Depository Participant (DP) Audit (NSDL / CDSL)

It is a periodic, independent check — performed by a practising CA, CS, or CWA — of how a Depository Participant (a bank or broking firm offering demat accounts) handles client securities: opening accounts correctly, processing dematerialisation and transfers accurately, using Powers of Attorney within their permitted scope, and keeping proper records. The auditor reports findings to NSDL and/or CDSL in a prescribed format, and the DP must fix and report back on anything flagged.

Every entity registered as a Depository Participant with NSDL and/or CDSL under the SEBI (Depositories and Participants) Regulations, 2018 is required, under SEBI and depository circulars, to have its depository operations audited periodically by an independent qualified auditor. This applies equally to banks and broking firms offering demat services as DPs.

The periodicity is prescribed by NSDL and CDSL bye-laws and circulars and has generally been on a half-yearly cycle for DP internal/concurrent audits (covering the half-years ended September 30 and March 31), though the exact cadence and reporting deadline should always be confirmed against the specific NSDL and CDSL circulars in force at the time — depositories do revise timelines and formats from time to time.

SEBI and depository circulars permit the internal audit of DP operations to be conducted by a practising Chartered Accountant, Company Secretary, or Cost Accountant, provided the auditor is independent of the day-to-day depository operations being reviewed. PNPC conducts these audits through senior CAs with capital-market audit experience.

The audit covers the full depository operations lifecycle: account opening and KYC compliance, dematerialisation and rematerialisation of securities, off-market and on-market transfer instructions (including DIS and e-DIS controls), pledge and margin pledge processing, Power of Attorney usage, nomination, transmission on death of an account holder, account closure, grievance redressal, and the DP's internal controls and record-keeping around all of the above.

The statutory financial audit, conducted under the Companies Act, examines whether the DP's financial statements give a true and fair view. The DP audit is a separate, depository-mandated compliance and process audit that examines specifically how depository operations — account opening, transfers, pledges, and so on — are being conducted, independent of the entity's overall financial reporting.

The DP (internal/operations) audit reviews depository operational processes and controls. The Systems Audit is a separate, technically specialised review of the DP's IT infrastructure, cyber security controls, and data integrity, required to be conducted by a CERT-In empanelled auditor under SEBI's cyber security and cyber resilience framework for market intermediaries. They have different scopes, different auditor qualification requirements, and are typically reported separately.

Exceptions are classified by severity and reported to the depository in the prescribed format. The DP is typically required to submit an Action Taken Report (ATR) confirming what corrective action has been or will be taken, with a timeline for closure. Exceptions that remain unresolved into subsequent audit cycles attract closer depository — and potentially SEBI — attention.

A missed or delayed submission is itself flagged by the depository and can result in a deficiency communication. Depositories treat consistent timeliness of audit submission as one indicator of a DP's overall compliance discipline, and repeated lateness can contribute to enhanced monitoring of that participant.

Yes. The audit requirement attaches to DP registration itself, not to a minimum account or transaction volume threshold. A newly registered DP with a modest client base still needs its operations audited on the applicable periodicity from the point operations commence.

No. Given the transaction volumes most DPs process, the audit uses a risk-based sampling approach across account opening, transfers, pledges, and other tested areas, rather than a full population review. Sample sizes and selection criteria are documented so the basis for the audit opinion is defensible.

A POA is an authorisation a client gives their broker/DP to operate the demat account on their behalf for specified, limited purposes — for example, transferring securities for pay-in against a sale. POA misuse — operating beyond its stated scope — has historically been a significant source of client grievances and regulatory action in the industry, which is why depository audits test POA usage closely, especially after SEBI's margin pledge reforms narrowed the permissible use of POA for margin purposes.

A Delivery Instruction Slip (DIS) is the physical instrument a client signs to instruct the DP to transfer securities out of their demat account; e-DIS is the electronic equivalent, using an authenticated digital instruction instead of a physical slip. Because a DIS or e-DIS instruction can move securities out of a client's account, the audit checks DIS book issuance controls (numbering, client acknowledgement, safe custody) and, where e-DIS is offered, the authentication mechanism and audit trail behind each electronic instruction.

Broadly: DP registration and participant agreement documents, governance policies relevant to depository operations, the previous audit report and ATR, and — for the sampled period — account opening/KYC files, DRF and transfer records, DIS/e-DIS registers, pledge and POA records, transmission and closure files, and the grievance register. The full checklist is shared at engagement kickoff and tailored to your specific service profile.

It depends on whether that role creates an independence conflict with the specific depository operations being tested. Where PNPC's other engagement with the DP touches the same processes under review, we assess independence carefully before accepting the DP audit engagement, and will decline or restructure the engagement where independence cannot be maintained.

A Basic Services Demat Account (BSDA) is a category of demat account with reduced or waived charges for eligible small investors, subject to holding-value thresholds prescribed by SEBI/depositories. The audit checks whether accounts classified as BSDA actually meet the eligibility criteria at the relevant testing date and whether the DP's system correctly reclassifies accounts when eligibility changes.

Transmission is the process of transferring securities in a deceased account holder's demat account to the legal heir(s) or nominee, based on prescribed documentation (death certificate, succession documents or nomination, and identity/KYC of the claimant). It is a sensitive, document-heavy, and time-bound process, and errors or delays directly affect grieving families — which is why depositories expect it to be handled with particular care and the audit tests it specifically.

No. The DP audit report is a confidential submission made to the concerned depository (NSDL and/or CDSL) as part of the DP's regulatory reporting obligations. It is not a public document and is not routinely shared with the DP's individual clients.

PNPC agrees a fixed, written fee for each DP audit engagement, scoped to the DP's branch count, transaction volume, and whether one or two depositories are involved. The fee is confirmed in writing before the engagement begins — there is no standard published rate, since scope varies materially between a single-branch DP and a multi-branch dual DP.

A serious finding — such as evidence of unauthorised transfer, POA misuse beyond its permitted scope, or a material control breakdown — is reported to the depository as a significant exception, and the DP is expected to take immediate corrective and, where relevant, client-remediation action. Depending on severity, the depository may escalate the matter to SEBI. PNPC documents such findings factually and supports the DP's compliance officer in preparing an appropriately serious response.

NSDL and CDSL periodically issue operating circulars that update audit checklists, formats, and timelines. PNPC's capital-market audit team tracks current circulars from both depositories as part of our practice discipline, and we confirm the applicable version before scoping each audit cycle rather than reusing a prior cycle's checklist by default.

The underlying fieldwork — account opening samples, transfer testing, pledge review — can often be planned as a single coordinated exercise for efficiency, but each depository requires its own report in its own prescribed format, submitted to that depository directly. The two audits are not interchangeable or substitutable for each other.

The compliance officer is typically the primary point of coordination — assembling documents, facilitating access to branch records and systems, and being the first point of discussion on draft findings before the report is finalised. A well-prepared compliance officer materially speeds up the audit and improves the quality of the ATR that follows.

Yes. Account opening and KYC testing includes checking that the prescribed identity and address verification steps were completed and documented for sampled accounts, and that PAN and Aadhaar-linked KYC requirements applicable at the time of account opening were met, consistent with SEBI/KRA (KYC Registration Agency) norms in force.

A genuinely clean report is possible for a well-run DP with disciplined processes, but auditors are expected to test rigorously rather than aim for a clean outcome. A report with zero findings across a large, complex DP operation, cycle after cycle, can itself invite depository scrutiny of the audit's rigor rather than being taken purely as reassurance.

PNPC's capital-market audit practice operates from our Chennai, Bangalore, and Hyderabad offices, and we coordinate fieldwork across branch locations outside these cities as required by the engagement, including remote/digital evidence review for branches where an on-site visit is not practical for every cycle.

We scope each engagement around your actual risk profile — branch mix, POA usage, e-DIS adoption, BSDA proportion — rather than mechanically ticking a generic checklist. We track open exceptions across cycles until genuinely closed, confirm the current depository circular before each engagement rather than reusing a prior format, and engage directly with your compliance officer through fieldwork rather than only at kickoff and report delivery.

Yes. PNPC's audit and assurance practice also supports related capital-market engagements — stock broker internal and concurrent audits, Ind AS and company audits for broking/DP entities, and internal financial controls reviews — so a client's overall capital-market compliance calendar can be coordinated by one practising CA team rather than split across unrelated firms with no shared context.

In that situation, the first audit is typically scoped to cover the actual period of operations to date, even if shorter than a full standard cycle, so the DP is not left without any audit coverage simply because a full period has not yet elapsed. The precise treatment should be confirmed with the depository given the specific circumstances.

Yes. Where a client account has been frozen — whether on the client's own request, on instruction from a regulatory or law-enforcement authority, or under the depository's own risk framework — the audit checks that the freeze was applied and lifted only on proper authorisation, and that the DP's records clearly evidence who authorised each freeze or unfreeze action and why.

The DP audit obligation rests with the registered Depository Participant. Where the DP sources business through authorised persons or sub-brokers, the audit tests the DP's oversight of those channels — how account-opening and KYC files sourced through them are reviewed and controlled by the DP itself — rather than auditing the authorised person as a separately regulated entity in its own right.

Many DPs are also stock brokers or clearing members with their own SEBI/exchange-mandated internal and concurrent audit obligations. The DP audit and the broker audit are separate engagements with separate scopes and reporting lines, but PNPC coordinates the overall audit calendar for such composite entities so that account-level data — particularly around margin pledge, which touches both trading and depository operations — is tested consistently across both engagements.

DPs are required to maintain proper records of client accounts, transactions, and related documentation as prescribed under SEBI and depository regulations and record-retention circulars. Retention periods vary by document type and applicable regulation. PNPC advises clients to confirm current retention requirements with reference to the specific SEBI/NSDL/CDSL circulars in force, since these have been updated over time and vary by record category.

Findings from a DP audit are separate from individual staff certification requirements under NISM (National Institute of Securities Markets), but a pattern of serious or repeated exceptions relating to how depository operations are handled by specific staff can prompt the DP to review whether relevant personnel hold the applicable NISM certification and are adequately trained, as part of its own remediation response.

Yes. Alongside the formal report filed with NSDL/CDSL in their prescribed format, PNPC provides the DP's management and compliance officer with a supplementary management letter that explains findings in plain language, prioritises them by practical urgency, and sets out our specific recommendations for closing each one — beyond what the prescribed regulatory format itself requires.