The Central Depository Services (India) Limited (CDSL), on September 18, 2026, has issued instructions to Depository Participants (DPs) regarding submission of compliance on the closure of observations identified during the Cyber Audit. The instructions are in continuation of CDSL Communiqués dated May 22, 2026 and June 12, 2026 concerning submission of Cyber Audit Reports.
Any observation raised by the auditor during the Cyber Audit is required to be remediated immediately and certified by the auditor. Compliance regarding closure of the identified findings must be submitted to CDSL within three months from the due date for submission of the Cyber Audit Report. For the Cyber Audit period October 2025 to March 2026, DPs are required to submit the closure compliance on or before September 30, 2026, using the User Manual provided as Annexure A.
Failure to complete the submission within the prescribed timeline will be treated as non-compliance, and the applicable penalty will be imposed in accordance with CDSL Communiqué CDSL/AUDIT/DP/POLCY/2025/105 dated February 12, 2025. DPs are therefore required to ensure timely remediation, auditor certification and submission of closure compliance.
[CDSL/IS/DP/POLCY/2026/646]
