Regulation · decoded
In February 2025, India's market regulator SEBI wrote new rules for people who let computer programs trade for them. After two extensions and a phased glide path, the framework is in full force for every broker since April 1, 2026. The legal text is dense. Here is what it actually says — minus the legalese.
You write down rules — "buy this when it gets cheap, sell when it goes up" — and a program follows them, fast, without you clicking anything. SEBI calls any order placed by a program through an API an algo order.
Grown-up version: orders generated using automated execution logic, routed through broker APIs, are algorithmic orders under the framework.
Every single order placed through an API carries an algo tag. Registered robots get their own unique ID from the exchange; small unregistered ones share a generic tag. Either way, if a robot misbehaves, everyone knows which robot it was and who owns it.
There are three kinds of name tags: robots built by your broker, robots sold by approved robot shops (one ID works across all brokers), and robots you built yourself.
Grown-up version: all API orders are treated as algo orders. Registered algos carry a unique exchange-issued algo ID; below-threshold self-built algos are tagged with a generic algo ID. IDs come in three categories — broker in-house, empanelled provider (portable across brokers), and client-developed. Any change to an approved algo's logic requires fresh exchange approval, reported through the broker.
Built your own robot? If it places fewer than 10 orders every second, you can use it without registering — it just wears the shared generic tag. Faster than that, and you must register it with the exchange through your broker, and it gets its own unique name tag.
Grown-up version: the Threshold Orders Per Second (TOPS) is initially 10 OPS, measured per segment per exchange, set by the Brokers' Industry Standards Forum. Below TOPS: generic algo ID, no registration. Above TOPS: mandatory exchange registration via the broker and a unique algo ID.
Your registered robot can also trade for your husband or wife, your kids and your parents (if they depend on you). Friends, neighbours, or paying customers? Not allowed — that would make you a business, and businesses have their own rules.
Grown-up version: a registered self-developed algo may be used for "family" — self, spouse, dependent children, dependent parents — but not for other investors.
No more open doors. Your robot may only enter from one fixed home address (a static IP your broker writes down and ties to your key), with its own special key, after showing ID twice (two-factor login). Old-style logins are switched off. Your family can share your home address — strangers can't.
Grown-up version: no open APIs; access only via unique vendor/client-specific API keys mapped to broker-whitelisted static IPs (the client's IP, or the vendor's for empanelled providers), OAuth-based authentication exclusively, 2FA on API access, and password-expiry hygiene. One household static IP may be mapped to multiple family accounts' API keys.
The broker is in charge, and robot shops (algo providers) work as the broker's helpers. If a robot loses your money or something breaks, you complain to your broker — the broker cannot point fingers at anyone else.
Grown-up version: brokers act as principal, algo providers as their agents. Brokers are solely responsible for investor grievances, API monitoring for prohibited activity, and due diligence on providers.
Some robots show you exactly how they think — white box. Some keep their brain secret — black box. Mystery-robot makers must sign up as official Research Analysts and keep a written report explaining each robot. New brain? New registration, new report.
Grown-up version: execution/white-box algos have disclosed, replicable logic. Black-box providers must register as Research Analysts under SEBI's RA regulations, maintain research reports per algo, and re-register on any logic change.
Companies selling robots must get on the exchange's approved list before brokers can work with them. If a shop shares fees with your broker, they must tell you everything you're paying, clearly.
Grown-up version: algo providers must be empanelled with exchanges per exchange criteria. Fee/brokerage sharing between provider and broker is allowed only with prominent, complete disclosure and no conflict of interest.
The stock exchange watches every robot all day, tests them before they play, and keeps a kill switch — one press, and every order from a misbehaving robot stops instantly. A robot that goes rogue can be thrown out of the game entirely.
Grown-up version: exchanges run SOP-based algo testing, continuous surveillance and simulation, retain a per-algo-ID kill switch as the last line of defence, and can terminate rogue algos. Execution algos get fast-track registration TATs, published in each exchange's SOP.
What about robots that learn — AI that decides trades by itself? In June 2025 SEBI published a draft rulebook for AI in the markets. The short version: a real human boss must stay responsible, the robot must be tested before and watched after it plays, it must be fair with everyone's data, and firms must tell you when an AI is making decisions about your money. And remember: an AI whose reasoning you can't explain is a mystery robot — the black-box rules above already apply to it.
Grown-up version: SEBI's consultation paper "Guidelines for Responsible Usage of AI/ML in Indian Securities Markets" (June 20, 2025) proposes five principle areas — model governance (board-approved framework, senior-management ownership, human-in-the-loop), investor-protection disclosure of AI use in algo trading/advisory, testing frameworks (validation, shadow testing, fallback plans), fairness & bias controls, and data privacy & cybersecurity — with periodic accuracy and audit reporting to SEBI. Final guidelines are pending; AI-driven strategies with non-explainable logic fall under the existing black-box regime (Research Analyst registration, per-algo research reports).
SEBI wrote the rules in February 2025. Everyone needed more time, twice. Ready brokers switched on from October 1, 2025; the slower ones had homework with deadlines — register robots by November, pass a practice drill by January — or they were banned from taking new robot customers. Since April 1, 2026, every broker in India plays by these rules. That includes today.
Grown-up version: effective date moved from Aug 1, 2025 to Oct 1, 2025 (circular of Jul 29, 2025), then circular 132 (Sep 30, 2025) set a glide path: ready brokers live Oct 1, 2025; Milestone 1 — apply to register API algo products + ≥1 strategy by Oct 31, 2025; Milestone 2 — registrations completed by Nov 30, 2025; Milestone 3 — mock session participation by Jan 3, 2026. Brokers missing milestones were barred from onboarding new retail API-algo clients from Jan 5, 2026. Full framework + exchange operational modalities (issued Jul 22, 2025) binding on all brokers from Apr 1, 2026.
What this means here
The platform you're on was designed after this framework existed — so the safeguards aren't bolted on, they're the architecture:
POST /v1/killswitch in the sandboxAU-1005)Last reviewed August 2026. This page is a plain-language summary for education, not legal advice and not a substitute for the circulars themselves. Rules evolve — always check the current text at sebi.gov.in, your exchange's implementation standards and operational modalities (issued Jul 22, 2025, with subsequent clarifications) before going live with an algo. Threshold values (like 10 orders per second) are set by exchanges via the Brokers' Industry Standards Forum and can change. The AI/ML guidelines referenced are at consultation stage; final norms may differ.