SEBI’s algo framework: what brokers and algo providers must build
SEBI’s circular of 4 February 2025 on retail algo trading gave brokers, algo providers and exchanges new duties, and after its deadlines were extended it applies to every stock broker from 1 April 2026. Our guide to the retail rules covers the trader’s side. This one covers the systems a broker or an algo provider has to run, with each point taken from SEBI’s circular or NSE’s FAQ.
General information as of November 2026, taken from the SEBI and NSE documents listed at the end. It is not legal or regulatory advice. The circulars and your exchange’s current notices decide the details.
The four roles
- SEBI sets the framework. It does not regulate algo providers directly; it has them empanelled with the exchanges instead.
- The exchange sets the procedure for testing algos, watches every algo order, keeps a kill switch for orders from a particular algo ID, defines the brokers’ roles and runs the empanelment of algo providers.
- The broker is the principal for algo trading through its API. It gets the exchange’s permission for each algo, handles investor grievances about algo trading and monitors its APIs.
- The algo provider is the broker’s agent. It must be empanelled with the exchanges and pass the broker’s due diligence before it is onboarded.
What a broker’s systems must do
- Detect and categorise every order above the threshold as an algo order.
- Allow no open APIs: access only through a unique vendor and client specific API key and a static IP the broker has whitelisted, so the algo provider and the investor can both be traced.
- Use OAuth based authentication only, with every other method discontinued, and two factor authentication for API access.
- Deal only with empanelled algo providers, and handle every related complaint.
- Get the exchange’s permission before offering each algo, and its approval for any change to an approved algo.
- Tag every algo order with the identifier the exchange provides, for the audit trail.
- Monitor the APIs for prohibited activity.
What an algo provider must do
- Be empanelled with the exchanges. NSE’s criteria are in its circular NSE/INVG/70309 of 19 September 2025. Among them, the provider declares on its own letterhead any cyber or adverse technical incident in the previous three years.
- Pass the broker’s due diligence before it is onboarded.
- Run its algos on the broker’s servers. NSE requires all strategies of algo providers to run on the broker’s servers, with order messages originating there. For a provider’s platform hosted on the broker’s infrastructure, the static IP is the broker server’s.
- For black box algos, register as a Research Analyst and keep a detailed research report for each algo, confirmed to the exchanges. If an algo’s logic changes, it is registered as a fresh algo with a new report. A Research Analyst who wants to deploy black box algos has to become an algo provider first.
- Disclose every charge to the client when the provider and the broker share subscription charges or brokerage.
Order tagging and the threshold
NSE treats every order a client sends through an API as an algo order that needs a tag, including a standard tag when the client stays within the threshold of 10 orders per second. For retail algo orders through a client API or the broker’s own internet and mobile apps, the first 12 digits of that tag are 444444444444 and the 13th digit is 0, 2 or 4. Above the threshold, an algo built by a tech-savvy investor has to be registered with the exchange through the broker. A client static IP is needed only for such a tech-savvy investor using the API.
Order types and testing
NSE does not permit market orders as algo orders, and in the commodity segment neither market nor IOC orders may be placed through algorithmic trading. Brokers and providers take part in the mandatory monthly mock trading sessions; an individual tech-savvy client does not have to. The exchanges set the procedure for testing algos, run simulation tests and publish the turnaround time for registering algos, with a faster track for execution algos.
| Requirement | Broker | Algo provider | Source |
|---|---|---|---|
| API access only by a unique vendor and client API key and a whitelisted static IP | Enforces it | Connects only this way | SEBI I(d) |
| OAuth based authentication only, with two factor authentication | Enforces it | Signs in this way | SEBI I(d) |
| Orders above the threshold detected and categorised as algo orders | Detects them | SEBI I(d); NSE FAQ 8 | |
| Exchange identifier on every algo order, for the audit trail | Tags every order | SEBI I(b), II(b) | |
| Exchange permission for each algo, and approval for any change | Obtains it | SEBI II(a), II(b) | |
| Empanelment with the exchanges | Deals only with empanelled providers | Must be empanelled | SEBI I(d), III(a) |
| Due diligence before a provider is onboarded | Carries it out | Goes through it | SEBI III(c) |
| Algos run on the broker’s servers | Hosts them | Deploys there | NSE FAQ 5 |
| Black box algos: Research Analyst registration and a research report for each algo | Must hold both | SEBI V | |
| Full disclosure of charges when fees are shared | Ensures no conflict of interest | Charges disclosed to the client | SEBI III(d) |
| Investor grievances about algo trading, and monitoring APIs for prohibited activity | Solely responsible | SEBI II(c) | |
| No market orders as algo orders (and no IOC through algos in commodities) | Blocks them | Does not send them | NSE FAQ 11 |
| Monthly mock trading sessions | Takes part | Takes part | NSE FAQ 9 |
Questions to ask of an existing API stack
- Can every request be traced to one key, one client and one whitelisted static IP?
- Is OAuth with two factor authentication the only way in?
- Can the system count each client’s orders per second and categorise them?
- Is the exchange tag set when the order is created, rather than added later?
- Can you stop one algo, or one client, at once?
- Can you show any order’s full history, from the request to the exchange?
- Is each algo version registered, and is a changed algo registered again?
- Are market orders, and in commodities IOC orders, blocked for algo orders?
Where Trade Vectors fits
We build these systems for brokers and algo providers: controlled API access, sign-in, rate limits, tagging, the kill switch, the logs and the deployment, described on our page on technology for SEBI’s retail algo framework. We are a software developer. We have never registered or been empanelled with an exchange as an algo provider. The permissions, the empanelment and every compliance decision stay with the broker or the provider.
Sources
- SEBI circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/0000013, Safer participation of retail investors in Algorithmic trading, 4 February 2025 (sections I to V).
- SEBI circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/132, extension of the implementation timeline, 30 September 2025 (applicable to all brokers from 1 April 2026).
- NSE, FAQs on safer participation of retail investors in algorithmic trading, 3 November 2025 (questions 1 to 11), which cites NSE circulars NSE/INVG/67858 (5 May 2025), NSE/MSD/67753 (29 April 2025), NSE/INVG/69255 (22 July 2025) and NSE/INVG/70309 (19 September 2025).
Common questions
- Who is responsible for algo orders placed through a broker’s API?
- The broker. SEBI makes the broker the principal and any algo provider its agent, and the broker alone handles investor grievances about algo trading and monitors its APIs.
- Can a Research Analyst offer black box algos through someone else’s platform?
- No. NSE’s FAQ says a Research Analyst who wants to deploy a black box algo must first become an algo provider, and because algos run on the broker’s servers, one provider cannot host the black box algos of several third party Research Analysts.
- Do retail clients on a provider’s platform need their own static IP?
- No. NSE’s FAQ says a client static IP is needed only for a tech-savvy investor using the API. For a provider’s platform hosted on the broker’s infrastructure, the static IP is that of the broker’s server.
- Are market orders allowed as algo orders?
- No. NSE’s circular of 29 April 2025 does not permit market orders as algo orders, and in the commodity segment neither market nor IOC orders may be placed through algorithmic trading.