If you run an automated strategy on an Indian broker API, the rules you traded under last year no longer apply. SEBI’s framework for retail algorithmic trading — first issued in a circular dated 4 February 2025 and deferred twice — became fully mandatory on 1 April 2026.
This is a plain-English summary of what changed and what it means in practice. We build trading automation for a living, so this is written from the perspective of people who had to make their own systems comply.
Each order placed by an algorithm must carry a unique identifier issued by the exchange — on placement, modification and cancellation alike. The purpose is traceability: every automated order can now be tied back to the strategy that generated it.
The practical consequence: a strategy that is not registered and does not carry an Algo-ID cannot legally trade.
API orders may only be sent from a static IP address registered with your broker. Dynamic IPs — home broadband that rotates, mobile data, cafe Wi-Fi — are blocked. Brokers are required to reject requests from non-whitelisted addresses.
In practice this means running your bot from a VPS or cloud instance with a fixed IP, or obtaining a static IP from your ISP, and registering it with your broker. This is also why multi-user algo platforms are non-trivial to build: each user needs their own whitelisted network identity, not a shared one.
The framework establishes a principal–agent relationship. The broker is the principal, and any algo provider operating through the broker’s API is treated as the broker’s agent. The broker is legally accountable for algo orders running through their platform, regardless of who wrote the strategy.
This is why brokers have been restructuring their API programmes and conducting due diligence on vendors. If you use a third-party algo service, it should be empanelled and working through your broker — not connecting to the exchange on its own.
Not every API user needs formal registration. The widely reported dividing line is order throughput:
Most retail strategies — an intraday breakout, a straddle with adjustments, a pivot-based system — sit comfortably under the threshold.
Strategies with transparent, rule-based logic (“buy if RSI < 30”) are classified as white box and are more straightforward to approve. Black box strategies, where the logic is not disclosed, carry a heavier burden: providers of black box algos are required to register as Research Analysts and disclose performance periodically.
If you are choosing an algo vendor, this is a useful filter. A provider who cannot or will not explain what the strategy does now has a regulatory problem, not just a transparency problem.
The framework also brings API access closer to institutional standards: OAuth-based logins with two-factor authentication, API sessions that reset before the next pre-open, and multi-year retention of algo and API activity logs by brokers.
The rules add friction — but the friction is aimed at unregistered vendors promising guaranteed returns, not at traders automating their own strategies. Retail algo trading in India is now a regulated activity with a clear chain of accountability, which is a good thing for anyone building seriously.
This article is a general summary and not legal or compliance advice. Rules continue to evolve and interpretations vary by broker — confirm your own position with your broker’s compliance team.
Need your strategy automated properly — compliant infrastructure, static IP deployment and all? Get a free consultation and fixed quote from Data Genesis.
Your Gateway to Advanced Trading Solutions. Discover our innovative bots and strategies for a smarter, more efficient trading experience. Connect with us for cutting-edge technology that transforms your financial journey.
