SEBI Algo Trading Rules 2026: What Changed on 1 April

Since 1 April 2026, every stockbroker in India has to apply SEBI’s retail algo trading framework. If you place orders through your own API app, those orders must now come from a static IP you’ve registered with your broker, you log in with 2FA every day, and you can’t run an unregistered strategy faster than 10 orders a second. If you use a third-party platform, that platform has to be empanelled with the exchange and plugged in by your broker. If you only trade by hand in your broker’s app, nothing changed for you.

The rules aren’t new. SEBI published them in February 2025 and let brokers switch over gradually from October 2025; 1 April ended the grace period. Whether automating trades is allowed at all is a separate question, answered in is algo trading legal in India (yes, through your broker’s official API). This post is about what you have to do now.

Last updated: November 2026.

What you need to do, depending on your setup

The framework sorts you by how your orders reach the broker, not by how clever your strategy is. Find your row.

Your setup	What changed on 1 April 2026	What you need to do
Your own Python (or any) script on a broker API: Kite Connect, FYERS API, SmartAPI, DhanHQ, Upstox	Order requests must come from a static IP registered with the broker. Fresh 2FA login every day at most brokers. Unregistered strategies capped at 10 orders per second. Market orders may be converted or refused	Get a static IP, register it on your broker’s API page, rebuild your morning login routine, and test how your broker now treats market orders
A third-party no-code or “algo platform”	The platform must be empanelled with the exchange and integrated by your broker. Black-box strategy sellers must be SEBI-registered research analysts	Ask the platform the five questions further down. You often don’t need your own static IP, but confirm whose IP your orders leave from
TradingView or Chartink alerts that fire orders through a webhook	Depends where the webhook lands. If it hits your own server, which then calls the broker API, that server is “your own app”. If it hits a platform, the platform row applies. Some brokers now block generic “API bridge” tools	Move your webhook receiver to a machine with a registered static IP, or route alerts through a platform your broker has integrated
Manual trader: broker app, web terminal, GTT, basket orders	Nothing	Nothing. A GTT you set by hand in Kite or any broker app is not an API order
You pay for someone else’s strategy and can’t see its rules	It’s a black-box algo. The provider must be registered with SEBI as a research analyst	Ask for their RA registration number and check it on sebi.gov.in. No number, no money

Two things people get wrong here. First, “your own app” includes a Python script running on your laptop. FYERS staff said as much in their April 2026 explainer thread: API-placed orders count as algo orders, desktop scripts included. Second, the static IP only matters for order requests. Pulling quotes, positions or your order book works from any IP at Zerodha, FYERS and Dhan.

The 10-orders-per-second line exists to catch runaway code

SEBI left the exact threshold to the exchanges and the brokers’ standards forum, and they set it at 10 orders per second. Below that, your algo doesn’t need its own registration; your orders go out tagged with a generic algo ID from the exchange. Above it, the strategy has to be registered with the exchange through your broker and gets a unique ID. Zerodha’s Kite Connect FAQ says that route involves fees and a written strategy note to the exchange. Unregistered orders over the line are rejected; at Zerodha you get an HTTP 429.

Brokers describe the scope slightly differently. Zerodha’s FAQ says 10 per second per client trading account. Angel One’s SmartAPI notice says 10 per exchange/segment. If you run equity and F&O strategies hard at the same moment, check which reading your broker uses.

Now some arithmetic. Entering an iron condor is four orders, even if you fire all four legs in the same second. A short straddle with a stop-loss on each leg is also four. Ordinary retail strategies don’t get near ten.

What does get near ten is a bug, or a lazily written trailing stop. Picture code that modifies the stop on both legs of a straddle every time the price ticks. Nifty options can tick several times a second in a fast market, and FYERS counts modifications toward the limit. Two legs at five ticks a second is ten modifications. Zerodha also counts rejected, invalid requests. So throttle your modifications (once every second or two is plenty for a retail trailing stop-loss) and make sure a failed order can’t trigger an instant retry loop.

Static IP is the change that costs money

The SEBI circular of 4 February 2025 tells brokers not to permit open APIs, and to allow access only through a client-specific API key and a static IP the broker has whitelisted, so every order can be traced to a person. How brokers apply it:

• You register one IP, and several brokers also let you add a secondary as a backup. The IP must be unique to you.
• Family is the exception. Zerodha, Angel One, FYERS, Dhan and Upstox all allow a spouse, dependent children and dependent parents to share a static IP, after a declaration or written request.
• Most brokers let you change the registered IP only once a week, so a typo can cost you several trading days.

Where to get the IP (a home ISP add-on, a small cloud server in Mumbai, or a platform that deals with it) and where to enter it at each broker is in our static IP guide. My short opinion: if you write your own code, rent a small cloud server. Home broadband and home power are the weakest parts of most retail setups.

Daily login: nobody keeps a permanent session now

The circular requires OAuth-based authentication and two-factor authentication for API access. Most brokers have read that as a fresh login every trading day, though the details differ. FYERS discontinued the refresh-token flow that kept systems logged in indefinitely. Zerodha’s access tokens always expired before the next market open, so Kite users won’t notice much. Dhan’s access tokens are valid for 24 hours.

Day to day, someone has to complete a login before your strategy can trade. If you’re on the 8:30 am flight to Delhi, your intraday system doesn’t trade that day. Make the login part of your morning, and have your code refuse to start, loudly, when the token is missing, instead of failing quietly on the first order at 9:20.

Market orders behave differently at each broker now

This is where brokers really diverge, and the same code can do different things depending on where your account sits.

• Dhan converts API market orders into limit orders with market price protection (MPP) applied, per its 1 April announcement.
• Upstox applies market protection by default to market and SL-M orders, per its community notice.
• FYERS converts market orders to MPP orders and doesn’t accept AMOs through the API.
• Angel One’s notice says market and IOC orders are prohibited for algorithmic trading.

If your exits rely on market orders, test with one lot on a quiet day. A protected limit order that doesn’t fill during a spike is a different risk from slippage, and your backtest assumed you got out.

White-box vs black-box: who can see the logic

The circular splits algos into two categories (section V):

1. White-box, or execution algos. The logic is disclosed and replicable. You know exactly which rules fire the orders.
2. Black-box. The logic isn’t known to the user and can’t be replicated.

For black-box algos, the provider must register with SEBI as a research analyst, keep a detailed research report for each algo, and confirm to the exchange that the report exists. If the logic changes, it has to be registered as a fresh algo with a fresh report. Exchanges were also told to fast-track registration for execution-type algos.

For you, this works as a consumer-protection filter. Someone on Telegram selling a strategy that “never loses” without showing the rules is selling a black box and needs an RA registration. Ask for the number and check it against SEBI’s list of registered research analysts. If you write your own rules, in Python or a no-code builder, you know the logic; how the exchange classifies a particular platform’s strategies is a question for that platform.

Empanelment: what it means for the platform you use

SEBI doesn’t regulate algo providers directly. Instead, any provider that lets you place algo orders with a broker through an API has to be empanelled with the exchanges, on criteria the exchanges set (section III of the circular). The broker is the principal and the provider is its agent. The broker does due diligence before onboarding a provider and handles your complaints. Providers and brokers may share the subscription and brokerage you pay, but every charge has to be disclosed to you.

Broker practice varies on top of that. Zerodha says it doesn’t file empanelment applications for third parties; providers apply to the exchange themselves. FYERS and Angel One say third-party algos must be hosted on the broker’s own systems, and FYERS says orders from API bridge tools won’t be allowed.

We build INDfolio, a no-code platform that connects to seven brokers, so weigh what I say about platforms accordingly. These are the questions I’d ask any platform, including us, before connecting a live account:

1. Are you empanelled with NSE, and since when?
2. Which brokers have integrated you under the new framework, and is mine one of them today?
3. Whose static IP do my orders leave from: mine, yours or the broker’s?
4. Are the strategies I run classed as white-box or black-box?
5. If an order goes wrong, who handles my complaint, and who can hit the kill switch?

Get the answers in writing. A platform that’s vague about question 2 is one whose orders might get rejected on a Tuesday expiry.

The timeline

• 4 Feb 2025: SEBI issues the circular, effective 1 August 2025.
• May 2025: NSE publishes implementation standards, including the 10-order threshold and the static IP requirement (Zerodha’s summary).
• 22 Jul 2025: Exchanges issue the detailed operational modalities.
• 29 Jul 2025: SEBI moves the start date to 1 October 2025.
• 30 Sep 2025: SEBI sets a glide path. Ready brokers go live on 1 October. The rest must apply to register a retail algo product and at least one strategy by 31 October, finish registration by 30 November, and join an exchange mock session by 3 January 2026.
• 5 Jan 2026: Brokers that missed those milestones are barred from onboarding new retail clients for API algo trading.
• 1 Apr 2026: The full framework applies to every broker.

What didn’t change

You still don’t need SEBI registration to run your own strategy, and the framework doesn’t touch how your F&O income is taxed. Your broker is still responsible for every order you send, which is why brokers are strict about the IP and the login.

The rules make automation traceable. They don’t make it profitable. SEBI’s own September 2024 study found 93% of individual F&O traders lost money between FY22 and FY24, about ₹2 lakh each on average including costs. A static IP doesn’t change those odds. Testing a strategy properly before it touches money might, and that’s the part INDfolio is built for: you can paper trade a strategy on live NSE prices on the free Starter plan.

This is general information, not legal advice. Your broker’s API notice is the final word on how it applies the framework.

Frequently asked questions

Do I need a static IP if I use an algo trading platform? Often not. Angel One says retail clients using no-code platforms hosted on broker servers don’t need to provide one, and that an empanelled vendor’s orders can come from the vendor’s IP or the client’s. Ask the platform which applies to you.

Is the 10 orders per second limit per strategy or per account? Zerodha applies it per client trading account; Angel One describes it per exchange and segment. Either way, every unregistered strategy on that account shares the same budget.

Do I have to register my own algo with SEBI? No. An algo you write yourself needs exchange registration, through your broker, only if it crosses 10 orders per second. Below that, you need a registered static IP and the daily login.

Can I still automate TradingView alerts in India? Yes. Either the webhook lands on your own server with a registered static IP, or it goes through an empanelled platform your broker has integrated. Our post on automating TradingView alerts covers the moving parts.

Is a GTT order placed in the Kite app an algo order? No. A GTT you set by hand in your broker’s app is a manual order. The same GTT placed through the API is an API order and needs your registered static IP.