SEBI Retail Algo Trading Rules 2026: What Changed and What to Do Now

SEBI Retail Algo Trading Rules 2026: What Changed and What to Do Now

SEBI’s framework for retail algorithmic trading has applied to every stock broker since 1 April 2026. The deadline has passed. If you are a Research Analyst (RA), an algo provider or an Authorised Person (AP, the role people still call “sub-broker”), the question is no longer “how do I prepare?” It is “am I operating inside the framework today, and if not, what do I fix first?”

This guide covers what the rules say, where the dates landed, what counts as an algo, the white-box and black-box split, and a practical checklist for anyone whose clients were on informal API or copy-trade setups before April 2026. Facts are taken from the SEBI circulars and NSE’s published FAQs, linked inline.

Where things stand (October 2026)

• The framework is live for all brokers. The SEBI circular of 30 September 2025 said that from 1 April 2026 the February 2025 framework, along with the exchanges’ implementation standards and operational modalities, applies to all stock brokers.
• Algo providers must be empanelled with the exchanges. NSE publishes and updates its list of empanelled providers. See our guide on NSE empanelled algo providers and how to get empanelled.
• Black-box algos need an RA registration. If the logic is hidden from the user, the provider must be registered with SEBI as a Research Analyst.

How the timeline played out

The core rules in plain English

The broker is the principal, the algo provider is its agent

When algo trading is offered through a broker’s API, the broker is the principal and any algo provider or fintech vendor acts as the broker’s agent. Brokers may deal only with empanelled algo providers and handle all related complaints. This is why brokers have become strict about whom they let onto their APIs.

Every algo order is tagged

Algo orders flowing through broker APIs carry a unique identifier provided by the exchange. The broker needs the exchange’s permission for each algo it offers, and must seek approval for any change to an approved algo.

API access is locked down

• No open APIs. Access only through a unique vendor-client API key and a static IP whitelisted by the broker.
• OAuth-based authentication only; other mechanisms are discontinued.
• Two-factor authentication for API access.

Strategies run on the broker’s servers

NSE’s operational modalities require that strategies run on the broker’s servers and order messages originate from there. The exception is a “tech-savvy” individual running their own algo, who hosts it at their end on a static IP (per the NSE FAQs on retail algo trading).

The orders-per-second threshold

SEBI left the threshold to the brokers’ Industry Standards Forum and the exchanges. NSE’s FAQs refer to a threshold of 10 orders per second (OPS). An individual who writes their own algo must register it through the broker only if it crosses the threshold, and may use it for their family (self, spouse, dependent children and dependent parents) but not for other investors. All API orders from clients are still treated as algo orders and carry a standardised tag even below the threshold.

Market orders through algos

NSE’s FAQ cites its circular NSE/MSD/67753 (29 April 2025): algo orders with order type “Market” are not permitted. If any automation you rely on sends market orders, check how your broker now handles it.

White-box vs black-box algos

The circular splits algos into two categories:

• White-box (execution) algos: the logic is disclosed and replicable. The user can understand what the strategy does.
• Black-box algos: the user cannot see the logic and cannot replicate it. For these, the algo provider must register as a Research Analyst, keep a detailed research report for each algo, confirm to the exchanges that the report is maintained, and register any change in logic as a fresh algo with a fresh report.

NSE’s FAQ adds two points that matter for RAs. An RA who wants to deploy a black-box algo must first become an empanelled algo provider. And because algos must be hosted on the broker’s server, one algo provider cannot host black-box algos for several third-party RAs.

Is my model portfolio an “algo”?

The 2012 definition SEBI restates is “orders generated using automated execution logic”. A useful way to think about it:

• Research the client acts on. You publish a model portfolio or a recommendation; the client reviews it and places the order in their own broker account. That is research or advice, governed by your RA or RIA registration.
• Logic that places orders. A program that decides and sends orders on the client’s behalf through an API is algo provision. It needs the broker, exchange registration and, for hidden logic, an RA-registered empanelled provider.
• Grey areas. Screeners that auto-generate buy and sell lists, or “auto-execute” toggles, sit closer to the line. Ask your broker’s compliance team how they classify the flow before you launch it.

Whatever side you are on, label backtested results as hypothetical and keep them separate from live performance. Past-performance claims now have to come through SEBI’s verification route; see what PaRRVA is and how it works. If you are still testing a strategy, our guide on how to backtest a stock strategy in India covers the common pitfalls.

If your clients were on informal rails before April 2026

Many APs and strategy sellers had clients on shared API keys, Telegram signal groups or untagged copy-trade setups. Those flows do not get “grandfathered” because the client is old: tagging and empanelment attach to the order flow. If any of that is still running, work through this list in order.

1. Confirm the registration you need. Are you giving advice, distributing research or executing? Decide with a compliance professional whether you need RA or RIA registration, or should work only as an AP. No platform substitutes for this step. Our comparison of AP, MFD, RIA and RA roles is a good starting point, and what SEBI RA registration costs covers the fees.
2. Inventory the book. List every client, the strategy they follow, their broker, how they pay you and the rail they are on today.
3. Stop the non-compliant mechanics. Retire shared API keys, untagged automation and any fee-for-tips arrangement without registration. Do not patch them.
4. Pick a compliant destination. Either an empanelled provider working through a broker, or registered model portfolios that clients execute in their own broker accounts.
5. Re-paper onboarding and billing. Digital KYC, signed terms (MITC for RAs) and proper subscription invoices, so the money trail matches the advice trail.
6. Tell clients early and plainly. Explain that you are moving them to a registered, traceable setup. A calm note sent before the change loses far fewer clients than a scramble after a broker cuts access.
7. Migrate in small batches. Move one cohort, confirm execution and billing end to end, then move the rest and shut the old rail.

What the rules mean for your business model

SEBI has pushed automated trading into named, registered, traceable channels. For a serious RA that is mostly good news: the anonymous operator running someone else’s API key is squeezed out. Many RAs are better served publishing model portfolios and letting clients execute through their own brokers, rather than running shared automated execution. It keeps you clearly on the research side of the line. If you want to sell a strategy as a product, read can I sell trading strategies after SEBI’s April 2026 rules for the compliant routes.

AlphaQuark is built for that research-side model: model portfolios with rebalancing that clients approve and place in their own broker accounts, onboarding with KYC and e-sign, subscription billing, and time-stamped advice records. See the SEBI RA software platform and our algo compliance overview. It is not a way around a registration you are required to hold.