NSE DRHP risks: Derivatives reliance and SEBI overhang

Why NSE’s risk disclosures matter ahead of the IPO

NSE’s draft red herring prospectus (DRHP) places unusual emphasis on how sensitive the exchange’s earnings are to trading activity, especially equity derivatives. Because a significant portion of its income is linked to transaction charges, a sustained slowdown in volumes can translate quickly into weaker operating revenue. The filing also underlines that NSE operates as critical market infrastructure, which increases the cost of downtime, cyber incidents, and compliance gaps. Alongside business risks, the document highlights regulatory scrutiny, enforcement actions, and legal uncertainty that may affect cash flows and reputation. These disclosures are central for investors because they frame what can realistically disrupt a well-established exchange business. They also show where the biggest operational and governance pressure points sit today. The DRHP and related commentary repeatedly flag three themes: derivatives concentration, regulatory overhang, and technology resilience.

Derivatives dependence: the largest revenue concentration

A central risk disclosed is the concentration of operating revenue in derivatives (futures and options). For FY2026, derivatives contributed 78.65% of NSE’s operating revenue, with options alone accounting for 60.22%. The exchange explicitly links its earnings sensitivity to trading volumes because transaction charges form a meaningful portion of revenue. This makes NSE’s topline exposed to market cycles as well as rule changes that alter retail and institutional activity. The DRHP commentary notes that SEBI has been tightening the equity derivatives framework to curb speculation. If such measures reduce participation or change product economics, NSE’s transaction revenue can be hit through lower volumes, lower fee realization, or both. The filing frames this as a structural dependency rather than a short-term issue. It also implies that sustaining or growing volumes is not guaranteed in a changing regulatory environment.

SEBI and regulatory scrutiny: actions, penalties, and uncertainty

NSE states it has faced and continues to face enforcement actions, penalties, and judicial proceedings related to alleged violations under applicable SEBI regulations. It adds that outcomes of ongoing and potential future proceedings are unpredictable and could affect business, reputation, financial position, operating results, and cash flows. The DRHP also notes continuous supervision by SEBI, the Reserve Bank of India (RBI), and other regulators through inspections, audits, and compliance requirements. It discloses that SEBI has issued observations, show-cause notices, administrative warnings, deficiency letters, and advisory communications in the past. In addition to the broad enforcement risk, the filing and commentary highlight settlement-related costs already reflected in financial records. These include ₹643 crore in October 2024 related to Trading Access Point (TAP) architecture and ₹40.35 crore in July 2025 related to regulatory inspection findings. The co-location and dark fibre matter remains a notable overhang in the disclosures and discussion around the DRHP.

Co-location and “dark fibre” case: settlement costs and reputational tail

The DRHP commentary refers to the long-running co-location and dark fibre issue, where SEBI alleged certain brokers received preferential access. The exchange is described as being in the process of settlement with SEBI on this matter. One disclosure highlighted is that NSE has put aside ₹1,491 crore for the SEBI settlement related to the case. Separately, the provided material also notes that the filing moved forward after NSE settled prolonged co-location and dark-fibre cases with SEBI for over ₹1,388 crore. Taken together, these figures point to substantial, non-trivial regulatory costs tied to historical issues, even as the business continues to operate at scale. Beyond the cash impact, the DRHP frames the continuing uncertainty of proceedings and regulatory outcomes as a material risk. For investors, this section is less about one-time payments and more about the persistence of compliance and governance scrutiny around a systemically important institution.

Revenue concentration among top trading members

Another clear risk is dependence on a small set of large trading members. The exchange obtained 46.78%, 44.48%, and 45.26% of its operational revenue from its top ten trading members in FY2026, FY2025, and FY2024, respectively. NSE warns that any interruption to the services of these members, or their failure to onboard new trading members, could negatively affect operations. This concentration can amplify the impact of broker-level disruptions such as technology failures, financial stress, or changes in business strategy. Even without a market-wide volume decline, share loss among a few large members can reduce transaction revenue and weaken operating leverage. The DRHP positions this as a business continuity and revenue stability risk rather than a simple client concentration metric.

Technology resilience: outages, system risks, and vendor dependence

As an electronic exchange, NSE’s operations rely on IT infrastructure, systems, software, and telecom connectivity. The DRHP warns that issues, breakdowns, or shortcomings in its technology stack, including those attributable to external vendors, can harm business, reputation, and operating results, and may lead to SEBI-imposed regulatory measures or financial penalties. The filing cites a major disruption on February 24, 2021, when trading was halted for nearly five hours and 24 minutes due to telecom connectivity issues impacting critical systems. In addition, the exchange reported a high-volume cyberattack in May 2025. The material states these events did not cause material long-term damage, but they underscore operational vulnerability. NSE also notes dependence on external vendors for parts of essential infrastructure and software, exposing it to execution failures, interruptions, or fraud risks arising from third parties and intermediaries.

Cybersecurity and market integrity risks in a critical institution

The DRHP describes cyber threats including phishing, ransomware, denial-of-service attacks, and data breaches. For a market infrastructure institution, such risks can carry second-order effects such as delayed or failed trades, member losses, and supervisory intervention. NSE also depends on other market infrastructure institutions (MIIs) such as clearing corporations, depositories, and financial intermediaries to deliver services. Any disruption in these entities can cause transaction delays or non-execution and may lead to customer losses, affecting NSE’s reputation and operating results. The document’s framing is that resilience is not only an internal technology question but also a network risk across linked institutions. This is relevant because even strong internal systems may not fully insulate the exchange from failures elsewhere in the market plumbing.

Structural conflicts: regulator-like duties vs shareholder expectations

The DRHP commentary highlights a structural risk in NSE’s model: the exchange performs regulatory functions while also operating as a profit-generating business. It notes that regulatory duties may conflict with shareholder interests in some cases. This is an important risk disclosure because it shapes how the exchange may respond to market conduct issues, fee structures, and product governance. It also aligns with the broader theme of sustained regulatory supervision. For investors, it implies that business decisions may be constrained by market integrity priorities, even when a commercial path exists. The DRHP does not present this as a theoretical concern, but as an operating reality for an exchange at the center of India’s capital markets.

AI and algorithmic trading: new risks alongside new tools

The filing flags risks associated with the application of Artificial Intelligence (AI) and machine learning technologies, as well as AI-driven strategies used by market participants. It warns that these developments may adversely affect business, reputation, financial position, and operational results. The material notes NSE uses AI for monitoring and risk management, but flawed algorithms or data can lead to errors. It also states that the rise of AI-driven trading strategies and algorithmic trading could contribute to sudden price swings or create new methods of market manipulation that are harder to detect. Alongside this, the DRHP commentary links AI proliferation to higher cyberattack risk. This section reflects how exchanges increasingly have to manage both technology opportunity and technology-driven market conduct risk.

Funds, approvals, and compliance: costs that can pressure dividends

NSE notes it may need to make substantial payments to the Investor Protection Fund Trust (IPFT) and the Settlement Guarantee Fund (Core SGF). It warns such payments could reduce profitability and affect dividend distribution capacity. The filing also states there is no guarantee these funds will always be sufficient to cover investor claims or settlement responsibilities if clearing members default. Separately, NSE’s operations require statutory and regulatory approvals, licenses, registrations, and permissions that need periodic renewal and ongoing compliance, with a risk of delays or failure to secure renewals in time. The material also mentions that the company previously incurred late-submission fees due to delays in filing forms with the RBI for certain allotments, and it cannot guarantee there will be no legal or regulatory action in the future related to that matter.

Key disclosed metrics at a glance

What investors typically track from these risk factors

The disclosures point to a small set of measurable monitorables. First is the trajectory of derivatives volumes and any rule changes that directly affect options participation, since options alone accounted for 60.22% of FY2026 operating revenue. Second is system reliability and incident frequency, given the 2021 outage and the May 2025 cyberattack disclosure. Third is the path and cost of regulatory resolutions, including settlement-related provisioning and any further actions linked to legacy issues. Fourth is the business concentration among top trading members and how that evolves over time. The provided material also flags practical risks for retail investors in the unlisted market, including liquidity constraints and valuation sensitivity if unlisted prices imply an IPO valuation of ~₹5,00,000 to ₹6,00,000 crore.

Conclusion

NSE’s DRHP lays out a risk map dominated by derivatives dependence, regulatory and legal uncertainty, and technology and cybersecurity resilience. The concentration of operating revenue in derivatives and the reliance on a small group of top trading members are the most direct business sensitivities disclosed with numbers. The filing also shows how governance, settlement costs, approvals, and third-party dependencies can influence profitability and reputation. The next concrete signposts, as indicated in the material, will be regulatory observations and updates on pending settlement petitions and proceedings tied to connectivity and dark fibre matters.