The curious case of definition and adjudication of front running in India

by Natasha Aggarwal, Amol Kulkarni and Bhavin Patel.

One of the core legislative mandates of the Securities and Exchange Board of India (SEBI) is to prohibit fraudulent and unfair trade practices (FUTP) relating to securities markets. A practice commonly classified as FUTP is front running. It is generally understood as a set of two trades or positions: first, a trade or position taken in advance of a large order, and second, a squaring off of the initial trade or position after the large order, to benefit from the price movement it causes.

SEBI issued the SEBI (Prohibition of Fraudulent and Unfair Trade Practices Relating to Securities Market) Regulations, 2003 (the PFUTP Regulations) to deter and sanction front running and other FUTPs.

Neither the SEBI Act nor the PFUTP Regulations define front running. SEBI has, however, defined it elsewhere: in guidelines, glossaries, master circulars and consultation papers, and in a number of adjudicatory orders.

In our working paper, Front running: The law and enforcement of an ill-defined violation, we set out the legal elements that a violation under the PFUTP Regulations requires: fraud, manipulation and unfair trade practice. These elements should inform any definition of front running. We find that the characteristics of front running laid down by SEBI in its other regulatory instruments and adjudicatory orders are inconsistent with these legal requirements.

Through an empirical study of 33 SEBI adjudicatory orders on front running between 2019 and 2024, we show that SEBI's enforcement practice is also disconnected from the codified law, and does not engage with its key requirements.

This proliferation of inconsistent definitions and interpretations causes a range of problems:

• It creates confusion, and weakens the certainty and predictability of the law.
• It gives the regulator untrammelled discretion in deciding whether a violation has taken place.
• It raises concerns about separation of powers: the boundary between the regulator's law-making and adjudicatory functions is erased and re-drawn erratically, at cost to the integrity of each function.

The result is a lack of doctrinal clarity about what front running means, and a set of conflicting articulations of the violation with no clear grounding in the codified law.

We suggest that the term be defined clearly, either in the parent statute or in the PFUTP Regulations. There is now a nearly three-decade history of enforcement, which should be enough to identify the ingredients of this violation.

The Securities Markets Code Bill, 2025 (the SMC) is an opportunity to write such a definition into the parent law. This would take the power to define the violation away from the regulator, restore the integrity of SEBI's separate functions, and meet the requirements of separation of powers. In its present form, though, the SMC may fall short: we show the gaps and confusions that remain in its treatment of fraud, and its failure to define fraudulent or unfair trade practice, or front running, explicitly.

Part of the problem may lie in the absence of separation of powers within SEBI. The regulator can write subordinate legislation, investigate alleged violations, and adjudicate and sanction them, all without a strict separation between its quasi-legislative, investigative and adjudicatory arms.

This may incentivise SEBI to write broad, all-encompassing regulations in its quasi-legislative capacity, and then to widen their scope further to suit its quasi-judicial needs.

The regulator might defend this by pointing to the constantly changing methods used by fraudsters. International experience suggests otherwise: methods change, but the key constituents of securities fraud stay broadly constant.

In India, a lasting solution may require Parliament, not SEBI acting under its delegated powers, to define terms such as front running in the parent legislation.

Front running is only one example of an inconsistently defined and adjudicated practice within the broader category of FUTP. There are likely others. This points to the need for a wider review of how fraud, manipulation and unfair trade practice are defined and adjudicated under Indian securities law, with the aim of achieving consistency and certainty in interpretation and enforcement.

References

Front running: The law and enforcement of an ill-defined violation, TrustBridge working paper.

SEBI (Prohibition of Fraudulent and Unfair Trade Practices Relating to Securities Market) Regulations, 2003, Securities and Exchange Board of India.

Securities Markets Code Bill, 2025, Bill No. 200 of 2025.

Natasha Aggarwal, Amol Kulkarni and Bhavin Patel are researchers at TrustBridge Rule of Law Foundation.

Market Reaction to Insider Trading: Evidence from Regulatory Orders in India

by Arjun Gupta, Sonam Patel, and Renuka Sane.

Introduction

Market integrity depends on effective enforcement against market abuse. When regulators credibly sanction violations, they reinforce investor confidence and reduce the risk premiums that markets impose for uncertain governance. In developed markets, evidence suggests that enforcement achieves this objective: SEC enforcement actions in the United States produce abnormal stock price declines of $-0.5\%$ (Persons, 1997), and UK sanctions trigger reputational losses that far exceed the direct penalties (Armour et al., 2017). This is especially true for insider trading enforcement: Persons (1997) documents significant negative abnormal returns following the SEC's announcements of insider trading enforcement actions. (Engelen, 2012) finds that a clear negative abnormal return on the day of even newspaper coverage of the illegal insider trading practice of CEOs.

An open question, however, is whether this pattern extends to India. We investigate this by examining stock price movements around two types of insider trading enforcement actions in India: final SEBI adjudicatory orders and appellate decisions by the Securities Appellate Tribunal (SAT). We focus on insider trading orders as they can be a signal about the quality of the firm's internal governance. If insiders are trading on privileged information, it suggests that boards, compliance functions, and internal controls are weak, leading to investors discounting the stock accordingly. Further, when the firm and its executives face potential penalties, disgorgement, or other sanctions, these can impose direct costs on the firm and may affect its ability to attract capital and talent. The insider trading laws in India are quite expansive, and cover not only connected persons, but also those who just have access to unpublished price sensitive information, or if there have been some minor disclosure violations. All orders, therefore, may not signal governance issues within a firm. We therefore also look at orders by violation severity and type of insider relationship.

Empirical Strategy

We use an event-study methodology to test whether Indian stock markets react to SEBI enforcement actions and outcomes challenged before SAT. We compile a list of individuals and entities against whom an insider-trading order was issued, then identify the companies whose scrip was alleged to have been insider traded, map them to their corresponding order dates (event dates), and use these firm-event pairs to check for market reaction.

Estimation Procedure

We estimate each firm's normal return using the market model over an estimation window of 210 trading days ending 11 days before the event ($t = -210$ to $t = -11$):

\( R_{it} = \alpha_i + \beta_i R_{mt} + \varepsilon_{it} \)

where $R_{it}$ is the daily return of stock $i$ on day $t$ and $R_{mt}$ is the daily return on the Nifty~50 Index. The Abnormal Return (AR) on event day $t$ is the difference between the actual return and the predicted normal return:

\( AR_{it} = R_{it} - \left(\hat{\alpha}_i + \hat{\beta}_i R_{mt}\right) \)

Cumulative Abnormal Returns (CARs) are computed by summing $AR_{it}$ over a 21-day event window centred on the insider trading announcement date:

\( CAR_i = \sum_{t=-10}^{+10} AR_{it} \)

We test whether the cross-sectional average $\overline{CAR}$ is statistically different from zero using a $t$-test; a negative $\overline{CAR}$ indicates an adverse market reaction to the announcement.

Data and Sample

Our sample is drawn from the data set used by Aggarwal et al., (2025). It comprises two types of regulatory actions from 2009 to 2023, restricted to firms listed on the National Stock Exchange (NSE). After removing duplicates and cases with missing stock price data, our final sample contains:

1. SEBI Orders: Final adjudicatory orders; $N = 176$ firm-event pairs.
2. SAT Orders: Appellate Tribunal decisions; $N = 42$ firm-event pairs.

We further look for heterogeneity in market reactions by partitioning the sample along four dimensions of interest:

• Sanction status: Sanctioned ($N = 119$) vs. not sanctioned ($N = 57$). An order may or may not result in a sanction. Here, we examine a reaction based on whether an order resulted in a sanction.

• Violation severity: Major violations ($N = 74$) vs. minor violations ($N = 122$). We classify insider trading violations as Major (e.g., sharing or using unpublished price information for trading) or Minor (e.g., code-of-conduct breaches, delayed disclosures).

• Insider relationship: Connected persons ($N = 44$), deemed connected ($N = 21$), and those with access to UPSI ($N = 19$). Connected persons are loosely defined as those associated with a company (contractual, fiduciary, or employment), while those deemed to be connected persons include their relatives or cohabitants. UPSI access refers to knowledge of information materially impacting the stock price.

• Monetary outflow: Above-median ($N = 59$) vs. at-or-below-median ($N = 60$) alleged illegal gains. Monetary outflow is the total penalty and disgorgement paid to SEBI. We analyze market reaction based on the magnitude of this outflow to see if the amount paid affects the reaction.

Results

Baseline Event-Study Findings

Our event-study results indicate that Indian stock markets exhibit no statistically significant reaction to any type of insider trading enforcement announcement. CARs are indistinguishable from zero across all two regulatory action types at the 95% confidence level, with point estimates close to zero in magnitude. For comparison, SEC insider trading enforcement actions in the US produce average CARs of $-3.47\%$ (Muradoglu and Clark Huskey, 2008).

Figures display the CAR trajectories. In all two cases, the CARs fluctuate around zero with no discernible trend before, during, or after the announcement date.

Cumulative Abnormal Returns (CARs) around SEBI final order announcements ($N = 176$). The shaded region represents the 95% confidence interval.

The result for SEBI final orders is striking: these orders contain explicit findings of misconduct and penalties, yet markets do not react. We discuss four candidate explanations below: high appeal and reversal rates, long enforcement delays, low penalty amounts, and pre-existing credibility discount.

Cumulative Abnormal Returns (CARs) around SAT order announcements ($N = 42$). The shaded region represents the 95% confidence interval.

SAT orders, on the other hand, are more final in nature. They may affirm, modify, or overturn SEBI sanctions, and should lead to a market reaction. In our dataset, they also produce no detectable market reaction. However, this result should be interpreted with caution, given the small sample size. With only 42 events, our test has limited statistical power to detect abnormal returns. It is possible that these may be further appealed at the Supreme Court, but given the small sample size, we do not test for the impact of those decisions.

Subsample Analysis

We examine whether the aggregate result masks heterogeneous effects by partitioning the sample along the four dimensions described above. Across all subsample splits, CARs remain statistically and economically insignificant. Even for high-severity cases, directors trading on confidential information, monetary outflows above the median of Rs.~12.83 lakh, and third quartile of Rs.~5.27 crore, abnormal returns remain proximate to zero. Also, there is no evidence of a significant market reaction even in the subsample of cases where the insider relationship is more direct (connected persons). This suggests the null result is not an artefact of averaging across heterogeneous effects; rather, it is pervasive across subgroups.

One caveat to our analysis is if the true information release occurred earlier (e.g., via media leaks), our tests measure the reaction to information from informal sources rather than to the announcement itself.

Interpreting the results

One interpretation of this result is that markets may rationally discount the significance of SEBI enforcement actions. Several institutional features of Indian capital markets lend support to this interpretation:

1. High appeal and reversal rates: Aggarwal et al., (2025) find that a substantial fraction of SEBI orders (30-41%) are appealed to SAT, and around 50% result in modifications or reversals. Investors who have learned that sanctions are frequently overturned will rationally discount any announced penalty. This is probably compounded by the fact that several SEBI orders are not able to demonstrate the unfair gains or loss avoided, or provide reasons for imposing sanctions as debarment, reducing the credibility of its enforcement actions (Aggarwal et al., 2024).
2. Long enforcement delays: Damle and Zaveri (2022) find a median of over three years between violation and SCN, and a further 18 months to a final order. This is reinforced by the findings of Aggarwal et al., (2025), who find similar timelines for insider trading orders. By the time enforcement is announced, investors may have already moved on.
3. Low penalty amounts: The median penalty is Rs 12.83 lakhs, with approximately 40 cases involving amounts under Rs 10 lakhs. Such low penalties suggest a lower perceived severity of the offense, and consequently signal the market to treat this news as immaterial.
4. Pre-existing credibility discount: If years of weak or delayed sanctions have already led investors to assign a low probability to effective enforcement, individual announcements convey little new information, and markets have stopped paying attention.

Another possibility is that markets receive the enforcement information but do not regard insider trading as material to firm valuation. Under this view, it reflects an investor judgment that insider trading by management is not indicative of broader governance failure or future cash-flow risk.

Conclusion

Indian stock markets exhibit no statistically significant response to insider trading enforcement, in contrast to the negative abnormal returns documented in the US and UK. This result is robust across SEBI final orders and SAT appellate decisions, and persists even for high-severity violations involving senior insiders and large monetary outflows.

The functioning of SEBI entails considerable public expenditure, and the Board has, over time, sought progressively wider powers - including expanded surveillance capabilities. Given this, the question of what is actually being achieved warrants serious scrutiny. A stock price reaction to an enforcement order is one observable signal of whether the market believes the enforcement actions carry some significance. A null result across many orders suggests the market does not view these actions as conveying meaningful new information. It is, therefore, worth questioning if enforcement actions are advancing the goal that justified the expenditure in the first place.

The authors are researchers at Trustbridge Rule of Law Foundation.

Comments on the Securities Market Code Bill, 2025

by Natasha Aggarwal, Pratik Datta, K. P. Krishnan, Bhavin Patel, M. S. Sahoo, Renuka Sane, Ajay Shah and Bhargavi Zaveri-Shah.

Finance is the brain of the economy. It dictates allocative efficiency. The financial system chooses which industries and firms receive capital. This efficiency determines the extent to which investment translates into GDP growth. Getting finance right is critical. The prioritisation of financial reform must be absolute.

The Securities Market Code Bill, 2025 (SMC) marks a substantial advance over the existing Securities and Exchange Board of India Act, 1992, particularly in strengthening governance arrangements and formalising the processes of regulation-making. Importantly, it makes a serious attempt to end the ''circular raj'' by confining the issuance of subsidiary instruments to the Chairperson or senior members of the Board, rather than dispersed internal authorities. Further, it has introduced timelines for investigations and attempted to separate the investigation function from the adjudication function, making the first effort towards a clearer separation of powers. That said, the SMC can make further strides if it focuses on the issues described below.

We now address the issues in relation to specific provisions drafted within the current SMC.

Separation of powers

The SMC raises three related concerns, which demonstrate a concentration of powers at SEBI.

Issue 1: Excessive delegation of essential legislative functions

Clause 96 prescribes imprisonment, a fine, or both as penalties for market abuse (an offence defined under Clause 93). However, Clause 93 also grants the regulatory authority to define new offences within the 'market abuse' category, which would carry the same criminal sanctions. This raises concerns around excessive delegation: the identification of criminal offences is a core legislative function and cannot be delegated. Moreover, such excessive delegation is subject to being struck down in judicial review.

Issue 2: Regulation-making on adjudication

Clause 146(2)(j), read with Clause 17(4), permits SEBI to make regulations on the manner of conducting adjudication proceedings. This should not be done by SEBI itself. SEBI is the agent, and the Parliament is the principal. The Parliament must define the checks and balances on the coercive power of the agent. Otherwise, the agent always has incentives to appropriate more arbitrary power.

Issue 3: Ineffective separation of investigative and adjudicatory functions

Clauses 17 and 27 introduce limited separation of investigative and adjudicatory functions for specific matters. Investigation is an executive function, and adjudication is a quasi-judicial function. A conflation of these two functions in the same individual raises concerns about the separation of powers.

In summary, there is no clear separation of power between the three functions of the regulator. The same regulator is empowered to define the scope of violations and offences, investigate them, enforce them, adjudicate upon them, and impose sanctions for their violations, all under regulations of its own design. This combination blurs the distinction between legislative, executive, and adjudicatory functions and concentrates powers in the same persons.

Proposal:

Remove Clauses 17(4), 92(f), 93(g), and 146(2)(j) from the SMC. Implement strong structural separation between the investigative and adjudicatory functions. One way to do this is to create a distinct career track for adjudicatory officers as Administrative Law Officers (ALO). One SEBI board member should also be designated as an Administrative Law Member, who oversees the functions of ALOs. These officers should be solely responsible for adjudication and must have no involvement in investigative or quasi-legislative functions. Introduce extraordinary safeguards to mandate arm's length operation between investigation and adjudication.

Timelines for investigation and adjudication

Issue: Clauses 13, 16, and 27 introduce timelines for investigation and interim orders. However, provisos allow these timelines to be extended (Clause 27(4), proviso to Clause 13(2)). Additionally, the SMC specifies no timelines for the completion of adjudication proceedings. This allows investigations and adjudications to continue indefinitely, rendering the statutory limits ineffective.

Proposal: Remove the power to extend timelines for investigation. If extensions are retained, mandate the publication of written reasons, subject to mandatory review by the SEBI governing board. Introduce a strict statutory timeline for the conclusion of adjudicatory proceedings. These timelines should be part of the Parliament-specified regulations on the manner of conducting adjudication proceedings that we recommend in our preceding suggestions.

Methodology for calculating unlawful gains

Issue: The SMC requires the determination of unlawful gains by an investigating officer under Clause 13(3), but provides no calculation methodology. This virtually guarantees arbitrary and inconsistent determinations. It defeats the rule of law.

Proposal: Codify standard methods or guidelines for calculating unlawful gains within the SMC. Operationalise these through detailed regulations. Reference the Competition Commission of India (Determination of Monetary Penalty) Guidelines, 2024, as a baseline.

Sanction determination factors

Issue: The SMC lists factors for adjudicating officers to consider while imposing sanctions. Some mirror Section 15J of the SEBI Act, which are unimplementable in practice. Terms like 'impact of the default or contravention on the integrity of the securities markets' (Clause 19(b)(v)) lack precision and invite arbitrariness.

Proposal: Base sanctions strictly on the quantifiable extent of harm caused to specific persons. Codify this methodology. Alternatively, publish binding guidelines detailing specific aggravating and mitigating factors, expanding upon the approach in the SEBI (Settlement Proceedings) Regulations 2018.

Criminal enforcement

Issue: The SMC retains criminal liability, including imprisonment, for some offences. Establishing guilt in Indian criminal law requires proof beyond a reasonable doubt, typically coupled with the requirement to establish intention. This is an inefficient tool for complex financial markets. The boundary between aggressive trading and market manipulation is thin. The threat of criminal sanctions deters contrarian strategies. This reduces market liquidity and harms price discovery. Traditional fraud is adequately covered by the Bharatiya Nyaya Sanhita.

Proposal: Remove all criminal liabilities. Structure sanctions as punitive civil penalties or restorative remedies, scaling to a multiple of the illicit gains. Retain debarment for systemic misconduct.

Power to issue directions

Issue: Clause 23 vests SEBI with open-ended direction-making powers. Moreover, the requirement to record reasons in writing (currently included in Section 11(4) of the SEBI Act) has not been included in Clause 23.

Proposal: Delete Clause 23. Confine non-penal measures to specific, narrowly defined statutory triggers (e.g., immediate asset freezing powers under strict procedural safeguards). All adjudicatory actions must be justified by reasons in writing.

Nominee directors on the SEBI board

Issue: The SMC retains government nominee directors on the SEBI board. Nominee directors prioritise the perspective of their parent departments over market efficiency. They exercise disproportionate influence. Inter-agency coordination should not occur via board representation.

Proposal: Appoint mid-career professionals for fixed terms until a mandatory retirement age. Bind them statutorily to SEBI's specific objectives. Address inter-agency concerns externally through the Financial Stability and Development Council (FSDC).

Commodities markets

Issue: Clause 49 empowers the government to determine commodities eligible for trading. The market must decide which commodities warrant hedging instruments. State determination of eligible commodities is equivalent to the government deciding which firm is permitted to issue equity.

Proposal: Delete Clause 49. Empower SEBI to draft regulations defining objective eligibility criteria for commodity derivatives, identical to the framework for eligible scrips.

Ombudsperson

Issue: Clause 73 empowers SEBI to designate an Ombudsperson. This creates a conflict of interest. The SMC lacks an appeals mechanism for decisions made by the Ombudsperson.

Proposal: Mandate statutory independence for the Ombudsperson. Ensure job security separate from SEBI management. Define a clear appellate process.

Exemptions for PSUs

Issue: Clause 65(2) empowers the Central Government to exempt listed public sector companies from listing and disclosure requirements. This violates Article 14 of the Constitution. State-owned enterprises must face the identical market discipline applied to private enterprises.

Proposal: Delete Clause 65(2). Mandate equal treatment for all market participants.

References

Natasha Aggarwal and others, "'Balancing Power and Accountability: An Evaluation of SEBI's Adjudication of Insider Trading'" (Working Papers, TrustBridge Rule of Law Foundation, 2025).

In Re: The Delhi Laws Act, 1912 (AIR 1951 SC 332).

M S Sahoo and V Anantha Nageswaran, 'Regulatory architecture 2.0: Securities Markets Code marks a decisive shift' (Business Standard, 25 December 2025).

M.S. Sahoo and Sumit Agrawal, "Reimagining SEBI's Consent Settlement Framework" (Chartered Secretary, January 2026).

C.K. Takwani, Lectures on Administrative Law (7th edition, 2023) at page 100.

Bhargavi Zaveri-Shah, 'SEBI does not need unlimited powers – here's what's wrong with the Securities Markets Code' (ThePrint, 5 January 2026).

Bhargavi Zaveri-Shah and Harsh Vardhan, 'Ghost of the Commodities Controller—why India's new financial law feels like the 1970s' (ThePrint, 19 January 2026).

Beyond Syndication: Unlocking the Power of Single-Asset Securitisation

by Amrita Agarwal and Harsh Vardhan.

An overlooked yet transformative pillar of India’s evolving securitisation framework is the newfound empowerment of lenders to undertake the securitisation of a single, standard asset (Master Direction – Reserve Bank of India (Securitisation of Standard Assets) Directions, 2021. RBI/DOR/2021-22/85, September 24, 2021). To appreciate the magnitude of this shift, one must first look at the historical contours of the Indian market. Traditionally, securitisation has been synonymous with "pass-through certificates" (PTCs) backed by granular pools of consumer debt—typically vehicle and personal loans or microfinance receivables. The market has also frequently, if somewhat inaccurately, applied the term to "direct assignments," where loan portfolios are sold outright between lenders.

Indian securitisation has long been a predictable, if somewhat narrow, affair. Historically, the market has been the domain of "pass-through certificates" (PTCs)—complex bundles of granular consumer debt, ranging from tractor loans in Punjab to microfinance receivables in Tamil Nadu. The logic was simple: there is safety in numbers. By pooling thousands of small loans, lenders could hedge against individual defaults, creating a diversified product for investors.

In September 2021, the Reserve Bank of India (RBI) issued a comprehensive new framework. The impact on traditional volumes was immediate. PTC transactions, which languished at a modest ₹0.33tn in the 2021 financial year, surged beyond ₹1tn by 2024. Data from the first half of 2025 suggests the market is reaching critical mass, with volumes already beyond ₹0.7tn.

Yet the true significance of the 2021 guidelines lies not in the scaling of the old model, but in the birth of a new one. In a radical departure from the "diversified pool" orthodoxy, the new regime permits a lender to carve out a single, standard project loan, house it in a bankruptcy-remote trust, and issue securities against that solitary asset.

It is the "securitisation of one" -- a sweet insight that is one pioneer away from becoming a market reality.

Breaking the CLO Mould

Globally, the securitisation of commercial credit is a mature, if occasionally notorious, discipline dominated by Collateralised Loan Obligations (CLOs). But the Indian iteration is a distinct breed. A typical European or American CLO might bundle 150 different corporate loans to achieve the "granularity" required for a triple-A rating.

India’s provision, by contrast, allows for the atomisation of a single, massive exposure. This offers banks unprecedented agility in managing the long-tenure, high-ticket exposures inherent in infrastructure finance.

Until now, such projects were managed through the consortium model: a cumbersome, 20th-century process where a lead bank manages a gaggle of lenders or "down-sells" portions of the debt to stay within internal risk limits. Crucially, under syndication, the loan remains an illiquid fixture on the balance sheet. Single-asset securitisation changes the chemistry of the transaction, turning a private contract into a tradable financial instrument.

Efficiency by design

The single-asset model introduces a surgical approach to capital efficiency. Under RBI rules, a fully disbursed project loan becomes eligible for securitisation after a six-month "minimum holding period." This timing is strategic.

In the volatile world of infrastructure, early-stage risks -- regulatory bottlenecks, environmental clearances, and land acquisition disputes -- are at their most acute during the first shovel-load of dirt. By the time a loan is fully disbursed and has survived its first six months, these foundational uncertainties have typically receded.

Securitising at this juncture allows a bank to capture the higher yields associated with the high-risk inception phase, only to exit and free up capital just as the asset settles into the boring, predictable cash flows of a stable utility.

Beyond individual relief, this mechanism addresses two systemic vulnerabilities that have long haunted the Indian subcontinent:

1. The Asset-Liability Mismatch: Indian banks are perennially caught in the "borrow short, lend long" trap: using three-year deposits to fund 20-year power plants. Securitisation provides a vital exit valve, moving long-dated assets off the books.
2. Broadening the Investor Base: By transmuting a private loan into a security, the industry can tap into the deep pockets of institutional liquidity. Insurance companies and pension funds, which crave long-duration cash flows, have historically lacked a direct route to project-level credit without taking on the broader, often messy, corporate risk of the developer.

The friction points

If the advantages are so compelling, why has the market not yet ignited? The answer lies in a combination of dormant private capital expenditure and significant fiscal friction.

For the better part of the last decade, India’s infrastructure story has been a public sector affair, financed largely through the bond markets. As the private sector begins to re-engage, two primary hurdles remain:

The stamp duty trap

The primary hurdle is the prohibitive cost of registration. In many Indian states, transferring a loan to a trust can incur charges of between 3% and 4%. While some states have capped this at 1% for pooled assets (creating regional hubs for securitisation) the single-asset model remains burdened by archaic fees. Analysts argue that state governments must act in their own enlightened self-interest to reduce these frictions if they wish to see infrastructure projects in their backyard funded efficiently.

The Regulatory Glass Ceiling

Current Securities and Exchange Board of India (SEBI) regulations present a barrier. Rules for listed securitised debt instruments require that no single obligor represents more than 25% of the asset pool. This effectively bans single-asset securities from being listed on recognized exchanges.
This lack of listing creates a domino effect. Insurance companies, governed by strict IRDAI mandates, are generally restricted to "approved investments" that must be listed. Without a SEBI carve-out, the senior, high-quality tranches of these deals (precisely what insurers want to buy) remain off-limits. Furthermore, under Minimum Retention Ratio (MRR) rules, the originating bank must keep a 10% "skin in the game," usually the junior "equity" tranche. This leaves the "Senior Tranche" looking for a home that current listing rules effectively block.

How this fits into Indian economic growth

As the private capex cycle begins its long-awaited ascent, the demand for sophisticated financing tools will be immense. The "securitisation of one" is no longer a mere regulatory curiosity or an academic exercise. It is a vital instrument for a banking sector that must fund a nation's growth without choking on the resulting long-term risk. For the pioneer who manages to navigate the stamp duty and the listing hurdles, the rewards and the market share will be substantial.

The framework is there. The assets are coming. All that remains is for the market to move beyond the safety of the pool and embrace the power of the one.

The authors are experts on finance and public policy.

Balancing Power and Accountability: An Evaluation of SEBI's Adjudication of Insider Trading

by Natasha Aggarwal, Amol Kulkarni, Bhavin Patel, Sonam Patel, and Renuka Sane.

Insider trading is considered to undermine the fairness of the market and erode investor confidence. The Securities and Exchange Board of India (SEBI) has, in recent years, increased its focus on, and intensified its enforcement of, insider trading cases. Expanding enforcement actions should prompt a deeper examination of how effectively SEBI is performing this function vis-a-vis the "rule of law". Adherence to the rule of law by the regulator promotes transparency, creates a stable and predictable environment for businesses and individuals and builds public trust in the regulatory system. Regulatory actions need to be evaluated on benchmarks grounded in legal theory and the extant legal framework.

In a new working paper, Balancing Power and Accountability: An Evaluation of SEBI's adjudication of Insider Trading, we evaluate SEBI's orders on insider trading cases over a 15-year period (2009 - 23) as well as the performance on these orders in appeal before the Securities Appellate Tribunal (SAT). We develop an evaluation framework based on elements of the rule of law applicable to regulatory adjudication, with 56 indicators for SEBI orders, and 82 indicators for orders of the Securities Appellate Tribunal (SAT).

This paper addresses three critical questions:

• What do SEBI's enforcement actions look like, and how have they evolved over the years?

  SEBI's annual reports provide some broad data about the total number of enforcement actions undertaken in a year, but do not provide details of the type of enforcement actions taken for each type of violation, the particular legal or regulatory provision alleged to have been violated, or the impact of successful enforcement actions in reducing instances of insider trading.

  Our dataset comprises 320 SEBI orders - 255 orders are by Adjudicating Officers (AOs) and 65 are by Whole-Time Members (WTMs). Each order can contain cases against multiple entities - we call them alleged violators. The 320 orders contain a total of 912 alleged violators. SEBI officers have imposed sanctions on 565 of the 912 alleged violators (62% of the alleged violators). AOs and WTMs have imposed penalties in 336 cases and 82 cases respectively. The median penalty amount for AOs is about Rs. 7.8 lakh, and for WTMs is about Rs. 15 lakh. Only WTMs, and not AOs, have the power to impose debarment and disgorgement. We observed that they have imposed disgorgement in 144 cases, and debarment in 192 cases. The average disgorgement amount is Rs. 46 crore, while the median is only Rs. 1 crore. The average period of debarment is 3 years, and a median of 1 year.

  Our paper illustrates the number of insider trading orders issued between 2010 and 2022. This shows that a spike in orders on insider trading from 2017, and then again in 2019. There has been a slight drop in the number of WTM orders in 2022. This is consistent with statements in the SEBI annual reports, which suggest that insider trading has been high on the regulator's agenda.

• Are SEBI's orders consistent with the requirements of procedural and substantive rule of law requirements?

  The procedural rule of law measures are based on administrative law and natural justice principles, and deal with how SEBI has been performing in terms of procedural fairness while adjudicating insider trading matters. One aspect of procedural fairness is that the orders should include certain basic information. We find several shortcomings in providing factual information on basic rule-of-law indicators. First, several orders do not mention basic facts about the case such as the date of show cause notice (7%), period of investigation (17%), period of UPSI (27%), and a description of UPSI (20%). Second, orders do not cite precedent. We find that about 87% of orders do not cite any previous AO or WTM order. Finally, the orders do not specify the full details of the sanctions imposed. In 12% of cases where disgorgement was ordered, the time period for payment was not specified. Similarly, for both penalties and disgorgement, interest rate was not specified in a large number of cases.

  The substantive rule of law measures are based on the law relating to insider trading. These dive a bit deeper than the procedural requirements, and examine whether the orders satisfy the requirements of applicable law and regulation. For example, a key component of a good order on insider trading should be that SEBI has been able to clearly demonstrate that the violator is an insider. We find that SEBI has identified a clear insider relationship in only 335 (60%) of its orders. In the remaining 230 orders, it has described a connection in 152 (66%) orders. Describing a connection is not as clear as specifying the connection. If we were to give SEBI the benefit of the doubt and consider it as an acceptable description, even then, in 14% of the cases SEBI has failed to provide any explanation on how a person is an insider

• How do SEBI's insider trading orders stand up to challenge before the Securities Appellate Tribunal (SAT)?

  Our analysis resulted in a set of 119 cases in the SEBI and SAT datasets. These cases result in 183 appeals (32%) out of the total 565 cases with sanction. Out of these, 97 (53%) were allowed, partly allowed, or remanded, while 86 (47%) were dismissed. This suggests that once appealed there is a 50% chance that the SEBI order will not hold in appeal.

  We find that the higher the sanction, the higher the proportion of appeals. 38% of AO cases and 17% of WTM cases with a penalty amount higher than Rs. 10 lakhs resulted in an appeal, relative to 22% of AO cases and 5% of WTM cases below Rs. 10 lakh. This is more pronounced in the case of debarment and disgorgement, where appeals are present for more than half the cases with higher sanctions. We also find that it is less likely that an AO or WTM case with penalty above Rs. 10 lakh or debarment for more than one year will be modified in appeal. 79% of WTM cases involving higher disgorgement amounts and all WTM cases involving a penalty below Rs. 10 lakh were modified in appeal.

Regulatory enforcement actions are necessary to ensure that those who violate the law face consequences, and may also have a deterrent effect on others. However, there are adverse consequences if these actions emerge from a flawed process, or if the actions taken are arbitrary or disproportionate. SEBI is ahead of other Indian regulators such as the Reserve Bank of India in at least publishing its orders. An appeal rate of between 30-38%, and a win rate of 50% at the SAT could be further improved by investments in order writing, and by re-evaluating the regulations on insider trading.

The authors are researchers at the TrustBridge Rule of Law Foundation.

The exercise of discretionary powers: The case of debarment and restraint from capital markets

by Natasha Aggarwal, Bhavin Patel, and Renuka Sane.

Introduction

Financial market regulators, such as the Securities and Exchange Board of India (SEBI), can impose monetary penalties and other sanctions, including debarment from capital markets and restraint from dealing in particular securities. Enforcement action by the state, such as a market regulator, is a double-edged sword. On the one hand, empowering the state to impose sanctions ensures that violators face consequences. Enforcement actions potentially serve as a deterrent against future violations and restore society's (and the market's) trust in the system's fairness. However, if the procedure established by law is not followed while imposing sanctions or if the sanctions are unpredictable or disproportionate to the offence, the process can be seen as unjust and lose its legitimacy. Such actions would damage markets instead of protecting them. Research suggests little clarity exists about the basis for determining penalty amounts in insider trading cases ( Asthana, Sane, and Vivek, 2021) and that there is no discernible pattern on how SEBI applies debarment provisions (Damle and Zaveri, 2022).

Debarment and restraint have enormous business, reputational, and career consequences on whom they are imposed. Section 11(4) of the Securities and Exchange Board of India Act, 1992 (SEBI Act) requires that SEBI provide written reasons when ordering debarment or restraint in final and interim orders. Such reasons must explain why a sanction is necessary in the interests of investors or the market. SEBI has ordered debarment in 575 instances and debarment with disgorgement in 111 instances (SEBI Annual Report (2022-23)) across all violations. This article investigates SEBI's process for applying debarment and restraint sanctions. It focuses on the following questions:

1. Whether SEBI specifies reasons for ordering debarment and/or restraint?
2. What reasons are specified?
3. Are these reasons special to the instances where debarment or restraint is ordered?
4. Is there a correlation between the amount of quantified gain or advantage and the period of debarment or restraint ordered?
5. If the answers to the above questions are negative, are there constitutional grounds of arbitrariness and non-application of mind on which such orders can be challenged?

Our analysis suggests that SEBI often does not provide reasons for imposing debarment and/ or restraint. When it does give some reasons, it does not indicate why debarment and/ or restraint are imposed rather than other sanctions, such as penalties. In such instances, SEBI uses near-identical language in its orders when imposing debarment and/ or restraint as it does when imposing penalties. We also find little correlation between the quantified gain or advantage resulting from the violation and the period of debarment or restraint. Our reading of the law suggests that SEBI's processes expose its orders to challenge on constitutional grounds of non-application of mind and arbitrariness.

Data and methods

Our data consists of SEBI orders on insider trading, which has become an important issue for SEBI in recent years. During 2022-23, SEBI took up 85 insider trading investigations and imposed penalties worth Rs. 3 crore (SEBI Annual Report (2022-23)). There has also been a rise in the percentage of appeals in insider trading cases allowed at the Securities Appellate Tribunal (SAT), from 9% in 2021-2022 to 44% in 2022-2023. The increasing numbers of insider trading matters investigated, penalties, debarment and restraint imposed, and appeals allowed by SAT raise questions about whether SEBI has exercised its administrative discretion in consistently, rationally, and predictably determining sanctions.

We collected a set of insider trading orders passed by SEBI between September 2009 and July 2023. We then created a dataset of orders which matched the following set of keyword searches relating to insider trading: a single instance of 'insider' AND a single instance of 'UPSI' OR 'unpublished' OR 'prevention' OR 'insider trading' (case-insensitive). This gave us 913 observations (599 by Adjudication Officers (AOs) and 314 by Whole-Time Members (WTMs)). AOs do not have the power to impose debarment and restraint as sanctions. We, therefore, focus on the subset of observations related to WTMs. Table 1 presents the summary of our dataset.

Table 1: Summary of our data

Total number of observations	913
Number of observations from WTMs	314
Debarment	188
Restraint from capital markets	71
Both	57
Average period of debarment (in years)	2.9
Average period of restraint (in years)	1.8

There are 188 instances where WTMs have ordered debarment from capital markets and 71 instances of restraint from dealing in securities of the relevant company. In 57 cases, debarment and restraint have both been ordered. We observed no qualitative difference between these 57 cases and the remaining cases where only debarment or restraint was ordered. The average debarment period is about three years, and the average period of restraint is two years.

As described earlier, the SEBI Act requires SEBI to give reasons for imposing debarment or restraint. We use this as the basis of our analysis. From each order, we extracted information on whether SEBI explicitly provided reasons for imposing debarment or restraint, what the reasons were, and whether the order noted the amount gained or loss avoided by the violator. We then used the 'Free online text compare tool' from GoTranscript to compare SEBI's reasons for imposing penalties with reasons for ordering debarment and restraint. This helps us understand if the reasons provided by SEBI are generic or specific. We also studied whether the number of years of debarment or restraint was correlated with the amount gained or loss avoided. This provides one measure of determining proportionality in such orders.

Results

Has SEBI specified reasons?

Table 2: How often does SEBI provide reasons for its actions?

Sanction	Number of instances	Reasons provided	Reasons not provided
Debarment	188	153 (81.4%)	35 (18.6%)
Restraint	71	20 (28.2%)	51 (71.8%)

Table 2 shows SEBI orders do not provide a rationale in ~19% of cases where debarment has been sanctioned and ~72% of cases where restraint has been ordered.

What reasons has it specified?

Where SEBI does provide reasons, they are similar to non-statutory factors it provides when imposing penalties higher than the minimum prescribed under the SEBI Act. The reasons include:

1. Ensuring a level playing field and minimising information asymmetry.
2. Protecting the investors' interests.
3. Regulating and developing the market.
4. Upholding standards of transparency, good governance and ethical behaviour.
5. Upholding the integrity, orderly development and fairness of the market.
6. The seriousness of the violation.
7. Insider trading is behaviour that undermines confidence in the securities market.
8. Discouraging and curbing future instances of insider trading.
9. The role and extent of involvement of an alleged violator.

Are these reasons special to the instances where debarment or restraint is ordered?

The reasons are broad and do not indicate anything special that justifies the imposition of debarment and/or restraint rather than another sanction, such as a penalty. The reasons also do not clarify how the period of debarment or restraint was determined in these instances.

Our analysis from the GoTranscript tool indicates a 99% similarity between the reasons for imposing penalties and ordering debarment and an 86% similarity between the reasons for imposing penalties and ordering restraint. This indicates that the reasons for imposing debarment or restraint are the same as those for imposing penalties. Moreover, the language used to describe these reasons is nearly identical. Application of mind in the exercise of administrative discretion implies that the regulator provides reasons for imposing a sanction and clarifies why it has decided to impose one type of sanction (such as debarment or restraint) rather than another (such as penalty). The fact that SEBI uses near-identical language suggests that SEBI does not consider the proportionality of the sanction to the specific nature and extent of the violation in recording its reasons for imposing certain sanctions or calculating the quantum of penalty or the periods of debarment and restraint. This also suggests that its orders in such instances suffer from procedural lapses and a lack of application of mind and are open to challenge.

Is there any correlation between the amount of quantified gain and the period of debarment or restraint ordered?

Table 3 provides the number of instances in which SEBI established the amount gained or loss avoided before imposing a sanction and the average period of debarment and restraint.

Table 3: Amount loss/gained and the average period of debarment

	Number of instances	Average period (years)	Cases with "Till further orders"
Debarment: Amount gain/loss established
Yes	120/188	3.51	2
No	68/188	1.76	4
Restraint: Amount gain/loss established
Yes	40/71	2.05	2
No	31/71	1.47	12

The table points to three observations.

• First, in 36% of cases where debarment was imposed, SEBI did not identify the amount gained or loss avoided. This is higher in the case of restraint at 40%.
• Second, the average sanction period is higher when the amount of gain/loss avoided is established.
• Third, SEBI imposes debarment and restraint without an end date more often in cases where it has not established the amount gained or loss avoided.

Figure 1 shows the correlation between the amount gained/loss avoided and the years of debarment and sanction in more detail.

Figure 1: Amount loss/gained and the periods of debarment and restraint

Figure 1 does not include two instances in which SEBI quantified the amount of gain and ordered both debarment and restraint 'Till further orders'. The amounts gained in these two instances were Rs. 2,79,51,000 and Rs. 26,82,000.

There is no correlation between the period of debarment ordered and the quantified gain or advantage. There appears to be an inverse relation between the period of restraint ordered and the quantified gain or advantage. We, therefore, infer that the quantified gains or advantages have not been a consistent factor in determining the debarment or restraint period. Moreover, of the 188 instances where SEBI has imposed debarment, it could not quantify the gain in 158 instances (i.e., approximately 84%).

Constitutional safeguards on administrative discretion

One reason for SEBI's non-application of mind when imposing debarment and restraint may be that the SEBI Act provides no guidelines. However, the Indian Constitution and case law in the Supreme Court suggest that this is not a valid excuse.

The Constitution of India imposes restrictions against the exercise of arbitrary power by the State against its citizens. Such arbitrary exercise of power violates Article 14 of the Constitution. This principle has been reiterated by the Supreme Court (Bachan Singh v. State of Punjab, (1982) 3 SCC 24; East Coast Railway v. Mahadev Appa Rao, (2010) 7 SCC 678; Trustees of H.C. Dhanda Trust v. State of Madhya Pradesh, (2020) 9 SCC 510) where it has said:

Whenever a statute transfers discretion to an authority, the discretion is to be exercised in furtherance of the objects of the enactment. The discretion is to be exercised not on whims or fancies rather, the discretion is to be exercised on a rational basis in a fair manner.

Further, the Court has also said:

Every order should demonstrate "due and proper application of mind by the person making the order" and clearly set out the reasons for the order. --East Coast Railway v. Mahadev Appa Rao, (2010) 7 SCC 678.

The Court has also held that there must be consistency in decision-making involving the exercise of administrative discretion.

[I]t is important to emphasize that the absence of arbitrary power is the first essential of the rule of law upon which our whole constitutional system is based. In a system governed by the rule of law, discretion must be confined within clearly defined limits when conferred upon executive authorities. The rule of law, from this point of view, means that decisions should be made by the application of known principles and rules and, in general, such decisions should be predictable and the citizen should know where he is. If a decision is taken without any principle or without any rule it is unpredictable and such a decision is the antithesis of a decision taken in accordance with the rule of law. -- S.G. Jaisinghani v. Union of India, AIR 1967 SC 1427.

One can expect the constitutional guardrails to apply to SEBI actions, whether for penalties or debarment. Consequently, SEBI must provide clear reasons for imposing debarment or restraint, the period of such debarment and restraint, and what is special in the instances where such debarment or restraint is ordered, making it different from instances where it is not.

Conclusion

The absence of justifiable exercise of its discretionary power by SEBI when imposing debarment and restraint in a reasonable number of cases is demonstrated by the fact that there are many instances where no reasons are provided when imposing such sanctions. Where reasons are provided, they do not indicate anything special in these particular instances that distinguishes it from instances where such sanctions are not ordered and are largely the same as those provided for imposing penalties. Finally, little correlation exists between the quantified gain or advantage and the debarment or restraint imposed.

It is particularly important to examine whether SEBI provides reasons when imposing debarment or restraint, how it determines the duration of such sanctions, and what these reasons and methods are because the SEBI Act does not specify what these factors should be, unlike in the case of penalties. These reasons and methods must be described in its orders so that they are available to the persons directly affected and the general public. This is required by the rule of law principles of reasoned decisions and knowability and predictability of the law. It is not sufficient to describe such reasons and methods in internal, unpublished documents or decisions, such as those determining whether an Adjudicating Officer or a Whole-Time Member should adjudicate a matter. If SEBI fails to provide good reasons or does not clarify its methods, its orders are open to challenge on constitutional grounds of arbitrariness.

We recommend developing more precise, appropriate, and usable guidelines in the legal framework to guide and constrain SEBI's discretion in imposing sanctions. The amount gained or loss avoided in insider trading cases may be difficult to quantify. Given this, the 15J factors must be modified to indicate how the debarment period can be calculated in such instances. The Competition Commission of India (Determination of Monetary Penalty) Guidelines, 2024 may be a good reference point for designing such guidelines. Having a clear set of guidelines that SEBI follows in its orders will help satisfy the requirements of consistency, non-arbitrariness, and predictability. This will also help address the high (44%) overturn rate at the SAT, which SEBI self-reports for its insider trading cases. This is perhaps attributable to the frequency with which the SAT modifies sanctions imposed by SEBI.

The Report of the High-Level Committee under the Chairmanship of Justice Anil R. Dave on the Measures for Strengthening the Enforcement Mechanism of the Board and Incidental Issues stated that debarment may serve as an ineffective deterrent mechanism. This, coupled with the lack of specific reasons in SEBI's orders, suggests a need to review the use of debarment and restraint as sanctions in SEBI's enforcement proceedings and to develop more implementable guidelines to guardrail the regulator's actions in imposing such sanctions.

References

Asthana, Sane, and Vivek, An analysis of the SEBI WhatsApp Orders: Some observations on regulation-making and adjudication, Leap Blog, 27 May 2021.

Damle, Devendra and Zaveri, Bhargavi, Enforcement of Securities Laws in India: An Empirical Overview, 24 August 2022.

Securities and Exchange Board of India, Report of the High-Level Committee under the Chairmanship of Justice Anil R. Dave on the Measures for Strengthening the Enforcement Mechanism of the Board and Incidental Issues, 2020.

Securities and Exchange Board of India, Annual Report, 2022-2023

The authors are researchers at TrustBridge. The data cited here was collected by a team at TrustBridge comprising Madhav Goel, Karan Gulati, Amol Kulkarni, Sonam Patel, Praduta Singh, and the authors. We thank Sonam Patel for her assistance in data analysis and creating graphs and tables. We also thank the three anonymous referees who read an earlier draft and provided their comments and suggestions.

Concerns about recent developments on SEBI's regulation-making on market rumours and insider trading

by Bhavin Patel and Renuka Sane.

Insider trading is one of the areas of financial regulation where the order of complexity required of state capability is relatively high, and the gains to society from successful implementation are relatively low. The Indian environment on SEBI enforcement against insider trading has accumulated many difficulties. In recent months, we have seen the next step forward in SEBI's journey, with a novel legal idea around rumours swirling in the market. In this article, we summarise the recent developments, and show two substantive problems with the direction taken by SEBI. These substantive problems are ultimately grounded in failures of process. There are signs that the process adopted in recent months for these developments on rumours, has more deficiencies than usual.

Recent developments on how SEBI thinks about rumours

Over the past year, SEBI has been concerned about the impact of market rumours on security prices. It proposed that certain listed entities be required to verify "market rumours" related to their firm. Amendments to this effect (the June 2023 Amendments) were made in the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 (the LODR Regulations), though the amendments are yet to be enforced. On December 28, 2023, it published a Consultation Paper on Amendments to SEBI Regulations with Respect to Verification of Market Rumour (the Current Consultation Paper) suggesting that listed entities should verify market rumours only if they are material. 'Materiality' meant that such rumours should lead to price movement in the security. It also proposed that if a listed entity classifies certain information as Unpublished Price Sensitive Information (UPSI) but does not verify a market rumour related to such information, it should continue to be treated as UPSI under the SEBI (Prohibition of Insider Trading) Regulations, 2015, (the PIT Regulations). In its Board Meeting held on March 15, 2024, SEBI approved this proposal, confirming that if a rumour related to UPSI is not verified, it will continue to be treated as UPSI. In other words, if a speculative story appears in the public domain, pertaining to UPSI about a firm, it will still be treated as UPSI until the listed entity verifies the story.

These steps contain difficulties that are generic to the working of SEBI. Firms are already mandated to release certain information (through listing obligations), and not release some (through prohibition on insider trading). SEBI's proposals on verification of market rumours have not yet explained the market failure proposed to be solved and how the selected intervention is the least costly way of doing so. In this particular case, the legal effects of the new law can be particularly damaging. The decision in the March 15 Board meeting, to continue to treat Generally Available Information (verified or not) as Unpublished Price Sensitive Information (till the company verifies it), goes against the grain of how price discovery works in the public market. A greater process discipline will help improve the thinking, and the democratic legitimacy, of insider trading regulation.

Substantive problem #1: The impact on the OTC market

Consider the following illustration:

• Assume a listed entity classifies "defaulting on a large supplier contract" as UPSI.

• Since the information is classified as UPSI, insiders would be prohibited from trading based on such information under the PIT Regulations. Note that the definition of insider under R. 2(1)(g) of the PIT Regulations includes persons with access to UPSI. This implies that if a retail investor, with no connection to the firm, has access to this information, the retail investor is also classified as an insider. This speaks to the over-inclusiveness of the term 'insider' under prevailing securities laws.

• Assume that a newspaper carries a story about a "rumour about the default". Since this is now reported in the media, it will be accessible to the general public. The listed entity chooses not to verify the information since it does not trigger the materiality threshold under R. 30 of the LODR Regulations (for example, it might not cause a price movement or may only cause a price movement lower than the limits specified in the threshold).

• Under the current proposal, an unverified event or information reported in the media would not be considered 'generally available information' under the PIT Regulations. It would continue to be UPSI. The definition of insider regarding UPSI would extend to the general public. As a result, the PIT Regulations would generalise the prohibition on trading based on such information, even though it has been reported in the media, because the listed entity chose not to verify it. This may effectively hinder the price discovery process, a core function of securities markets.

Further, the explanation to R. 4(1) of the PIT Regulations states that if a person possesses UPSI, their trades would be presumed to have been motivated "by the knowledge and awareness of such information". The proviso to this explanation states that an insider can prove their 'innocence' if: (i) the transaction is an off-market inter-se transfer between insiders who were in possession of the same unpublished price sensitive information without being in breach of R. 3 and both parties had made a conscious and informed trade decision, (ii)the transaction was carried out through the block deal window mechanism between persons who were in possession of the unpublished price sensitive information without being in breach of R. 3 and both parties had made a conscious and informed trade decision.

As a result, under proviso (i) two people who read the same unverified story in the media are consequently insiders and who have made a 'conscious and informed trade decision' can trade in the listed entity's securities if such trade is off-market; and under proviso (ii) a block deal trade is also allowed under similar circumstances.

The effect would be that regular trades on the floor of the exchange based on unverified media reports would be prohibited. However, off-market transactions or block deals conducted based on such information would not count as 'insider trading', creating a problem of arbitrary discrimination. This also drastically reduces the pool of investors able to trade, which may possibly lead to a liquidity collapse.

Substantive problem #2: Contradictions with existing regulations

The proposals contradict a literal interpretation of UPSI as set out in the PIT Regulations since they suggest that information which is neither unpublished (since it has been published in the media) nor price-sensitive (since it does not affect the price of securities and therefore falls outside the scope of the materiality threshold verification requirements under R. 30 of the LODR Regulations) would still be considered UPSI. This would suggest a need to amend the definition of UPSI under the PIT Regulations and, potentially, the provisos to the explanation to R. 4(1) and the definition of insider under R. 2(1)(g). The proposals in the Current Consultation Paper also necessitate changes to determining materiality under R. 30(4) of the LODR Regulations. This is because the proposed definition of materiality is not a part of the June 2023 Amendments. The materiality thresholds proposed impact which market rumours listed entities need to verify.

Difficulties with the process

Assuming that SEBI has considered the potential impact on liquidity and does not regard it as problematic, we are still faced with the problem of how these proposals may be implemented. The current proposal may require changes in other substantive regulations. If they are indeed to be implemented, they should be done through amendments to the PIT and LODR Regulations. Board minutes, Circulars, or Guidelines should not suffice to effectuate substantive changes. Under Section 30 of the Securities and Exchange Board of India Act, 1992 (the SEBI Act), changes to regulations must be laid "as soon as may be after it is made, before each House of Parliament, while it is in session, for a total period of thirty days." This allows for Parliamentary oversight of the regulator's exercise of powers of subordinate legislation and prevents the use of such powers beyond permitted limits. The June 2023 Amendments are scheduled to take effect from June 1, 2024, there is little time left for listed entities to prepare, and such amendments should be published soon. The process under S. 30 of the SEBI Act was followed in the case of the June 2023 Amendments, and the Amendments were laid before Parliament on August 11, 2023. There is no reason this process should be side-stepped now. SEBI should come out with a precise legal instrument, and the amendments to the PIT and LODR Regulations, to implement its proposal.

Ideally, the regulator should, in addition to inviting and analysing public comments, identify the problem or market failure these seek to address, the principles governing the proposals, the outcome the regulator aims to achieve through such changes, and an analysis of their costs and benefits as recommended by the Financial Sector Legislative Reforms Commission (FSLRC) in its Handbook on adoption of governance enhancing and non-legislative elements of the draft Indian Financial Code of December 26, 2013. The Financial Stability and Development Council had also approved the implementation of the FSLRC's recommendations in its meeting in October 2013. If this process had been followed, the failures in substantive thinking described earlier would have been avoided.

The authors are researchers at TrustBridge. We thank Amol Kulkarni and Madhav Goel for useful comments.

Evaluating capital market responses to cybersecurity incidents in Indian listed companies

by Sayan Dasgupta, Renuka Sane and Karthik Suresh.

In a previous report on the Information Technology Act, 2000 we described the infirmities in the laws and institutions that govern cybersecurity threat detection and response in India. However, two questions persist. Firstly, what is the true scale of the cybersecurity problem among Indian firms? Secondly, what are the financial and reputational consequences of a cybersecurity breach at an Indian firm?

It is difficult to find answers to the first question in the public domain. But when it comes to the second question, we can gain some insights by looking at how investors respond to the news of cybersecurity incidents whenever such details are made public. In the United States, the results of these studies range from a slightly negative effect on stock prices following the announcement of an incident (e.g. Cavusoglu et al, 2004 estimated an average 2.1% loss in the first two days after disclosure) to no significant effects (e.g. Kannan et al, 2007). Amir et al (2018) however observed that there is a significant difference between the fall in stock prices for firms that disclosed the cybersecurity incident (0.7% decline in one month) vs. firms that withheld this information (3.6% decline in one month).

It is important and interesting to understand the current state of play. How many Indian listed companies made public disclosures of cybersecurity incidents? How did investors in these companies respond to this news given the limited information they had? We attempt to provide some insights into this question by conducting an event study of stock price movements that follow cybersecurity incidents in Indian listed companies. We found that there was a significant negative effect on stock prices given the prior system of disclosures.

Why is it important to make disclosures of cybersecurity incidents?

A cybersecurity incident can be a costly negative externality. In 2022, IBM surveyed 49 Indian companies and estimated the loss they suffered from a single data breach to be USD 2.32 million (INR 184.5 million). A firm suffers direct costs (e.g. costs of data recovery) as well as indirect costs (e.g. loss of trust and goodwill) due to a cybersecurity incident. These costs, along with the reluctance to divulge details about its vulnerabilities to competitors, mean that firms are not incentivized to share information on their cybersecurity incidents.

There are two reasons why firms should make disclosures about cybersecurity incidents. Firstly, consumers have a reasonable expectation of privacy. In India, the Supreme Court in the Puttaswamy decision traced this expectation of privacy to one's right to life and personal liberty. On these grounds, data privacy legislations, such as Article 34 of the EU General Data Protection Regulation and Section 8 of the Digital Personal Data Protection Act, 2023 require firms to disclose details of data breaches to their users. Secondly, securities laws are concerned with whether cybersecurity risks are "material information" that should be disclosed to investors. The concept originated in the United States --- the US Supreme Court in TSC Industries v. Northway held that a given piece of information is "material" if there is "a substantial likelihood that a reasonable shareholder would consider it important in deciding how to vote".

Specifically on materiality, the US Securities and Exchanges Commission (SEC) issued non-binding guidance in 2011 and 2018 which provided the format in which a listed entity or market participant should report on cybersecurity risks. However, in March 2023, the SEC proposed a framework for compulsory disclosures of cybersecurity risk and preparedness. In India, SEBI's general disclosure requirements on materiality are found in Regulation 30 read with Schedule III of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 ("LODR Regulations"). Sub-part B, no. 6 requires the listed entity to report "disruption of operations of any one or more units or division ... due to natural calamity (earthquake, flood, fire etc.), force majeure or events such as strikes, lockouts etc." While it was not explicitly mentioned that cybersecurity risks are to be reported, many listed companies (example) made such disclosures anyway. In June 2023, specific reporting requirements for cybersecurity incidents were added to the LODR regulations which we describe in the discussion section.

Data

Our list of cybersecurity incidents comes from two datasets that provide firm-specific incident information. The first dataset --- the "CISSM Cyber Attacks Database" --- is based on the work of Harry and Gallagher (2018). It is hosted by the University of Maryland (UoM). It has a set of 285 incidents that took place in India between 2014 and 2023. Of these, 45 incidents took place in companies listed in India. This dataset includes detailed information on the type of data that was compromised, the method of attack, and the responses of the affected companies. This data was collected by deploying a customised script that queries a list of news websites for articles or news items on cybersecurity incidents which are collected, sorted and stored. Another script then categorizes these incidents into various types.

The other dataset, called the Data Breach Investigations Report (DBIR), is hosted by Verizon. It has information on the type of breach (e.g., malware, hacking, social engineering), the target of the breach (e.g., government, enterprise, small business), the method of attack (e.g., phishing, spear phishing, watering hole attack) and the impact of the breach (e.g., data loss, financial loss, reputational damage). The DBIR dataset accepts information from a broad set of user-reported sources which are manually sorted by varying levels of confidence. The dataset has 83 incidents that took place in India between 2009 and 2017, of which 11 incidents took place in Indian-listed companies. 8 of the 11 incidents are already mentioned in the UoM database, so we are left with 3 unique entries in the DBIR. We manually categorized these three incidents based on the typology provided by Harry and Gallagher (2018).

The distribution of the different types of cybersecurity incidents is as follows:

Type	Description	No. of incidents
Data attack	This type of attack covers the manipulation, destruction, or encryption of data in the target network.	7
Exploitation of application server	This type of attack uses a misconfiguration or vulnerability to gain access to data in a server-side application (e.g. a database) or the server itself.	27
Exploitation of network infrastructure	This type of attack covers the theft of data through direct access to network infrastructure such as routers, switches and modems.	1
Denial of service	This type of attack is meant to degrade or deny access to other parts of the firm's network.	3
Message manipulation	This type of attack covers interferences with the target's ability to accurately communicate information to its customers.	3
Combination of methods		5
Undetermined		2
Total		48

In total, our dataset has 40 unique companies and 48 incidents that took place between June 2013 and March 2023.

For stock prices, we retrieved the NSE daily closing prices for all the affected companies from CMIE Prowess for the period between 1 March 2013 to 31 July 2023.

Methodology

The event study methodology (ESM) is commonly used to measure stock price reactions to certain events (Fama et al, 969). We use the ESM to analyze the stock price consequences of cybersecurity incidents. Price reactions are represented by abnormal returns, which are stock returns adjusted for the normal daily stock price and market. We use the eventstudies package developed by Anand et al (2014) for our analysis.

This methodology involves the following steps:

1. Identifying the event date: The event dates are the dates on which each of the cybersecurity incidents were made public i.e. the date of the news article.
2. Calculating the abnormal returns: The abnormal returns for the affected companies are calculated on the event date and 45 days before and after the event. Abnormal returns are the difference between the actual returns of the affected companies and the expected returns of the market. The expected returns are calculated using the market model.
3. Statistical tests: They help us determine whether the abnormal returns are statistically significant. The abnormal returns are used to test whether the cybersecurity incidents had a significant impact on the stock prices of the affected companies. The statistical tests are conducted using a variety of methods such as the t-test and the Wilcoxon signed-rank test.
4. Analyzing the results: The results of the event study are analyzed to determine (i) the magnitude of the impact of cybersecurity incidents on stock prices, (ii) the factors that influence the impact of cybersecurity incidents on stock prices, and (iii) the implications of the results for investors, companies, and regulators.

Results

Event study results covering all incidents

Fig 1: Event study results for all 48 incidents.

We observe a significant decrease in the cumulative abnormal return (CAR) after the event date. The average decrease in the first month after the event was 3.48%. At its lowest, the CAR was -8.06%. However, with a widening 95% confidence interval, there is some uncertainty about the true effect of the cybersecurity incident on the stock prices of the companies. The sample size is low and the information available regarding the nature and magnitude of the incident is limited.

Event study covering incidents of the type "exploitation of application server"

Fig 2: Event study results for 27 incidents which were of the type "exploitation of application server".

The majority of the cybersecurity incidents were of the type "exploitation of application server". We conducted another event study on this set of incidents. However, we do not see significant results. In the first month after the event, the CAR increased by an average of 9.79%.

Limitations

Our list of 48 incidents is certainly not exhaustive. Many cybersecurity incidents may not have been reported. Given that the majority of our data comes from news sources, some disclosures may have been made long past the incident date.

Discussion

We began by asking about the financial and reputational consequences of a cybersecurity breach in a listed Indian firm. The trends in our analysis show that investors do tend to react negatively to the news of a cybersecurity incident.

As time progresses, we may be able to find more conclusive answers to both questions. This is thanks to some recent changes in the disclosure regime which will give us the true picture of cybersecurity incidents at Indian listed companies. In November 2022, SEBI in its consultation paper proposed amendments to these regulations. The consultation paper notes that cybersecurity incidents "may impact the operations and/or performance of the listed entity" but also recognizes that the "immediate disclosure of such events may not be desired since the entity may be vulnerable to further attacks". SEBI therefore proposed that the disclosures be made on a quarterly basis in the corporate governance report where the listed entity mentions the root cause of the incident as well as the remedial measures that they undertook. In June 2023, these proposals were adopted by amending Regulation 27(2) of the LODR regulations. Given the recent amendments to the SEBI LODR regulations, the quality of information on cybersecurity incidents could become richer. This could inform further studies which could deploy more sophisticated methodologies that control for other factors that could affect stock prices and remove the variation caused by them before performing the event study.

References

Chirag Anand, Vimal Balasubramaniam, Vikram Bahure and Ajay Shah, eventstudies: an R package for conducting event studies and a platform for methodological research on event studies, NIPFP Macro/Finance group, 2014.

Hassan Cavusoglu, B. K. Mishra, and S. Raghunathan, The Effect of Internet Security Breach Announcements on Market Value: Capital Market Reactions for Breached Firms and Internet Security Developers, International Journal of Electronic Commerce, Vol. 9 (2004), no. 104, pp. 70--104.

Karthik Kannan, Jackie Rees and Sanjay Sridhar, Market Reactions to Information Security Breach Announcements: An Empirical Analysis, International Journal of Electronic Commerce, Vol. 12 (2007), no. 1, pp. 69--91.

Eli Amir, Shai Levi and Tsafrir Livne, Do Firms Underreport Information on Cyber-Attacks? Evidence from Capital Markets, Review of Accounting Studies, Vol. 23 (2018), issue 3, no. 11, pp. 1177-1206.

Charles Harry and Nancy Gallagher, Classifying cyber events: a proposed taxonomy, Journal of Information Warfare, Vol. 17 (Summer 2018), no. 3, pp. 17-31.

Eugene F. Fama, Lawrence Fisher, Michael C. Jensen and Richard Roll, The Adjustment of Stock Prices to New Information, International Economic Review, Vol. 10, no. 1, pp. 1--21.

Sayan Dasgupta and Karthik Suresh are researchers at XKDR Forum. Renuka Sane is a researcher at TrustBridge. We thank Ajay Shah, Geetika Palta and Siddhant Bharti for their useful comments.

How are securities laws enforced in India: some facts from a new data-set of SEBI orders

by Devendra Damle and Bhargavi Zaveri Shah.

Introduction

The Securities and Exchange of Board of India (SEBI) is one of the most powerful regulators in India. As the regulator of one of the world's largest stock markets by market capitalization, SEBI has a variety of enforcement tools at its disposal. These include the imposition of monetary penalties, license cancellation and pursuing criminal proceedings against violators. The law empowers SEBI to issue directions to intermediaries, and more broadly, to persons associated with the securities market. Such directions may be of a prohibitory nature, such as restricting companies from raising capital in the public markets, disqualifying persons from acting on the board of publicly traded issuers and restricting access to the capital market altogether. They may also be of a remedial nature such as disgorging illegal gains made by violators or directing restitution to wronged investors. The grounds for issuing such directions are wide.

How has SEBI used these enforcement powers over time? Has it prioritized enforcement against some kinds of misconduct over others? If yes, have the priorities stayed static or changed over time? Do certain types of violations consistently entail certain types of sanctions? How efficient are the enforcement proceedings in terms of the time taken, and what is the success rate for enforcing such sanctions? Unlike some Indian financial sector regulators, SEBI follows a due process before issuing such orders, involving the issuance of a show cause notice and a hearing and publishes each enforcement order passed by its officials systematically on its website. This transparency in enforcement allows us to establish some basic facts on securities laws enforcement in India over a long observation period. In a new paper, we analyse over 8,000 enforcement orders passed by SEBI over a span of ten years to answer some of the questions we mentioned above. In this article, we summarize the key findings of our work.

Data description

In our study period beginning 1st January, 2011 and ending on 31st December, 2020, SEBI passed 9048 enforcement orders, of which we were able to sucessfully download and parse 8032 orders. We then analysed these orders, using text-mining software we designed ourselves, to arrive at some summary statistics on the frequency and type of enforcement undertaken by SEBI during the study period. To answer more detailed questions on the nature of enforcement, we manually analysed a stratified random sample of about 10% of these orders. The sample was drawn from the set of orders involving four regulations, which are most frequently enforced by SEBI (as per our data), namely, orders pertaining to fraudulent and unfair trade practices in the Indian securities market (FUTP), violations of the Insider Trading regulations, the Takeover Code and Broker regulations.

As mentioned above, the SEBI Act empowers SEBI to pass two types of orders, namely, orders imposing monetary penalties and orders issuing directions. Such orders can be issued against intermediaries, market participants, issuers of capital or persons generally associated with the securities market. Until 2019, monetary penalty orders could be passed only by adjudication officers and directions would be issued by whole time members of the SEBI board. With effect from 2019, the members of the SEBI board have also been empowered to pass orders imposing monetary penalties. In addition to these, the law also empowers SEBI to settle violations upon the payment of a settlement fee, without passing a guilty verdict against the violator. Basis this scheme of the SEBI Act, we categorize the enforcement orders in our data set into three categories shown in the Table. On an average, SEBI issues 250 enforcement orders with directions and double the number of orders imposing monetary penalties each year. The SEBI Act also empowers SEBI to initiate criminal prosecution against persons accused of having violated the SEBI Act or the regulations made by it, but we do not take account of this typology of enforcement proceedings in our study.

Table: Enforcement orders (2011-20)

Type of order	Type of sanction	Total^
Orders by Adjudicating officers	Monetary penalties	4911 (61)
Orders by Chairperson/member	Non-monetary sanctions	2484 (31)*
Settlement orders	Settlement fee	637 (8)
Total		8032 (100)
^Numbers in brackets are a percentage of the total. *We estimate that not more than 30 orders may involve a monetary penalty.

As is evident from the Table, securities law enforcement is largely undertaken in India through monetary penalties, but the proportion of enforcement undertaken through non-monetary sanctions is not trivial. Settlements account for less than 10% of the total enforcement orders in our data. The annual distribution of these types of orders is shown in the Figure. The Figure shows that from 2018 onwards, there has been a sharp increase in the intensity of enforcement, with the number of monetary penalty orders nearly doubling from the previous years. The proportion of settlements has also increased over time, particularly after 2016. While the growth in the size of the market, an increase in the intensity of regulation and enforcement capacity are intuitive explanations for this jump, more precise, causal explanations require further research.

Figure: Year-wise types of enforcement orders (2011-2020)

Findings

SEBI draws its substantive powers from a set of three laws, over and above the SEBI Act, namely, the Companies Act, 2013 (and its preceding legislation), the Securities Contracts (Regulation) Act,1956 (SCRA) and the Depositories Act, 1996. While the Companies Act largely deals with the incorporation of Indian companies and the governance of their affairs, it also governs primary issuances, the requirements to be met by public offer documents and some aspects of the governance of listed companies. These matters under the Companies Act are administered by SEBI. The SCRA governs the conceptual definition of securities and securities contracts, regulates some types of securities contracts and governs the licensing and affairs of stock exchanges. The Depositories Act, 1996 deals with the regulation of depositories and depository participants. Under each of these laws, and in particular under the SEBI Act, SEBI has issued regulations defining the registration and reporting requirements for intermediaries, the kinds of misconduct that will elicit penalties, and so on.

We find that orders against fraudulent and unfair trade practices (FUTP) are the single largest group (15%), followed by orders dealing with violations of the provisions of the Companies Act (11%), insider trading regulations (10%) and the takeover code (9%). The enforcement actions (i.e. the number of orders) under the remaining regulations are few, with some of them having witnessed enforcement not more than once during the study period. Some of these seemingly rarely-enforced regulations, such as the regulations governing alternative investment advisors, are relatively new, which may explain why they do not appear more often in our data. However, others, such as the regulations governing venture capital funds, stock exchanges and clearing corporations, are older, but we see fewer orders issued under these regulations as compared to other regulations. Whether this is because the regulations themselves are not violated as frequently by market participants, or because SEBI chooses not to enforce them, requires further study.

To answer more specific questions of these enforcement orders, we manually analysed a random sample of 818 orders (approximately 10% of the total sample) from amongst the orders against the following types of violations: (1) FUTP, (2) insider trading, (3) violations of the takeover code and (4) violations of brokers' regulations. Some findings from this micro-study are summarised below:

1. Duration of the enforcement proceedings: The formal enforcement process at SEBI begins with the appointment of an investigating authority who investigates the facts and reports her findings to the SEBI board. If the findings are adverse, a show cause notice is issued to the accused by the adjudication officer (where the proposed sanction is a monetary penalty) or a whole time member of the SEBI board (where the proposed intervention is a direction). We find that the median time for the issuance of a show cause notice is a little more than three years from the date on which the violation was committed. Further, the median time from the date of issuance of a show cause notice to the date of an order imposing monetary penalties is a year and a half. It is a little more than two years for orders issuing directions. A regulation-wise analysis of the duration suggests no relationship between the complexity of the violation involved and the duration of the enforcement proceeding.
2. Subject and outcome of enforcement: A bulk of the enforcement actions are in respect of unregulated entities, that is, entities that are not SEBI-licensed intermediaries. This phenomenon could be attributed to the type of violations that are most often enforced against, namely FUTP and insider trading. Both these practices would likely involve traders and market participants that are not SEBI-licensed intermediaries. Further, in nearly 80% of the cases, SEBI found the person(s) guilty of all the violations that they were charged with, with a marginally higher conviction rate for unregulated entities compared to regulated entities. The conviction rate for violations of the Takeover Code is also marginally higher, compared to violations under the three sets of regulations. It is hard to comment on the optimality of this high conviction rate as these enforcement proceedings are undertaken and decided by SEBI officers themselves. All orders of SEBI, except those rejecting an application for settlement, are appealable to the Securities Appellate Tribunal (SAT). The rate of appeals and the outcome of appeals before the SAT could be a rough proxy to evaluate the optimality of this conviction rate and would be a good direction for further research.
3. Proportionality of sanction: We find a lot of variation in the amount of penalty levied across cases. While the median (i.e. typical) size of the penalty is in the range of Rs 5,00,000, the average is in the range of Rs. 57,00,000. This difference indicates that while there are few cases where large penalties are issued, the size of these penalties is very large compared to the typically-imposed penalties. One explanation that could account for this variation is the amount involved in the violation. The SEBI Act requires an Adjudicating Officer to take into account, among other factors, the amount of disproportionate gain or unfair advantage made as a result of the default or the amount of loss caused to investors as a result of such default. However, we find that in a vast majority of the cases in our sample (90%), the size of the violation was not calculated.

   We similarly find a lot of variation in the orders that impose sanctions other than monetary penalties. Out of 118 such orders, 82 orders restricted the market access of the accused. The duration of such restrictions varied from 15 days to 4 years, and we could not discern any relationship between the duration of the restriction on the one hand and the violation or the purpose of the restriction on the other. Further, courts have repeatedly held that SEBI's direction making powers are remedial and preventive in nature, and not punitive. However, it is unclear at what point an order that operates to restrict market access starts to become punitive in nature, since none of the orders in our data clearly draw the line between remedial and punitive measures.

Conclusion

In India, the field of securities laws is often studied from the perspective of a specific case, individual legislative amendments or specific judgements of courts. While such analysis is useful, a slightly different, more quantitative approach is necessary to gain a systematic understanding of the manner in which the regulator uses the wide variety of enforcement tools available to it, the manner in which it seeks to enforce against different kinds of misconduct and the efficiency of its enforcement functions. The consistent publication of easily accessible enforcement orders by SEBI on its website makes it possible to undertake such systematic research on securities laws enforcement in India. This paper is one such effort to begin developing more systematic knowledge on enforcement of private law in India.

The data used for this analysis can be found here. The data-set can be cited as Zaveri Shah, Bhargavi; Damle, Devendra (2022), "Securities law enforcement in India", Mendeley Data, V1, doi: 10.17632/ppdk9pzfdp.1.

Devendra Damle is an independent researcher. Bhargavi Zaveri Shah is a doctoral candidate at the National University of Singapore.