Your Trading Bot Needs a Static IP Now. Six Months Inside SEBI's Algo Rules.
SEBI's retail algo framework became mandatory on 1 April 2026. Almost nobody needs to register a strategy — but everyone running a Python script or TradingView webhook got hit by static IPs, daily logouts and a rule that quietly bans sharing your own code.
SEBI's retail algo framework (circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/0000013, February 2025) became fully mandatory on 1 April 2026. The headline everyone feared — "you must register your strategy" — applies only above 10 orders per second, which essentially no retail trader hits. What actually changed is plumbing: static IP only, OAuth only, 2FA every session, and sessions that die at the end of each trading day. Your broker is now legally the principal for every algo order. And there is one rule almost nobody has read: you may not share your self-built strategy with anyone outside your immediate family.
The framework in four numbers:
Registration threshold
10 orders/sec
per exchange, per client
Mandatory from
1 Apr 2026
six months ago
Allowed IPs
1
static, registered with your broker
Session lifetime
1 day
no persistent logins
When the circular landed, the reaction in every trading group was the same: retail algo trading is finished, you will need a licence to run a Python script, SEBI has killed automation. Six months past the deadline, none of that happened. Something else did, and it is both smaller and more annoying than what people braced for.
This post is what actually applies to a person running one strategy from a laptop, what broke on 1 April, and the two rules that got almost no coverage but matter more than the ones that did.
- Any strategy that places orders through a broker API is an algo under this framework. Manual clicking is not. If you run a Python script, a TradingView webhook or a third-party bot, you are in scope.
- Registration with the exchange applies above 10 orders per second per exchange per client. Below that, your broker handles approval and tags your orders with an exchange-issued Algo ID — you file nothing with SEBI yourself.
- Four technical changes bind everyone: orders accepted only from a static IP registered with the broker, OAuth as the sole authentication method, two-factor authentication on every session, and sessions that expire at the end of the trading day.
- Brokers are now the principal and algo vendors are their agents, so the broker carries legal responsibility and grievance handling for every algo order on its platform — which is why broker approval got noticeably stricter.
- A strategy you wrote for yourself may be used by you and your immediate family. Distributing or selling it makes you an algo provider, and a black-box provider must hold a SEBI Research Analyst licence.
Do these rules apply to you?
The honest answer for each kind of setup:
| What you do | In scope? | What you have to do |
|---|---|---|
| Click buy/sell in your broker app | No | Nothing |
| Use a broker's own in-built strategy or basket order | No | Nothing — it is the broker's product |
| Run a personal Python script on your broker's API | Yes | Broker API approval, Algo ID, static IP, kill switch |
| TradingView alert → webhook → broker | Yes | Same as above; the webhook relay needs the static IP |
| A third-party algo platform or subscription bot | Yes | Confirm the vendor is exchange-empanelled through your broker |
| Buy a "black box" strategy that hides its logic | Yes | The provider must hold a SEBI Research Analyst licence |
| Share your own script with friends or a group | Yes | Not permitted — see the sharing section below |
| Above 10 orders/second | Yes | Formal strategy registration through your broker |
The row people get wrong is the third one. "It is just a personal script, nobody knows" stopped being true the moment orders had to carry an Algo ID and arrive from a registered IP. The exchange can see which orders came from automation, because that is the entire point of the tagging.
The 10-orders-per-second line, and why it is not about you
This is the threshold that caused the panic, and it is worth understanding how high it actually is. Ten orders per second, per exchange, per client, sustained. A discretionary intraday strategy running on five instruments might place forty orders in a day. A fairly aggressive scalping bot might place four hundred. Neither is anywhere near ten in a single second.
Below the line, you do not file anything with SEBI. Your broker gets the API approved, the exchange issues an Algo ID, and your orders are tagged with it. Above the line, the strategy itself has to be formally registered through the broker before it can keep running — and if the broker later modifies an approved algo, it needs fresh exchange approval.
Who actually crosses ten per second? Market-making desks, arbitrage engines quoting both sides of many strikes, and anyone spraying orders across an option chain. If that is you, you already have a compliance conversation with your broker. If it is not, the threshold is scenery.
The threshold counts orders, not trades — and modifications and cancellations are orders. A strategy that constantly repositions limit orders can generate far more order messages than you would guess from its trade count. Worth measuring rather than assuming.
What actually broke on 1 April
Here is the part that produced real support tickets. Four changes to how API sessions work, none of them negotiable.
Before and after:
| Before | Since 1 April 2026 | |
|---|---|---|
| Where orders can come from | Any IP | One static IP registered with the broker; others rejected |
| Authentication | Various — token, password, API key | OAuth only |
| Two-factor | Usually once | Every session |
| Session lifetime | Could persist for days | Auto-closes at end of trading day |
What each one costs you in practice:
- Static IP. A home broadband connection usually has a dynamic IP that changes on reconnect. Once it changes, your orders are rejected — silently, from your script's point of view, mid-session. The fixes are a static IP from your ISP (usually a paid add-on), or running the bot on a cloud VM with a fixed address, which is what most people ended up doing.
- OAuth only. Anything that authenticated with a stored API key and secret had to be rewritten. Older open-source broker wrappers broke outright.
- 2FA every session. The daily login is now interactive. Fully unattended start-up is no longer possible without deliberate handling, which is precisely the point.
- Daily session expiry. Anything that assumed a long-lived token now has to re-authenticate before every trading day. If your bot runs pre-open, its token refresh has to run earlier still.
Taken together, these are not risk controls in any deep sense — they are traceability controls. They make it possible to say, after the fact, exactly which machine sent which order under which identity. That is a reasonable thing for a regulator to want after a few years of unattributable order floods.
The Algo ID and the kill switch
Two requirements that sit on the broker but land on you.
Every algo order carries a unique identifier issued by the exchange. You do not generate it; the broker obtains it and attaches it. Its effect is that an order is now permanently attributable to a specific automated strategy rather than just to a client code. When something goes wrong at 3:20 PM, there is a clean audit trail.
A kill switch is mandatory — a way to halt the strategy's order flow immediately, both in your own code and on the broker's side. If you have ever watched a loop misfire and send the same order repeatedly, you already understand why this is not bureaucracy. Build it before the first live order, not after the first incident.
Try it now . Free
F&O Screener — the scan before the script
OI buildup, price-volume shifts and unusual activity across the F&O universe. Most strategies start as a filter someone runs by hand every morning; this is that filter, already built.
White box, black box, and the business that died
The framework splits algos by whether their logic is disclosed.
The two categories:
| White box | Black box | |
|---|---|---|
| Logic | Disclosed — replicable from the description | Hidden from the user |
| Approval | Faster | Heavier |
| Provider must hold | Exchange empanelment via the broker | SEBI Research Analyst licence |
| Documentation | Strategy description | Research report per strategy, maintained |
This is the clause that changed an industry. For years the standard product was: pay ₹5,000 a month, plug in our bot, do not ask what it does. Under the framework, a hidden-logic strategy sold to the public requires its provider to be a SEBI-registered Research Analyst, maintaining research documentation for each strategy. Most operators selling black-box bots on Telegram were not, and are not.
So the practical advice if you are buying: before you pay anyone for a strategy, ask two questions — is the provider exchange-empanelled through my broker, and if the logic is hidden, what is your RA registration number? Both are verifiable. A provider who cannot answer is not a bargain, they are a liability you have taken on.
The sharing rule nobody read
Here is the clause that surprised people who had already dealt with everything else. A strategy you write for yourself is for you and your immediate family — reported as spouse, dependent children and dependent parents. Share it outside that circle and you are no longer a retail trader using an algo; you are an algo provider, with all the obligations that follow.
That is a bigger cultural change than the IP rules. The Indian retail algo scene was built on open sharing: GitHub repos, forum posts, a script passed around a WhatsApp group, someone's Streak strategy copied by forty people. As written, casual distribution of a live-trading strategy is no longer a neutral act.
The obvious question is what counts as sharing. Publishing a backtest, explaining an approach, or writing about a method in prose is analysis, not provision. Handing someone a runnable strategy that places orders through their broker is the thing the rule is aimed at. The boundary between those has not been tested much yet, and if you are close to it, that is a question for a compliance professional rather than for us — we build tools, we do not interpret circulars for a living.
If you maintain a public repo of live-trading strategies for Indian brokers, this is worth an hour of your attention. The rule is not hypothetical; enforcement in adjacent areas has been active.
Your broker is now the principal
One structural change explains why broker API approval suddenly got slow and fussy: under the framework the broker is the principal and the algo provider is its agent. The broker bears legal responsibility for every algo order that passes through its platform, whoever wrote the code, and handles investor grievances about algo trading.
Put yourself in the broker's position. You are now answerable for the behaviour of thousands of scripts written by people you have never met. The rational response is to approve carefully, monitor closely, and keep a kill switch on your own side. That is exactly what happened.
It also means the framework has teeth without SEBI ever having to look at your code. The enforcement point is your broker, and your broker can switch you off.
If your bot stopped working
The failures we have seen, in rough order of frequency:
- Orders silently rejected after a router restart — dynamic IP changed. Move to a cloud VM with a static address, or buy a static IP from your ISP, and re-register it with the broker.
- Authentication fails after an update — the old API-key flow is gone. Migrate to the broker's OAuth flow; check whether your open-source wrapper is still maintained, because several are not.
- Works at 9:30, dead the next morning — the session expired overnight. Re-authenticate as part of start-up rather than assuming a stored token.
- Third-party platform suddenly unavailable — the vendor may not have completed empanelment. Ask them directly for their status through your broker.
- Everything works but orders are rejected at the exchange — the Algo ID may not be attached. That one is the broker's to fix; raise it with them.
And a broader point worth making, because the compliance scramble distracted from it: none of these rules make an unprofitable strategy profitable. The framework governs how your orders reach the exchange, not whether they should. If the strategy did not survive costs and slippage before April, a static IP has not helped. We wrote about that arithmetic in risk of ruin, and the automation crowd is if anything more exposed to it, because a bot executes a bad edge faster and more faithfully than a human ever could.
This is a plain-language summary of a framework, not legal or compliance advice, and it is built on published reporting rather than an official reading of the circular. If a decision turns on the detail, read SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/0000013 and talk to your broker's compliance desk.
Read next
Related reading: best AI tools for intraday trading in India for what is actually available without writing code, India's ₹1.55 lakh crore MTF book on the other leverage story running right now, and the biggest mistake new F&O traders make. We will update this post if SEBI revises the thresholds.
Frequently Asked Questions
Is algo trading legal in India for retail traders?
Yes. SEBI's framework, mandatory from 1 April 2026, regulates how retail algos operate rather than banning them. You need your broker's API approval, an exchange-issued Algo ID on your orders, a registered static IP and a kill switch. Formal strategy registration applies only above 10 orders per second.
Do I need to register my personal trading script with SEBI?
Not directly, and not at all if you stay below 10 orders per second per exchange. Your broker obtains exchange approval and the Algo ID; you file nothing with SEBI yourself. Above that threshold the strategy must be formally registered through your broker before it continues running.
Why is my trading bot getting order rejections since April 2026?
Most commonly the static IP rule. Orders are accepted only from one IP address registered with your broker, and home broadband connections usually get a new IP on reconnect. The other frequent causes are the move to OAuth-only authentication, mandatory 2FA per session, and sessions that now expire at the end of each trading day.
What is the 10 orders per second rule?
The threshold, measured per exchange per client, that separates unregistered from registered algos. Below it, standard broker approval and order tagging apply. Above it, the strategy needs formal registration. Note that modifications and cancellations count as orders, so a strategy that constantly repositions limit orders generates more messages than its trade count suggests.
Can I still use TradingView webhooks with an Indian broker?
Yes, as an algo under the framework. The relay that forwards the alert to your broker must send from the registered static IP and use the broker's OAuth flow, and the orders carry an Algo ID like any other automated order. In practice most people moved the relay to a cloud server with a fixed IP.
Can I sell or share my trading strategy in India?
A self-built strategy is for you and your immediate family — reported as spouse, dependent children and dependent parents. Distributing it more widely makes you an algo provider. If the logic is hidden from the user (a black box), the provider must hold a SEBI Research Analyst licence and maintain research documentation per strategy.
What is the difference between white box and black box algos?
A white-box algo discloses its logic so it can be replicated from the description, and gets a lighter approval path. A black-box algo hides its logic; its provider must be a SEBI-registered Research Analyst and keep a research report for each strategy. Before buying any paid bot, ask for the provider's empanelment status and, for black boxes, their RA registration number.
Who is responsible if an algo misfires — me or my broker?
Under the framework the broker is the principal and algo providers are its agents, so the broker carries legal responsibility for algo orders on its platform and handles related investor grievances. That is why broker API approval became stricter. It does not make your trading losses someone else's problem — the strategy's results remain yours.
MarketsEasy Research
Market Structure
We build tools on top of broker and exchange APIs, so when the authentication rules change we find out the same way everyone else does — at 9:14 in the morning.