SEBI Tightens Algo Trading Rules With Mandatory 2FA And Audit Trails From April 1

The Securities and Exchange Board of India (SEBI) has introduced new regulations for algorithmic trading, effective from April 1, 2026, and has made stricter regulations such as 2FA and audit trails a mandate for brokers to control retail participation in algorithmic trading, as per a circular from SEBI to its stockbrokers.

Invest in Indian Markets and Unlock Future Potential With 5paisa!

Open Account Now

The new framework has been introduced to improve risk management and transparency, considering the growing use of algorithmic trading among retail investors.

Mandatory Controls On API-Based Trading

Under the new rules, brokers will have to offer structured and secure access to Application Programming Interface-based trading. Open APIs have been discontinued, and access is now restricted to client-specific API keys linked to static IP addresses.

SEBI has mandated that all API access must follow OAuth-based authentication systems along with compulsory 2FA. Additionally, the brokers are required to enforce password expiration and auto-logout on a daily basis to improve security.

It is a requirement for all algorithmic orders to have a unique identifier issued by the stock exchanges to enable traceability and monitoring of all trades.

Audit Trails And Record-Keeping Requirements

The brokers are now required to keep records of all algorithmic trades. This includes information on time stamps, price, quantity, and order identification numbers.

Audit trails are intended to enhance accountability and enable exchanges to monitor all trades effectively. Brokers that fail to comply with these requirements will not be allowed to onboard new API clients, as per SEBI guidelines.

Registration And Scope Of Retail Algos

Retail investors using self-developed algorithms will also fall under regulatory oversight if their systems cross a specified order-per-second threshold. Such algorithms must be registered with stock exchanges through brokers.

The use of registered algorithms is restricted to the investor and their immediate family, including spouse, dependent children, and dependent parents.

Broker Responsibility And Provider Empanelment

SEBI has made brokers entirely responsible for managing algorithmic trading activities. Brokers have to seek prior approval from stock exchanges before providing algorithm trading services. They have been made responsible for keeping a check on API usage for any prohibited activities.

Further, brokers will only be allowed to deal with empanelled algorithm providers, who have been approved by stock exchanges. It has been made mandatory for brokers to conduct due diligence before dealing with such providers. All revenue sharing will have to be disclosed to clients.

Role Of Stock Exchanges And Risk Measures

Stock exchanges have been directed to establish standard operating procedures for testing algorithms and conducting continuous surveillance. They are also required to implement “kill switches” to stop malfunctioning algorithms when necessary.

Exchanges will define approval timelines for different types of algorithms and ensure systems are in place to distinguish between algorithmic and non-algorithmic orders.

SEBI has also divided algorithms into white box and black box, and different compliance requirements are applicable to these two different categories, depending on the level of transparency.

This new framework would codify the retail algorithmic trading ecosystem, including the roles and responsibilities of brokers, stock exchanges, and algo vendors, in a way that maintains market integrity.