Corporate & Compliance Digest October 05, 2026
We are delighted to share this week's AKP Corporate & Compliance Weekly Digest. Please feel free to write to us with your feedback at info@akandpartners.in.
1. Labour Law & Employment Law
1.1. EPFO highlights revised wage ceiling and enhanced social security coverage
The Employees’ Provident Fund Organisation ("EPFO") has highlighted the enhancement of the statutory wage ceiling for mandatory social security coverage under Chapter III of the Code on Social Security, 2020 (CoSS) from INR 15,000 (Indian Rupees Fifteen Thousand only) to INR 25,000 (Indian Rupees Twenty-Five Thousand only) per month, with effect from 17 September 2026. The revision is expected to bring over 51 lakh additional employees within the ambit of the Employees’ Provident Fund (EPF), Employees’ Pension Scheme (EPS) and Employees’ Deposit Linked Insurance Scheme (EDLI). EPFO has advised employers to promptly enrol eligible employees, update payroll and human resources systems, and ensure compliance with the revised contribution requirements. The organisation has also reiterated the availability of the VISHWAS, 2026 dispute settlement scheme and the Employees’ Enrolment Campaign, 2026, while encouraging employers to participate in the PM Viksit Bharat Rozgar Yojana (PMVBRY) to support employment generation and formal workforce enrolment.
1.2. Assam notifies Assam Shops and Establishments (Amendment) Act, 2026
The Government of Assam has notified the Assam Shops and Establishments (Amendment) Act, 2026, introducing significant reforms to modernise employment regulation, strengthen worker welfare and align the State framework with the Occupational Safety, Health and Working Conditions Code, 2020 ("OSH Code"). Key amendments include recognition of work-from-home and remote working arrangements, introduction of definitions relating to gig workers and platform workers, replacement of the inspector regime with an Inspector-cum-Facilitator framework, digitisation of registration and compliance processes, mandatory appointment letters and service certificates, enhanced provisions relating to wages, welfare facilities and employee separation, and inclusion of adjudication and appeal mechanisms for certain labour disputes. The legislation also streamlines compliance requirements for establishments and strengthens protections relating to working conditions, employee benefits and grievance redressal.
2. Securities & Capital Markets
2.1. CDSL notifies SEBI Circular on Display of Investor Awareness Messages by stockbrokers
Central Depository Services (India) Limited ("CDSL") has notified Depository Participants ("DPs") regarding the Securities and Exchange Board of India ("SEBI") circular mandating the display of investor awareness messages by stock brokers on their trading applications and websites under Project Jagrook. From 1 November 2026, stockbrokers will be required to display prescribed investor awareness messages and risk disclosures on an alternate-day basis on the landing pages of their trading applications, while specified awareness messages must also be prominently displayed on their websites. The initiative forms part of SEBI’s broader investor education and protection efforts and is intended to enhance investor awareness regarding responsible participation in the securities market.
2.2. CDSL extends timeline for OTP-Based authentication of physical BO modification requests
CDSL has extended the implementation timeline for OTP-based authentication of physical Beneficial Owner (BO) modification requests by two months. The revised framework, which was earlier scheduled for implementation pursuant to CDSL’s communiqué dated 17 September 2026, will now become effective from 27 November 2026 (End of Day). The extension has been granted following representations from DPs regarding system readiness and to facilitate smooth implementation of the revised authentication process. CDSL has advised DPs to complete the necessary system modifications and operational preparations within the extended timeline.
2.3. CDSL notifies SEBI master circular for Debenture Trustees
CDSL has notified DPs of the SEBI Master Circular for Debenture Trustees, which consolidates and supersedes the earlier master circular and various operational circulars issued up to 28 September 2026. The circular streamlines the regulatory framework governing Debenture Trustees by consolidating requirements relating to due diligence, security creation and monitoring, Security and Covenant Monitoring Systems, Recovery Expenses Fund (REF), security cover certification, investor grievance redressal, covenant monitoring, default management, disclosure obligations and regulatory reporting. The Master Circular also strengthens oversight of secured debt issuances through enhanced due diligence, digital monitoring of security and charge creation, periodic covenant compliance reporting and expanded disclosure requirements, thereby improving investor protection and transparency in the debt securities market.
2.4. NSDL revises business rules for BSDA and Income Range Disclosures
National Securities Depository Limited ("NSDL") has amended its Business Rules relating to the Basic Services Demat Account ("BSDA") provisions in Form 9 (Account Opening Form for Individuals) and income range disclosures in Form 11 (Account Opening Form for Non-Individuals). The amendments align account opening documentation with the revised regulatory framework for BSDA eligibility, nomination, pledge-related undertakings and income disclosure requirements. Participants have been advised to adopt the revised forms and ensure compliance with the updated account opening procedures.
2.5. NSDL mandates submission of VAPT Audit ATRs through e-PASS
NSDL has directed DPs to submit Action Taken Reports ("ATRs") for annual and half-yearly Vulnerability Assessment and Penetration Testing ("VAPT") audits through the e-PASS application. For half-yearly VAPT audits applicable to qualified stockbrokers and entities designated as protected systems or Critical Information Infrastructure (CII), ATRs must be submitted by 30 September following the initial report submission. For annual VAPT audits applicable to non-qualified stockbrokers, ATRs must be submitted by 30 November. NSDL has clarified that non-submission of ATRs within the stipulated timelines will be treated as a regulatory non-compliance and may attract penalties or other actions.
2.6. NSDL introduces e-PASS-based submission of Annual System Audit ATRs
NSDL has introduced an electronic mechanism for submission of ATRs for Annual System Audit observations through the e-PASS application. DPs are required to submit ATRs relating to non-compliances identified in the initial Annual System Audit Report within three months from the due date of the audit report submission, i.e., by 30 September for audits due on 30 June. NSDL has cautioned that failure to submit the Annual System Audit Report and/or ATR within the prescribed timelines will constitute a regulatory non-compliance and may result in penalties or other actions under the NSDL Business Rule.
2.7. NSE mandates half-yearly AI and ML reporting by algorithmic trading members
National Stock Exchange of India Limited ("NSE") has mandated the submission of half-yearly reports on Artificial Intelligence ("AI") and Machine Learning ("ML") applications and systems used by trading members. The requirement applies to all active trading members that executed even a single algorithmic trade during the period from 1 April 2026 to 30 September 2026, irrespective of whether AI or ML systems are actually deployed. Members using algorithmic trading without AI or ML systems must submit a NIL report. The reporting is required to be completed through the Electronic NSE Interface for Trading Members (ENIT) portal between 1 October 2026 and 15 October 2026. NSE has clarified that failure to submit the required information within the prescribed timeline will be treated as a regulatory non-compliance and may attract enforcement action.
3. Information Technology & Data Protection
3.1. CERT-In issues critical advisory on multiple vulnerabilities in Google Chrome
The Indian Computer Emergency Response Team ("CERT-In") has issued a critical security advisory regarding multiple vulnerabilities affecting Google Chrome for Desktop versions prior to 154.0.8037.92/.93 for Windows and Mac, and 154.0.8037.92 for Linux. The vulnerabilities could enable remote attackers to execute arbitrary code, access sensitive information, bypass security controls, conduct spoofing attacks and cause denial-of-service ("DoS") conditions through flaws such as buffer overflows, type confusion, use-after-free vulnerabilities and cross-site scripting issues. CERT-In has advised users to immediately update Google Chrome to the latest available version to mitigate the identified risks.
3.2. CERT-In warns of critical remote code execution vulnerability in Fortinet FortiMail
CERT-In has issued a critical advisory concerning a path traversal vulnerability in Fortinet FortiMail versions 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and 7.2.0 to 7.2.9. The vulnerability could allow an unauthenticated attacker to execute arbitrary code on affected systems through specially crafted HTTP or HTTPS requests. CERT-In has noted that the vulnerability is being actively exploited in the wild and has advised organisations to apply vendor-issued security patches or implement the recommended mitigation measures without delay.
3.3. CERT-In issues high-severity alert on Apple vulnerability under active exploitation
CERT-In has issued a high-severity advisory regarding a remote code execution vulnerability (CVE-2026-86950) affecting Apple iOS, iPadOS, macOS Sequoia and macOS Tahoe versions prior to the latest security updates. The vulnerability arises from an out-of-bounds write issue and may be exploited by persuading a user to open a specially crafted malicious file. CERT-In has further noted that the vulnerability is being actively exploited in targeted attacks and has urged users to install the latest Apple security updates immediately to prevent system compromise and data exposure.
4. Taxation (Indirect & Direct)
4.1. CBDT extends due dates for Tax Audit Reports and Income Tax Returns for AY 2026-27
The Central Board of Direct Taxes ("CBDT") has extended the due date for filing Income Tax Returns (ITRs) for taxpayers covered under tax audit requirements for Assessment Year (AY) 2026-27 from 31 October 2026 to 21 November 2026. Consequent to this extension, the due date for furnishing audit reports under Section 44AB of the Income-tax Act, 1961 has also been extended to 21 October 2026. The extension has been granted in exercise of the CBDT’s statutory powers and is intended to provide additional time for taxpayers and auditors to complete tax compliance requirements for the relevant assessment year.
4.2. CBDT notifies amendment to Jurisdictional Framework for Income Tax (Appeals) Authorities
CBDT has notified an amendment to the existing jurisdictional framework under the Income-tax Act, 2025, by revising the reporting structure applicable to Joint Commissioners of Income-tax (Appeals) and Additional Commissioners of Income-tax (Appeals). Pursuant to the amendment, such appellate authorities will now be subordinate to the Principal Chief Commissioners of Income-tax or Chief Commissioners of Income-tax within whose jurisdiction they perform their functions. The notification came into force on 30 September 2026, being the date of its publication in the Official Gazette, and forms part of the Government’s efforts to align administrative and appellate structures under the new income tax regime.
Disclaimer
The note is prepared for knowledge dissemination and does not constitute legal, financial or commercial advice. AK & Partners or its associates are not responsible for any action taken based on its contents.
For further queries or details, you may contact:
Mr Anuroop Omkar
Founding Partner, AK & Partners
Comments