NSE Flags Extensive Broker Lapses in Margin Trading, Client Funds, and Cybersecurity

The National Stock Exchange (NSE) has identified significant compliance failures among brokers following recent inspections, spanning issues from margin trading facilities (MTF) to client fund management and cybersecurity protocols. The observations, covering the period from October 2025 to March 2026, reveal systemic weaknesses requiring immediate attention.

Regarding margin trading, the NSE flagged instances where brokers failed to collect adequate margins, specifically in the form of cash, cash equivalents, or Group I equity shares with appropriate haircuts. Furthermore, some brokers extended MTF against ineligible securities, providing the facility for instruments other than the permitted Group I shares. The exchange also noted several lapses in handling client money, including payouts exceeding available credit balances, non-settlement of client funds, and delays in upstreaming clear credit balances to the clearing corporation within stipulated timelines. Other issues involved pledging fully paid-up securities in client unpaid securities pledgee accounts, invoking client securities beyond debit balances, and funding client transactions. Penalties for short collection of upfront margins were also found to be passed on to clients.

Inspections further uncovered irregularities concerning authorised persons (APs), with some found receiving or paying funds directly from or to clients, and others taking client user IDs and passwords for trading. The NSE also cited instances of APs offering assured returns, engaging in mis-selling, or operating unauthorised portfolio management services. Additionally, terminals were not located at their reported addresses in some cases. Broader compliance issues included incorrect data submission under risk-based supervision and in annual returns, delays in issuing contract notes, and allowing trading in minor accounts without proper oversight. Some members also neglected surveillance of client trading activities.

On the cybersecurity front, critical deficiencies were identified, such as the absence of two-factor authentication on important systems, inadequate password policies, and a lack of encryption for data at rest. The NSE also highlighted the use of generic IDs with privileged access and the absence of web application firewalls for internet-facing infrastructure. In response to these findings, the NSE has advised brokers to implement robust systems and procedures to enhance overall compliance and safeguard client interests.

What to watch: NSE's follow-up actions and brokers' compliance improvements.

Editor's note: Comprehensive summary of the inspection findings, effectively organizing technical details into a readable format.