WARRANTThe framework in one paragraph.
SEBI did three things in this paragraph that the older 2012 framework on broad guidelines for algorithmic trading did not. It named retail demand as the trigger. It named brokers and exchanges, in that order, as the load-bearing actors. And it conceded the existing framework needed review, not extension. The 2012 circular CIR/MRD/DP/09/2012 set broad guidelines for algorithmic trading at the exchange and member level; institutional desks separately reached the market through the Direct Market Access facility. The 2025 circular covers a different population entirely: retail investors using broker APIs, with third-party algo providers in the loop.
The distinction matters because retail algo trading exposes a different risk surface. An institutional desk has compliance, controls, and a regulated balance sheet. A retail trader using an algo bought from a fintech vendor has none of those. The framework solves the problem by making the broker the principal and the algo provider the agent. The agency relationship is not a metaphor in the circular. It is the operative legal device that pulls every algo order back inside a SEBI-supervised perimeter.
The four sub-clauses of paragraph 5(I) of the 4 February 2025 circular, paraphrased and indexed:
Registration, pre-approval, or self-attestation.
The single most-asked question on this circular in May 2026 is whether SEBI requires pre-approval, registration, or self-attestation for retail algos. The answer is two answers, because the framework operates on two different registers at once.
Algos themselves are pre-approved. Paragraph 5(II)(a) reads: The facility of algo trading shall be provided by the broker only after obtaining requisite permission of the stock exchange for each algo. The verb is obtaining requisite permission, not notifying. Each algo. Not each algo provider. Not each strategy family. Each algo. Paragraph 5(II)(b) extends the requirement to modifications: the broker shall seek approval from the Exchange for any modification or change to the approved algos. A version bump that changes the logic is a re-approval event.
Algo providers, by contrast, are empanelled, not registered with SEBI. Paragraph 5(III)(a) reads: While algo providers shall not be regulated by SEBI, for better oversight, any algo provider, providing the facility to place algo orders with Brokers through API, shall require to be empaneled with Exchanges in a manner as stipulated by Exchanges. Paragraph 5(III)(b) leaves the empanelment criteria to the exchanges. Paragraph 5(III)(c) puts the broker on the hook for due diligence before onboarding any empanelled provider.
The third register sits inside paragraph 5(V). Black-box algos, where the logic is not known to the user and is not replicable, attach an extra obligation: the algo provider shall register as a Research Analyst under the SEBI (Research Analysts) Regulations, 2014, and shall maintain a detailed research report for each such algo. A change in the logic re-registers the algo as a fresh algo with a fresh research report. White-box, replicable execution algos do not pull in the Research Analyst registration.
So the layered answer to the registration question · algo · exchange permission per algo. Algo provider · exchange empanelment plus broker due diligence. Black-box algo provider · SEBI Research Analyst registration on top. Self-attestation by the broker is not a permitted route at any of the three layers.
The September 2025 extension circular.
The original 4 February 2025 circular set two implementation dates in paragraph 7. Implementation standards by 1 April 2025, formulated by the Broker's Industry Standards Forum under the aegis of the stock exchanges and in consultation with SEBI. Provisions of the circular applicable from 1 August 2025.
Neither date held. SEBI extended the implementation-standards date in April 2025. The exchanges issued the detailed operational modalities only on 22 July 2025. SEBI then extended the applicability date to 1 October 2025 by a further circular dated 29 July 2025. In the second fortnight of September 2025, the exchanges issued additional clarifications and modifications to the operational modalities. The 30 September 2025 circular records the path and resets the clock.
Paragraph 4 of the September 2025 circular sets a glide path. Paragraph 8 sets the universal applicability date. Verbatim: W.e.f. April 01, 2026, algo framework specified in circular dated February 04, 2025 along with implementation standards and detailed operational modalities (issued by exchanges) will be applicable for all stock brokers.
Three milestones inside the glide path, all inside paragraph 4 of the September 2025 circular:
The reason SEBI extended is recorded inside the circular itself, not inferred. It is system-readiness, not policy-disagreement. Brokers needed time to implement the operational modalities the exchanges had only finalised in late September 2025. SEBI did not soften any obligation in the underlying February circular. It softened the calendar.
Documentation and audit trail.
The 4 February 2025 circular does not centralise the documentation requirement. It distributes it across paragraphs 5(I)(b), 5(II)(b), 5(III)(c), and 5(V)(a)(ii). Read together, three categories of evidence become mandatory.
Per-order. Paragraph 5(I)(b) requires the unique exchange-issued identifier on every algo order flowing through the API. Paragraph 5(II)(b) repeats and adds the audit trail purpose: All algo orders shall be tagged with a unique identifier provided by the Exchange in order to establish audit trail. The order ledger therefore must carry the algo identifier alongside the order identifier. A trade blotter without the algo identifier does not satisfy the framework.
Per-algo. Each algo carries an exchange permission. Each modification is approved before it goes live. The broker's algo register therefore needs three fields per algo: the exchange permission reference, the version-controlled logic record, and the modification-approval reference. Paragraph 5(II)(b) is explicit: the broker shall seek approval from the Exchange for any modification or change to the approved algos.
Per-algo-provider. Paragraph 5(III)(c) places due diligence on the broker before onboarding an empanelled algo provider. Black-box algos add the Research Analyst report requirement under paragraph 5(V)(a)(ii). The algo-provider register therefore needs the empanelment confirmation, the broker due-diligence record, and, for black-box algos, the Research Analyst registration plus the per-algo research report confirmation.
The retention period is not stated in the February 2025 circular. SEBI's master circular on stock brokers and the SEBI (Stock Brokers) Regulations, 1992 set the retention floor at five years for order records and broker books. Exchange-level operational modalities, issued 22 July 2025 and clarified in late September 2025, set the retention floor for API audit-trail data at five years, and separately require the broker's server routing API orders to the exchange to be located in India. A six-month rolling log destroyed twelve months ago is not an answer to a SEBI inspection a year and one day after a disputed order.
The enforcement signal since 1 April 2026.
Paragraph 8 of the September 2025 circular makes 1 April 2026 the universal applicability date for all stock brokers. Today is 9 May 2026. Five weeks of operational application have run.
Three observable enforcement vectors. First, the 5 January 2026 sanction gate under paragraph 5 of the September 2025 circular barred non-compliant brokers from onboarding new retail clients for API-based algo trading. The bar is automatic. It does not require a SEBI adjudication. Brokers who failed to hit milestones 1 through 3 lose new-retail onboarding by operation of the circular itself.
Second, exchange-level monitoring under paragraph 6 of the September 2025 circular. Stock exchanges shall monitor the compliance of stock brokers with the above stated milestones. The exchanges followed with their own compliance material — NSE issued a retail-algo FAQ on 3 November 2025, and BSE a circular on adherence to the milestones on 24 November 2025. The monitoring runs continuously, not at quarter ends.
Third, the algo identifier itself is the enforcement instrument. Every algo order on every Indian exchange after 1 April 2026 carries an exchange-issued algo identifier. An exchange surveillance team can pull every order generated by a single algo across every broker that runs it, in seconds. An algo that misbehaves is identifiable, addressable, and switchable off via the kill switch contemplated in paragraph 5(IV)(a)(iii) of the February 2025 circular.
Who carries the obligation.
The framework solves the broker-vs-vendor split with the agency device. The broker is principal. The algo provider is agent. The retail trader is the customer of the principal. Three downstream consequences.
Liability runs to the broker. Paragraph 5(II)(c) reads: Brokers shall be solely responsible for handling investor grievances related to algo trading and the monitoring of APIs for prohibited activities. The retail trader does not chase the fintech that built the algo. The retail trader chases the broker. The broker, in turn, has its own contractual recourse against the algo provider, but the customer-facing obligation is non-delegable.
Conflict of interest is broker-managed. Paragraph 5(III)(d) permits revenue sharing between broker and algo provider on subscription charges and brokerage. However, prominent and complete disclosures of all the charges shall be made to the client. The broker shall also ensure that such arrangements do not result in any conflict of interest. The disclosure-and-conflict obligation sits with the broker, not the algo provider.
API access is broker-controlled. Paragraph 5(I)(d) prohibits open APIs, requires unique vendor-client API keys, static-IP whitelisting, OAuth-only authentication, and two-factor authentication, and limits broker dealings to empanelled algo providers. All four controls are broker-implemented. None of them is a vendor obligation. A vendor without a broker relationship cannot route a single retail algo order to an Indian exchange after 1 April 2026.
How SEBI clauses map to evidence fields.
Eight clauses, no dedicated fields. The schema is closed — actions, authorizations, classification, coverage_by_regime, deferred_regimes, obligations, refusal_reason, risk_tier, trace_metadata, and nothing else — and not one requirement below has an attribute of its own. What a package establishes is which regimes a decision was assessed against, what the per-action authorization verdict was, and — in obligations, keyed by action_id — which corpus sub-clauses that action triggered and whether each is satisfied, gap, uncertain or unvalidated. A row saying the tagging obligation is satisfied is a verdict about the obligation. It is not the tag. Every identifier, permission, approval and milestone the framework demands lives in the broker's records. This table says so clause by clause, because a compliance officer who assumes otherwise finds out during an inspection.
classification.jurisdictions and classification.regimes for scope.
actions[] permits exactly action_id, actor, action and subject; exchange and broker order identifiers, sequence numbers and per-action timestamps are all stripped before the signed aggregate is built.
classification.regimes names the regimes a decision was assessed against; naming a regime is not evidence that permission to offer the algo was granted.
actions[] is closed to action_id, actor, action and subject. trace_metadata fixes the package identifier, the sealed timestamp and the regulatory-corpus digest — it versions the corpus a decision was read against, never the algorithm that produced the order.
trace_metadata.timestamp fixes when a decision was sealed, which places it on one side or the other of a dated deadline — it is not evidence that a milestone was met.
The specimen below is not a trading record. It is an RBI NBFC-MFI lending decision, and the five regimes it cites are Indian lending and data-protection regimes — the SEBI algo framework is not among them. It is linked because the shape of the record is the point of this section: closed roots, per-action verdicts, obligation rows that name a sub-clause and a status. Read it for the shape, not for the regime.
The earlier institutional algo framework.
Paragraph 1 of the February 2025 circular cites the genealogy directly: SEBI, vide circular no. CIR/MRD/DP/09/2012 dated March 30, 2012, provided broad guidelines on Algorithmic Trading (Algo - orders generated using automated execution logic). Thereafter, SEBI has introduced measures to strengthen controls around Algorithmic Trading.
The 2012 circular set broad guidelines for algo trading in a market where access ran through institutional channels such as direct market access. It set order-rate controls, system audits, and stock-exchange surveillance obligations on members offering algo trading. SEBI circular SEBI/HO/MRD/DP/CIR/P/2018/62 of 9 April 2018, on measures to strengthen the algorithmic trading and co-location framework, refined the institutional surveillance model. The SEBI discussion paper of 9 December 2021 on algorithmic trading by retail investors raised the API question for the first time. The February 2025 circular is the operative answer.
The genealogy matters because the 2012 circular is not superseded. Paragraph 6 of the February 2025 circular reads: Exchanges and brokers shall continue to comply with existing provisions prescribed with regard to Algorithmic trading. The retail framework sits on top of the institutional framework. A broker offering both desks complies with both.
Paragraph 9 of the February 2025 circular roots the legal authority in the standard SEBI machinery: This circular is issued in exercise of powers conferred under Section 11(1) of Chapter IV of the Securities and Exchange Board of India Act, 1992, read with Section 30 of the Securities and Exchange Board of India (Stock Brokers) Regulations, 1992 to protect the interests of investors in securities, to promote the development of and to regulate the securities market. Penalty exposure for non-compliance runs through the SEBI Act, the Stock Brokers Regulations, and the exchange bye-laws. There is no single penalty ceiling number to quote.
Relationship to RBI FREE-AI and India DPDP.
Three Indian instruments are read together on this population, and as at the date of this entry, 9 May 2026, exactly one of them binds it. Ranking them by force, not by prominence:
Binding. The SEBI framework above. Paragraph 8 of the 30 September 2025 circular made it applicable to all stock brokers from 1 April 2026, and it carries a penalty route through the SEBI Act, 1992 and the Stock Brokers Regulations, 1992.
Not binding. The Reserve Bank's FREE-AI report of 13 August 2025 is the report of a committee the Reserve Bank constituted. RBI's press release of that date records only that the committee has since submitted its report and the same is being placed on the RBI website. No adoption instrument, no direction, no compliance date, and no consequence attaches to non-adherence. The report's recommendations are drafted in binding-sounding modality — Recommendation 16 reads REs must implement robust model governance mechanisms — and that modality is the report's, not the Reserve Bank's. Treating a FREE-AI recommendation as a duty is a reading error, not a conservative posture.
Not yet commenced, in the part that matters. The Digital Personal Data Protection Act, 2023 received assent on 11 August 2023 and was brought into force in tranches by G.S.R. 843(E) of 13 November 2025. The administrative provisions took effect on publication. The substantive obligations — sections 3 to 17, section 6 in most of its sub-sections, and section 27 other than clause (d) — take effect at eighteen months from the publication of that gazette, which falls in May 2027. The DPDP Rules, G.S.R. 846(E), were notified the same day and run to the same clock. Neither instrument states a calendar date; both state the interval.
The perimeters intersect unevenly. A retail algo platform that uses AI to generate trade signals is bound by the February 2025 circular today. The FREE-AI recommendations address it only if it is operated by a Reserve Bank regulated entity, and exchange empanelment does not make an algo provider one — paragraph 5(III)(a) is explicit that algo providers shall not be regulated by SEBI, and nothing in it puts them inside the RBI perimeter either. Its trade ledger holds personal data of the investor, which the DPDP Act reaches when those sections commence, not now.
The intersection still has practical consequences for the evidence package. Three record-keeping demands sit around the same order, on three different clocks. The exchange-issued algo identifier under SEBI paragraph 5(I)(b), in force. The model-governance record FREE-AI Recommendation 16 recommends, in force against no one. The data-fiduciary linkage the DPDP Act will require of any personal-data processing once its substantive sections commence. A Warrant package carries none of the three. What it carries is narrower: the regimes a decision was assessed against, and per action, an authorization verdict with its justification and the obligation rows keyed to that action — checkable without contacting Warrant. A SEBI inspection reads it against the broker's order records. It does not replace them, and it does not stand in for a model-governance file no instrument yet requires or a data-fiduciary register the Act does not yet compel.
Questions a compliance officer asks first.
Read the source directly.
- SEBI circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/0000013 of 4 February 2025 · Safer participation of retail investors in Algorithmic trading
- SEBI circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/132 of 30 September 2025 · Extension of timeline for implementation
- SEBI circular of April 2025 · Extension of timeline for formulation of implementation standards
- SEBI circular of 29 July 2025 · Extension of timeline to 1 October 2025
- SEBI circular CIR/MRD/DP/09/2012 of 30 March 2012 · Broad Guidelines on Algorithmic Trading
- Per-obligation Warrant evidence field mapping · India
Authored by Warrant Compliance, the regulatory-analysis function at Warrant. [email protected]. Editorial commentary on regulatory text. Not legal advice. The verbatim quotations of paragraphs 1, 3, 5(I), 5(II), 5(III), 5(IV), 5(V), 6, 7, and 9 of circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/0000013 reflect the official English-language text published by SEBI on 4 February 2025. The verbatim quotations of paragraphs 1, 3, 4, 5, 6, and 8 of circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/132 reflect the official English-language text published by SEBI on 30 September 2025.