TRAI proposes detailed audit framework for IPTV systems, tightens subscriber data checks

The Telecom Regulatory Authority of India (TRAI) has proposed a dedicated audit framework for digital rights management (DRM)-based television distribution systems, seeking to strengthen checks on subscriber records, content encryption and compliance by Internet Protocol Television (IPTV) operators.

The draft Telecommunication (Broadcasting & Cable) Services DRM Based Digital Addressable Systems Audit Manual, issued on October 9, sets out detailed procedures for auditing the technical systems used to distribute television channels over IPTV platforms. It also specifies the documentation, data extraction, verification and reporting requirements for distribution platform operators (DPOs), broadcasters and auditors.

Stakeholders have been asked to submit comments by October 30, 2026, three weeks after the draft's release.

The move addresses a gap in the existing audit framework. While TRAI's Digital Addressable Systems Audit Manual, issued on March 10, 2026, provides procedures for verifying conditional access systems (CAS), subscriber management systems (SMS) and set-top boxes (STBs), it does not contain a corresponding clause-by-clause audit procedure for DRM-based systems.

The regulator said IPTV operators, broadcasters and auditors had sought a similar framework for DRM-based distribution. The draft has been prepared in consultation with Broadcast Engineering Consultants India Limited (BECIL), taking into account the Ministry of Information and Broadcasting's infrastructure-sharing guidelines for distribution platform operators.

Subscriber records and system compliance under scrutiny

A key objective of the proposed manual is to establish a consistent process for checking whether subscriber information maintained by an IPTV operator's SMS matches the records held by its DRM system.

The two systems perform complementary functions. The SMS maintains subscriber and subscription information, while DRM governs the authorisation and technical mechanisms through which consumers access protected content. Discrepancies between the systems can affect the verification of subscriber numbers reported to broadcasters.

The draft requires auditors to reconcile DRM and SMS data and document the results. It also sets out checks covering subscriber activation and deactivation, channel and bouquet subscriptions, entitlement records, system logs and the generation of monthly subscription reports.

The manual proposes that reconciliation reports be retained alongside system data for at least three years or three audit cycles, whichever is later, subject to the applicable provisions of Schedule X of the Interconnection Regulations.

The framework also requires systems to maintain logs of commands, including subscriber activation and deactivation, and provide historical records for audit. SMS logs are required to be maintained for at least three consecutive years under the relevant provisions.

Auditors will examine whether the systems can generate subscriber-level and channel-wise reports, trace changes in subscriptions and identify active, inactive, suspended and deactivated connections. The checks also cover whether subscriber records can be linked to a unique set-top box identifier or, in applicable IPTV deployments, a unique consumer subscription associated with a software application on the user's device.

Annual audits and pre-signal checks

The draft distinguishes between pre-signal or compliance audits and subscription audits.

A pre-signal audit may be conducted before a distribution platform operator acquires television channel signals from a broadcaster. The purpose is to establish whether the operator's addressable system meets the requirements prescribed under Schedule X of the Interconnection Regulations.

The draft clarifies that an audit by an empanelled auditor or BECIL is not mandatory in every case before signals are requested. However, the distributor must ensure that its system complies with the applicable regulatory requirements and may provide a written declaration, accompanied by vendor certificates and other supporting documents.

A broadcaster can also commission an audit if it believes that a distributor's system does not meet the prescribed requirements. However, where the distributor has produced a report demonstrating full compliance from an empanelled auditor or BECIL within the preceding year, a fresh pre-signal audit should not be conducted unless the system's configuration or version has changed.

Separately, Regulation 15 requires distributors to have their addressable systems audited annually for the preceding financial year. The audit covers systems such as SMS, CAS, DRM and related infrastructure, along with verification of the monthly subscription reports supplied to broadcasters.

The resulting report, including its annexures, must be shared with broadcasters with whom the distributor has interconnection agreements by September 30 each year. The draft also sets out the process for broadcasters to commission audits or seek further scrutiny when discrepancies are identified, subject to the conditions prescribed in the regulations.

Changes to systems must be reported

The draft places particular emphasis on changes to the technology and infrastructure used by distribution platforms.

Once an interconnection agreement has been signed, a distributor must inform the relevant broadcasters within seven days of changes to its DRM, SMS or related systems. These include the addition or removal of an SMS or DRM system, changes to software versions, deployment of new types of set-top boxes or software applications that have not previously been audited, and changes arising from infrastructure-sharing arrangements.

The distributor must also provide an undertaking that the changes do not compromise the system's functioning or its compliance with statutory requirements.

The provisions are intended to ensure that broadcasters are informed when changes could affect the configuration or operation of systems through which their channels are distributed.

The proposed manual also addresses infrastructure sharing between distribution platform operators. An audit of an infrastructure seeker would cover its own addressable system and the relevant elements obtained from the infrastructure provider. An audit of the provider would cover the systems under its ownership as well as elements shared with the seeker.

TRAI says joint audits by infrastructure providers and seekers could be useful, particularly where they share an SMS. Broadcasters may also conduct joint and simultaneous audits covering the systems of multiple distributors sharing infrastructure, where required under the regulations.

Subscription audits to verify broadcaster-wise reporting

The proposed subscription audit framework focuses on validating the monthly subscriber reports that distributors submit to individual broadcasters.

Auditors are required to examine the integration between SMS and DRM before extracting data. The draft calls for simulation tests on sample devices to check functions such as activation, deactivation, fingerprinting and messaging, followed by verification of system logs and the timing of commands.

Auditors would then extract data from the systems and examine a sample of weeks from the audit period to validate the subscription reports submitted to broadcasters.

The reports must be prepared separately for each broadcaster and contain information relating to that broadcaster's channels and bouquets, along with the relevant annexures.

Under the existing regulatory framework cited in the draft, a variation of less than 0.5% in the billed amount resulting from an audit does not require revision of invoices already issued and paid. Where a subscription audit reveals a variance exceeding 0.5% in the monthly subscription report submitted to a broadcaster, the draft places responsibility on the distributor to inform the broadcaster so that the invoices can be revised.

The draft also reiterates that discrepancies in subscriber declarations may result in payment liabilities being settled in accordance with the interconnection agreement between the broadcaster and distributor.

Non-compliance could lead to signal disconnection

The proposed manual sets out the audit procedures through which non-compliance with the Interconnection Regulations can be identified and documented. It does not replace the underlying regulations, which will prevail in the event of any inconsistency.

Under the existing regulatory provisions cited by TRAI, where an audit establishes that a distributor's addressable system does not comply with Schedule III or Schedule X, as applicable, a broadcaster may disconnect television channel signals after giving three weeks' written notice.

The regulations also provide for financial disincentives where distributors fail to complete the prescribed annual audit within the stipulated period.

The draft outlines the responsibilities of distributors, broadcasters and auditors, including access to systems and records, support during data extraction, retention of relevant information and preparation of audit reports.

Distribution platform operators must provide auditors with access to the relevant DRM and SMS servers and ensure that the data required for verification is available. Broadcasters may depute representatives to provide inputs during the audit, within the scope permitted by the regulations.

TRAI has said the manual is intended as a guidance document and may be reviewed as technology, commercial arrangements and market conditions evolve. Stakeholders can submit comments with supporting evidence and proposed alternative wording by October 30, 2026.