DP Audit NSDL & CDSL: Documents and Evidence
Most delay on DP Audit NSDL & CDSL comes down to paperwork that was not ready, so it is worth knowing what will be asked for. The questions below are the ones raised most often in practice; the full scope of the service is on the DP Audit NSDL & CDSL page.
What exactly does a DP auditor test?
The audit covers the full depository operations lifecycle: account opening and KYC compliance, dematerialisation and rematerialisation of securities, off-market and on-market transfer instructions (including DIS and e-DIS controls), pledge and margin pledge processing, Power of Attorney usage, nomination, transmission on death of an account holder, account closure, grievance redressal, and the DP's internal controls and record-keeping around all of the above.
In practice: We test each area against a risk-based sample, not a token handful of files. Account opening and DIS/POA controls are typically where the most consequential exceptions surface, because they touch client authorisation directly.
Is the DP audit report made public or shared with clients of the DP?
No. The DP audit report is a confidential submission made to the concerned depository (NSDL and/or CDSL) as part of the DP's regulatory reporting obligations. It is not a public document and is not routinely shared with the DP's individual clients.
In practice: That said, in the event of a client grievance or arbitration, relevant extracts or the underlying findings can become relevant evidence — which is another reason the audit needs to be conducted rigorously and documented properly, not treated as a low-stakes formality.
What if our DP audit uncovers a serious issue, like unauthorised transfer of client securities?
A serious finding — such as evidence of unauthorised transfer, POA misuse beyond its permitted scope, or a material control breakdown — is reported to the depository as a significant exception, and the DP is expected to take immediate corrective and, where relevant, client-remediation action. Depending on severity, the depository may escalate the matter to SEBI. PNPC documents such findings factually and supports the DP's compliance officer in preparing an appropriately serious response.
In practice: We do not soften the classification of a serious finding to make the report look better — that only shifts the problem to a later, more damaging discovery. Our engagement letter is explicit that findings are reported as assessed.
Does PNPC only serve DPs in South India, or can it audit a DP with a pan-India branch network?
PNPC's capital-market audit practice operates from our Chennai, Bangalore, and Hyderabad offices, and we coordinate fieldwork across branch locations outside these cities as required by the engagement, including remote/digital evidence review for branches where an on-site visit is not practical for every cycle.
In practice: For DPs with a wide branch footprint, we agree an on-site versus remote-review sampling plan upfront, so coverage across locations is documented and defensible, not left to convenience.
Does the DP audit cover freeze and unfreeze instructions on client accounts?
Yes. Where a client account has been frozen — whether on the client's own request, on instruction from a regulatory or law-enforcement authority, or under the depository's own risk framework — the audit checks that the freeze was applied and lifted only on proper authorisation, and that the DP's records clearly evidence who authorised each freeze or unfreeze action and why.
In practice: Freeze/unfreeze authorisation is an area where informal, undocumented instructions sometimes slip through, particularly for urgent requests. We test specifically for a documented authorisation trail, not just the system log of the action itself.
What records must a DP retain, and for how long, to support a future audit?
DPs are required to maintain proper records of client accounts, transactions, and related documentation as prescribed under SEBI and depository regulations and record-retention circulars. Retention periods vary by document type and applicable regulation. PNPC advises clients to confirm current retention requirements with reference to the specific SEBI/NSDL/CDSL circulars in force, since these have been updated over time and vary by record category.
In practice: We flag any record we cannot locate during an audit as an exception in its own right — a documented control that cannot be evidenced is, for audit purposes, treated the same as a control that did not operate.
Where this sits in the wider engagement
DP Audit NSDL & CDSL rarely arrives on its own. The statutory basis and the current requirements are set out on the DP Audit NSDL & CDSL service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On DP Audit NSDL & CDSL we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.