The Multi-Commodity Exchange (MCX) on May 18, 2026, issued a notification regarding the submission of the VAPT Report for the FY 2025-26.
The following has been stated:
The scope of Vulnerability Assessment and Penetration Testing (VAPT) shall include all critical assets and infrastructure components, such as networking systems, security devices, servers, databases, applications, systems accessible through WAN/LAN, public IPs, and websites. The VAPT activities, to be conducted on a half-yearly or yearly basis, must strictly follow the scope and methodologies prescribed under Annexure–L of the SEBI CSCRF circular dated August 20, 2024.
Updated formats for the VAPT Audit Report/Summary, declarations from Regulated Entities (REs) and auditors, and assessment details aligned with SEBI CSCRF requirements have also been provided. Further, as clarified by SEBI through its circular dated August 28, 2025, Trading Members/REs are not required to submit detailed vulnerability findings unless specifically requested by SEBI or the Exchanges. However, they must maintain detailed VAPT reports along with proof of concepts (POCs) for a minimum period of three years and submit them whenever sought by the regulators.
For conducting VAPT and appointing auditors or auditing organizations, Trading Members/REs are required to adhere to the auditor selection norms specified under Annexure–3 and also take note of SEBI’s advisory dated May 05, 2026, regarding the use of advanced Artificial Intelligence (AI) tools for vulnerability detection. Members are additionally advised to comply with the provisions of Exchange Circular dated April 17, 2026, which outlines financial disincentives, penalties, and disciplinary actions for non-compliance in periodic VAPT submissions. The details of such actions are provided in Annexure 4.
Further, as per the Exchange circular dated September 29, 2025, NSE-registered trading members who are also registered with other Exchanges and use algorithmic software across multiple Exchanges are required to submit VAPT details only to NSE, which will share the submissions with the respective Exchanges. Members who are not registered with NSE must continue to submit the reports directly to the concerned Exchange as per the existing process. All members are advised to inform their auditors of these requirements and establish adequate systems and procedures to ensure strict compliance with the regulatory provisions.
Please refer to the document attached below for more details.
[Circular No.: MCX/TECH/294/2026]
