Retail algorithmic trading in India is undergoing a regulatory transformation. On May 5, 2025, the National Stock Exchange (NSE) released a detailed framework defining what retail traders, algo platforms, and stockbrokers must now follow to participate in algorithmic trading through APIs.
This is not just another compliance circular—it’s a shift toward structured, secure, and auditable retail algo access.
Let’s break down who needs to do what.
What Retail Traders Must Do
Retail traders now fall under a stricter structure for API access and algo execution. Here’s what they are expected to comply with:
Static IP Requirement
Every trader using API access must provide a static IP address to their broker. Only one static IP is allowed per client (with an optional secondary for redundancy).
Algo Access Based on Order Speed
- If your algo sends ≤10 orders/second, you do not need to register it with the exchange.
- If it exceeds 10 orders/second, registration is mandatory via your broker.
Multiple API Keys
You may use multiple API keys, but brokers will control which are allowed for registered vs. unregistered algos.
Weekly Static IP Change Limit
Static IPs can only be changed once a week unless there’s a valid emergency.
IP Sharing Within Family
IPs can be shared only among family members under SEBI’s definition, and must be pre-approved with written consent and 2FA verification.
Daily Session Logout
All API sessions will be forcibly logged out before the next trading day.
Unregistered Algo = Limited OPS
Algos that do not exceed 10 OPS can run without formal registration, but must still comply with risk controls.
What Algo Platforms Must Do
Algo platforms—especially those offering software, signal engines, or hosted infrastructure—have a specific set of responsibilities:
Empanelment With Exchanges
They must be registered and empanelled with NSE or any exchange they intend to trade on.
Algo Registration
Every algo offered must be registered, and will be assigned a unique Algo ID by the exchange.
Whitelisted Static IP
Platforms must operate from whitelisted static IPs. Each API call must be traceable to the platform and end-user.
Technical + Commercial Disclosures
Platforms entering partnerships with brokers must disclose technical and commercial relationships to the exchange.
Secure Hosting and Compliance
- All retail algos must be hosted on Indian servers.
- Algo platforms must follow SEBI cybersecurity norms, audit trails, and maintain logs for at least 5 years.
Two-Factor Authentication and Access Control
API access must be protected with OAuth, password policies, and 2FA for retail traders.
No Open API Models
Open-access APIs are now banned. Each client must have a unique key + IP pairing.
What Brokers Must Do
Brokers act as the gatekeepers and are now responsible for end-to-end oversight of API-based trading:
Approve API Access Based on Static IPs
They must whitelist static IPs provided by clients or algo vendors and maintain mapping for all keys.
Monitor Order Rate (OPS)
Brokers must actively monitor and block orders that exceed the Threshold Orders Per Second (TOPS), currently set at 10 OPS per exchange.
Algo Tagging and Audit Trail
All orders—registered or not—must include a unique Algo ID for full traceability. They must maintain audit logs for 5 years.
Restrict Disallowed Contracts
Brokers must ensure APIs don’t allow trades in restricted order types or instruments specified by the exchange.
Control Session Hygiene
All API sessions must be forcibly terminated daily. Multiple API keys should be properly segmented between registered and unregistered algos.
Due Diligence on Algo Providers
Before partnering with any third-party platform, brokers must conduct strict due diligence and report any violations immediately to the exchange.
Client Eligibility Enforcement
Only eligible, approved clients should be allowed to use trading APIs or plug into any vendor-provided system.
Full Responsibility for Trades
Brokers remain fully liable for every trade coming from client APIs or vendor APIs—regardless of who initiated the order.
What Happens if You Don’t Comply?
- Brokers may reject or block API orders that violate the rules.
- Stock exchanges have the authority to terminate rogue algos that disrupt the market.
- Violations or misuse could result in API access termination, regulatory action, or financial penalties.
The Road Ahead
This circular makes one thing clear—India’s retail algo trading is evolving from a gray zone into a regulated, professional-grade domain. It may feel restrictive in the short term, but in the long run, it brings trust, fairness, and transparency into the system.
Algo platforms and brokerages must now adapt quickly to these standards. Retail traders must stay informed, structured, and ensure they work within the defined thresholds.
Platforms like OpenAlgo.in are already in the process of aligning their infrastructure with these new rules, including static IP enforcement, OPS (rate limiting to 10 orders per second as default standard) and unique algo ID integration.
The future is still algorithmic—but now it’s accountable too.
I want to buy for nse india