Where the report comes from
In November 2020 SEBI issued circular SEBI/HO/MIRSD2/DOR/CIR/P/2020/221, an advisory for financial sector organisations on Software as a Service (SaaS) based solutions. It forwarded an advisory from CERT-In and asked regulated entities to keep complete protection and control over their critical systems while keeping critical data within the legal boundary of India, and to report on compliance every half year. The circular was addressed to intermediaries such as stock exchange members and depository participants. It reaches Research Analysts because BSE, as the Research Analyst Administration and Supervisory Body, asks RAs to file a half-yearly SaaS report on its RA/IA portal.
What the form asks, provider by provider
The report asks for complete and accurate information about every SaaS-based solution or hosted service you use. For each one, the format circulated by the exchanges asks for the provider's name, the nature of the service you consume, how you use it including the nature of the data exchanged, the geo-location where it is hosted, any gap against the circular, and the date by which you will close that gap. For the half-year to 30 September 2026 the report was due by 31 October 2026; BSE's notice gives the date for each period.
List every tool, not only the main platform
The platform your clients sign up on is the obvious entry, but a research desk usually runs on more hosted services than it first counts: the mailbox your agreements and invoices go out from, the WhatsApp Business provider, a Telegram channel, the payment gateway, the cloud storage where KYC copies or reports are kept, a video tool for webinars, the website host, accounting software, and any AI tool a team member pastes client details into. Each one that holds or carries client data belongs on the list. A tool you do not use does not; one you forget makes the report incomplete.
Hosting location: be exact, including the exceptions
Answer the geo-location question per service, not for the business as a whole. A line such as "all our data is in India" is rarely true once WhatsApp and email are counted: Meta and Google process messages on infrastructure that may be outside India. The accurate answer separates where the core records live (clients, KYC, payments, research) from the specific data each outside service receives, such as a phone number and a message. That is also what the Digital Personal Data Protection Act, 2023 expects of you as the data fiduciary: you decide which processors handle your clients' data, and transfers outside India are permitted except to countries the Government restricts.
Gaps, and what to write when you find one
The form asks for gaps against the circular and a date to close each one. A gap you explain is an answer; a gap you leave out is a finding. If a service keeps client data outside India, say which data, why you use the service, and what you will do: keep it with your reason, move to an option hosted in India, or stop sending it client data. Where the judgement is close, settle it with your compliance adviser once and apply it the same way every half year. SEBI's Cybersecurity and Cyber Resilience Framework of August 2024 is a separate matter: under the clarification the exchanges circulated, an RA not registered in any other capacity is exempt from it, and a dual registrant follows its other category.
Evidence: get each provider's answer in writing
A report is only as good as the documents behind it. For each provider that holds client data, keep a document that says where it hosts the data and which other services it relies on: a data processing agreement, a sub-processor list or a signed undertaking. Read it before you rely on it. A letter that says all data stays in India, from a provider that sends your clients' WhatsApp messages through Meta, is not evidence you can file; ask for one that names each service and the data it receives.
How OptumFlex does this
The Platform Services Agreement states where OptumFlex hosts the platform (the application server, the database and your files, with their backups, in Mumbai) and lists every service that processes specific data outside India, with the data each one receives (clause 11.4 and Annexure E). When your agreement is signed, the platform issues a numbered, dated undertaking for your SaaS report and emails it to you: it cites your agreement, lists the services outside India that your own account uses, and carries a link to a public page that shows whether the letter is genuine and current. A new sub-processor comes with 15 days' notice. Filing the report, and the judgement on your other tools, stay with you as the registered analyst.