SEBI Algo Trading Rules 2026: What Retail API Traders Must Do

If you write your own trading code and send orders through your broker's API, SEBI's retail algo framework has applied to you since 1 April 2026. Below 10 orders per second per exchange you don't register your algo: you register a static IP with your broker, log in with two-factor authentication every trading day, and your orders go out under a generic exchange tag. Faster algos must be registered with each exchange through your broker.

Running strategies for other people is different: that is the job of exchange-empanelled algo providers. This guide covers the whole framework beyond the static IP, as it stands in October 2026.

Where the rules come from, and what is in force in October 2026

On 19 October 2026, SEBI's circulars list showed nothing on retail algo trading newer than the September 2025 circular, and NSE still linked the November 2025 FAQ. The threshold is still 10 orders per second. This guide quotes NSE's paragraph numbers.

Who counts as a retail algo user

SEBI defines an algo order as one "generated using automated execution logic" (para 1). NSE goes further: "all orders received via API from clients are considered Algo orders" and must be tagged, even below the threshold (NSE FAQ, Q8). A script that places one order a day through Kite Connect or DhanHQ is inside the framework.

NSE sorts API users by who wrote the code: vendor algos, broker in-house algos, and tech-savvy retail investors within or beyond the threshold (NSE/INVG/69255, para 2.4.2). Most self-coders are tech-savvy investors within the threshold.

The static IP is for them. NSE's FAQ says "Client static IP is required only in case of Tech savvy Investor using API" (Q6). If you use a vendor's platform hosted on your broker's servers, the broker's IP is used instead (Q10). The IP rules themselves, one client per IP and one change a week, are in our static IP guide for algo trading.

"Family" means "self, spouse, dependent children and dependent parents" (SEBI, para 5(I)(c)). Direct Market Access, the institutional route, sits outside these standards (NSE/INVG/67858, J.1).

The 10 orders-per-second threshold, and when you must register

The threshold is "initially set at not exceeding 10 orders per second" per exchange, counted on "the calendar clock second of the broker server" (NSE/INVG/67858, B.2). Section F applies it per exchange and segment and lets your broker set a lower limit for you. Orders over the limit are rejected (B.5).

• One API key for unregistered algos. You can hold several keys, but unregistered algos may run "only through one of the predefined API keys" (A.4). Three keys don't give you 30 orders a second.
• Unregistered still means tagged. On NSE, your broker sends these orders with the generic algo ID "99999" (NSE/INVG/73992, para 8.4.7).

Registering a faster algo

Above the threshold, clients "must register their algorithm with each Exchange where the algorithm is intended to be used" (C.1). Your broker applies and passes on the algo ID the exchange issues (C.2). For a client-built algo, NSE asks for a system auditor's certificate, a strategy write-up and a risk-management write-up (NSE/INVG/69255, para 8.2.5.3), and aims to decide within 10 working days (para 5.2). Any change to the logic means updating the registration (C.3), and your broker may pass the exchange's charges on to you (J.2). A registered algo may be used for your family, "but not for other investors" (SEBI, para 5(I)(c)).

The standards also promised "a simplified registration and compliance framework for orders up to a certain threshold" (C.1). We couldn't find one published as of October 2026, so for most self-coders, staying under the limit avoids the process entirely.

Algo IDs, exchange tags and the market-order ban

Every algo order carries an exchange identifier "in order to establish audit trail" (SEBI, para 5(II)(b)). On NSE, API orders use the terminal code 444444444444, a 13th digit marking them as algo, and either a registered algo ID or the generic 99999 (NSE/INVG/73992, section 16).

For an unregistered algo, your broker fills in these fields, not your code. Zerodha's official Python library, for example, accepts an optional algo_id for an algo registered with the exchange, and you leave it out below the threshold. Fields such as Kite Connect's tag in its order API are free-text labels for your own use. NSE has tightened its checks on them: from 12 October 2026 it also rejects F&O orders whose terminal code and algo ID don't match (NSE/FAOP/76748).

The rule that touches your code most is about order types: "Algo orders with order type as Market Order are not permitted" (NSE/INVG/73992, para 8.1.12; FAQ, Q11). NSE's risk table expects a market-protection percentage to be "accompanied by a limit price" (NSE/INVG/69255, para 11.1), so brokers send such orders as limit orders. Kite Connect, for instance, documents a market_protection parameter for MARKET and SL-M orders. Check how your broker handles a plain market order before your code relies on one.

White-box, black-box and the Research Analyst rule

SEBI splits algos into two kinds (para 5(V)):

• White-box, or execution algos, where the "logic is disclosed and replicable".
• Black-box, where "the logic is not known to the user and is not replicable".

For a black-box algo, the provider must "Register as a Research Analyst and maintain a detailed research report for each such algo", and any change in its logic makes it a fresh algo. NSE adds that registered black-box algos can't be modified, and lapse as "Deemed Surrendered" if the RA certificate expires (NSE/INVG/69255, paras 7.1.3.1.2 and 9.9). An RA who wants to offer one must also become an empanelled algo provider (NSE FAQ, Q4).

For your own code the split matters less. You know the logic, and NSE puts "the entire responsibility of the logic of the strategy" on the tech-savvy client (para 13.1.3). One wrinkle if you ever register: NSE's April 2026 rulebook lists an RA certificate "in name of the Trading Member /Tech Savvy client" for a black-box algo (NSE/INVG/73992, para 2.2.4.5). Ask your broker which category it would use.

Selling or sharing bots: what empanelled algo providers are

An algo provider "can be any fintech / vendor providing algo facility through the usage of API" (NSE/INVG/73992, section 15). SEBI says "algo providers shall not be regulated by SEBI", but any provider placing algo orders through a broker's API must "be empaneled with Exchanges" (para 5(III)(a)). Brokers must "deal with empaneled algo providers only" (para 5(I)(d)).

The bar is high. NSE's criteria include two years of securities-market experience for a proprietor, director or partner, a minimum net worth of ₹1 crore, ISO 27001:2022 certification and half-yearly security testing (VAPT) by a CERT-In empanelled auditor (section 15 and Annexure 7). Every strategy is then registered separately and gets its own algo ID (NSE/INVG/67858, E.2). Provider algos "should be hosted on brokers' cloud servers/environment" (NSE/INVG/73992, para 8.4.8.16).

Return claims are restricted too. Under a September 2022 SEBI circular, brokers may not refer to an algorithm's past or expected returns, or associate with platforms that do (para 4.1). Since 4 May 2026, PaRRVA, a SEBI-recognised agency, has been verifying past performance of algo trading, research and advisory services, which regulated entities may then use in their adverts (SEBI press release 28/2026).

On 16 October 2026, NSE's list had 17 providers, some provisional and some final. Empanelment is per exchange, and BSE keeps its own list.

• Your own code, your own account: fine.
• Your family: allowed, through a written request to your broker, if it supports family sharing.
• Running your bot for friends or paying clients: that is an algo provider's job. It also breaks the one-client-per-IP rule and NSE's model API terms, which say the facility "shall not be used for transactions on behalf of any other person / entity" (NSE/INVG/73992, Annexure 11).
• Selling a script, or sharing code that others run themselves: the circulars don't address this directly. Talk to a securities lawyer before you charge for a strategy.

What your broker must do: approval, 2FA, daily logout and kill switches

• Exchange approval. A broker can offer algo trading "only after obtaining requisite permission of the stock exchange for each algo" (SEBI, para 5(II)(a)).
• No open APIs. Access only "through a unique vendor client specific API key and static IP whitelisted by the broker" (para 5(I)(d)).
• OAuth and 2FA. OAuth-based authentication only, "and all other authentication mechanisms shall be discontinued", plus two-factor authentication (same para).
• Daily logout. "All API sessions shall be compulsorily logged out every day before the start of the next trading day" (NSE/INVG/67858, A.8). Whether you may automate the morning login is each broker's call: see our Kite Connect guide and Dhan API guide.
• Risk checks on every order. Price bands, quantity, value, margin and position limits, before an order reaches the exchange (NSE/INVG/69255, para 11).
• Records and complaints. Order-routing servers in India, a five-year audit trail (paras 10.2 and 10.3), and sole responsibility for algo grievances (SEBI, para 5(II)(c)).

SEBI also requires exchanges to keep "the ability to use the kill switch for orders emanating from a particular algo id" (para 5(IV)(a)(iii)). BSE has given brokers one since October 2025: a broker can cancel pending orders and reject new ones from an algo ID for the rest of the trading day (BSE notice 20250930-74). NSE's model API terms also let your broker "shut down the API/ALGO PROVIDER facility and remove any outstanding client orders in case of any suspected dysfunctional algo" (Annexure 11).

What changed between April and October 2026

• 27 April: BSE updated its kill-switch screens without changing how the switch works (notice 20260427-20).
• 30 April: NSE's consolidated circular replaced NSE/MSD/67753 and gathered the retail algo rules in one place, repeating that only tech-savvy retail investors need a static IP.
• 4 May: PaRRVA began regular performance verification.
• May to October: NSE empanelled more providers, moved several to final empanelment (NSE/INVG/76481) and cleared two for black-box algos. BSE gave eight providers final empanelment on 5 October (notice 20261005-38).
• 12 October: NSE began rejecting more kinds of mismatched tags in F&O; currency derivatives follow on 19 October (NSE/CD/76841).

For a self-coder, the basics haven't moved: the same threshold, static IP, daily logout and tagging rules.

What a self-coding trader actually has to do

1. Turn on API access and read your broker's API terms. NSE's model terms say every order from your API "shall be deemed to be authorized by the client" (Annexure 11).
2. Register a static IP that only you, or your family, use (see the static IP guide).
3. Throttle your code to 10 orders a second per exchange at most, or your broker's lower cap, through one API key.
4. Log in every trading day with 2FA before your first order.
5. Use limit orders or market protection, not plain market orders.
6. Build your own brakes. The model terms make you keep "necessary checks and balances, in place to identify and control dysfunctional algorithms": order and position caps, and a quick way to stop the bot. Our guide to running a trading bot 24/7 shows one approach.
7. Report leaked keys to your broker at once; you stay responsible for orders placed with them.
8. Register the algo only if you need more than 10 orders a second.

You don't have to join the exchanges' monthly mock sessions: NSE exempts individual tech-savvy clients (FAQ, Q9). The flip side is "no recourse against the Trading Member or the Exchange Grievance Redressal Mechanism" for losses from your own algorithm (Annexure 11).

Where the code runs is your choice. NSE expects the tech-savvy client to "host the Algo using a static IP at their end" (FAQ, Q5). The rules we read require the broker's routing server to be in India, not yours. An ISP static IP, a free cloud tier and a VPS can all work; our VPS buyer's guide for algo trading compares them. If you are happy to set it up yourself, a plain Cloud VPS starts at ₹860 a month, or about ₹774.17 a month when billed yearly, and Mumbai adds a monthly location fee. Algo VPS Mumbai, with Python and the broker SDKs ready, costs ₹1,510 a month, or about ₹1,325 a month when billed yearly.

Common misconceptions

• "SEBI banned retail algo trading." No. The circular was written "to facilitate safer participation of retail investors in algo trading" (para 3).
• "Every algo needs exchange registration." Not your own code below 10 orders a second. Vendor and broker algos need it at any speed (NSE/INVG/69255, para 8.2.1).
• "Algo platforms are SEBI-approved." Providers are empanelled by exchanges. Only a black-box provider's Research Analyst registration comes from SEBI.
• "Once my IP is whitelisted, I'm done." The daily login, order-rate limit, tags and order-type rules still apply.
• "A VPS makes me compliant." A server gives you a fixed IP. Staying within the rules depends on how your code and account behave, and that part is yours.

Frequently asked questions

Do I need to register my Python trading bot with SEBI or the exchange?

Not if it stays within 10 orders per second per exchange. A self-coded bot under that limit needs no algo registration, and your broker tags its orders with a generic exchange algo ID. You still need API access from your broker, a registered static IP and a fresh two-factor login every trading day. Above 10 orders a second, the algo must be registered with each exchange through your broker, with an auditor's certificate and write-ups of the strategy and its risk controls.

Can I run my trading bot for friends or paying clients?

Only if you are empanelled with the exchanges as an algo provider. SEBI's February 2025 circular requires anyone offering others a way to place algo orders through a broker's API to be empanelled, and brokers may deal only with empanelled providers. NSE's criteria include a minimum net worth of ₹1 crore and ISO 27001 certification. Running other people's accounts from your server also breaks the one-client-per-IP rule; your family is the only exception.

What is the difference between white-box and black-box algos?

A white-box algo's logic is disclosed and replicable, as with execution, TWAP or VWAP algos. A black-box algo's logic is not known to the user and cannot be replicated. Under SEBI's February 2025 circular, a black-box provider must register as a Research Analyst, keep a detailed research report for each algo and register any change in logic as a fresh algo. NSE does not allow registered black-box algos to be modified.

Did SEBI's algo trading rules change after 1 April 2026?

Not for self-coders, as of October 2026. The 10 orders-per-second threshold, static IP, daily logout and tagging rules are unchanged, and SEBI has issued no new retail algo circular since September 2025. NSE did gather its rules into consolidated circular NSE/INVG/73992 on 30 April 2026, empanel more algo providers, and start rejecting more kinds of mismatched algo tags in F&O orders from 12 October 2026.