For most of the last decade, retail API trading in India ran in a grey zone. Brokers offered APIs, traders automated against them, and nobody was quite sure what the rules were. SEBI’s circular of 4 February 2025 — Safer Participation of Retail Investors in Algorithmic Trading — ended that. Automation is permitted, and it is permitted on stated conditions.
The order-rate threshold
Decision tree
Does the strategy cross the registration threshold?
Measure the busiest one-second window per exchange and segment, including new orders, modifications and cancellations.
Start with measured peak order messages per second for one exchange segment. Below 10 per second, exchange registration is not required but orders are still tagged as algorithmic. At 10 or more per second, register the algorithm through the broker, obtain the exchange identifier and continue monitoring the peak rate.
Average traffic is not the test. A fifteen-message basket fired in one second crosses the line even if the strategy is quiet for the rest of the day.
This is the provision that determines whether you have a registration process to go through or not, so it is worth being precise about it.
An algorithm that sends 10 or more orders per second to an exchange, measured per exchange and per segment, must be registered with that exchange through your broker, and receives its own algo ID. An algorithm below that rate does not require registration, but the orders it sends must still be tagged so they are identifiable as algo orders. The exchanges have stated the threshold may be revised, with notice.
Strategy shape
Typical order rate
Registration
Daily rebalance at a fixed time
A few orders per day
Not required
Intraday breakout on 5 instruments
Tens of orders per day
Not required
Options straddle with trailing adjustments
Hundreds of orders per day, bursty
Usually not required — but measure the peak second
Continuous quote-chasing limit orders
Can exceed 10/sec in bursts
Likely required
Market making across a strike chain
Well above 10/sec
Required
Which side of the threshold typical retail strategies fall on
The distinction that catches people is bursty traffic. An average of two orders per second with a one-second burst of fifteen at 09:15:00 is above the threshold in that second. If your strategy fires a basket of legs simultaneously, count the legs.
White-box and black-box algos
Decision tree
Disclosure determines the provider path
The relevant question is whether a user can reproduce the strategy output from disclosed rules, not whether the code itself is public.
Ask whether the strategy logic and parameters are disclosed well enough to reproduce its decisions. If yes, it is a white-box algorithm with standard provider controls. If no, it is black-box; a provider distributing it has heavier obligations including Research Analyst registration and a research report for each algorithm.
Running private logic solely on your own account is different from distributing undisclosed logic to other clients. Distribution is where provider obligations become material.
The framework classifies algos by whether their logic is disclosed and reproducible.
White-box
Black-box
Logic disclosure
Disclosed; a user can reproduce the outputs from the stated rules
Not disclosed
Provider obligation
Lighter
Register as a Research Analyst; maintain a research report for each algo
Record keeping
Standard
Additional documentation obligations
Typical example
A published moving-average crossover with stated parameters
A vendor strategy sold as a signal without stated rules
If you write a strategy for your own account, this classification is largely academic — you know your own rules. It becomes material the moment you distribute a strategy to other people, at which point you are an algo provider and the obligations attach to you.
Static IP and API access
API access to a broker’s trading system must come from a static IP address registered with the broker. This is a straightforward control — it means an API key leaking is far less useful to whoever obtains it, because orders from an unregistered address are rejected.
Operationally it means home broadband on a dynamic IP will not work reliably. The usual answers are a static IP from your ISP, or running the strategy on a cloud instance with a fixed address. Setting up a static IP for algo trading covers the options and their trade-offs.
What this changes in practice
Your strategy needs somewhere permanent to run. A laptop that sleeps is not that place, regardless of the IP question.
IP changes need to be re-registered with the broker, which is not instant. Plan for it before you migrate infrastructure.
If you run from a cloud region far from the exchange, add the round-trip latency to your slippage assumptions.
Who is accountable
System architecture
The accountability chain around one algo order
Execution responsibility has a traceable path, while investment and strategy risk remains with the client.
The client selects or authors the strategy. A third-party provider may supply logic through a formal relationship with the broker. The broker authenticates the client, applies controls and is accountable for order access. The exchange receives a tagged order with an algorithm identifier. Execution incidents move back through the broker; strategy losses remain with the client.
A unique algo tag connects the exchange event to the broker, provider and client audit trail. Keep your own decision log so that chain includes why the order existed.
The framework places responsibility with the broker. Your broker is answerable to you for orders that reach the exchange under your client code, and where a third-party algo provider is involved, the broker–provider relationship is formalised so the chain of accountability does not have a gap in it.
This is a genuine improvement on the previous position, where a third-party platform malfunction left the client arguing with two parties who each pointed at the other. It does not, however, transfer strategy risk. A correctly executed order from a badly designed strategy is your loss.
The framework makes execution failures somebody’s clear responsibility. It does not make strategy failures anybody’s responsibility but yours.
A compliance checklist for your own account
Confirm your broker’s current API terms and algo onboarding process
Implementation detail varies between brokers even where the underlying rule does not.
Register a static IP and document it
Including what your rollback plan is if that address changes unexpectedly.
Measure your strategy’s peak orders per second, including modifies and cancels
Per exchange, per segment. Log it rather than estimating it.
Verify algo tagging is present on your orders
Check the order book and your contract note, not just your own logs.
Keep your own audit trail
Every order your system sends, with timestamp, parameters and the decision that triggered it. You will need it the first time a fill surprises you.
Re-read the rules if you start distributing the strategy
The obligations for a provider are materially different from those for a trader running their own book.
Frequently asked questions
When did SEBI’s retail algo trading framework take full effect?
The circular was issued on 4 February 2025 and was implemented in phases through 2025, with full applicability from 1 April 2026. Exchange circulars from NSE and BSE set the operational detail, including the order-per-second threshold and static IP requirements.
Do I have to register my algo with the exchange?
Only if it sends 10 or more orders per second to an exchange, counted per exchange and per segment. Below that rate, exchange registration is not required, though the orders must still carry an algo identifier. The threshold counts order messages including modifications and cancellations, and the exchanges may revise it with notice.
What is the difference between a white-box and a black-box algo?
A white-box algo has disclosed logic that a user can reproduce from the stated rules. A black-box algo does not disclose its logic. Black-box algo providers carry heavier obligations under the framework, including registering as a Research Analyst and maintaining a research report for each algo offered.
Why do I need a static IP address for API trading?
API access to a broker’s trading system is whitelisted to a registered static IP. It limits the damage from a leaked API key, because order requests from an unregistered address are rejected. In practice it means running your strategy on infrastructure with a fixed address, such as a cloud instance, rather than on a home connection with a dynamic IP.
Who is responsible if a third-party algo platform malfunctions?
The framework places the accountability with your broker, and formalises the broker–algo provider relationship as a principal–agent arrangement. That closes the gap where a client previously had to pursue two parties who each pointed at the other. It does not shift strategy risk: losses from a badly designed strategy that executed correctly remain yours.
Does using a TradingView webhook count as algo trading?
Yes. If software places an order without a human approving that specific order, it is algorithmic trading regardless of how simple the trigger is. A webhook wired from an alert to a broker API falls inside the framework and needs the same static IP registration and order tagging as a Python strategy.