The National Securities Depository Limited (NSDL) on May 12, 2026, issued circular on Facility for submission of VAPT compliance half yearly and Annual report in electronic form through e-PASS.
NSDL, through this circular, has introduced a facility for electronic submission of VAPT (Vulnerability Assessment and Penetration Testing) audit reports via its e-PASS portal. This is in continuation of earlier guidelines issued in September 2025 regarding VAPT audits, which outlined requirements such as audit timelines, auditor eligibility, and prescribed reporting formats.
Participants are now required to submit their half-yearly and annual VAPT reports online through the e-PASS portal, as per the procedure provided in Annexure A. After submitting the initial VAPT report, participants must rectify identified vulnerabilities and conduct a revalidation assessment, with compliance (closure report) to be submitted within 3 months of the initial report.
The circular also specifies strict timelines:
• Half-yearly VAPT report (Oct 2025–Mar 2026): due by June 30, with ATR (if applicable) by September 30
• Annual VAPT report (Apr 2025–Mar 2026): due by July 31, with ATR by October 31
In case of technical issues with the portal, reports may be emailed to NSDL; however, submission via e-PASS will be treated as final. Failure to submit reports within the prescribed timelines will be considered regulatory non-compliance, potentially leading to penalties or further action under NSDL Business Rules.
[Notification No. NSDL/POLICY/2026/0075]
