SEBI's algo trading rules, in plain words

The short version

• API trading by individuals is allowed, and the broker is responsible for it.
• API access works only from a static IP address registered with the broker.
• Every algorithmic order carries an identifier from the exchange, so it can be traced.
• Below a set order rate (ten orders a second, by the exchanges' standards) a trader's own algo needs no separate registration. Above it, the algo must be registered with the exchange through the broker.
• Anyone selling algos must be empanelled with the exchanges, and sellers of strategies whose logic is hidden must also be registered research analysts.

This page is a summary, not legal advice. The rules are SEBI's circular of 4 February 2025, "Safer participation of retail investors in Algorithmic trading", and the implementation standards the exchanges issued under it. Read those, and your broker's notes, before you rely on any detail here.

How it came about

For years individuals traded through broker APIs with no rule written for them. Unregulated sellers marketed "algos" with promised returns, and nobody could say which orders came from software.

SEBI consulted on a framework in December 2024 and issued its circular on 4 February 2025. The start date was put back more than once, from August 2025 to October 2025 and then, in phases, to 1 April 2026.

The static IP

An API key now works only from an IP address the trader has registered with the broker. Orders from anywhere else are refused. The aim is to tie every automated order to a known machine.

A static IP is one that does not change. Home broadband usually gives a changing one, so most traders use a cloud server or a VPS, which comes with a fixed address. Brokers allow a primary address and a backup.

An address cannot be shared by unrelated people at the same broker. Brokers do allow close family accounts to share one, each with its own API key.

For anyone running systems for more than one account, this shapes the whole design: one address per client, and so, in practice, one machine or one network identity per client.

Order tagging and the order rate

Exchanges tag orders that arrive through an API so that algorithmic orders can be told apart from manual ones and traced to their source.

A trader who writes an algo for their own use and stays under the exchanges' order-rate threshold needs no separate approval for it. Beyond the threshold the strategy has to be registered with the exchange through the broker, which involves a review and a cost.

Market orders sent through an API must carry price protection, so an order cannot fill at any price in a thin market.

Algo providers: white box and black box

The framework treats anyone who supplies algos to investors as an agent of the broker. Providers must be empanelled with the exchange, and brokers may offer only empanelled providers' products.

It separates two kinds of algo. In a white-box algo the logic is disclosed and can be reproduced: an execution rule, for instance. In a black-box algo the logic is not known to the user. A provider of black-box algos must register as a research analyst and keep a research record for each one.

This is the part aimed at the sellers of promised returns. A strategy whose logic you cannot see is now a regulated product.

What a compliant setup looks like

• A server with a static IP registered with the broker, and a backup address.
• API access through the broker's login flow with two-factor authentication, renewed as the broker requires.
• An order rate known and kept under the threshold, or a registered strategy above it.
• Price protection on market orders.
• Logs of every order sent, kept so that an order can be traced if the broker or exchange asks.

What it means for someone building a system

The rules do not make algo trading harder for a serious trader. They make the informal version (a script on a laptop over home wifi, a shared server for a group of friends) impossible.

They also raise the bar for infrastructure. Addresses, keys and logs now have to be designed, not improvised. That is the kind of system Aurevian engineers.

Keep reading