; Qualified REs self-assess yearly. Mid-size, Small-size and Self-certification REs have no CCI obligation. The distinction matters evidentially as well as operationally — a third-party assessment and a self-report carry different weight in a supervisory conversation.

This tool is one skill out of sixteen.

What runs on this page is the browser-sized version of regmap, a skill in BitScoreCoWork — our MIT-licensed Claude plugin. The full version runs against your own Bitsight tenancy and works from your measured attack surface rather than a form. The source is public, so you can read exactly what it does before you run it.

Read the source The Applied AI practice

Knowing the rule is the easy half.

This page tells you what you owe. It cannot tell you what an attacker already sees. Your organisation has a security rating calculated from signals visible from outside — request the complimentary Cyber Risk Rating Report and find out what it says. No agent, no system access, no questionnaire.

Request my rating All free tools