Technology for SEBI’s retail algo framework
Since 1 April 2026 every stock broker in India that offers API trading works to SEBI’s framework for retail algo trading, and every firm that offers algos through a broker has to be empanelled with the exchanges. We build the systems that make it work: controlled API access, order tagging, rate limits, the kill switch and the audit trail. You hold the permissions and the compliance sign-off.
We are a software developer. We are not a broker, an algo provider or a law firm. Exchange permissions, empanelment and every compliance decision stay with you and your compliance team; we build and document the systems they review.
Who this is for
- Brokers. For algo trading through its API, the broker is the principal and answers for every algo order that passes through it. More on our work for brokers on technology for brokers.
- Algo providers. A firm that offers algos to investors through a broker’s API acts as the broker’s agent, must be empanelled with the exchanges, and goes through the broker’s due diligence before it is onboarded.
- Platforms hosted with a broker. Algos from empanelled providers run on the broker’s servers, so the platform and the broker’s systems have to work as one.
What the rules ask the systems to do
Each line below is from SEBI’s circular of 4 February 2025 or NSE’s FAQ of 3 November 2025 (links at the end), with the system that answers it.
| The rule | What the system has to do | Source |
|---|---|---|
| No open APIs. Access only through a unique vendor and client specific API key and a static IP whitelisted by the broker. | An API gateway that checks the key and the IP on every request, with a register of whitelisted IPs per client. | SEBI, 4 Feb 2025, I(d) |
| OAuth based authentication only, with two factor authentication for API access. | An OAuth sign-in flow with two factor authentication and proper session handling. | SEBI, I(d) |
| Systems to detect and categorise orders above the threshold as algo orders. NSE treats every API order from a client as an algo order, with a standard tag within the threshold of 10 orders per second. | Per client order rate counting, limits that hold at the threshold, and categorisation. | SEBI, I(d); NSE FAQ 8 |
| Every algo order tagged with the unique identifier the exchange provides, to establish the audit trail. | Tagging at the moment an order is created: the exchange algo ID for registered algos, the standard tag for client API orders within the threshold. | SEBI, I(b) and II(b); NSE FAQ 7 and 8 |
| Exchange permission for each algo, and approval again for any change. A black box algo whose logic changes is registered as a fresh algo. | An algo register with version control, so every change is visible and goes through registration. | SEBI, II(a), II(b), V |
| Exchanges keep a kill switch for orders from a particular algo ID. SEBI describes a kill switch as the last level of defence against an algorithm malfunction, halting trading on predefined conditions. | Halts at algo and client level on preset conditions, alongside the exchange’s own kill switch. | SEBI, IV(a)(iii) and note 4 |
| The broker handles investor grievances about algo trading and monitors its APIs for prohibited activity. | Logs of every request, order and decision, with monitoring and reports. | SEBI, II(c) |
| Algos of empanelled providers run on the broker’s servers, and order messages originate from them. | Deployment on the broker’s infrastructure, using the broker server’s static IP for platform clients. | NSE FAQ 5 and 10 |
| No market orders as algo orders; in the commodity segment, no market or IOC orders through algos. | Order type checks before anything is routed. | NSE FAQ 11 |
- Client app or provider algoAPI key, OAuth sign-in
- Broker API gatewaystatic IP check, rate limits, tagging
- Risk checksorder types, kill switch, logs
- Exchangealgo ID, surveillance
For algo providers preparing for empanelment
NSE’s empanelment criteria are in its circular NSE/INVG/70309 of 19 September 2025; among them, a provider declares on its letterhead any cyber or adverse technical incident in the previous three years. A provider offering black box algos must also register with SEBI as a Research Analyst and keep a research report for each algo. We build what an application and a broker’s due diligence look at: clear documentation of each algo’s logic for white box algos, version control, complete logs, incident records, and the disclosure of charges to clients that SEBI asks for when a provider and a broker share fees.
Where we have built this
For an HNI client in India we built a system that works within these rules: an API gateway with static IP whitelisting, OAuth sign-in, algo ID tagging, order rate limits, a kill switch, audit logs and the workflow for registering algos with the exchange. Our wider Indian broker work is in the Indian multi-broker trading platformand the copy-trading system case studies, and the platforms behind them are on our strategy marketplace and copy-trading pages.
What stays with you
The permission for each algo, the empanelment, the research reports for black box algos, the client relationship and every compliance decision stay with the broker or the provider. We do not apply to the exchange on anyone’s behalf, and we make no promise that a system will be approved. The rules for a single trader running their own bot are in our guide to SEBI’s retail algo trading rules.
General information as of November 2026, from the documents below. It is not legal or regulatory advice; the circulars and your exchange’s current notices decide the details.
Sources
- SEBI circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/0000013, Safer participation of retail investors in Algorithmic trading, 4 February 2025.
- SEBI circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/132, extension of the implementation timeline, 30 September 2025 (applicable to all brokers from 1 April 2026).
- NSE, FAQs on safer participation of retail investors in algorithmic trading, 3 November 2025, which cites NSE circulars NSE/INVG/67858 (5 May 2025), NSE/MSD/67753 (29 April 2025), NSE/INVG/69255 (22 July 2025) and NSE/INVG/70309 (19 September 2025).
Common questions
- Can you get our algos approved or our firm empanelled?
- No. Only the exchange approves algos and empanels providers. We build and document the systems that your application and your broker’s due diligence look at, and your team makes the submission.
- We are a broker with an API already. Can you work on our existing stack?
- Yes. Most of the work is adding the controls around an API that already exists: key and static IP checks, OAuth sign-in, rate limits, tagging, the kill switch and the logs. We start by reading how your system works today, then propose the changes.
- Is Trade Vectors an algo provider?
- No. We are a software developer. We have never registered or been empanelled with an exchange as an algo provider, and we do not offer algos to the public through brokers.
- Do you give legal or regulatory advice?
- No. We work from the SEBI and exchange documents and from your compliance team’s reading of them. Whether a system meets the rules is for your compliance team and the exchange to decide.