Is Your Algo Setup SEBI-Compliant? A Retail Trader's Checklist

Is Your Algo Setup SEBI-Compliant? A Retail Trader's Checklist

Most traders find out their setup has a compliance gap at the worst possible moment — when an order gets rejected, or a tool they relied on stops connecting. You'd rather know in advance. So here's a practical, line-by-line audit you can run in about ten minutes.

Work through it honestly. If everything checks out, you're trading inside SEBI's 2026 framework and can stop worrying. If something doesn't, you've found it before it found you.

Section 1 — Your broker

<p>☐ Is your broker still onboarding API / algo clients? This is the quickest litmus test. Brokers who failed the compliance milestones were barred from onboarding new retail API clients from early January 2026. A broker actively signing up new algo traders is, almost by definition, compliant.</p><p>☐ Does your broker provide exchange-issued Algo-IDs on your orders? Every automated order should be tagged. If your broker can't tell you that your algo orders carry an exchange identifier, that's a red flag worth a direct conversation.</p><p>☐ Has your broker implemented 2FA and audit trails? Two-factor authentication on API access and a complete audit trail of orders are mandatory. A compliant broker will have both, and you'll have noticed the 2FA because you use it.</p>

Section 2 — Your access setup

<p>☐ Are you connecting from a registered static IP? Under the framework, API orders can only originate from a static IP address registered with your broker. If you trade from home on a typical broadband connection, your IP probably changes periodically — which means you need a static IP arrangement. We cover how to set this up here static-ip-whitelisting-api-trading-setup.</p><p>☐ Is 2FA active on your API access? Not just on your login — on the API pathway your orders travel through.</p><p>☐ Do you know your order rate? If your strategy can fire more than 10 orders per second measured per exchange, per calendar second, you're in registration territory. Most retail strategies sit comfortably below this, but high-frequency logic or aggressive order-splitting can creep up. If you're unsure, the 10-orders-per-second guide explains how to think about it.</p>

Section 3 — Any third-party tool or strategy provider

<p>☐ Is the provider empanelled with the exchanges? An algo provider can't connect directly to exchanges anymore. Legitimate ones empanel with NSE and BSE and pass your broker's due diligence. Ask for their empanelment status — a real provider will answer without hesitation.</p><p>☐ Is the strategy registered where required? If you're using someone else's strategy, it should carry a valid Algo-ID tied to a registered strategy. No ID, no legal execution.</p><p>☐ Does the provider make realistic claims? This one isn't a formal rule, but it's the best scam filter you have. Anyone promising fixed monthly returns or "guaranteed" profits is, at minimum, ignoring how markets work — and quite possibly operating outside the framework's spirit entirely. SEBI built these rules partly to push exactly that kind of operator out.</p>

Section 4 — Your own records

<p>☐ Can you reconstruct what your automation did? Keep your own logs. Between your broker's audit trail and the Algo-ID system, the regulator can reconstruct activity — but for your own risk management, you should be able to as well.</p><p>☐ Have you accounted for the April 2026 cost changes? Not a compliance item, but relevant: the Securities Transaction Tax on futures rose to 0.05% from 1 April 2026. If your strategy's edge was thin, re-check the maths.</p>

How to read your score

If every box is ticked, you're compliant — carry on. If a box in Sections 1 or 3 is unchecked, that's the priority: your broker and any provider you use are the load-bearing pieces of compliance, because the framework puts responsibility on them. Sort those first.

If only a Section 2 item is open — usually the static IP — it's a setup task, not a crisis. Handle it and re-run the list.

Where a platform takes this off your plate

A lot of these boxes get ticked automatically when you trade through a properly empanelled platform rather than stitching the pieces together yourself. StrykeX is empanelled with the NSE and BSE, which means the Algo-ID tagging, registration plumbing, and access controls are handled as part of the platform rather than left to you to assemble. It's built and run by Stockwiz, a SEBI-registered firm (INH000013925).

That isn't the only way to be compliant — a careful DIY trader on a compliant broker can absolutely tick every box. It's just the difference between assembling the safety yourself and having it built in.

For the reasoning behind each rule on this list, see the complete guide to SEBI's 2026 algo framework. sebi-algo-regulations-2026-complete-guide.