Regulatory Guidance
SEBI Accessibility Audit Checklist for RTAs
A SEBI accessibility audit checklist for RTAs covering investor-service journeys, shared portals, downloadable forms, reporting attachments, and remediation verification.
What should a SEBI accessibility audit for an RTA include?
A SEBI accessibility audit for a Registrar to an Issue and Share Transfer Agent (RTA) should evaluate the investor-facing websites, portals, apps, and documents within the agreed scope. Follow representative service requests through authentication, instructions, form completion, document handling, and confirmation. Record barriers, assign remediation, and verify the changes before concluding on the assessed scope.
This checklist is for RTA compliance, operations, product, and technology teams preparing an assessment. The task examples are audit-planning recommendations, not a statement that every RTA offers every service or must introduce new functionality. Include the services the entity actually provides and document any exclusions.
Where do RTAs submit accessibility information?
Part D of SEBI's September 25, 2025 guidelines lists RTAs under direct submission to the Securities and Exchange Board of India (SEBI), with MIRSD as the concerned department. Part B specifies digital_acc@sebi.gov.in for those submissions. Confirm current instructions before filing.
Keep the RTA's registration details separate from those of an issuer or fund it services. A portal can involve several organizations without their assessments or submissions becoming interchangeable. Record who operates each interface, controls its content, supplies the software, and approves the final audit scope.
Build the scope around investor tasks, not only URLs
Start with a service inventory. Depending on the RTA's offering, this might include locating an investor-service form, accessing a folio, requesting a statement, updating information, tracking a request, or raising a grievance. A folio is an investor account record in the relevant service; use the terminology of the platform being assessed.
For each task, map the entry page, authentication steps, selected issuer or fund, required documents, confirmation, and help route. Public sitemaps are useful inputs, but they may miss private pages, error states, embedded services, and generated files.
- Record the registered entity, platform URL or app version, service owner, and external dependencies.
- Identify shared templates and materially different issuer or fund configurations.
- Provide approved test accounts with the roles and permissions needed for the selected journeys.
- List unavailable areas and document samples explicitly, rather than silently treating them as tested.
Which investor-service states deserve manual testing?
Test the complete task, including paths that do not succeed immediately. As an illustrative scenario, an investor selects an issuer, enters a reference number, uploads a supporting file, corrects a validation error, and receives an acknowledgement. A useful audit asks whether the person understands what happened at each step, not simply whether the final page loads.
Combine automated checks with keyboard, screen-reader, zoom, and responsive-layout evaluation. Use controlled accounts and agreed environments; avoid submitting real financial instructions or changing live investor records during an assessment.
- Issuer and service selection: identify controls, understand the selected option, and move through dependent fields.
- Authentication: operate the available steps and recovery routes without bypassing security controls.
- Data entry: understand field labels, required information, instructions, and corrections.
- Uploads: select or replace a file and understand format, size, progress, and rejection feedback.
- Completion: locate the acknowledgement, reference number, next action, and request-tracking route.
- Support: find and use the accessibility assistance or grievance channel.
Can investors perceive upload and request-status messages?
A portal might show a green confirmation or a brief error notice without moving keyboard focus. Check whether an assistive-technology user receives the equivalent information. WCAG Success Criterion 4.1.3 addresses qualifying status messages that need to be programmatically available without receiving focus; it does not mean every page update must become an interruption.
For an upload, examine both success and failure. An investor should not have to infer whether the file was accepted from a color change alone. Record the exact event, visible message, focus location, and screen-reader behavior. That evidence helps a developer distinguish a missing announcement from an unrelated navigation problem.
Which forms and documents belong in the sample?
Include the documents necessary to understand or complete the selected services. Depending on what is provided, examples could include investor instructions, service-request forms, statements, acknowledgements, or notices. Treat a downloadable form and a portal-generated document as separate outputs, even when they carry similar information.
Review text availability, headings, reading sequence, links, table relationships, meaningful image alternatives, and interactive fields where present. W3C's PDF3 technique illustrates logical reading and tab order. Selectable text alone does not demonstrate that the document's structure works for assistive technology.
Record the file version, language, source template, and generating system. A repaired sample is useful, but remediation should also address the authoring or export process so the next document does not repeat the barrier. Protect investor identifiers in shared examples and evidence.
How should standards and methods be stated?
SEBI's July 2025 directions name Web Content Accessibility Guidelines (WCAG) 2.1 or the latest version, current Guidelines for Indian Government Websites (GIGW), IS 17802, and the Rights of Persons with Disabilities framework. The audit direction also includes usability testing by persons with disabilities.
Agree the applicable versions, requirements, test environments, sampling approach, and evaluator responsibilities in writing. Distinguish automated findings, manual evaluation, and user-testing observations. A clean scan is not a conclusion about every relevant requirement, and a severity rating is not a substitute for a conformance decision.
W3C's WCAG conformance requirements address full pages and complete processes. Do not use one tested step to claim that an entire service conforms. State what was assessed, what remained inaccessible or unavailable, and what evidence supports the conclusion.
How can shared-platform findings be made actionable?
An RTA may use common software across several issuer or fund configurations. Group recurring defects by the responsible component, but preserve the affected configurations and task examples. A template fix may resolve many occurrences; it still needs verification where content, validation, or configuration changes behavior.
For example, if a shared file-upload control does not expose its error, assign the component fix to the platform team and identify the services using it. After implementation, retest the original failure and a justified selection of affected configurations. Keep configuration-specific defects separate rather than closing them because the shared library changed.
- Give each issue a stable identifier and a clear description of the investor impact.
- Include the role, service, URL or document version, environment, and reproduction steps.
- Map the finding to the applicable requirement and identify expected versus observed behavior.
- Record the remediation owner, release, retest date, result, and any remaining limitation.
What belongs in C3 and C4 submissions?
Table C3 records initial-audit details; Table C4 records final-audit details, remediation, compliance status, and evidence. The September guidelines require separate scope and consolidated report attachments. Neither table is the audit report itself.
Maintain a submission register linking each table to the correct report version and supporting files. Match platform names to the agreed inventory. Reconcile unresolved findings with the declared status, and use the department-based naming convention in the official instructions rather than improvising filenames.
Which timeline should the team confirm?
The July 31, 2026 SEBI extension moved the audit and remediation timeline to October 31, 2026, as confirmed in NSE circular COMP/75511 carrying the SEBI circular. This article is dated October 28, 2026. Check for later instructions before relying on that date; the NSE reference confirms the extension, not an exchange submission route for RTAs.
Keep scheduling separate from the audit conclusion. A deadline does not justify marking an untested release as remediated. If evidence is incomplete, record the actual status and have the responsible compliance team determine the appropriate submission approach.
What should be ready for the final review?
Use the final review to trace the result from the investor task to the report evidence. The following is a practical handover checklist, not a replacement for SEBI's prescribed formats.
- Entity details, platform inventory, selected journeys, and exclusions are consistent across the engagement documents.
- Relevant forms, authenticated states, generated documents, and support routes have recorded coverage.
- Findings identify user impact, reproducible steps, requirement mapping, and accountable owners.
- Remediation claims link to tested releases and dated verification results; open items remain visible.
- C3/C4 tables reference the appropriate attached reports and evidence.
- A named reviewer has checked the submission against current instructions and the actual audit outcome.
Official sources and next steps
SEBI digital accessibility directions, July 31, 2025, including standards and audit methods: https://www.sebi.gov.in/sebi_data/attachdocs/aug-2025/1754651443956.pdf
SEBI reporting formats and RTA department mapping, September 25, 2025: https://www.sebi.gov.in/sebi_data/attachdocs/sep-2025/1758794128066.pdf
NSE circular carrying SEBI's July 31, 2026 timeline extension: https://nsearchives.nseindia.com/content/circulars/COMP75511.pdf
W3C explanation of status messages: https://www.w3.org/WAI/WCAG22/Understanding/status-messages.html
W3C PDF reading-order technique: https://www.w3.org/WAI/WCAG22/Techniques/pdf/PDF3
W3C WCAG 2.2 conformance requirements: https://www.w3.org/TR/WCAG22/#conformance-reqs
To prepare an RTA accessibility audit with IAAP Audit, bring the platform inventory, representative service journeys, approved test access, and document samples. These inputs help define a useful scope, assign remediation responsibilities, and plan evidence-based retesting.