SEBI’s Plethora of Proposals
– Sourish Kundu, Executive | corplaw@vinodkothari.com
Read More:
Subsidiaries to refer LODR definition of “related party” – going too far with relationships?
– Sourish Kundu, Executive | corplaw@vinodkothari.com
Read More:
Subsidiaries to refer LODR definition of “related party” – going too far with relationships?
Team Corplaw | corplaw@vinodkothari.com
– Anshika Agarwal (finserv@vinodkothari.com)
The Reserve Bank of India (RBI) has consistently emphasized the significance of robust internal control systems; where gaps are found by the supervisor, it has penalised regulated entities for non-compliance. Recently, the RBI imposed a penalty on an NBFC for outsourcing one of its core management functions, i.e., internal audit to an external auditor, thereby raising doubts as to whether internal audit for NBFCs can be conducted by external auditors. Does the very fact that internal audit is being conducted not internally but by an external chartered accountancy firm amount to “outsourcing” of core management function? This article examines outsourcing in the context of internal audit function, and the conditions subject to which internal audit may be conducted by external agencies.
Outsourcing is defined under the Basel 2005 document1 as “a regulated entity’s use of a third party (either an affiliated entity within a corporate group or an entity that is external to the corporate group) to perform activities on a continuing basis that would normally be undertaken by the regulated entity, now or in the future.” Similarly, the IOSCO Consultation Paper2 refers to outsourcing as “a business practice in which a regulated entity uses a service provider to perform tasks, functions, processes, or activities that could otherwise be undertaken by the regulated entity itself.”
NBFCs, especially those with asset-light models or limited resources, opt for outsourcing to manage financial as well as non-financial functions. Outsourcing by NBFCs typically involves delegating tasks such as loan application processing, collection of documents, data processing, IT support, customer service, and back-office operations to third-party providers. While outsourcing boosts operational efficiency, they also carry risks, particularly when core management functions are outsourced. Notably, outsourcing is distinct from availing professional services like legal, audit, consulting, or property management, which are ancillary to the NBFC’s core business. In case of outsourcing of financial functions by regulated entities, there are specific guidelines issued by the RBI to regulate the arrangements. Clear regulatory oversight is crucial to strike a balance between leveraging external expertise and maintaining ethical, efficient practices in the financial services sector.
The RBI guidelines are specifically aimed at managing risks related to outsourcing of financial services. Master Direction – Reserve Bank of India (Non-Banking Financial Company – Scale Based Regulation) Directions, 2023 (‘SBR Directions’)3, particularly Annexure 13 on Instructions on Managing Risks and Code of Conduct in Outsourcing of Financial Services by NBFCs (‘Outsourcing Guidelines’), Para 2 lays down stringent conditions for outsourcing to ensure compliance, accountability, and effective risk management. While outsourcing can support operational efficiency, core management functions must remain under the direct control of the regulated entity.
The Outsourcing Guidelines explicitly prohibits NBFCs from outsourcing core management functions vital to governance, decision-making, and risk management. The core management functions are those that are vital and crucial for the existence as well as operations of the entity. These have been defined to include:
These functions are critical for ensuring the organization’s stability and operational integrity. For example, internal audit functions identify risks, ensure regulatory compliance, and assess control effectiveness. Entrusting such functions to external entities could compromise decision-making and erode organizational trust.
While the internal audit function itself is a core management process, the Outsourcing Guidelines in the same lines allows regulated entities to engage internal auditors on a contractual basis. This means external professionals can be brought in to execute internal audits, provided their engagement adheres to regulatory standards, independence is maintained, and the entity retains oversight and control rather than putting all the responsibility on a third party.
For example, an entity may handle several operational tasks related to an audit, such as preparing documentation, organizing records, or conducting initial reviews. However, the ultimate responsibility for decision-making, oversight, and ensuring compliance with regulations rests with the audit committee or the entity’s senior management. This approach ensures that the internal management retains control over key aspects of the audit process, even while delegating specific tasks or availing expertise support. In contrast, the action of outsourcing shifts the entire responsibility for the audit to a third-party. This means the external firm is accountable for managing and executing all aspects of the audit, from operational tasks to final implementation. Such an outsourcing may reduce the internal workload, however, it also transfers control and accountability to an external entity, which may not align entirely with the entity’s internal objectives and strategic priorities.
In other words, what is permitted is to avail the expertise services of a third party for carrying out the internal audit function but not the transfer of the entire responsibility of carrying out internal audit to a third party.
The Institute of Chartered Accountants of India (ICAI) Standards on Internal Audit4 states that “Where the Internal Auditor lacks certain expertise, he shall procure the required skills either though in-house experts or through the services of an outside expert, provided independence is not compromised”.
The aforesaid guidance from the ICAI emphasizes maintaining expertise and independence. While not explicitly addressing outsourcing, these standards recognize that internal auditors may lack certain specialized skills. In such scenarios, they encourage engaging in-house or external experts while safeguarding independence.
The standards indirectly allow for outsourcing when:
By availing the services of experts ensures that internal audit teams possess the necessary skills to perform effective reviews, while the entity retains oversight and accountability.
Section 138 of the Companies Act, 2013 (‘CA 2013’)5, specifies the requirement for internal audits for certain classes of companies. It allows the appointment of internal auditors, which may include chartered accountants, cost accountants, or other professionals, as decided by the Board. Explanation of Rule 13 of the Companies (Accounts) Rules, 2014, states that “the internal auditor may or may not be an employee of the company”.
The aforesaid provision also enables companies to engage external auditors to perform internal audits, even if they are not part of the organization. While the CA 2013 does not explicitly prohibit outsourcing of internal audit functions, it places the ultimate responsibility for conducting and reporting on internal audits with the Board. This also clarifies that companies may utilize external expertise while maintaining oversight and control of the audit process.
In conclusion, the RBI’s recent penalties underscore the importance for regulated entities to maintain strict compliance with outsourcing regulations, particularly regarding core management functions. While the Outsourcing Guidelines as well as the provisions of CA 2013 permit engaging external auditors on a contractual basis to perform operational tasks related to audits, accountability and strategic control such as having audit plan approved by the audit committee, regular reporting to the audit committee, discussion of the board and audit committee on the conduct of audit,implementing remedial measure on the oversight of the audit committee or senior management must remain firmly within the organization. Adherence to these principles will help maintain the fine distinction between outsourcing the internal audit function and appointing external auditors as internal auditors, specifically in the context of internal audits.
Read our other related resources –
Participation is free. Register here – https://forms.gle/HsahWP3YmWnVXmRL7
Several proposals on the way to ease compliance
-Pammy Jaiswal, Partner & Sourish Kundu, Executive (corplaw@vinodkothari.com)
The applicability of CG norms (on a COREX basis) was extended to HVDLEs i.e. entities having an outstanding value of listed non-convertible debt securities of Rs. 500 Crore and above, by SEBI vide its notification dated 7th September, 2021. Following the extension thread for mandatory applicability of Corporate Governance (CG) norms under SEBI Listing Regulations (LODR) on High-Value Debt Listed Entities (HVDLEs) from FY 23-24 to FY 24-25 and again postponing it from 1st April, 2025, SEBI released another Consultation Paper (CP) on 31st October, 2024 containing several proposals to ease the compliance burden of HVDLEs. A similar CP was issued earlier on 8th October, 2024 to review the CG norms primarily focusing on related party transactions (RPTs) [Our analysis on the same can be read here].
While the intent behind the CG norms being made applicable was to protect debenture holders and assimilate corporate governance amongst such issuer entities, the complexities associated with its implementation hindered the ease of doing business and increased the compliance burden manifold. The current CP delves into the comments received on the previous proposal as well as the issues that HVDLEs have been facing in practically implementing the CG norms (i.e. Regulations 16 to 27 of LODR, 2015). While it discusses the much needed and critical areas (CG chapter, mandatory committees, RPTs, etc.) where HVDLEs can be considered to be relieved and not be kept on the same pedestal as that of the equity listed entities, however, for some provisions (included for max no. of directorship, committee membership, XBRL filings, etc.), HVDLEs have been proposed to be roped in at par with entities with their specified securities listed. While each of the proposals have been discussed in detail below, a snapshot of the same can be seen in the diagram below:
One of the most crucial concerns for HVDLEs was the impossibility of compliance when it came to securing approvals for RPTs. The same was highlighted by SEBI in its earlier CP dated 8th February, 2023 wherein it was mentioned that 104 out of 138 HVDLEs as of 31st March, 2022, comprised of shareholders with more than 90% of them being related parties (RPs).
The current proposal is set against a reference to a banking transaction wherein the lender reserves the right to allow the borrower to enter into any transaction that might be unfavorable to the lender such as entering into RPTs. Thus, HVDLEs being of the nature of a borrower and the debenture holders being the lenders, it is paramount to protect the latter’s interests by enforcing such provisions as may be necessary and safeguarding them through a debenture trustee.
In view of the same, the proposition has the following features:
LODR in its present form consists of 12 Chapters, each having its purpose and application. As far as the CG norms are concerned, HVDLEs are required to follow the provisions primarily centered around equity listed entities which, inter alia, relate to the composition of the Board of Directors, the constitution of various specialized committees, stipulations regarding RPTs and so on. Having said that, these provisions are not completely relatable to HVDLEs since the majority of these entities are purely debt listed without any other security being listed. Accordingly, it has been proposed to introduce a separate chapter on CG norms for HVDLEs distinct from the existing one for equity listed entities.
VKCO Comments: While this proposal is noteworthy, however, instead of rolling out a new chapter, there could have been certain modifications in the existing regulations by way of a proviso to align with the needs of an HVDLE. Further, one also needs to wait to see the fine print of the provisions once the same is issued.
Based on the data provided by NSDL as of 31st March, 2024, the number of pure debt listed entities with an outstanding of more than Rs. 500 crores is 166 (comprising of an aggregate outstanding of Rs. 13.54 lakh crores), of which 112 entities are those having an outstanding of more than Rs. 1,000 crores (comprising of an aggregate outstanding of Rs. 13.16 lakh crores).
Further, referring to SEBI’s circular dated 19th October, 2023 in which the threshold limit of outstanding long-term borrowing was enhanced from Rs.100 crore to Rs.1,000 Crore for the purpose of being identified as a Large Corporate called for introspection at the existing threshold of being identified as an HVDLE. Aligned with its objectives of tightening the regulatory regimes for debt listed entities and at the same time promoting ease of doing business in the corporate bond market, the proposal suggests doubling the limit from the present threshold of Rs. 500 crores to Rs. 1,000 crores.
VKCo Comments: The proposal to enhance the extant threshold is encouraging in terms of governing the maximum value of outstanding debt while at the same time achieving the same without bearing the burden of compliance by an increased number of purely debt listed entities. Subsequently, effective implementation of such a proposal aligns it with the identification criteria of Large Corporates.
The extant Regulation 3(3) of SEBI (LODR), 2015 provides for the applicability of the CG norms even when the value of the outstanding debt securities falls below the specified threshold forever. The same is in contradiction with respect to the period of applicability as compared to its equity counterpart wherein Regulation 15(2)(a) provides that the norms will have to be complied till such time that the equity share capital or net-worth of the listed entity falls and remains below the specified threshold for a period of three consecutive financial years. Accordingly, for the purpose of aligning the non-applicability, a similar sunset provision for HVDLEs too has been proposed. The proposal outlines that the CG norms shall continue to remain in force for HVDLEs till such time the value of outstanding debt listed securities (reviewed on the cutoff day being 31st March of every financial year) reduces and remains below the defined limits for a period of three consecutive financial years and further ensuring compliance within a period of six months from the date of a subsequent increase in the value above the trigger. The proposition also provides for disclosing such compliances in the Corporate Governance compliance report to be submitted on and following the third quarter of the trigger.
VKCO Comments: The proposal is welcome since it clearly sets the HVDLEs free from the barrier of once an HVDLE so always an HVDLE. This proposal sets a clear nexus between the compliance and the size of the debt outstanding, for the protection of which in the very first place, the compliance triggered.
Regulations 19, 20 and 21 of LODR mandate the constitution of the Nomination and Remuneration Committee (NRC), Stakeholders Relationship Committee (SRC) and Risk Management Committee (RMC) respectively and provide for their composition, the number of meetings to be held, quorum, duties and responsibilities, among other things. The proposal recognises the difficulties of constituting multiple committees by HVDLEs and therefore, extends the option of either establishing such committees or ensuring delegation and discharge of their functions by the Audit Committee in the case of NRC and RMC and by the Board of Directors in case of SRC.
VKCo Comments: Given the close construct of debt listed entities, it is often observed that the constitution of such committees becomes more of a hardship than in smoothening compliance and discussing specific matters. Accordingly, it looks appropriate to redirect the functions of NRC and RMC to the Audit Committee and that of the SRC to the Board.
Several entities are not incorporated in the form of companies and therefore, are regulated by specific acts of the Parliament. The rationale behind this move lies in the fact that the administration of these entities is governed by such specific Acts subject to approval from the concerned Ministries. An exclusion on similar lines was granted to equity listed entities by way of Regulation 15(2)(b) which was later omitted w.e.f. 1s September, 2021 vide notification dated 5th May, 2021.
Further, it is awaited as to how effective and permanent such an exemption would be, but SEBI’s working group has proposed for dispensation of entities like NABARD, SIDBI, NHB, EXIM Bank and such other entities fulfilling the criteria as laid out above and application of CG norms to the extent that it does not violate their respective regulatory framework formulated by the concerned authorities.
VKCo Comments: While SEBI refers to the introduction of similar exclusion for equity listed entities, however, it has also mentioned the subsequent amendment wherein the same was omitted. In any case, the instant proposal is a welcome change since it will help such entities to give preference to their principal statutes and not an ancillary one like LODR.
The extant provisions of Regulation 17A of LODR and Section 165 of the Companies Act, 2013 limit the number of directorship positions that a person can hold, with appropriate sub-limits being set out with respect to public companies and equity listed companies. Similarly, Regulation 26 of the SEBI (LODR), 2015 places ceiling limits on the number of memberships and chairmanships that a person can hold in committees across all listed entities, with explicit exclusion for such positions held in HVDLEs.
The instant proposal is for including the directors in HVDLEs as well as committee membership and chairpersonship positions held in HVDLE just as equity listed entities are included.
The same has been proposed in view of the fact that directorship is a significant position in any company and therefore, multiple directorships beyond a reasonable limit are likely to inhibit the ability of a person to allocate appropriate time to play an effective role in delivering its responsibilities including the timely repayment of debt..
Further, the initial proposal for inclusion of HVDLEs in max no. of directorship allows a period of six months or till the next AGM to ensure compliance.
VKCO Comments: The rationale completely aligns with the proposal made and seems to be justified.
Pursuant to Regulation 27(2), which mandates the submission of a quarterly report on complying with CG norms by listed entities, the format of the report has been supervised by Annexure 3 under Section II-B of the Master Circular for compliance with the provisions of SEBI (LODR), 2015 by listed entities in case of equity listed entities and Annexure VII-A under Chapter VII of the Master Circular for listing obligations and disclosure requirements for Non-convertible Securities, Securitized Debt Instruments and/or Commercial Paper in case of HVDLEs. The issue arises from the practice adopted by HVDLEs in the instant case, where filings made on the website of the stock exchange have been made in PDF format thereby affecting the readability and clause-wise compliance monitoring. Unlike the above-mentioned proposals which aim at bringing about relaxations for HVDLEs, this particular proposal tightens the regime by binding the XBRL format that is consistent with what is being filed by equity listed entities, for the report to be submitted on a quarterly basis.
VKCo Comments: This proposal is with an objective to align and standardize the filing of quarterly CG compliance report for bringing parity as in the case of equity listed entities.
This proposal originates from SEBI’s endeavour to inculcate good CG practices in HVDLEs, to be at par with equity listed entities. It is supported by Regulation 34(2)(f) which requires the top 1,000 listed entities (based on market capitalization) to include a BRSR in their annual report. It is pertinent to note in this respect that publishing of BRSR by HVDLEs is voluntary and not a mandatory requirement unless such an HVDLE also satisfies the criteria of the above-stated regulation.
VKCo Comments: The inclusion of a voluntary provision in the legislation with respect to a comprehensive report like BRSR is not likely to be submitted given the huge details under the BRSR. However, an opportunity to submit BRSR can be a game changer for an HVDLE from the perspective of being able to raise funds based on its reporting standards in this regard.
The proposal under the CP provides hope for a breather when it comes to compliance with CG norms and at the same time introduces certain new requirements to maintain uniformity whether it is for the XBRL filing or inclusion of directorship and committee membership as well as chairmanship in an HVDLE for the max no. of such positions. It will also be interesting to see what is rolled out under the new chapter for HVDLEs as well as the fine print of provisions as far as RPT controls are concerned.
Refer to our related resources below:
Lavanya Tandon, Executive | corplaw@vinodkothari.com
Our related resources on the topic-
Simrat Singh, Executive | corplaw@vinodkothari.com
“I decline to read into any enactment, words which are not to be found there and which would alter its operative effect because of provisions to be found in any proviso.”
– Lord Herschell in West Darby Union vs. Metropolitan Life Assurance Society[1]
Listed entities in India bear significant compliance obligations, including enhanced disclosure requirements and scrutiny by regulators, primarily due to the involvement of public funds and retail investors. To ensure market transparency and investor protection, several measures of ensuring a strong corporate governance (CG) culture have been provided by SEBI. Several of such requirements are enumerated under Regulations 17 to 27 of SEBI (LODR) Regulations, 2015[2] and are applicable on listed entities. However, all listed companies are not required to comply with these CG provisions, as Regulation 15(2)(a) provides certain exemptions for small size entities whose paid up equity capital and net worth do not exceed Rs. 10 Cr. and 25 Cr. respectively.
There are 2 things about the carve out for small listed companies – (a) it is based on monetary limits which were prescribed 9 years ago, and never revised since then, though the official loss of value due to inflation itself would be approx 42.9%[3] (b) Though the Regulation provides a twin-test window for qualifying for the exemption – small capitalisation and small net worth, SEBI was reading these qualifying conditions as being cumulative, with the effect that unless a listed entity was small by both these tests, it will not qualify for the exemption.
While the said Regulation provides for exempting specified classes of listed entities, however, the manner in which the amendment to the said exemption was framed raised two different views on availing the said exemption.
Read more →Team Corplaw | corplaw@vinodkothari.com
In terms of the scope and extent of amendments, the SEBI Board meeting of 30th Sept is certainly quite momentous. Major steps in ease of doing business were taken at the meeting, based on the proposals contained in various Consultation Papers floated by SEBI from time to time. The approvals bring about important changes to almost all major regulations of SEBI. While the fine text of the amendments are awaited, we present our brief understanding on the various approved amendments.
Mahak Agarwal | corplaw@vinodkothari.com
Investor protection provisions have been an inherent part of company laws in India. Whether it be S.34 of the Companies Act, 2013 (‘the Act’) imposing criminal liability on directors/ promoters in case of misrepresentation in prospectus, S.35 which imposes civil liability on persons involved in mis-statement of prospectus, S. 36 which imposes criminal liability on any person who fraudulently inducing persons to invest money and so on.
Following the Satyam fiasco in India, investor protection gained further light and the Company Law Bills of 2009 as well as 2011 contained provisions for introducing class actions as a measure available to the members and depositors of the company if the affairs of the company are conducted in a manner prejudicial to the interest of the company, or its members and depositors. However, it was only in 2016 that the same was introduced under S.245 of the Act.
Read more →-Harshita Malik | corplaw@vinodkothari.com
From zeroes and ones, to limitless possibilities, Artificial Intelligence (“AI”) has traversed a remarkable journey from theoretical concept to pervasive reality, revolutionizing industries, societies, and daily life. AI has significantly impacted various aspects of our daily lives and industries, including agriculture, finance, education, transportation, and entertainment. Corporate governance is also experiencing this transformation. This article provides an insight as to where AI stands in between the boardroom strife.
Read more →