Digital Law Weekly Tracker: W38 2026 — TRAI Writes AI/ML Spam Detection Into Binding Regulation With a New Regulation 21A, RBI Opens KYC Certification to Foreign Portfolio Investors, and CERT-In Logs a Cisco Identity-Infrastructure CRITICAL Cluster

India's digital-law week of 14 to 20 September 2026 produced its most consequential development at the telecom regulator, not at MeitY or the data-protection regime. On 18 September 2026 TRAI notified the Telecom Commercial Communication Customer Preference (Third Amendment) Regulations, 2026, inserting a new Regulation 21A that writes AI/ML-based spam detection and inter-operator intelligence sharing into binding law, with graded enforcement up to one-year disconnection and blacklisting. The same day, RBI extended a certified-copy KYC facility to Foreign Portfolio Investors. CERT-In logged thirteen vulnerability notes, with a CRITICAL cluster concentrated in Cisco identity and firewall infrastructure.

At a Glance — W38 Scoreboard

TL;DR for Founders

Three things to act on this week:

1. If your business places automated or bulk voice calls — appointment reminders, marketing, collections, robocalls of any kind — you now have a pre-declaration obligation to your telecom provider under the new Application-to-Person (A2P) category. An undeclared A2P call is treated as UCC, with the full Regulation 21A enforcement track attached, up to disconnection.

2. If you use SMS/voice headers or content templates for commercial communication, misuse triggers a six-hour suspension clock for your access provider and can end in a one-year, all-provider disconnection if a telemarketer is responsible. Audit who at your organisation controls header/template registrations.

3. If you are an FPI or bank serving FPIs, KYC document certification can now route through an overseas notary, court, or Indian embassy/consulate rather than a process routed through India — a genuine operational simplification, not a compliance relaxation.

Top 3 Developments

1. TRAI Turns Voluntary AI Spam Detection Into Binding Law (Telecom, Crypto and Emerging Tech)

What happened: On 18 September 2026 TRAI notified the Telecom Commercial Communication Customer Preference (Third Amendment) Regulations, 2026 (Press Release No. 119/2026, signed by Harinder Kumar, Secretary, TRAI), amending the Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR, 2018). The path to the amendment was conventional rule-making: a draft issued for consultation on 13 March 2026, comments and counter-comments to 19 April and 4 May 2026 respectively, an Open House Discussion on 3 June 2026, and the final regulations on 18 September.

The core mechanism — Regulation 21A. TRAI's press release records that major telecom service providers (TSPs) had already deployed AI/ML-based systems to detect suspected spam communications and alert customers, and that TRAI itself had issued a Direction on 27 February 2026 requiring TSPs to use AI/ML-based intelligence on suspected UCC for inter-operator sharing and further investigation. The Third Amendment Regulations, 2026 take that Direction's provisions and "suitably incorporate" them into binding regulation through a new Regulation 21A, which mandates TSPs to identify a sender's Calling Line Identifications (CLIs) that have a high probability of being used for sending Unsolicited Commercial Communications (UCC), and to share that information among TSPs.

The enforcement trigger. Where five or more CLIs associated with a single Sender are flagged within a period of ten days, Access Providers must initiate further investigation and graded action — KYC re-verification, physical verification, barring of outgoing services, and disconnection of telecom resources for repeated violations. A carve-out protects legitimate commercial and government traffic: regulated numbering series 140xx, 1600xx and 1601xx are excluded from flagging.

A new regulated category — Application-to-Person (A2P) calls. The amendment defines A2P calls as voice calls initiated by an application, software system or automated platform without direct human dialling — autodialling, robocalls, pre-recorded or artificial-voice technologies. Every entity using A2P calling must pre-declare that use to its TSP with the specific CLIs involved; an undeclared A2P call is treated as UCC. A deterrent termination charge of up to Rs 0.05 per minute applies, levied by the Terminating Access Provider on the Originating Access Provider, with an exemption for calls through Authority-designated regulated series.

Complaint-threshold reform. The existing complaint-based-action threshold — 5 or more unique complaints within 10 days — is supplemented, not simply lowered: action now triggers on 3 or more unique complaints within ten days, where the same Sender's CLI is independently flagged by the AI/ML system. This is corroboration logic, not a blanket reduction — the amendment ties human complaint volume to machine-detected signal before shortening the trigger.

Header and Content Template misuse. Where a Header or Content Template is misused, the Originating Access Provider must suspend it within six hours of becoming aware and notify the Sender. The Sender must undertake remedial measures and file a complaint with the appropriate law enforcement agency. Where the misuse is attributed to a Telemarketer, all of that Telemarketer's telecom resources across every TSP are disconnected for one year, plus blacklisting.

Other structural changes: a consumer appeal mechanism, with appeals to be filed within 15 days before the Appellate Authority under the Telecom Consumers Complaint Redressal (TCCR) Regulations, 2012, available through the TRAI DND App, TSP apps/portals, or 1909; an expanded scope of explicit consent to recognise digitised legacy consents, valid only where obtained through verifiable means and registered on a TSP's digital platform; a new classification power letting TRAI differentiate enforcement by category of Sender based on criticality, sector and scale; a prohibition on blanket blocking or spam-tagging by Call Management Applications of calls from the regulated numbering series, and a requirement that any spam report a CMA collects be routed to the DLT platform maintained by Access Providers; and a digital-interface mandate requiring Network Service Operators to give Virtual Network Operators real-time access to the DLT platform.

Why this matters — Veritect analysis. Three consequences follow for any business that communicates with Indian consumers at scale.

• AI/ML detection has moved from operational practice to a regulatory floor. TSPs were already running detection systems; what changes is that the detection-and-sharing duty is now a binding regulatory obligation with a defined enforcement trigger (five flagged CLIs in ten days), rather than a voluntary operational choice each TSP could calibrate independently. A sender's compliance posture can no longer assume TSP detection systems are advisory.
• A2P declaration is now a precondition, not paperwork. Because an undeclared A2P call is reclassified as UCC, the legal consequence of skipping pre-declaration is not a fine for a missing form — it is exposure to the entire Regulation 21A enforcement chain, including eventual disconnection. Any business running automated dialling — reminders, OTP-adjacent flows, collections, marketing — needs pre-declaration confirmed with its TSP before its next campaign, not before its next audit.
• The six-hour and one-year clocks create asymmetric exposure for telemarketing intermediaries. A telemarketer whose header or content template is misused — potentially without its own direct fault, e.g. through credential compromise or a client's non-compliant campaign — faces a full year's disconnection across every provider. That is a severe consequence relative to the underlying misuse, and telemarketing intermediaries should treat header/template access control as a top-tier operational risk, not a routine IT setting.

2. CERT-In's CRITICAL Cluster Moves From the Security Stack to the Identity Layer (Cybersecurity)

What happened: Between 14 and 18 September 2026 CERT-In issued thirteen vulnerability notes, CIVN-2026-0454 through CIVN-2026-0466. Every note below was opened and read individually for this tracker.

The theme, read across the six CRITICAL notes: three of the six sit specifically in identity and management-plane infrastructure rather than in general-purpose applications. CIVN-2026-0462 and CIVN-2026-0463 together cover fifteen CVEs in Cisco's Identity Services Engine (ISE) and its Passive Identity Connector — the product that performs network access control and identity policy enforcement across an estate — spanning authentication bypass, command injection, SQL injection and remote code execution categories. CIVN-2026-0465 covers an unauthenticated stack overflow in Check Point's Security Management and Log Servers, affecting every supported version down to R80, that permits remote code execution and privilege escalation through the unauthenticated login process — a defect in the console that manages an organisation's firewall estate, not in a firewall itself.

Why grouping these three matters — Veritect analysis. This tracker has now recorded, across three consecutive weeks, CRITICAL findings concentrated in the infrastructure that other security controls depend on: SIEM and segmentation tooling in W35, remote-access appliances and mail platforms in W36, and now identity policy enforcement and security-management consoles in W38. A compromise of Cisco ISE does not merely expose one application — it can compromise the access-control decision every downstream system relies on, in the same category of risk this tracker flagged for Keycloak's authentication bypass in W37. A compromise of a Check Point management server does not attack a firewall directly — it attacks the system that configures every firewall the organisation runs. Patch-prioritisation logic built around CVSS score alone will under-weight this category: a defect in identity or management-plane infrastructure should be treated as higher-priority than an equivalently scored defect in a single business application, because its blast radius is structural rather than local.

No confirmed active exploitation this week — a genuine contrast worth naming. Unlike W36 (SonicWall SMA1000 and Zimbra, both recorded by CERT-In as actively exploited) and W37 (Chrome's CVE-2026-87491, Google-confirmed exploited), none of the six CRITICAL notes read for this tracker carries CERT-In's own or a vendor-confirmed statement of active exploitation. That is a meaningful distinction for a compliance function deciding how to sequence a patch backlog: this week's items should be prioritised on structural blast radius (identity and management-plane position) rather than on urgency signalled by confirmed attack activity, because that signal is absent here.

Regulatory hook, unchanged: the CERT-In Directions of 28 April 2022, issued under Section 70B(6) of the Information Technology Act, 2000, require mandatory reporting of a qualifying cyber incident within six hours of noticing it. None of this week's notes, by themselves, constitutes such an incident; the obligation activates only once an actual incident within the listed categories is noticed or reported. Non-compliance once triggered carries the Section 70B(7) penalty of up to one crore rupees, per the Jan Vishwas (Amendment of Provisions) Act, 2023 (Act 18 of 2023), effective 30 November 2023.

3. RBI Opens an Overseas Certification Channel for Foreign Portfolio Investor KYC (Fintech and Payments)

What happened: On 18 September 2026 RBI issued the Reserve Bank of India (Commercial Banks - Know Your Customer) Amendment Directions, 2026 (RBI/2026-27/257), signed by Veena Srivastava, Chief General Manager, together with five parallel Amendment Directions the same day for Rural Co-operative Banks, Urban Co-operative Banks, Regional Rural Banks, Local Area Banks and Small Finance Banks — the same six-category pattern this tracker has seen RBI use before for amendments that apply across the full scheduled and co-operative banking spectrum.

The mechanism. The amendment modifies paragraph 5(1)(v) of the KYC Directions issued 28 November 2025. Under the existing framework, banks could accept an original certified copy of specified KYC documents for Non-Resident Indians (NRIs) and Persons of Indian Origin (PIOs), where certification was performed by one of a defined list of authorities: an authorised official of an overseas branch of an Indian scheduled commercial bank, a branch of an overseas bank with which the Indian bank has a relationship, a Notary Public abroad, a Court Magistrate, a Judge, or an Indian Embassy or Consulate General in the customer's country of residence. The Third Amendment Directions extend this facility to Foreign Portfolio Investors (FPIs).

What is unchanged. RBI's amendment does not alter the underlying customer due-diligence obligation: the existing definition of a "certified copy" continues to apply, and where Aadhaar offline verification cannot be completed, the bank must still compare the submitted proof of Aadhaar possession (or another officially valid document) against the original, with an authorised bank officer recording that verification. The change is confined to who may perform the certification and where — it does not remove any category of required document or verification step.

Why it matters — Veritect analysis. This is a narrow but practically significant change for FPI onboarding operations. Previously, an FPI based overseas without NRI or PIO status had a narrower set of routes to certify KYC documents; the amendment closes that gap by extending the same overseas-certification channel already trusted for NRIs and PIOs. For a bank's FPI-onboarding desk, the immediate task is procedural: update onboarding checklists and relationship-manager guidance to reflect that FPI document certification can now be completed through the same overseas channels as NRI/PIO certification, without waiting for a document to be routed through an India-based certification process. The change sits inside a broader pattern this tracker has tracked across the year — RBI issuing narrow, additive KYC facility extensions (see also the FIU-India information-sharing and CKYCR-responsibility amendments referenced in prior sessions) rather than wholesale KYC framework rewrites.

A gap, stated as a gap: the six parallel Amendment Directions issued the same day for other bank categories were confirmed present on RBI's notifications index by title and date, but this tracker read the full operative text only for the Commercial Banks Direction (RBI/2026-27/257). The other five are treated as materially identical in substance based on their titles, consistent with RBI's established pattern of issuing parallel same-day directions across bank categories, but that assumption has not been individually verified against each direction's full text.

Regulatory Action Log — Items 4 to 6

Research Gaps and Unretrieved Sources

Per CLAUDE.md §5.10, the following are recorded as gaps. None of them is a finding of silence unless expressly marked as portal-checked.

Checked at the issuing authority's own listing page, and genuinely empty for 14-20 September 2026:

• SEBI circulars — no circular issued between the 9 September 2026 entry (logged in W37) and the next entry after the window. No SEBI circular in the W38 window.
• IRDAI circulars — the listing's most recent entry before the window is 28 August 2026; the next is 22 September 2026, outside the window. No IRDAI circular in the window.
• CERT-In advisories (CIAD series) — the most recent advisory as at the time of research is CIAD-2026-0045 of 10 September 2026 (logged in W37). No CIAD advisory in the W38 window.

Not retrievable, and therefore reported as unknown rather than absent:

• meity.gov.in — homepage and /whatsnew rendered without any dated content confirming or ruling out an instrument in the window.
• dot.gov.in/whatsnew — rendered without dated content.
• npci.org.in circulars path — unreachable.
• uidai.gov.in press-releases path — HTTP 404.
• tdsat.gov.in judgments path — no dated content retrieved.
• egazette.gov.in — no ministry-and-date search reachable for MeitY or DoT instruments in the window.

The five parallel RBI KYC Amendment Directions (Rural Co-operative, Urban Co-operative, Regional Rural, Local Area and Small Finance Banks) were confirmed present by title and date but not individually read in full text; treated as materially identical to the Commercial Banks Direction on the strength of RBI's established same-day parallel-direction pattern, not independently verified. See the gap note under Item 3.

Live threads with no movement traced this week — constitution of the Data Protection Board of India under Section 18(1) of the DPDP Act, 2023 (no notification traced as at 20 September 2026; a retrieval gap, not a finding, because MeitY and eGazette could not be searched); DPDP Rules 2025 phased rollout; the Promotion and Regulation of Online Gaming Act, 2025 and its 2026 Rules; the synthetic-media labelling regime under the February 2026 IT Rules amendment; Demat 2.0 Stage II secondary-market trading enablement (see W37).

What's Next

Watch items with no fixed date: when TRAI's Regulation 21A enforcement mechanics (the five-CLIs-in-ten-days trigger, the AI/ML corroboration for the lowered complaint threshold) begin producing visible enforcement outcomes against specific senders or telemarketers; whether the five parallel RBI KYC Amendment Directions for other bank categories diverge in any respect from the Commercial Banks text once independently verified; and whether CERT-In follows its Cisco ISE and Check Point Security Management notes with any India-sector-specific advisory, given the identity-infrastructure concentration.

Founder Action Items

1. Confirm A2P pre-declaration with your TSP this week if your business places any automated, autodialled, robocall or pre-recorded-voice call to Indian numbers. An undeclared A2P call is now treated as UCC.
2. Map who controls your SMS/voice header and content template registrations. A misuse finding against your organisation triggers a six-hour suspension clock for your access provider and can end in a one-year cross-provider disconnection if a telemarketer is implicated.
3. If you onboard Foreign Portfolio Investors, update KYC checklists to reflect the newly available overseas certification channels — notary, court, embassy/consulate — under RBI/2026-27/257.
4. Patch-prioritise Cisco Identity Services Engine and Check Point Security Management Server deployments ahead of equivalently-scored application-layer CVEs this week — both sit in identity/management-plane infrastructure with structural blast radius.
5. Do not assume the five parallel RBI KYC directions for other bank categories are identical to the Commercial Banks text without checking — this tracker treated them as materially the same based on pattern, not independent verification.

Practitioner Watch-List

• New Regulation 21A, TCCCPR 2018 is now the operative provision for AI/ML-based UCC detection and inter-operator CLI sharing — cite this rather than the underlying 27 February 2026 Direction it formalises.
• A2P call definition is new; any client running automated outbound calling to Indian numbers needs a compliance review against the pre-declaration requirement, not just a data-protection review.
• RBI/2026-27/257, paragraph 5(1)(v) KYC Directions 2025 is the citation for the FPI certified-copy extension; confirm against each parallel direction's own text before relying on it for a non-Commercial-Bank client.
• Section 70B(7) IT Act 2000 remains at one crore rupees following the Jan Vishwas (Amendment of Provisions) Act, 2023 substitution effective 30 November 2023. Do not cite the pre-amendment one lakh figure.
• MeitY and DoT portal availability remains a live research risk for the fifth consecutive tracker; insist on the eGazette record over the ministry website where certainty is required.

FAQ

What did TRAI actually change on 18 September 2026, and is AI/ML-based spam detection now legally mandated?

Yes, in a specific and narrow sense: TRAI has written into binding regulation a spam-detection mechanism that telecom service providers had already begun deploying voluntarily, plus a formal inter-operator information-sharing duty. On 18 September 2026 TRAI notified the Telecom Commercial Communication Customer Preference (Third Amendment) Regulations, 2026 (Press Release No. 119/2026), amending the Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR, 2018). The amendment inserts a new Regulation 21A, which mandates telecom service providers (TSPs) to identify a sender's Calling Line Identifications (CLIs) that have a high probability of being used for sending Unsolicited Commercial Communications (UCC), and to share that information among TSPs. TRAI's press release records that major TSPs had already deployed AI/ML-based systems to detect suspected spam and alert customers, and that TRAI itself had issued a Direction on 27 February 2026 to TSPs for using AI/ML-based intelligence on suspected UCC for inter-operator sharing and further investigation of suspected senders; Regulation 21A is that Direction's provisions "suitably incorporated" into binding regulation. The mandate formalises an existing operational practice and information-sharing duty rather than compelling any specific AI/ML model or technical standard.

What actually happens once a sender's CLIs are flagged?

A defined numeric threshold triggers escalating enforcement. Under Regulation 21A, where five or more CLIs associated with a single Sender are flagged within a period of ten days, Access Providers must initiate further investigation and graded action, which can include KYC re-verification, physical verification, barring of outgoing services, and disconnection of telecom resources for repeated violations. Separately, the complaint-based-action threshold is lowered from 5 unique complaints in ten days to 3, but only where the Sender's CLI is also independently flagged by the AI/ML-based system — corroboration, not a blanket lowering. Regulated commercial-communication numbering series (140xx, 1600xx, 1601xx) are excluded from flagging. Where a Header or Content Template is misused, the Originating Access Provider must suspend it within six hours of becoming aware and notify the Sender; where the misuse is attributed to a Telemarketer, all of that Telemarketer's telecom resources across every TSP are disconnected for one year, plus blacklisting.

What is the new Application-to-Person (A2P) call regime, and who does it affect?

It is a new, separately regulated category of automated calling. The Third Amendment Regulations, 2026 define A2P calls as voice calls initiated by an application, software system or automated platform without direct human dialling, including autodialling, robocalls and pre-recorded or artificial-voice technologies. Every entity using A2P calling must pre-declare that use to its TSP, along with the specific CLIs to be used; an A2P call made without the required prior declaration is treated as UCC. A termination charge of up to Rs 0.05 per minute is introduced, levied by the Terminating Access Provider on the Originating Access Provider, with an exemption for calls made through Authority-designated regulated numbering series. Any business using automated dialling technology for customer outreach needs to confirm its TSP has received the required pre-declaration before the next billing cycle.

What did RBI change for Foreign Portfolio Investors on the same day, and does it weaken KYC requirements?

No — it adds a certification channel; it does not remove any underlying KYC obligation. On 18 September 2026 RBI issued the Reserve Bank of India (Commercial Banks - Know Your Customer) Amendment Directions, 2026 (RBI/2026-27/257), with five parallel Amendment Directions the same day for other bank categories. The amendment modifies paragraph 5(1)(v) of the KYC Directions issued 28 November 2025 to extend, to Foreign Portfolio Investors, a certified-copy mechanism previously available only to Non-Resident Indians and Persons of Indian Origin: banks may accept an original certified copy of specified KYC documents where certification is performed by an authorised official of an overseas branch of an Indian scheduled commercial bank, a branch of an overseas bank with a relationship to the Indian bank, a Notary Public abroad, a Court Magistrate, a Judge, or an Indian Embassy or Consulate General. The underlying customer-due-diligence obligation is unchanged — RBI's existing definition of a certified copy and its Aadhaar offline-verification comparison requirement continue to apply.

What is CERT-In's cybersecurity theme this week, and is anything under confirmed active exploitation?

The theme is identity and network-perimeter infrastructure, and — distinguishing this week from the two preceding trackers — none of the CRITICAL notes read for this tracker carries CERT-In's own or a vendor-confirmed statement of active exploitation. Between 14 and 18 September 2026 CERT-In issued thirteen vulnerability notes, CIVN-2026-0454 through CIVN-2026-0466, of which six carry a CRITICAL rating: Android OS (99 CVEs, CIVN-2026-0454), ConnectWise ScreenConnect Client (CVE-2026-84869, CIVN-2026-0455), MikroTik RouterOS (three CVEs, CIVN-2026-0460), two Cisco Identity Services Engine notes (fifteen CVEs, CIVN-2026-0462 and CIVN-2026-0463) and Check Point Security Management and Log Servers (CVE-2026-91843, CIVN-2026-0465). Three of the six sit in identity and management-plane infrastructure rather than end-user applications, continuing this tracker's recurring observation across recent weeks that security-tooling and identity infrastructure carries a disproportionate share of CRITICAL findings.

Methodology and Date Provenance

• Window: ISO week 2026-W38, Monday 14 September 2026 to Sunday 20 September 2026, IST.
• Event dates: TRAI's Third Amendment Regulations and RBI's KYC Amendment Directions are both dated to their own issuance/press-release date (18 September 2026). SEBI's SPM extension is dated to its press-release date (17 September). CERT-In notes are dated by their own issue date.
• Exploitation status: no CRITICAL note read for this tracker carried CERT-In's own or a vendor-confirmed statement of active exploitation; this is stated explicitly rather than left implicit, to distinguish the week from W36 and W37.
• Parallel RBI directions: five of six same-day RBI KYC Amendment Directions were confirmed present by title and date on RBI's notifications index but not individually read in full text; treated as materially identical to the Commercial Banks Direction based on RBI's established pattern, not independently verified. See the gap note under Item 3.
• Sources: every item was read at the issuing authority's own surface — trai.gov.in (press release PDF downloaded and read directly, after an initial text-extraction proxy failed to render body text), rbi.org.in notifications index and individual notification pages, cert-in.org.in vulnerability-note indexes and individual note pages, sebi.gov.in press releases.
• What is not here: any item that could not be read at a primary source is recorded in the gaps section rather than summarised from elsewhere.

Primary Sources

• TRAI Press Release No. 119/2026, 18 September 2026 — TRAI Strengthens Framework for Curbing Unsolicited Commercial Communications through Technology-Driven Enforcement and Enhanced Consumer Protection: https://www.trai.gov.in/sites/default/files/2026-09/PR_No119of2026.pdf
• RBI/2026-27/257, 18 September 2026 — Reserve Bank of India (Commercial Banks - Know Your Customer) Amendment Directions, 2026: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=13699&Mode=0
• RBI Notifications index, 18 September 2026 (five parallel KYC Amendment Directions): https://www.rbi.org.in/Scripts/NotificationUser.aspx
• CERT-In Vulnerability Notes index, 2026: https://www.cert-in.org.in/s2cMainServlet?pageid=VLNLIST02&year=2026
• CERT-In Vulnerability Note CIVN-2026-0462, 17 September 2026 (Cisco Identity Services Engine, CRITICAL): https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0462
• CERT-In Vulnerability Note CIVN-2026-0465, 18 September 2026 (Check Point Security Management and Log Servers, CVE-2026-91843, CRITICAL): https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0465
• CERT-In Vulnerability Note CIVN-2026-0454, 14 September 2026 (Android OS, 99 CVEs, CRITICAL): https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0454
• CERT-In Vulnerability Note CIVN-2026-0460, 16 September 2026 (MikroTik RouterOS, CRITICAL): https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0460
• CERT-In Advisories index, 2026: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBADVLIST02&year=2026
• SEBI Press Release No. 58/2026, 17 September 2026 — Samuhik Prativedan Manch extended to Members of Clearing Corporations: https://www.sebi.gov.in/sebiweb/home/HomeAction.do?doListing=yes&sid=6&ssid=23&smid=0
• SEBI Circulars listing (checked, none in window): https://www.sebi.gov.in/sebiweb/home/HomeAction.do?doListing=yes&sid=1&ssid=7&smid=0
• IRDAI circulars listing (checked, none in window): https://irdai.gov.in/circulars
• The Telecom Commercial Communications Customer Preference Regulations, 2018, as amended — read via the TRAI press release's own recitation of amended text
• The Information Technology Act, 2000, Sections 70B(6) and 70B(7), as amended by the Jan Vishwas (Amendment of Provisions) Act, 2023

Veritect Legal Intelligence. Tier 1 government and regulator sources only. This tracker reports facts drawn from primary records; analysis is original Veritect work. Where a primary record could not be retrieved, the gap is stated as a gap.