What the SEBI compliance audit is
Every SEBI-registered Research Analyst (RA) must have an annual audit of its compliance with the SEBI (Research Analysts) Regulations, 2014 and the circulars under them. The requirement is in Regulation 25(3), and the details are in paragraph 1.14 of SEBI's Master Circular for Research Analysts dated 6 February 2026.
The audit report has to list each provision of the regulations and circulars on which compliance is being reported. It also covers your obligations under the model portfolio guidelines, and your annual client-level segregation certificate forms part of it. In short, it is a yearly check of nearly everything an RA does.
Due dates
| Step | Deadline (for FY ending 31 March) | Source |
|---|---|---|
| Client-level segregation certificate obtained | Within six months of year end (30 September) | Master Circular para 1.10(h) |
| Annual compliance audit completed | Within six months of year end (30 September) | Master Circular para 1.14(c)(i) |
| Audit report submitted to RAASB/SEBI | Within one month of the date of the audit report | Master Circular para 1.14(c)(i) |
| Adverse findings and action taken submitted | Within one month of the audit report, and not later than 31 October | Master Circular para 1.14(c)(ii) |
| Audit status and adverse findings published on your website; report given to clients | After the audit (no separate date is given) | Master Circular para 1.14(d) |
For FY 2025-26, that means the audit should be finished by 30 September 2026 and filed by 31 October 2026 at the latest. These requirements apply from the audit for the year ended 31 March 2025 onwards.
Who can conduct the audit
The audit must be done by a member of one of three institutes:
- the Institute of Chartered Accountants of India (ICAI),
- the Institute of Company Secretaries of India (ICSI), or
- the Institute of Cost Accountants of India (ICMAI). SEBI added cost accountants by circulars dated 25 March 2026, effective from the date of issue.
The segregation certificate can come from an ICAI, ICSI or ICMAI member, or from your auditor (individual RA) or statutory auditor (non-individual RA). In practice, pick someone who has audited securities market intermediaries before and who has no role in running your practice. An auditor who knows the RA framework will ask for the right evidence the first time.
Compliance audit checklist
Use this table to prepare. It follows the obligations in the RA Regulations and the master circular.
| Area | What the auditor checks | Evidence to keep ready |
|---|---|---|
| Registration | Registration in force, five-yearly SEBI fee paid, enlistment with RAASB, changes reported | Registration certificate, fee receipts, RAASB correspondence |
| Qualification and NISM | Valid NISM certification for you and every person associated with research services | Current certificates with expiry dates |
| Deposit | Deposit matches the slab for the maximum client count of the previous year and is lien-marked to RAASB | Client count working, lien confirmation |
| Fees | Fees within ₹1,51,000 per family per year for individual and HUF clients; advance fee within the permitted period; pro-rata refunds; no breakage fee; no cash | Invoices, payment records, refund records |
| Terms and MITC | Consent to terms and conditions, including MITC, taken before any service or fee | Signed or e-signed terms with timestamps |
| KYC | KYC done for every fee-paying client and checked with a KRA | KYC records per client |
| Client records | Client register with PAN, service, securities and fee; records of interactions with clients and prospects | Client register, emails, call recordings, chat logs |
| Research | Every recommendation backed by a signed, dated report with rationale; disclosures made | Report archive, rationale files |
| Model portfolios | Compliance with the model portfolio guidelines in Annexure A of the master circular | Portfolio change logs, client communications |
| AI tools | Extent of AI use disclosed in the terms | Terms and conditions document |
| Advertising | Advertisement code followed, prior approval from RAASB, copies kept for five years | Ad copies, approvals, social media archive |
| Investor charter and complaints | Charter on website and app and shared at onboarding; monthly complaint data published by the 7th; grievances handled on time | Website screenshots, complaint register, SCORES records |
| Periodic reporting | Half-yearly reports to RAASB filed within 30 days; SaaS undertaking given | Filing acknowledgements |
| Segregation | Research and distribution kept apart at client level | Annual segregation certificate, client declarations |
After the audit: filing and disclosure
- Submit the report to RAASB/SEBI within one month of the audit report date.
- Submit adverse findings, if any, with the action taken. The action must be approved by you (individual RA) or by management (non-individual RA). The outer limit is 31 October.
- Publish on your website the status of the compliance audit report, and any adverse findings with the action taken.
- Give the report to clients. The master circular requires RAs to provide the compliance audit report to their clients. A link from your website and client dashboard is a simple way to do it.
A preparation plan, April to October
| Month | What to do |
|---|---|
| April | Close the year's records. Freeze the client register and complaint register. Work out the maximum client count for the deposit check (revision due by 30 April). |
| May | Engage the auditor and agree the scope. Run your own check against the checklist above. |
| June | Fix gaps: missing consents, incomplete KYC, missing rationale, old social posts that break the advertising code. |
| July–August | Audit fieldwork. Answer queries quickly and keep a log of documents shared. Get the segregation certificate. |
| September | Review the draft, agree action on any findings, and sign off before 30 September. |
| October | File the report and any adverse findings with action taken, by 31 October at the latest. Update your website. |
Common gaps to check for
- Consent after payment. The rule is consent to terms and MITC before any service or fee. A flow that collects payment first and sends terms later fails this.
- Incomplete KYC. Fee-paying clients without completed KYC, or KYC not checked with a KRA.
- Calls without rationale. A Telegram or WhatsApp call with no report behind it. The master circular says a timestamped chart alone is not enough.
- Old advertisements. Past posts claiming returns or using "best" or "No. 1". Performance claims need PaRRVA verification.
- Complaint data not published. The monthly table is due by the 7th, including months with no complaints.
- Uncertified staff. Sales or support staff who talk to clients about research are persons associated with research services and need NISM certification.
SEBI inspections: how they differ from the audit
The audit is yearly and done by your chosen professional. An inspection is done by SEBI's inspecting authority under Regulation 27. Under the RAASB framework, BSE as RAASB may also be assigned on-site or off-site inspection of RAs, on behalf of or together with SEBI. There is no fixed schedule. An inspection can look at several years of records, so the same evidence you keep for the audit is what you will be asked for.
If you receive an inspection notice:
- Read the scope and the period covered, and gather the records listed.
- Keep the same folders you use for the audit: registration, client files, research archive, complaints, advertisements, filings.
- Answer questions accurately. If you need time to retrieve a record, say so and agree a date.
- Note every document you hand over and every question asked.
- Reply to any findings in writing with the corrective action. If the matter looks serious, take advice from a securities lawyer.
Personal trading is in scope. The RA Regulations limit trading by RAs in securities they cover, so keep your own and your associates' trading records in order.
Make the audit a by-product of daily work
Most audit pain comes from rebuilding records after the event. If consents, KYC, recommendations and complaints are recorded as they happen, the audit becomes an export. AlphaQuark records KYC and MITC e-sign before payment, payments and invoices, and every recommendation and model portfolio change with a timestamp, so you can hand the auditor dated evidence. See the RA platform. For every RA deadline by month, see the SEBI RA compliance calendar. For half-yearly reporting to RAASB, see our guide to annual and half-yearly RA reporting.
Hand your auditor dated evidence, not a scramble
AlphaQuark records KYC, MITC consent, payments and every recommendation with timestamps for SEBI-registered Research Analysts.
See the RA platformFrequently Asked Questions
When is the SEBI compliance audit due for research analysts?
The audit must be completed within six months of the end of the financial year, so by 30 September. The report goes to RAASB/SEBI within one month of the audit report date, and adverse findings with action taken must be submitted no later than 31 October.
Who can conduct the annual compliance audit of an RA?
A member of the Institute of Chartered Accountants of India, the Institute of Company Secretaries of India, or, since SEBI's circular of 25 March 2026, the Institute of Cost Accountants of India.
What does the RA compliance audit cover?
Compliance with each provision of the SEBI (Research Analysts) Regulations, 2014 and the circulars under them. This includes fees, terms and MITC consent, KYC, records, research rationale, advertising, investor charter, complaint data, periodic reporting, the model portfolio guidelines and client-level segregation.
Do I have to publish my compliance audit report?
You must publish the status of the compliance audit report on your website, along with any adverse findings and the action taken. The master circular also requires you to provide the compliance audit report to your clients.
Is a SEBI inspection the same as the compliance audit?
No. The audit is an annual check by a professional you appoint. An inspection is carried out by SEBI's inspecting authority, and RAASB may be assigned to inspect on SEBI's behalf or together with it. Inspections have no fixed schedule and can cover several years of records.