Sansa Law Desk

A lender taking shares as collateral is relying on an entry in a depository's records rather than on possession of a certificate. A pledge of dematerialised securities is created, cancelled and enforced by a sequence the regulations set out step by step, and the security interest exists only once the entry does. Step 1: Start From Section 12 and the Previous Approval Section 12 of the Depositories Act, 1996 permits a beneficial owner to create a pledge or hypothecation in res

Foreign portfolio investors have been living with a know your client review that comes round every year or every three years. From December 1, 2026, the FPI KYC review periodicity becomes two years or eight years, and which of the two applies turns on the category of the investor and the risk classification of its jurisdiction. What Was Issued SEBI issued Circular No. HO/19/34/14(10)2026-AFD-POD3/I/24814/2026 on October 30, 2026, titled Rationalisation of Periodicity of KYC R

A depository has been fined one crore rupees twice in just over three months. The second SEBI penalty on CDSL came on October 30, 2026, and unlike the first it has nothing to do with a cyberattack. It comes out of a routine inspection, and the findings are the kind that any market intermediary could be carrying without knowing it. What Was Decided The Securities and Exchange Board of India imposed a penalty of one crore rupees on Central Depository Services (India) Limited. T

Compounding is the route by which a foreign exchange contravention is closed by paying a sum rather than by fighting an adjudication. An application for compounding of a FEMA contravention succeeds or fails largely on preparation, because a great deal of what the Reserve Bank requires has to be done before the application is filed at all. Step 1: Confirm the Contravention Is One That Can Be Compounded Section 15 of the Foreign Exchange Management Act, 1999 permits any contrav

Applicants settling a foreign exchange contravention now have to think about geography before they think about anything else. The Reserve Bank has moved FEMA compounding for three large categories of transaction out of its Central Office and into named Regional Offices, and the receiving office is now fixed by a rule rather than chosen. What Was Issued A.P. (DIR Series) Circular No. 28/2026-27, referenced RBI/FED/2026-27/298, was issued on October 23, 2026 and is addressed to

The Ministry of Corporate Affairs has moved the dates for this year's annual filings. The MCA annual filing extension gives companies until the end of December for the financial statements and the end of January for the annual return. It relaxes the additional fee and it relaxes nothing else. What Was Issued General Circular No. 05/2026 was issued on October 24, 2026, under File No. Policy-17/111/2022-CL-V-MCA. The stated reason is representations from stakeholders asking for

The Securities and Exchange Board of India has relaxed one of the record keeping obligations that research analysts have found hardest to operate. From November 8, 2026, call recording optional for research analysts is the position for interactions with institutional investor clients, and the relaxation is narrower than the headline suggests. What Was Issued SEBI issued circular HO/38/11/(9)2026-MIRSD-POD/I/24272/2026 on October 23, 2026. It revises the Master Circular for Re

Aadhaar records are closed by statute, and the statute names exactly two ways in. For a litigant or an investigating agency, the one that matters is the court route, and a disclosure of Aadhaar information obtained that way has to satisfy a forum requirement and two provisos before it is ordered at all. Step 1: Start From the Restrictions, Not From the Exception Section 28 of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 dea

A single Judge of the Kerala High Court has ordered the Unique Identification Authority of India to compare fingerprints against the Aadhaar database for a criminal investigation. The order was made on October 14, 2026, and the way it is confined is as important as what it permits. The Order In W.P.(Crl.) No. 639 of 2024, reported as 2026:KER:78637, Mr Justice G. Girish allowed a petition by the State of Kerala, represented by the Deputy Superintendent of Police, Crime Branch

A lender that wants to find out what a defaulting borrower owns does not have to ask the borrower's permission. The loan default exemption in clause (f) of sub-section (1) of section 17 of the Digital Personal Data Protection Act, 2023 says so, and it says it in terms narrow enough that the limits matter as much as the permission. Step 1: Fix the Commencement Position Section 17 comes into force eighteen months after publication of commencement notification G.S.R. 843(E) date

The question whether the Digital Personal Data Protection Act, 2023 spares journalism is answered by reading one section and finding out what is not in it. An exemption in the DPDP Act has to be located in a limb of section 17, the limbs are a closed list, and the method for answering any exemption question is the same: find the limb, or conclude there is none. Step 1: Fix the Commencement Position Section 17 comes into force eighteen months after publication of commencement

On October 27, 2026 the Supreme Court issued notice to the Central Government on a writ petition by the Digital News Publishers Association challenging provisions of the Digital Personal Data Protection Act, 2023. The Digital News Publishers challenge to the DPDP Act is now listed for November 17, 2026, and what the Court did on the first day is worth separating carefully from what was argued. What the Court Actually Ordered The Bench of the Chief Justice of India Surya Kant

A data principal who complains to the Board, and whose complaint ends in a penalty, receives none of it. Section 34 of the Digital Personal Data Protection Act, 2023 says where the money goes, and the answer disposes of a misconception that a DPDP penalty is a remedy for the individual whose data was mishandled. Step 1: Fix the Commencement Position Section 33 and section 34 make up Chapter VIII of the Act, and that Chapter comes into force eighteen months after publication o

A bank that discovers an intrusion has more than one reporting obligation and they do not run to the same body, on the same form or on the same clock. To report a cyber incident to the RBI is to work to a threshold, a format and a timing of its own, all of them set out in a circular that has been in force for a decade. Step 1: Identify the Instrument and Whether It Applies The requirement sits in Reserve Bank of India circular RBI/2015-16/418, bearing reference DBS.CO/CSITE/B

Two days after telling the stock exchanges about a cyberattack, the State Bank of India told its customers. The bank's statement that it has individually informed every customer whose data was identified as being involved was made on October 23, 2026 through its own channels rather than by a further exchange filing, and the difference between the two communications is the part worth noting. What the Bank Said The bank said that it had individually informed all customers whose