Frequently asked questions
How does CDSL score on the five pillars?
CDSL passes all five pillars: sunrise, leadership, moat, iron fortress, and free cash flow. The moat is legal (a regulated duopoly) plus the retail network of 18.6 crore accounts. The leadership grade carries the owned deduction of the November 2022 ransomware lapse and the July 2026 SEBI penalty. The fortress is the cleanest pillar: zero debt against Rs 1,487 crore of cash and investments.
What is CDSL's moat?
CDSL's moat is legal before it is economic: India has exactly two depositories, and the MII framework makes a third license functionally unthinkable. Inside the duopoly, CDSL holds the retail network: 18.59 crore accounts, 80% of new account flow, 49,684 issuers. SEBI can reprice tariffs (it did in October 2024) but cannot legislate away the network.
Pillar 1: Is the sector a sunrise? (PASS)
The tailwind is the financialization of Indian savings, and it is structural, not cyclical. Under 10 percent of India's population participates in the securities market, demat accounts keep compounding (CDSL crossed 18 crore in FY26, the first depository to do so), and SEBI keeps widening the demat mandate. CDSL takes about 80 percent of incremental industry accounts, the regulatory direction is one-way (demat mandates, insurance dematerialization, commodity e-receipts), and the account base is the installed base for e-voting, e-CAS, KYC records, and insurance e-accounts. The caveat: transaction income was flat for five quarters through Q1 FY27 even as accounts grew, because the sunrise compounds accounts while the cycle moves volumes.
Pillar 2: Can the leadership execute? (PASS)
Nehal Naleen Vora has run CDSL since September 2019 and is reappointed through September 2029 with SEBI approval. He spent a decade at SEBI before joining; under his tenure demat accounts roughly tripled, CVL crossed 10 crore KYC records, and the company won 30+ awards including CSD of the Year 2025. The deduction, honestly stated: the November 2022 LockBit ransomware attack was a leadership failure, and SEBI's July 2026 Rs 1 crore penalty says so in writing. The company absorbed it and is now spending structurally more on IT. One owned failure in seven years of compounding, with the fix visible in the P&L: PASS, with the cyber record as the monitored metric.
Pillar 3: Does a moat protect returns? (PASS)
The moat is legal before it is economic: India has exactly two depositories. Inside that duopoly, CDSL holds the retail network: 18.59 crore accounts, 80 percent of new account flow, 49,684 issuers, 1,33,364 active ISINs. Issuers, depository participants, RTAs, and KRAs all integrate to CDSL's rails; switching is operationally expensive. CVL adds a second regulated network with 10.6 crore+ KYC records. NSDL holds 87 percent of custody value and is now listed and pushing retail, but custody value is the wrong scoreboard: the retail annuity compounds on account counts, where CDSL leads 4-to-1, with about 65 percent recurring revenue against NSDL's 42 percent (IPO-time comparison).
Pillar 4: Is the balance sheet a fortress? (PASS)
The cleanest pillar in the set. Zero debt, nil interest expense in every reported year, Rs 1,487 crore of cash and investments on the March 2026 balance sheet. The fortress survived its siege: through the November 2022 ransomware attack and the 46-hour settlement halt, the company never raised emergency capital, never drew debt, and kept paying the dividend, now Rs 12.75 a share at a ~58 percent payout. Receivables are tiny, capex is light outside build years, and the float is 85 percent with 15.23 lakh shareholders. PASS, no real deduction.
Pillar 5: Does the free cash flow show up? (PASS)
A depository is a software-and-trust business with near-zero marginal cost per account, so free cash flow tracks operating cash flow closely: Rs 258 cr (FY22), Rs 44 cr (FY23, the capex year), Rs 313 cr (FY24), Rs 388 cr (FY25), Rs 346 cr (FY26). FCF-positive in every year, with operating cash flow consistently exceeding operating profit. The watch item: FY26 FCF trailed the FY25 peak because the tariff reset and KRA pricing compression hit operating leverage while IT investment rose. That is a margin story, not a cash-conversion story. Q1 FY27's growth turn is the path back to FCF growth. PASS.
What would change the grade?
Moat downgrades to partial if NSDL sustains retail account-share gains over several quarters or if a tariff reset cuts deeper than the 2024 one. Leadership downgrades on any repeat cyber event. Iron Fortress or FCF downgrades if the payout is cut to fund a large acquisition or if cash conversion breaks. Sunrise is the least likely to move: the penetration number has a decade of runway.
© 2026 DalalBytes Research · For educational purposes only. Not investment advice.