Sebi Considers Tech-Based Measures To Curb Unauthorised Transactions In Demat Accounts

Market regulator Securities Exchange Board of India (Sebi) proposed several technology-based measures to create a secure trading environment for investors and prevent unauthorised transactions in trading and Demat accounts in a consultation paper on February 18.

The market regulator highlighted that advancements in technology in the world of trading have also given rise to scams and fraudulent activities which involve gaining unauthorised access to trading accounts. The regulator stated that this is done by SIM spoofing to divert One-Time Passwords(OTPs) which are used to make unauthorised account modifications, erroneous transfer of shares etc.

The Sebi flagged concerns regarding the lack of measures which safeguard web-based and mobile-based trading platforms from fraudulent activities such as hacking and identity theft. To tackle the same a working group constituted by the Sebi has recommended measures such as the hard binding of SIMs with mobile devices and the use of Unique Client Codes (UCC) similar to that of UPI payment applications wherein the application recognises the SIM, mobile device and bank account details for carrying out UPI transactions.

The market regulator said that mobile devices possessing the registered mobile number(SIM) and device IMEI number shall be linked to the Unique Client Code (UCC) of the clients. The hard bind device would then become the primary SIM-bound device for the investor. Sebi said that the stock exchanges will issue a detailed procedure for such hard binding(registration) of devices. In addition to the primary device, the client will have the option to register one more SIM and device with the UCC which would become a secondary SIM-bound device.

The Sebi said that both the primary and the secondary device will be active provided that they are within a 100-meter proximity. However, investors can trade through only one of the devices at any given point in time. Further, if any of the two active devices are moved away beyond a 100-meter distance, the secondary device will be logged out automatically.

In case an investor changes or loses their primary or secondary device, the market regulator has proposed a fall back mechanism for registering a new device. Clients will be able to revoke the existing SIM/device and re-perform KYC to link a new SIM or device in such a situation.

Investors who use web-based trading applications from multiple devices such as desktops and laptops will need to authenticate their login from their primary or secondary SIM-bound device. The Sebi said that a QR code-based, proximity-sensitive and time-sensitive authentication will be done in the trading application for authorising web-based login for investors who use desktops and laptops. Notably at any point of time a single instance per channel apart from the sim-bound devices can be active.

Additionally, to prevent the unauthorised creation of trading or demat accounts the exchanges and depositories will develop a system to enable investors to ascertain and know the number of trading and demat accounts held with their PAN.

The Sebi stated that the framework of hard binding of SIM and mobile devices with the UCC will be applicable to top 10 Qualified Stock Brokers initially and they will be required to implement these provisions. Stock exchanges shall ensure that the top 10 QSBs are mandated to implement the above framework within 6 months from the date of the circular.

Initially, the hard-binding will be made optional for investors. However, the regulator plans to make the procedure mandatory in a phased manner for all investors.