Oversight
What you say to an inspector, and what you can put in front of them.
Registry is built so that the answer to a regulator’s question is a query rather than a reconstruction. Every change carries a name and a time; every filing carries the evidence that supports it; every clock is computed at intake rather than tracked in a spreadsheet.
Turnaround
The clock starts at intake, not when someone remembers.
Per-type statutory turnaround with the due date computed the moment the request is received. The clock stops only when an objection is out with the holder, and it restarts when the cure is received.
Every pause records who authorised it and why, because an unexplained pause is worse than a breach. Escalation is automatic: to the desk head at a configurable threshold before breach, and to the compliance officer on breach.
| Request type | TAT |
|---|---|
| Transfer of securities | 15 days |
| Transmission of securities21 where an indemnity is required | 15 days |
| Issue of duplicate certificateplus the advertisement waiting period | 15 days |
| Dematerialisation confirmation | 15 days |
| Rematerialisation | 30 days |
| KYC and detail updates | 15 days |
| Nomination recording | 15 days |
| Investor grievance | 21 days |
| Dividend payment from declaration | 30 days |
Audit trail
Every change carries a name and a time. This is what makes the rest defensible.
The audit table is append-only. UPDATE and DELETE are revoked at the database level, so the system cannot rewrite its own history even if the application is compromised.
An audit extract for a period or an entity can be signed, so its integrity is demonstrable outside the system.
Audit trail
Append-only · hash-chained · eight years on write-once storage
- AE-4471request.approvedp.raoprev 9f2c…a41b
- AE-4472certificate.issuedp.raoprev 3d81…77e0
- AE-4473folio.address_updateds.iyerprev c05a…12f9
- AE-4474benpos.committedsysprev 7ba4…9d3c
- AE-4475break.cleareds.iyerprev e610…4a88
Each event carries the previous event’s hash. Actor, role, time, IP, before state, after state and reason, for every mutation.
Filings
Drafted from register data, signed by a named officer, filed on time, archived with its evidence.
A filing calendar covers every obligation per issuer and period for the whole financial year, with a due date, a status and an owner.
Reg. 76 is gated
A quarter cannot be certified while a reconciliation break is open. The filing screen refuses and names the breaks.
Late is marked late
A filing past its due date cannot be quietly backdated. Revisions keep the original.
Reg. 31(1) uses your own classification
The shareholding pattern is built from the register’s own category classification, not from the depository feed, which does not carry a reliable one.
| Regulation | Certifies | Frequency |
|---|---|---|
| 7(3) | RTA compliance certificate | Half-yearly |
| 13(3) | Investor complaints statement | Quarterly |
| 31(1) | Shareholding pattern | Quarterly |
| 40(9) | Transfer, transmission and duplicate certificate | Half-yearly |
| 74(5) | Securities dematerialised and certificates destroyed | Quarterly |
| 76 | Reconciliation of share capital audit | Quarterly |
| IEPF-2 | Statement of unclaimed dividend | Annual |
| IEPF-4 | Transfer of shares to the IEPF Authority | As due |
Controls
What the regulator will ask about.
Maker–checker on anything that moves shares or money
Enforced by database constraint, not by convention. The checker on a request may not be its maker, and the releaser of a bank file may not be the person who staged it.
A complete audit trail
Actor, role, time, IP, user agent, action, entity, before state, after state and reason, for every mutation. Retained eight years, hash-chained, partitioned by month, on write-once storage, with UPDATE and DELETE revoked.
Evidence packs attached to each filing
Each filing carries the documents, extracts and runs that support it, so an inspection is a download rather than a fire drill.
Access control by mandate
A grant may be limited to named issuers; the absence of a scope means all mandates and is itself an audited decision. Enforced in Postgres row-level security, so a query that forgets its WHERE clause still returns nothing.
Time-boxed inspection windows
Read-only access scoped to one issuer, created by the compliance officer and itself logged. An auditor can be given exactly what they need and nothing else.
Cyber-security posture aligned to the SEBI framework
Mandatory multi-factor authentication, no shared logins, LUKS on the root volume, TLS 1.3 in transit, application-level encryption for depository credentials and identifiers, quarterly VAPT, annual system audit, and a tested disaster-recovery site with a stated RPO and RTO.
What Registry is not
Registry is software. SEBI registers Registrars and Transfer Agents; it does not approve, certify or endorse the systems they run on. Nothing here transfers your compliance obligations to us, and any vendor telling you their platform is “SEBI approved” is telling you something that does not exist. What Registry does is make your obligations cheaper to meet and far easier to evidence — the registration, and the responsibility, stay yours.
Bring your compliance officer to the demo.
This is the part of the product that rewards a hard audience.