SEBI inspects Alankit Assignments over IT security and service violations

This order details SEBI's adjudication proceedings against Alankit Assignments Limited, a Registrar to an Issue and Share Transfer Agent (RTA), for alleged violations of service timelines, code of conduct, and IT security standards observed during an inspection.

Who it concerns: Alankit Assignments Limited (PAN: AAACA9483E, SEBI Reg. No.: INR000002532)

What SEBI found or ordered

• SEBI inspected the company from Feb 24-27, 2026, and March 09, 2026, covering the period Sept 1, 2024 to Dec 31, 2025.
• Alleged delays in processing dematerialisation, rematerialisation, and investor grievances.
• Alleged use of correction fluid (whitener) on transfer deeds to modify original details.
• Alleged failure to enable Two-Factor Authentication (2FA) for firewall console access.
• Alleged insufficient Data Leakage Prevention (DLP) configuration, including accessible external file sharing sites and enabled USB access.
• Alleged weak password practices, specifically an admin user password set to '123456'.
• The company submitted a reply on September 02, 2026, arguing that some cited regulations were not in force during the alleged violations and that certain IT security allegations were mapped to incorrect regulatory clauses.

Also in the document

• The company argued that the RTA Regulations cited in the notice were notified on December 16, 2025, meaning they may not apply to events that occurred earlier in the inspection period.
• The company claimed that SEBI's Show Cause Notice incorrectly cross-mapped IT security findings (Data Leakage Prevention vs. Password Policy) to the wrong regulatory clauses.
• The document provided is truncated and does not contain the final penalty amount or the Adjudicating Officer's final decision on the allegations.