NEPSE's Weak System: The Shocking Truth Revealed by 3 Hidden Reports
Reports from the Nepal Securities Board and NEPSE's own IS audit reveal that NEPSE's trading system is extremely weak and at high risk of hacking. The contract awarded to YCO, lack of technical infrastructure, and absence of log management have put the data of millions of investors at risk.
Kathmandu. There is such deep corruption and bribery within the Nepal Stock Exchange (NEPSE) that it cannot even be compared to land revenue or customs offices. Due to the poor-quality system of YCO, which was purchased at a high price but built cheaply, the data of millions of share investors is at risk. NEPSE is neither helpless before YCO nor powerless against the corrupt system. Rather, NEPSE, running on a rickety system, is pretending that everything is technically fine.
Leaving behind a loophole that a single click by a hacker could destroy everything, NEPSE is creating the illusion that all problems have been resolved. Just yesterday, NEPSE's system was hacked, trading had to be halted, and the problem still hasn't been resolved, yet NEPSE has resumed trading as if everything is fine. This drama by NEPSE to cover up its weaknesses has exposed the system's flaws.
We are not the only ones saying this; it is a fact uncovered by the Nepal Securities Board (SEBON) report and NEPSE's own IS audit. Today, we are delving into the details of that fact, which shows that NEPSE, in its arrangement with YCO, is using such a poor system where YCO employees can do anything:
- Show a buy as a sell,
- Show a sell as a buy,
- Show that a trade occurred when no trade actually happened,
- Show any price for any script they want,
- Manipulate in any way they wish.
And the share market is running on a system built through arrangements with those appointed as NEPSE CEOs by old parties to collect donations in the name of elections. We have said this many times, and this time the results have shown how weak NEPSE's system is. Today, we are attempting to dig into the reports that NEPSE and SEBON themselves have hidden regarding NEPSE's weaknesses.
Securities Board Report: 'NEPSE's System Has Problems, Can Be Hacked at Any Time'
The study report prepared by the Nepal Securities Board, led by the Board's IT expert Saroj Lamichhane, with a team comprising Board Directors Rewat Shrestha and Sanu Khadka, and Assistant Directors Yamanath Aryal and Rabindra Dev Bhatta, clearly showed that NEPSE's system is being manipulated.
The report stated that contrary to Regulation 21 (b) Sub-regulation (4) of the Securities Trading Operation Regulations 2075, the operation and maintenance of the Trading Management System (TMS) and the Electronic Trading System of the Securities Market (NOTS) are being carried out through a single service provider company, which violates existing rules, creates a conflict of interest, and raises doubts about the reliability of trading.
Similarly, in a sensitive system like the Matching Engine, manual work is still being done to balance the load on the Script-wise Matching Engine's Instance, and there are no clear manuals on what basis and how much resource to allocate to which script, which could lead to bias when allocating resources based on personal discretion, the report noted.
The report also mentioned that due to the lack of adequate infrastructure for operating the NOTS system (power backup, data center, air conditioning system, etc.) and insufficient arrangements for a data recovery site, the trading system is frequently disrupted, depriving investors of trading opportunities. It was found that there are not enough documents, manuals, and standard operating procedures (SoP) available for operating NEPSE's information technology systems, and the excessive dependence on third parties for technical operations has increased business risks.
The company that sells and maintains NOTS (YCO) has been found to have easy access to critical systems like the Firewall, Database, and Active Directory of the data center operated by NEPSE, and NEPSE has not implemented any kind of log management in this regard, so there is no way to know about changes made to NEPSE's system by YCO employees. The report also mentioned that during supervision, discrepancies were seen in the Data Migration Report, but no logs were available for investigation, making it impossible to know what data was removed or added.
For securities brokers, the information technology-related requirements for operating the trading management system