The National Stock Exchange (NSE) has flagged a wide range of risks to its business from regulatory changes and technology failures to cyberattacks and artificial intelligence-related challenges in its draft IPO papers, while highlighting its heavy dependence on derivatives trading for revenue, according to a PTI report cited by Business Today.
Revenue concentration on derivatives
The disclosures, made in the draft red herring prospectus (DRHP) filed with the Securities and Exchange Board of India (Sebi), come as the country's largest exchange prepares for a public issue estimated at about Rs 30,000 crore, which could become India's biggest-ever IPO. According to the draft papers, transaction charges accounted for 78.65% of NSE's operating revenue in FY26, with options trading alone contributing 60.22% of total revenue from operations.
| Revenue Source | Percentage of Operating Revenue (FY26) |
|---|---|
| Transaction charges | 78.65% |
| Options trading (within transaction charges) | 60.22% of total revenue |
The exchange said recent measures introduced by Sebi to tighten the equity derivatives framework had already moderated trading activity across both cash and derivatives segments, affecting trading revenues during FY26. NSE cautioned that further regulatory tightening, higher transaction taxes, changing investor preferences or a shift towards alternative asset classes could hurt trading volumes and profitability.
Regulatory risks and ongoing scrutiny
The exchange also pointed to continuing regulatory scrutiny, noting that it remains subject to inspections, investigations and enforcement actions by Sebi. According to the DRHP, NSE has received show-cause notices, warning letters, deficiency letters and advisory communications from the regulator on issues relating to operations, governance, technology and compliance.
The bourse disclosed that it paid over Rs 643 crore in October 2024 to settle proceedings linked to its Trading Access Point (TAP) architecture and network connectivity, and another Rs 40.35 crore in July 2025 under a settlement order arising from regulatory inspection findings. It also noted that legal and regulatory proceedings related to the co-location and dark fibre matters remain unresolved and could have reputational as well as financial implications. NSE also highlighted concentration risks, noting that its top 10 trading members account for a significant share of trading activity.
Technology failures and cyber threats
Given its fully electronic trading ecosystem, NSE identified technology outages and cybersecurity incidents as key operational risks. The exchange said it has experienced website outages, market data dissemination glitches, login disruptions and derivatives-related information errors in recent years. It also recalled the February 2021 technical outage that affected critical risk management, clearing, settlement and surveillance systems, leading to a trading halt across all market segments for more than five hours.
On the cybersecurity front, NSE disclosed that its website was targeted by a distributed denial-of-service (DDoS) attack in May 2025 involving nearly 395 million hits within 11 minutes. While operations were not materially affected, access to some webpages slowed during the incident.
Artificial intelligence as an emerging risk
The exchange also identified artificial intelligence and machine learning as emerging risk areas. NSE said that while AI is increasingly being used for surveillance, risk management, analytics and customer service, flawed algorithms or poor-quality data could generate inaccurate or biased outcomes, leading to operational failures, financial losses or regulatory breaches.
"The proliferation of AI-driven and algorithmic trading strategies... may amplify market volatility, contribute to sudden and severe price dislocations, and give rise to new forms of market manipulation that are difficult to detect," the draft papers noted.
The exchange further warned of AI-powered cyberattacks, deepfake-enabled impersonation, data leakage through third-party AI tools and vulnerabilities created through AI-assisted coding. According to the DRHP, evolving regulations around AI could also result in stricter compliance obligations, including requirements relating to governance, transparency, explainability and auditability of AI systems deployed in financial markets.
Implications for investors and market participants
For finance executives and treasury professionals tracking capital market infrastructure, the NSE's IPO disclosures underscore the operational and regulatory risks inherent in a derivatives-heavy business model. The concentration risk from top trading members and the exchange's exposure to Sebi's evolving regulatory framework may influence how investors price the IPO. The recent settlement payments — totalling over Rs 683 crore between October 2024 and July 2025 — highlight the cost of past compliance issues. Moreover, the technology outage and DDoS attack demonstrate that even India's largest exchange faces significant cybersecurity threats. The caution around AI-driven trading volatility and manipulation risks is a reminder for market participants to reassess their own risk management frameworks in an increasingly automated trading environment.
Sources:
