What Is a Qualified RTA (QRTA)? SEBI's 2 Crore Test

A qualified RTA is a registrar large enough that SEBI treats its failure as a market problem rather than a company problem. The test is folio count. Cross it and a registrar inherits a policy framework, a board approved risk management policy, and recovery deadlines measured in minutes. This page sets out how a qualified RTA is categorised, how long the label sticks, and what the enhanced obligations actually require.

How is an RTA categorised as a qualified RTA?

Paragraph 11.1 of the RTA master circular states the test in one sentence: an RTA shall be categorised as a QRTA if at any time during a financial year the combined number of physical and demat folios being serviced by the RTA for listed companies exceeds 2 crore.

Three details in that sentence do real work. "At any time during a financial year" means a single day above the line is enough. "Combined physical and demat" means a registrar cannot stay below the threshold by pointing at its shrinking physical book. And "for listed companies" scopes the count to listed issuers rather than the registrar's total business.

The registrar reports itself. On being categorised, an RTA must send an intimation to SEBI within 5 working days.

How long does the QRTA label last?

Three financial years, and shrinking does not get you out. An RTA is considered a QRTA from the date of categorisation and for the next 3 financial years, irrespective of a subsequent fall in the number of folios, and remains liable to comply with all requirements specified from time to time.

New QRTAs get one concession. Because the systems and procedures take time to stand up, a period of 60 days from the date of categorisation is provided for complying with the enhanced requirements.

What does a QRTA have to put in place?

A comprehensive policy framework approved by the board of directors. The modality is worth reading precisely, because the circular splits it: paragraph 11.4 says QRTAs are advised to formulate and implement that framework, and 11.4.1 says they are advised to establish the risk management policy, while 11.4.2 says they are required to comply with the business continuity and disaster recovery framework. The recovery clock is mandatory; the policy framework around it is written as advice.

A risk management policy, advised to be clear, thorough and documented, covering:

• an integrated view of risks to the QRTA, including risks from vendors, outsourced third parties and clients
• a list of all relevant risks, expressly including operational, fraud, technology and cyber security risk, plus general business risks including credit, market, legal and reputation risk "as the BoD of QRTAs deems fit", with the systems and procedures to identify, assess, monitor and manage them, and audit and reporting of the same to the board
• named responsibility and accountability for risk decisions, and a decision making process for crises

A business continuity and disaster recovery framework, this one required rather than advised, with a primary data centre, a disaster recovery site and a near site, staffed so the DR site can run live operations independently at short notice without help from primary site staff.

The recovery clock is the sharpest obligation

For a QRTA servicing asset management companies, SEBI names the critical systems, indicatively, as accepting and processing transactions end to end including purchase, redemption and dividend payment, connectivity with AMCs, and NAV calculation processes. If any of them is disrupted:

1. The QRTA must declare the incident a "Disaster" within 30 minutes.
2. It must restore operations, including from the disaster recovery site, within 45 minutes of that declaration.
3. The recovery time objective is therefore 45 minutes.
4. The recovery point objective, the maximum tolerable period of data loss, is 15 minutes.

Replication between the primary data centre and the near site must be synchronous to ensure zero data loss; replication to the disaster recovery site may be asynchronous. Systems must be designed so no configuration change is needed at the AMC's end to switch over.

Testing is not annual, and the circular frames this clause with "should" rather than "shall". DR drills should be conducted quarterly, close to real trading day conditions and with minimal notice to DR site staff, and the drill should include running all operations from the DR site for at least one full trading day. QRTAs should also conduct unannounced live operations from the DR site for at least one day, on a normal working day rather than a weekend or trading holiday, in every three months, at 45 minutes notice. During drills, the staff based at the primary data centre should not be involved in supporting operations in any manner. Results are documented and placed before the board, and the annual system auditor checks DR preparedness as part of the mandated system audit.

Why the QRTA tier matters to an investor

Because the registrar is where the folio lives. A registrar processes transmission claims, KYC and nomination updates, dividend and corporate action execution, and the folio records that decide whether a claim is even actionable. The QRTA rules are the reason the largest of them carry a 45 minute recovery deadline rather than a best-efforts one.

If you need to know which registrar holds a particular company's folio, and what state your own record is in, that lookup is in how to check RTA and folio details. On the demat side the equivalent counterparty is the depository participant, and the holdings themselves show on the depository holding statement.

So a qualified RTA is a size-triggered regulatory tier: over 2 crore folios, in for three years, with recovery measured in minutes and drills you cannot schedule around.

Flock reports the filings themselves, each one dated and linked to its source. What any disclosure means for your money is your call to make. Not investment advice.