.png)
Ananya Dutta and Rahul Ranjan*
Part One has extensively dealt with the Draft Directions, and its failure to account for the regulation of cryptocurrencies. We continue the analysis of the Draft Directions, by looking into its approach on Data Localization, and its implications for India’s Data sovereignty. Further, we propose the inclusion of Over-the-counter derivatives into the regulatory framework proposed by the Draft Directions.
A) Vouching for Data Localization
The Draft Directions make a departure from the 2018 Directions by expanding the scope of regulatory oversight to offshore ETPs. However, they maintain continuity with the 2018 Directions regarding the essentials provided under the “Eligibility Criteria” or in the requirements pertaining to preservation, access and use of data. Currently, ETPs are required to maintain all data regarding its activities for a minimum of ten years in easily retrievable media and ensure strict control over access as well as confidentiality and security of such data. Additionally, notwithstanding the minimum storage mandate, in case of an investigation by the RBI or any other competent authority approbated by any Indian law, the data related to the investigation must be stored for a minimum of three years after the investigation. However, the Central Bank has refrained from suggesting the nature, location or other modalities of such storage.
It is interesting to note that the draft of 2018 Directions proposed that all trade generated data ought to be stored for at least twenty years within India and could only be exported out of its territorial jurisdiction with prior permission of the RBI. They also prohibited the use of data generated by the ETP platform or its sharing by the ETP operator for any purpose other than as authorised by the RBI. Further, they permitted such use or share in case of separate bilateral agreements of the ETP with its members but clarified that such an arrangement was excluded from being part of the general conditions of access for members. However, the requirement of such data localization was ultimately not incorporated in the 2018 Directions and does not find a place in the 2024 Draft Directions as well.
This development appears to mirror the hesitation shown in the incorporation of data localization obligations into the Digital Personal Data Protection Act (DPDP Act), 2023 even though such mandate had initially been provided under the DPDP Bill owing to objections by conglomerates of the tech-industry who flagged increased operational costs attached to localization mandates.
It is important to note that simply mandating that data access be strictly controlled by ETP operators may not sufficiently address the significant risks associated with a completely open approach. By only mandating that data access be strictly controlled by ETP operators without setting any parameters for date storage or processing, the RBI has created an easily accessible data regime. However, there are significant risks associated with a completely open approach as evident in the example of the European Union (EU). The EU permitted transnational data transfers to non-member countries, upon determination of adequacy of those countries’ level of data protection. However, this policy has proved inefficient as revealed by the years of back and forth concerning the adequacy of the data protection regime of the U.S.A., a non-member country. This issue has only been marginally addressed by the European Commission’s issuance of standard clauses for international data transfers. Ultimately, with the introduction of such clauses, even the EU has moved onto a more structured data regime compared to its earlier stance. However, it remains to be seen whether such clauses will prove to be efficacious in resolving the conundrum between sovereignty and accessibility.
This highlights the broader issue of balancing national security with the benefits of collaboration. The Joint Parliamentary Committee Report on the DPDP Bill had stressed on the importance of such balance, recognizing the needs of national security alongside the benefits of collaboration. While innovation is inherent to economic growth, the risks of unregulated cross-border transfer of data cannot be overstated. This was reiterated by the Report of the Committee of Experts headed by Justice B.N. Srikrishna.
In addressing this conundrum, India has implemented sector-specific laws which require category specific localization. For example, the RBI mandates storage of data concerning payment systems within India itself. Similarly, the Securities and Exchange Board of India (‘SEBI’) requires that financial institutions utilizing Software in the form of Service Based Solutions for compliance functions must store specific critical data sets relating to risk data, system information, audit data etc., within India.
While we acknowledge that highly stringent provisions might impede the ease of doing business, it is important to recognize that data localization can be more flexible than merely physical storage within India. For example, the data protection regime of China requires the organizations and people who process personally identifiable information to clarify the source of data and disclose any sharing agreements with third-party processors or other entities with regulators.
Further, the understanding of localization should be expanded to encompass storage of data in a cloud environment located within the borders of a particular country. SEBI’s Framework for Cloud Services’ adoption by REs can serve as a valuable reference for guidance. The framework requires that data relating to regulated entities should be stored in cloud services accredited by the Ministry of Electronics and Information Technology (‘MeitY’), and confined within India’s legal jurisdiction. In case of a foreign parent of such regulated entity, it mandates the accessibility of original data in India with the possibility of storage of copies of that data abroad.
Additionally, it is important to highlight that localization provides additional benefits to the economy, especially in a developing country. Technology-based foreign direct investments have only grown in India despite increase in data localisation norms and they provide a unique opportunity of gaining a competitive advantage in tapping a sizeable market in India and creating customer-needs driven business formula. It also supports the expansion of digital infrastructure by promoting server localization, leading to an overall growth of the digital industry with increased presence of skilled professionals and greater connectivity. This massive revenue potential is as yet unrealized in India. A step in this regard, would further provide a competitive advantage to local entities hoping to set up ETPs who would be facing cut-throat competition from offshore ETPs with a notable global presence after implementation of the Draft Directions.
It is also important here to distinguish the situation of imposing data localisation mandates on platforms which have already been operating in India for many years, as in the case of introduction of DPDP, as compared to the imposition of this norm on international players yet to enter the Indian market as under the Draft Directions. India is already growing as an attractive market for data centres and the median cost of constructing and operating data centres is significantly lower than several other countries. Regulatory standards required of financial institutions would always be higher than of media-based data fiduciaries, which is evidenced by the Draft Directions’ mandate that off-shore ETPs must be incorporated in a country that is a member of the Financial Action Task Force. Consequently compliance with norms could be a cheaper alternative than running the risk of bans, fines and protracted litigation. Ultimately, while stricter data localisation mandates may still run the risk of increasing costs for some off-shore platforms looking to enter the Indian market, it is likely have an overall net positive impact on data security; providing an edge to Indian ETP operators, boosting Indian digital infrastructure and industry, and growing the Indian investment market.
Given these benefits and the need for regulatory balance, we suggest that the requirements of data localization should form part of the eligibility criteria for authorisation, as well as form further layers of the compliance regime. The imposition of local cloud-based storage requirement coupled with allowance of standardized global processing of data could bring in the most positive outcome. Based on scientific evaluation of the costs involved, the time required for such compliance may be determined and the compliance status of localization mandates should form part of the mandatory annual report under paragraph 13 of the Draft Directions.
Consequently, we propose that the RBI ought to modify and create additional provisions under paragraph 12 of the Draft Directions relating to the preservation of data. In addition to existing provisions, the RBI should direct all onshore ETPs to ensure that the storage of all trade related data is carried out through cloud-based services empanelled by the MeitY. For ETPs that have received authorisation under the previous Directions, a transitional period of certain duration from the time that the Draft Directions take effect could be provided. Further, onshore and offshore ETPs which will receive in-principle approval under the Draft Directions should be required to show their willingness to engage with such cloud-based services as a precondition of the grant of approval. Further authorisation of the ETPs should be conditional upon providing proof that the data storage for at least their Indian members has been assigned to such approved cloud services. The RBI should also add further benchmarks of data localization, such as storage of original copies of all trade-related data by offshore ETPs in empanelled Indian cloud services within a set timeline. These requirements would protect India’s data sovereignty exigencies, provide increased transparency and allow greater oversight to the RBI, especially in terms of derivative instruments traded transnationally which would help it to keep a check on the INR exchange rate.
IV. WAY FORWARD
OTC Market: A Missed Opportunity
The preceding parts of this article discussed specific gaps in the Draft Directions, which are the regulatory issues surrounding the implementation of cryptocurrency trades and the potential for leveraging opportunities arising from data localization. Looking at a wider perspective, this part considers the additional scope of utilisation of ETPs and the necessary regulations to be brought in for it. Though not directly linked to the immediate implication of the Draft Directions, the RBI could consider making ETPs a more viable part of the OTC derivatives market. Such measures may help fix the long-existing transparency issues in the same and strengthen the all-round integrity of the market.
OTC derivatives are investment instruments whose value is based on underlying assets. They are not traded on traditional exchanges, but are directly negotiated between parties, such as financial institutions or even individual investors and may sometimes be traded on ETPs. To foster more transparency and mitigate the risk of counterparty default in this market, the RBI released a set of directions putting in stringent requirements for margin calculations including initial margin as well as variation margin, eligible collateral, and robust risk management into effect. This shows that the RBI has been proactive in its approach when it comes to the OTC derivative market, but it has shied away from usage of ETPs as a solution.
When the global economy began to rebound after the financial crisis of 2007-2008, derivatives market began to be viewed as a potential threat to the economic stability owing to lack of its regulation leading to accumulation of large unmonitored exposures and operational challenges. Consequently, leaders of the G20 countries pledged to reform the derivatives market, one of such reforms included trade of standardized OTC derivatives through exchanges or ETPs.
Currently, India has not taken steps in this direction but other G20 countries like Indonesia have accelerated their efforts to mandate transaction of standardized OTC derivatives through ETPs or exchanges. In a similar vein, Dodd-Frank Wall Street Reform and Consumer Protection Act which was brought in the U.S.A. after the financial crisis, has addressed various aspects of the financial system, including the establishment of centralized exchanges for the regulation of derivatives like credit default swaps. Presently, American law makers are pushing for standardized OTC derivatives to be traded on exchanges or through regulated entities, such as “Alternative Swap Execution Facilities” (‘ASEFs’), to enhance market efficiency. These ASEFs aim to provide greater transparency and flexibility, offering a more tailored trading environment compared to centralized exchanges.
After liberalization, India has ascended to become one of the foremost leading economic powerhouses. Though the 2008 financial crisis was not that adverse for the Indian banking sector owing to its limited operations outside India at the time, the global economy at present, has become more integrated than ever with the Indian Rupee being recognised for its potential for internationalization. Given this background, it becomes imperative that the RBI take steps to strengthen the OTC derivative market to further facilitate internationalization of the Rupee.
Herein we propose that regulations must be introduced to mandate trade execution of standardized OTC derivative transactions exceeding a certain value to be carried on ETPs. Such a step would lead to a regulation in the OTC derivative market while ensuring that the flexibility is not altogether compromised. Initial regulations can be brought in phases, firstly focusing on the standardized transactions involving those asset classes that enjoy dominant position in the Indian derivatives market like the FX and interest rates. This could be followed by a comprehensive mandate to cover additional asset classes and further standardization of market practices. This phased approach would balance regulation with flexibility, enhancing market oversight while accommodating the needs of various participants.
Such a step would offer several advantages. Mandating the use of ETPs addresses SEBI and RBI’s concerns about excessive speculation by the retail investors in the derivatives market. This would be achieved through the platforms’ enhanced monitoring, supervision, and reduced information asymmetry. Additionally, through exposure of bids and offers to a broader range of participants, there would be greater transparency and liquidity on ETPs. This will lead to a more accurate and timely price discovery, providing better pricing for market participants. Moreover, such a mandate can shift away from “trapped” OTC transactions, where value of derivatives remain inefficiently locked due to limited transparency and competition.
Furthermore, if more Indian residents engage in such exchanges through ETPs, the RBI, by virtue of the Draft Directions, would gain greater visibility and leverage to oversee and manage the market effectively. This would effectively extend the benefits of the Draft Directions to the OTC derivatives market. With improved transparency and data from ETPs, the RBI would be better positioned to monitor and mitigate systemic risks. Consequently, this will strengthen financial stability and market integrity.
V. CONCLUSION
RBI’s Draft Directions mark a significant step towards enhancing regulatory oversight, transparency, and stability in the electronic trading ecosystem, especially with the inclusion of offshore ETPs. Through the introduction of a more structured approval process, and imposition of stricter auditing requirements, these regulations aim to bolster market integrity. However, the framework’s ambiguity regarding cryptocurrency trade execution needs to be addressed. This could be an opportunity to bring in regulations for offshore ETPs that allow Indian residents to carry out such transactions, pertaining to their operational aspects. Additionally, the lack of emphasis on data localization, despite proven benefits for national security and digital infrastructure, represents a missed opportunity for India to assert greater control over its financial data. Incorporating a balanced data localization mandate in the form of another layer of compliance within the ETP framework could foster growth in digital infrastructure while ensuring India’s data sovereignty.
While the Draft Directions offer comprehensive solutions for securities and derivatives markets, they fall short in addressing the transparency concerns surrounding OTC derivatives trading. Leveraging ETPs to regulate OTC derivatives enhances oversight, mitigates risk, and align India with its obligation as a G20 country which ensures that the country’s financial markets remain robust and transparent. Thus, while the Draft Directions bring forward much-needed reforms, further enhancements in cryptocurrency regulations, data localization, and OTC market integration could pave the way for a more secure and transparent financial environment.
*Ananya Dutta is a 3rd Year BA LLB (Hons.) student at National Law University, Odisha. Rahul Ranjan is a 3rd Year BBA LLB (Hons.) student at National Law University, Odisha
Comments