For over a decade, algorithmic trading in India operated under a framework that SEBI first put in place in 2012; one designed primarily for institutional participants. Retail investors, for the most part, were outside its scope.
That changes from April 1, 2026.
Through a circular issued on February 4, 2025, SEBI has overhauled the rules governing algorithmic trading by retail investors. The changes affect how algo orders are placed, who is accountable for them, and what standards brokers, algo providers, and retail traders must now meet. The framework was originally scheduled for August 2025 but was deferred twice to allow brokers adequate time to comply.
Here is what the new rules say.
Your Broker Is Now Accountable for Every Algo Order
The most significant structural change in the new framework is the establishment of a principal-agent relationship between brokers and algo providers.
Under the revised rules, the stock broker is the principal. Any algo provider (whether a fintech company or an independent vendor) operating through the broker's API is considered the broker's agent. This means the broker is now legally responsible for every algo order that runs through their platform, regardless of who built the strategy.
Practically, this means no algo provider can connect to stock exchanges directly. All orders must route through the broker's infrastructure. Investor grievances related to algo trading must also be handled by the broker, not the vendor.
Every Algo Order Gets a Unique Exchange-Assigned ID
SEBI has mandated that all orders placed through an algorithm carry a unique identifier issued by the stock exchange. This applies to every order: placement, modification, and cancellation.
The objective is traceability. Each order must be tied to its source, creating a complete audit trail from strategy to execution. If a broker modifies an approved algo in any way, fresh exchange approval is required before the modified version can go live.
API Access Becomes Significantly More Restrictive
Retail traders who use APIs to connect third-party tools or run their own strategies will notice four concrete changes to how API access works.
First, only a static IP address registered with the broker can be used to send orders through the API. Connections from any other IP are rejected. Second, OAuth-based authentication is now the only permitted method, all other login mechanisms are discontinued. Third, two-factor authentication is mandatory for every API session. Fourth, all API sessions are automatically closed at the end of each trading day. Continuous, uninterrupted sessions are no longer permitted.
Open APIs (where access is unrestricted and broadly available) are not allowed under the new rules.
Algos Are Now Classified Into Two Categories
SEBI has introduced a formal classification for algorithmic strategies: White Box Algos and Black Box Algos.
White Box Algos, also referred to as execution algos, are strategies where the logic is transparent and replicable. The rules governing these remain relatively straightforward, requiring standard exchange registration.
Black Box Algos are strategies where the internal logic is not visible to the user and cannot be replicated. For these, the algo provider must be registered as a Research Analyst with SEBI and must maintain a detailed research report for each strategy. If the logic of a Black Box algo is changed in any way, it must be re-registered as a new algo entirely.
This classification has direct implications for retail investors using third-party platforms. If your algo provider cannot explain how their strategy works, they are operating a Black Box algo, and under the new rules, they need to be a SEBI-registered Research Analyst to offer it legally.
The 10 Orders-Per-Second Rule
Not every retail trader using an API needs to register their strategy with the exchange. SEBI has set a threshold: 10 orders per second, measured per exchange within any given calendar second.
If your trading activity stays below this threshold, no algo registration is required. If it crosses it, the strategy must be formally registered through your broker before it can continue running.
For traders who have built their own algorithms, the new rules permit personal use, and extend that to immediate family members, defined as spouse, dependent children, and dependent parents. Sharing a self-built strategy with anyone outside this definition is not permitted.
What This Means in Practice
For retail traders using APIs below the 10 OPS threshold, the day-to-day impact is largely operational, adjusting to static IP requirements, daily logouts, and 2FA. The trading experience itself does not change materially.
For traders using third-party algo platforms, the more pressing question is whether their provider has completed exchange empanelment and, for Black Box strategies, whether they hold the required SEBI Research Analyst registration. These are worth verifying before April 1.
For algo providers and fintechs, compliance is non-negotiable. Empanelment with exchanges through a broker is mandatory. Guaranteed return claims are prohibited. And any Black Box strategy requires both Research Analyst registration and documented research reports.
Disclaimer: The information provided in our blogs is for informational purposes only and should not be construed as financial, investment, or trading advice. Trading and investing in the securities market carries risk. Always conduct your own research and consult with a qualified financial advisor before making any investment decisions. Past performance is not indicative of future results. Copyrighted and original content for your trading and investing needs.
© 2026 — Tradejini. All Rights Reserved.
