Where a Technology Vendor Sits in the SEBI Algorithmic Trading Framework
Who registers the algorithm, whose static IP it is, and who carries the liability, answered from the circulars, with every reference attached.
What does the SEBI algorithmic trading framework require?
SEBI's circular of 4 February 2025 on safer participation of retail investors in algorithmic trading, extended by circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/132 of 30 September 2025, became applicable to all stockbrokers on 1 April 2026. NSE circular NSE/INVG/67858 of 5 May 2025 sets the operating detail.
The framework governs how automated orders reach the market through a broker's API: how access is authorised, when an algorithm must be registered with the exchange, what has to be recorded, and who answers for it. Direct Market Access is explicitly outside the scope of the NSE operating standards.
Nothing below is an interpretation. Each obligation is stated in the circulars, and the references are listed at the foot of this page so a reader can check rather than trust.
The obligations, and where each one comes from
| Obligation | The detail | Source |
|---|---|---|
| Authorised API access | Per user, by unique vendor and client specific API key, with OAuth authentication and two-factor verification. No open APIs. | NSE/INVG/67858, 5 May 2025 |
| Static IP whitelisting | Every API user operates from an address the broker whitelists. Mapped addresses may be updated at most once per calendar week; secondary addresses are permitted for redundancy. | NSE/INVG/67858, 5 May 2025 |
| Registration threshold | More than 10 orders per second, per exchange and per segment, requires the algorithm to be registered with the exchange. | NSE/INVG/67858, 5 May 2025 |
| Order tagging | Every algorithmic order carries the unique identifier assigned by the exchange. | NSE/INVG/67858, 5 May 2025 |
| Audit trail retention | Available for at least five years, identifying the actual user and user ID behind each order. | NSE/INVG/67858, 5 May 2025 |
| Vendor standing | Algo providers are empanelled by the broker and treated as the broker's agents. They cannot connect to exchanges directly. | SEBI, 4 February 2025 |
| Applicability | All stockbrokers, from 1 April 2026. | SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/132, 30 September 2025 |
Every row is checkable against the linked source. Where a detail is not in a circular, it is not on this page.
Who registers the algorithm, the broker or the vendor?
The broker does, with the exchange, and the exchange assigns the identifier. A vendor cannot register an algorithm because a vendor has no route to the exchange. What a vendor can do is make registration and per-order tagging operationally possible.
That distinction is worth stating precisely, because it is the first thing a compliance function checks and the first thing an over-eager vendor gets wrong. A platform claiming it will "handle registration" is describing something it has no standing to do.
How does the 10 orders per second threshold actually work?
It applies per exchange and per segment, not as a single aggregate figure. Equities and derivatives count separately, so a system maintaining one global rate counter is measuring something the rule does not describe.
It is also a rate, which means the measurement window matters. Forty orders in one second followed by nine quiet seconds averages four per second and peaks at forty. The conservative reading is the peak, and the conservative reading is the correct one when a regulator is the reader, which makes capacity planning a function of burst rather than average.
One genuinely open question: whether the disclosed legs of an iceberg order count individually against the threshold or the parent counts once. It changes whether a given strategy crosses the line, so it is worth obtaining in writing from the broker rather than inferring.
Where does liability sit when an automated order goes wrong?
With the broker. NSE circular NSE/INVG/67858 of 5 May 2025 states that brokers shall be fully responsible and liable for all orders emanating through their IBT, STWT, Client API and Vendor API systems.
A vendor that softens this has not read the circular. The framework places algo providers in the position of the broker's agent, which means the accountable principal for every order is the broker regardless of whose software formed it.
The practical consequence runs the other way too: because the broker carries the risk, it is entirely reasonable for a broker to ask a vendor what that vendor publishes, and to ask them to change it.
What changed on 25 March 2026?
SEBI passed adjudication orders against a group of stockbrokers in the matter of TradeTron and other Algo Platforms. The finding was not about anything the brokers published. It was that they remained API-integrated with a platform whose marketplace hosted strategies advertising returns, after a September 2022 circular required disassociation.
SEBI expressly rejected the defence that the broker had merely provided neutral execution infrastructure. R. K. Stockholding was penalised ₹2,00,000, and separately a larger group of brokers settled at ₹1 lakh each rather than be adjudicated.
Which produces the conclusion most vendor conversations never reach: a vendor's marketing is part of the broker's compliance surface. Not a presentational matter, an integration risk that sits with the broker.
What is explicitly out of scope?
Direct Market Access is excluded from the NSE operating standards. And the framework does not make a technology vendor an independently regulated entity, a vendor operates as the broker's agent, not alongside it.
Worth saying plainly what this article does not do: it makes no statement about the regulatory standing of any particular platform, including this one. Empanelment is a matter between a broker and a vendor, and any vendor publishing a claim about its own status without the broker's confirmation is telling you something it cannot know alone.
References
- Safer participation of retail investors in Algorithmic trading, 4 February 2025Securities and Exchange Board of India
- Extension of timeline, SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/132, 30 September 2025Securities and Exchange Board of India
- NSE/INVG/67858, operating standards, 5 May 2025National Stock Exchange of India
- SEBI orders and adjudication rulingsSecurities and Exchange Board of India
- sebi
- compliance
- regulation
- broker apis
- liability
- algo framework
Topics
Written by
The Stretus team writing on algorithmic trading, market structure and the systems that sit between a strategy and an exchange. Every claim about the platform links to the documentation that specifies it.
See these ideas running
The platform implements the workflow described here: strategies expressed as rules, backtested against historical data, paper traded, then executed through authorized broker APIs under platform-level risk controls.
Related reading
What a Five-Year Order Audit Trail Has to Contain
The retention obligation, the fields an inspection actually asks for, and why "comprehensive logging" is not an answer to the question.
Static IP, API Keys and the Once-a-Week Rule
How authorised API access works under the framework, and why the once-per-calendar-week limit on changing an IP breaks naive failover designs.
What Is Algorithmic Trading?
Algorithmic trading executes trades from predefined rules rather than discretion. How it works, what it does not promise, and where it fits.