The order comes two months after the market regulator passed a similar advisory for Axis Bank. Both cases involved the leak of price-sensitive information over social media groups.

HDFC Bank has been directed to conduct an internal enquiry into the leak and submit its findings within three months. In the five-page order, Sebi also asked the retail lender to identify employees who were responsible for the leak. It asked HDFC Bank to “strengthen its processes, systems, controls” to ensure that such leaks were not repeated. In its preliminary examination, Sebi said, “The messages circulated on WhatsApp closely matched the quarterly financial results of HDFC Bank for June 2017, which were subsequently published.” The leaked figures mentioned in the order are of the bank’s gross non-performing assets, profit after tax and net interest income.

The order also mentions HDFC Bank’s response where it had told Sebi that the management had shared unpublished price-sensitive information with only relevant parties such as “concerned employees” and statutory auditors on a strictly “need-to-know basis”.

HDFC Bank added that all such information was shared through the bank’s password-protected internal e-mail system on a secured file-sharing platform.

The bank also provided the chronology of events it followed in preparing and finalising the results.

Sebi said, “Prima facie, it appears that the financial results of HDFC Bank for quarter ended June 2017 were finalised on or before July 19, 2017, which was before the circulation of the WhatsApp message on July 21, 2017.” The actual results were announced on July 24, 2017, at 12:12 pm. Sebi asked the bank to furnish information regarding the process and controls it follows for handling price-sensitive information.

However, Sebi said the source of the leakage under the Prohibition of Insider Trading Rules cannot be ascertained. “However, it can prima facie be inferred on the basis of the facts and circumstances that the unpublished price-sensitive information relating to financials of HDFC Bank was leaked,” the regulator said. Such leakage could be attributable to the inadequacy of process, control or systems that the lender as a listed company had put in place, it added.

A HDFC Bank spokesperson said, “We have not been able to read the order, but needless to say we will comply. We are a conscientious, law-abiding company with the highest standards of corporate governance.”

The issue of earnings leaks on private WhatsApp groups was first reported by Reuters. The report had named 12 companies whose earnings were circulated in advance. These included Dr Reddy’s, Cipla, HDFC Bank, Tata Steel, Wipro, and Bajaj Finance. The market regulator is said to be examining four more companies apart from Axis Bank.