Penalties and Consequences of Non-Maintenance of Structured Digital Database under SEBI (PIT) Regulations

Regulatory Background and Purpose of SDD

The requirement to maintain a Structured Digital Database is one of the most enforcement-sensitive obligations under the SEBI (Prohibition of Insider Trading) Regulations, 2015. The obligation flows from Regulation 3(5) and Regulation 3(6), which mandate that every listed company, intermediary, or fiduciary must maintain a structured digital database containing details of persons with whom Unpublished Price Sensitive Information is shared.

The purpose of the SDD is not disclosure, but traceability. SEBI introduced this mechanism to ensure that every instance of UPSI sharing is recorded contemporaneously, in a tamper-proof manner, so that insider trading investigations are evidence-based rather than inferential.

SEBI treats SDD as a preventive compliance tool. Non-maintenance is therefore viewed as a systemic governance failure rather than a procedural lapse.

Who Is Required to Maintain an SDD

The obligation applies to:

• listed companies
• intermediaries registered with SEBI
• fiduciaries such as auditors, law firms, consultants, bankers, and advisors who receive UPSI

The responsibility to ensure maintenance of SDD rests with the company and its compliance officer. Delegation to IT teams or external vendors does not dilute statutory responsibility.

What Constitutes Non-Maintenance or Defective Maintenance

SEBI does not restrict violations to complete absence of an SDD. The following are treated as non-compliance:

• no SDD maintained at all
• SDD maintained manually instead of digitally
• database not time-stamped
• database editable or overwrite-enabled
• missing PAN or unique identifiers
• failure to record purpose of UPSI sharing
• delayed entries made retrospectively
• SDD maintained only for some transactions
• SDD created after SEBI inquiry commenced

SEBI has consistently rejected arguments that partial compliance or post-facto reconstruction cures the violation.

Nature of Liability for SDD Violations

Non-maintenance of SDD is treated as a violation of Regulation 3 of the PIT Regulations read with Section 15G and Section 15HB of the SEBI Act, 1992. Importantly, SEBI does not require proof of actual insider trading to impose penalties for SDD failures.

This makes SDD violations strict-liability in nature. The offence lies in the failure to maintain traceability, not in misuse of information.

Penalties Imposed by SEBI

SEBI has imposed monetary penalties ranging from several lakhs to crores of rupees depending on:

• duration of non-compliance
• number of UPSI instances unrecorded
• seniority of persons involved
• whether violations were systemic
• whether company is a repeat offender

Penalties are imposed even where:

• no insider trading is alleged
• no unfair gain is established
• UPSI sharing was for legitimate purposes

SEBI’s reasoning is that absence of harm does not excuse absence of controls.

Example: SDD Not Maintained for M&A Transaction

A listed company shares UPSI with investment bankers and legal advisors during a merger transaction. No structured digital database is maintained. The transaction completes without any insider trading allegation. SEBI initiates an inspection and imposes penalty solely for non-maintenance of SDD, holding that the obligation exists irrespective of outcome.

Liability of Compliance Officers and Senior Management

SEBI has increasingly held compliance officers personally responsible for SDD failures. Where the compliance officer fails to demonstrate reasonable steps to ensure SDD maintenance, individual penalties have been imposed.

Directors may also face adverse findings where:

• board oversight of compliance is absent
• repeated violations occur
• internal audit flags are ignored

The defence that SDD maintenance is an operational or IT function has not been accepted.

Example: Compliance Officer Penalty

A company maintains an Excel-based list of UPSI recipients without audit trail or time-stamping. SEBI holds that this does not meet SDD requirements and imposes penalty on both the company and the compliance officer.

Interaction with Insider Trading Investigations

SDD failures significantly weaken a company’s defence in insider trading investigations. Where SDD is absent or unreliable, SEBI draws adverse inferences regarding UPSI dissemination.

In several enforcement actions, SDD non-maintenance has converted what would have been a neutral inquiry into an adverse finding, even without direct trading evidence.

Example: Adverse Inference due to Missing SDD

During investigation into price movement prior to financial results, a company is unable to produce SDD records showing who received UPSI. SEBI treats this as a governance failure and proceeds with enforcement action.

Impact on Transactions and Due Diligence

SDD compliance has become a standard diligence item in:

• M&A transactions
• private placements
• QIPs
• rights issues
• fund raises involving UPSI sharing

Non-maintenance can:

• delay transactions
• trigger regulatory disclosures
• require indemnities
• lead to post-transaction penalties

Acquirers increasingly seek representations and warranties specifically on SDD compliance.

Defences Commonly Raised and SEBI’s Response

Companies frequently argue:

• SDD requirement was misunderstood
• UPSI was shared on a need-to-know basis
• no trading occurred
• data existed in emails or logs

SEBI has consistently rejected these defences. The regulator’s position is that the obligation is explicit, continuous, and non-negotiable.

Good faith, absence of intent, and lack of harm are not mitigating factors.

Compliance Checklist to Avoid SDD Penalties

To avoid enforcement exposure, entities should ensure:

• SDD is maintained in electronic form
• database is non-editable and tamper-proof
• entries are time-stamped automatically
• PAN or unique identifier is captured
• purpose of UPSI sharing is recorded
• access is restricted and logged
• entries are made contemporaneously
• compliance officer reviews entries periodically

Reliance on spreadsheets or manual logs is inadequate.

Consequences beyond Monetary Penalties

Apart from fines, SDD non-compliance may result in:

• enhanced scrutiny in future inspections
• reputational damage
• adverse audit observations
• board-level compliance issues
• difficulty in regulatory approvals

In repeated cases, SEBI has warned of stronger enforcement including directions and restrictions.

Practical Enforcement Reality

SEBI treats SDD as a cornerstone of insider trading prevention. Non-maintenance is viewed as a breakdown of internal controls rather than a technical lapse. Enforcement has shifted from outcome-based to process-based scrutiny.

For listed companies, intermediaries, and fiduciaries, SDD compliance is no longer optional hygiene. It is a frontline regulatory obligation with direct penalty exposure.