Corporate & Compliance Digest October 19, 2026
We are delighted to share this week's AKP Corporate & Compliance Weekly Digest. Please feel free to write to us with your feedback at info@akandpartners.in.
1. Labour Law & Employment Law
1.1. EPFO urges eligible PF Trusts to regularise exemption status under Amnesty Scheme, 2026
The Employees’ Provident Fund Organisation (“EPFO”) has urged eligible establishments to apply for retrospective regularisation of the exemption status of Provident Fund (“PF”) Trusts under the Amnesty Scheme, 2026, before the deadline of December 28, 2026. Introduced under the Employees’ Provident Fund (EPF) Scheme, 2026, the scheme provides a one-time opportunity for PF Trusts recognised under the Income-tax Act, 1961, but lacking a formal exemption order under the Employees’ Provident Funds and Miscellaneous Provisions Act, 1952 or the Code on Social Security, 2020, to regularise their status. Key benefits include waivers of certain statutory requirements, including minimum employee headcount, corpus size and the three-year compliance rule, along with flexibility to operate as an exempt or unexempt establishment after regularisation. EPFO has undertaken nationwide awareness and outreach initiatives, including industry consultations, seminars, training programmes and coordination with the Income Tax Department, to facilitate timely applications.
2. Securities & Capital Markets
2.1. CDSL notifies SEBI’s mandate on display of investor awareness messages by DPs
Central Depository Services (India) Limited (“CDSL”) has notified Depository Participants (“DPs”) regarding the Securities and Exchange Board of India (“SEBI”) requirement to display investor awareness messages under Project Jagrook, SEBI’s nationwide investor awareness initiative. Pursuant to the directive, DPs will be required to prominently display prescribed investor awareness messages on the landing page of their websites from 1 November 2026 onwards for the benefit, safety and education of investors. The mandatory messages include: ‘Understand Before You Invest’, ‘Choose Regulated Investment Products’, ‘Start Early, Stay Invested’ and ‘Beware of Investment Frauds’. CDSL has clarified that the messages must be displayed in a bilingual Hindi-English format and may be revised by SEBI from time to time. DPs have been advised to take note of the requirement and ensure timely compliance.
2.2. CDSL reiterates non-charging of AMC for certain Demat Accounts
CDSL has reminded DPs not to levy Annual Maintenance Charges ("AMC") on demat accounts that are marked as“To be Closed” and hold only securities that are illiquid, suspended from trading or delisted. To facilitate compliance, CDSL has shared DP-wise lists of eligible Beneficial Owners (BOs) based on information received from stock exchanges. CDSL has advised DPs to review the shared lists and ensure that AMC is not charged to such accounts in accordance with its earlier communiqué dated 30 September 2025. The depository has reiterated that DPs must comply with the prescribed requirements and take necessary action to ensure adherence to the non-charging framework.
2.3. NSDL notifies SEBI review of ISIN Framework for privately placed Debt Securities
National Securities Depository Limited (“NSDL”) has notified issuers and Registrar and Transfer Agents ("R&T Agents") regarding the SEBI circular dated 7 October 2026 reviewing the framework governing International Securities Identification Numbers ("ISINs") for debt securities issued on a private placement basis. NSDL has advised issuers and R&T Agents to take note of the revised SEBI requirements and ensure compliance with the updated framework. R&T Agents have also been requested to disseminate the circular to their client issuers. The SEBI review is aimed at revising the existing ISIN-related provisions applicable to privately placed debt securities and forms part of the regulator’s ongoing efforts to streamline debt market operations and facilitate efficient fund-raising through private placements.
2.4. NSE discontinues existing encryption mechanism for Interactive Messages across Trading Segments
National Stock Exchange of India Limited (“NSE”) has announced that the existing encryption mechanism for interactive messages in the Capital Market, Futures and Options (FO), Currency Derivatives (CD) and Commodity Derivatives (COM) segments will be discontinued with effect from 7 December 2026. The decision follows the phased introduction of the new encryption framework and the current coexistence period during which both the old and new encryption mechanisms are being accepted. NSE has advised members using National Exchange for Automated Trading (“NEAT”), NEAT Adapter and National Exchange for Financial Trading platforms to complete migration to the new encryption mechanism, including the version with MD5 check sum removal and the framework supporting immediate acknowledgement of order-related messages, before the discontinuation date. NSE has clarified that no extension will be granted beyond 7 December 2026 and has urged members to complete the migration within the prescribed timeline to avoid disruption of trading operations.
3. Information Technology & Data Protection
3.1. CERT-In issues critical advisory on multiple vulnerabilities in Microsoft products
The Indian Computer Emergency Response Team (“CERT-In”) has issued a critical security advisory regarding multiple vulnerabilities affecting Microsoft products, including Azure SRE Agent, Azure App Service for Linux, Azure API Center, Microsoft Bookings, Microsoft Dataverse, Azure Event Grid System and Microsoft Partner Center. The vulnerabilities could allow remote attackers to execute arbitrary code, elevate privileges, disclose sensitive information and conduct spoofing attacks on targeted systems due to improper authorisation, missing authentication, insufficient certificate validation and deserialisation of untrusted data. CERT-In has advised users and organisations to apply the appropriate security updates issued by Microsoft to mitigate the identified risks.
3.2. CERT-In issues critical advisory on multiple vulnerabilities in Google Chrome for Desktop
CERT-In has issued a critical security advisory regarding multiple vulnerabilities affecting Google Chrome for Desktop versions prior to 155.0.8059.79 for Linux and 155.0.8059.79/.80 for Mac and Windows. The vulnerabilities could allow remote attackers to execute arbitrary code, disclose sensitive information, gain elevated privileges, bypass security restrictions and cause denial-of-service (DoS) conditions on targeted systems due to security flaws affecting memory management, JavaScript processing and other browser components. CERT-In has advised users and organisations to update Google Chrome to the latest available version to mitigate the identified risks.
3.3. CERT-In issues critical advisory on incorrect privilege assignment vulnerability in Docker Hub
CERT-In has issued a critical security advisory regarding an incorrect privilege assignment vulnerability in Docker Hub. The vulnerability could allow an authenticated attacker to impersonate another user at the registry level and pull, push or delete container images within the scope of the impersonated user's permissions. The vulnerability arises from improper reassignment of personal access tokens (PATs) during Docker Hub account-to-organisation conversions, potentially enabling unauthorised access to container repositories and the publication of malicious container images under a legitimate user's identity. CERT-In has advised users and organisations to apply the appropriate security measures to mitigate the identified risk.
3.4. CERT-In issues critical advisory on multiple vulnerabilities in SAP products
The Indian Computer Emergency Response Team (“CERT-In”) has issued a critical security advisory regarding multiple vulnerabilities affecting various SAP products, including SAP S/4HANA, SAP NetWeaver, SAP Business Technology Platform and SAP Cloud Connector. The vulnerabilities could allow attackers to execute arbitrary code or commands, bypass security controls, gain unauthorised access, disclose sensitive information, manipulate data and cause denial-of-service (“DoS”) conditions on targeted systems. The vulnerabilities arise from security flaws, including improper access control, missing authorisation checks, server-side request forgery, code injection, memory corruption, cross-site scripting, open redirection and improper authentication. CERT-In has advised users and organisations to apply the appropriate security updates issued by SAP to mitigate the identified risks.
4. Taxation (Indirect & Direct)
4.1. CBDT notifies Protocol amending India–Mauritius Double Taxation Avoidance Convention
The Ministry of Finance, through Notification No. S.O. 5611(E) dated 13 October 2026, notified the Protocol amending the Double Taxation Avoidance Convention (DTAC) between India and Mauritius under Section 159(1) of the Income-tax Act, 2025. The Protocol introduces an entitlement-to-benefits provision under Article 27B, permitting treaty benefits to be denied where, having regard to the relevant facts and circumstances, obtaining such benefits was one of the principal purposes of an arrangement or transaction, unless granting the benefit is consistent with the object and purpose of the relevant treaty provisions. The Protocol entered into force on 10 August 2026 and its provisions take effect from that date. The amendment is relevant to cross-border investments and transactions involving Mauritius, as it strengthens scrutiny of arrangements undertaken to obtain treaty benefits.
5. Regulatory Enforcement (Securities and Exchange Board of India)
Authority | Name of the Entity | Amount | Contravention |
SEBI | Singularity AMC LLP
| INR 9,37,500 (Indian Rupees Nine Lakh Thirty-Seven Thousand Five Hundred only)
| Violation of Regulation 10(d) of the SEBI (Alternative Investment Funds) Regulations, 2012 read with Clause 11.1.2 of the Master Circular for Alternative Investment Funds dated 7 May 2024, due to failure to maintain the required continuing interest of the sponsor/manager in a Category III Alternative Investment Fund during specified quarters between September 2023 and June 2024. |
Disclaimer
The note is prepared for knowledge dissemination and does not constitute legal, financial or commercial advice. AK & Partners or its associates are not responsible for any action taken based on its contents.
For further queries or details, you may contact:
Mr Anuroop Omkar
Founding Partner, AK & Partners
Comments