Amid the artificial intelligence (AI) boom, the National Stock Exchange (NSE) has flagged that AI threats could adversely impact its business and financial condition.
In its draft red herring prospectus (DRHP) filed with market regulator Sebi on Wednesday, the country’s largest stock exchange said its risk management framework and insurance policies “may not be effective or adequate” and that its plans on disaster recovery “may not be sufficient” for all risk scenarios.
The exchange also warned that regulatory changes as well as its significant dependence on derivatives trading revenues could materially affect its financial performance and business operations.
Regulatory Sandbox
It said the evolving regulatory framework around AI could also increase compliance requirements, with regulators potentially introducing new norms on governance, transparency, explainability and auditability of AI systems used in financial markets.
NSE relies heavily on complex electronic systems and real-time data processing for critical business operations such as trading, clearing, and settlement of transactions. “There can be no assurance that our ongoing or future technology investments will achieve their objectives or result in the expected returns,” it said.
The bourse had reported certain operational failures and system-related issues between FY24 and FY26. NSE said it was not denied any insurance coverage for which it had applied during this period.
NSE also intends to continue developing its AI capabilities. In FY26, its IT capital expenditure of Rs 422 crore accounted for 72% of its overall capital expenditure. Technology expenses increased over 60% from FY24 to Rs 1,314 crore during the period, accounting for almost 8% of its revenue from operations. While not material, the initial public offering (IPO)-bound company had incurred costs on technology-related projects which were later discontinued.
Supply Chain Vulnerabilities
The stock exchange also uses third-party tools for data leakage prevention and data encryption. Its reliance on such platforms accounts for a significant proportion of which are developed and hosted outside India. “Disruptions, capacity constraints, technology failures, or performance lapses by third parties could disrupt our operations, impair trading activity, or result in regulatory sanctions, reputational harm, litigation, loss of market share, and loss of revenues,” it said.
The company had reported conflicts with third-party vendors in the past. In 2023, one of the vendors, which was supposed to provide technology infrastructure management services, invoked the termination clause three years after signing the five-year contract.
AI systems may be vulnerable to adversarial manipulation, such as AI-enabled cyberattacks, AI-powered social engineering, and risks from inadequately governed AI tools, NSE said. Currently, all generative AI model initiatives of the company are conducted within its own data centres without reliance on publicly-hosted large-language model platforms for sensitive data processing.