SEBI's Algo Trading Framework: New Rules for Retail Algorithmic Trading

For most of the past decade, algorithmic trading in India operated under a framework that SEBI put in place in 2012, designed primarily for institutional participants. Retail investors who ran automated strategies through broker APIs existed in a largely unregulated grey zone: the broker provided the interface, the retail trader ran the code, and the algo provider in between often had no formal accountability to anyone.

That arrangement, which allowed unscrupulous operators to promise guaranteed returns, execute strategies on client accounts without meaningful oversight, and disappear when those strategies failed, is no longer permissible.

Through a circular issued on February 4, 2025, SEBI overhauled the framework governing algorithmic trading by retail investors. After two timeline extensions that gave brokers and platforms time to build compliant systems, the full framework became mandatory for all stock brokers from April 1, 2026. The rules are now in force.

The catalyst for the framework was the rapid and largely unsupervised growth of retail participation in automated and API based trading. As broker technology improved and third party algo platforms proliferated, a growing number of retail investors began using automated strategies, ranging from simple rules based execution through broker APIs to fully outsourced black box strategies sold by fintech companies promising consistent returns.

SEBI's own data, cited in the context of its broader retail derivatives review, showed that over 90 percent of retail derivatives traders consistently lost money, with aggregate retail net losses in futures and options widening significantly in recent years. Against that backdrop, a market where unregistered algo providers could run client accounts with no accountability, no disclosure of how their strategies worked, and no requirement to hold any SEBI registration was a clear regulatory risk. The February 2025 circular was SEBI's response.

Before April 2026, a retail investor could hand their login credentials to an unregistered algo provider, who would trade their account using logic the investor had never seen, with no formal registration, no audit trail, and no regulator able to trace the source of any unusual order. That specific arrangement is now prohibited.

The most fundamental structural change in the framework is the establishment of a clear principal agent relationship between brokers and algo providers. Under the new rules, the stock broker is legally the principal and is fully responsible for every algorithm that operates through its platform.

Algo providers, whether a software company, an independent developer, or a SaaS fintech, are agents who must partner with a registered broker and cannot connect directly to exchanges under any circumstances.

Alongside this, every order generated by an algorithm must now carry a unique identifier, an Algo ID, issued by the exchange. This acts as a digital fingerprint that allows SEBI and the exchanges to trace any automated order back to the specific registered strategy that generated it. If a strategy causes unusual market activity, regulators have a direct audit trail to the source. The Algo ID requirement applies to every algo order, without exception, for every broker and every retail trader from April 1, 2026.

New Requirement	What It Means	Who It Affects
Principal-agent structure	The broker is legally responsible for every algo on their platform; providers cannot connect to exchanges directly	All algo providers and the brokers they work with
Unique Algo ID per strategy	Every exchange-registered algo strategy carries a unique identifier attached to every order it places	All retail traders using any automated or API based strategy
Exchange empanelment for algo providers	Algo providers must be formally empanelled with NSE or BSE through a partner broker before they can offer strategies to retail clients	Third-party algo platforms and independent algo developers
SEBI RA registration for black box algos	Providers offering strategies where the internal logic is not disclosed to the user must hold a SEBI Research Analyst registration	Algo providers offering proprietary undisclosed strategies

SEBI's framework introduces a formal classification for algorithmic strategies that has direct consequences for the level of oversight and registration required. A White Box or execution algo is one where the logic is transparent and can be understood and replicated by the user. These strategies are treated as relatively straightforward and require standard exchange registration without any additional SEBI licensing for the provider.

A Black Box algo is one where the internal logic is not visible to the user and cannot be replicated. For these strategies, the algo provider must hold a SEBI Research Analyst registration and must maintain a detailed research report for each strategy. Critically, if the logic of a black box algo is changed in any way, it must be registered again as an entirely new strategy.

This requirement was specifically targeted at the practice of selling opaque automated strategies to retail clients with no disclosure of how they work, no accountability when they fail, and no regulatory trail connecting the strategy to any registered entity.

If your algo provider cannot or will not explain how their strategy generates its signals, they are running a black box algo. Under the new rules, offering that strategy to retail investors requires SEBI Research Analyst registration. If your provider does not have that registration, operating under this framework is not legal.

Not every retail investor using a broker API needs to formally register their strategy with the exchange. SEBI has set a clear threshold: 10 orders per second, measured per exchange within any given calendar second. Trading activity that stays consistently below this threshold does not require formal algo registration. Activity that crosses it, even occasionally, requires the strategy to be registered through the broker before it can continue running.

For most retail investors running relatively simple rules based strategies, perhaps a moving average crossover that checks conditions once per minute or a bracket order placed on a breakout, the 10 orders per second threshold is unlikely to be relevant. For more active traders running high frequency strategies or anyone connecting through a broker API to execute multiple instruments simultaneously, the threshold deserves a precise check against their actual order submission rates.

The NSE's implementation standards, published in May 2025 following SEBI's February circular, set out specific technical security requirements that all brokers running retail algo platforms must meet.

These are not optional; they are mandatory for any broker that allows retail clients API access.

• Static IP requirement: retail clients using broker APIs must provide one or two static IP addresses, which the broker whitelists for their account. Variable or dynamic IP addresses are no longer accepted for API trading, which means retail traders who previously used home internet connections with dynamic IPs need to either upgrade to a static IP or use a cloud server with a fixed address.

• Two factor authentication: OAuth logins and two factor authentication are required for all API access, with specific cybersecurity standards around password expiry and encrypted data exchange.

• Daily session logout: all API sessions must automatically log out before each trading day begins, in the pre open session window. Sessions that persist across trading days are no longer permitted.

• Five year audit trail: brokers must maintain detailed logs of all API activity, including the order source, the Algo ID, timestamps, and strategy parameters, for a minimum of five years. This is the mechanism that enables the regulatory audit trail the framework is designed to create.

• Indian server hosting requirement: all retail algo strategies, whether built by the client or provided by a vendor, must be hosted on servers located in India. Offshore hosting of strategies that execute on Indian exchanges is no longer permitted.

The framework was not implemented overnight. SEBI's February 2025 circular set an initial implementation deadline of August 1, 2025, which was subsequently deferred twice. The first deferral moved the primary deadline to October 2025, with a glide path allowing brokers that had not yet complied additional time.

A second extension moved full mandatory compliance for all brokers to April 1, 2026, after brokers indicated they needed more time to build the technical infrastructure required to meet the implementation standards.

The phased approach had real enforcement teeth. Brokers that had not met the October 2025 milestones were barred from onboarding new retail clients for API based algo trading from January 5, 2026. The April 1 cutoff extended that enforcement to existing users, not just new ones, making it a hard deadline rather than a gradual one.

Milestone	Date	What It Meant
SEBI circular issued	February 4, 2025	The foundational regulatory framework published
NSE implementation standards	May 5, 2025	Exchange-level technical requirements published
Phased go-live for ready brokers	October 1, 2025	Compliant brokers allowed to begin onboarding algo clients
New client ban for brokers that had not yet complied	January 5, 2026	Brokers not yet compliant barred from new retail API onboarding
Full mandatory compliance	April 1, 2026	Framework applies to all existing and new retail algo activity across all brokers

The practical impact of the framework depends entirely on how you actually trade. Three broad categories of retail participants are affected differently.

• If you trade manually through a broker app or web terminal without any third party tools or APIs, the framework does not affect your trading experience in any way. These rules apply only to automated and API based trading.

• If you use a broker API for your own scripts or rules based tools below the 10 orders per second threshold, the primary operational changes are the static IP requirement, the daily mandatory logout, and 2FA on your API access. Your trading approach itself does not change, but your broker may ask you to complete a registration step confirming your self built algo meets the framework requirements.

• If you use a third party algo platform, the most important check is whether that provider has completed exchange empanelment and, for black box strategies, whether they hold the required SEBI Research Analyst registration. Using a platform that is not compliant with the new framework means your orders are being placed through a registration that does not exist in the regulatory system, which is a material compliance risk.

Disclaimer

Disclaimer: This article is for educational purposes only and does not constitute legal, financial, or trading advice. The description of SEBI's algo trading framework reflects SEBI circular SEBI/HO/MIRSD/MIRSD-PoD/P/2025/0000013 dated February 4, 2025, NSE implementation standards dated May 5, 2025, and the April 1, 2026 mandatory compliance date, as understood in June 2026, and is subject to further amendment. Readers should verify their broker's specific compliance status and consult a qualified financial or legal adviser before making changes to their trading setup.