SEBI Algo Trading Rules 2026: Static IP, Order Limits & API Compliance Explained

The 30-Second Summary

SEBI's retail algo trading rules, fully enforced from 1 April 2026, mean any order you send through a broker API must originate from a static IP you have whitelisted with that broker. If your strategy stays under 10 orders per second, you do not need to register the algo with the exchange — but you still need the static IP, the order must be tagged as an algo order, and plain market orders must carry a non-zero market-protection value. Manual trades through your broker's own app are not affected.

What Actually Changed in 2026

For years, retail traders connected scripts and platforms to broker APIs with almost no formal oversight. SEBI's algo framework changes that by making every automated order traceable. The regulator's goal is a clean audit trail: each API order can now be tied to a specific trader, a specific app, and a fixed network identity.

This matters because algorithmic orders are no longer a fringe activity — algo-driven orders now account for more than half of NSE cash-market volume. When a market segment grows that large, the regulator wants the same accountability that institutional algo desks have always had, extended down to the retail API user. The 2026 rules are how that accountability is implemented in practice.

Who the Rules Apply To

The framework applies to anyone placing orders programmatically through a broker API — whether through Zerodha Kite Connect, Dhan, Fyers, Angel One SmartAPI, Upstox, Groww or any other broker that offers API access. It does not matter whether you wrote the code yourself, bought a strategy, or route signals through a third-party bridge or webhook service.

The Four Requirements, in Plain English

Strip away the circular language and there are four things every retail API trader needs to get right. Three of them apply to everyone; the fourth (registration) only kicks in above a speed threshold.

Requirement #1: Static IP Whitelisting

A static IP is a fixed internet address that never changes, and from 1 April 2026 every broker API order must come from one you have whitelisted. Send an order from an unregistered address and the broker rejects it before it ever reaches the exchange — you get an "IP not whitelisted" message or an HTTP 403 Forbidden error.

You may register one primary IP plus one backup, and a single static IP can be whitelisted across multiple brokers at once. The catch is where your orders actually originate from:

• Home broadband fails — ISPs hand out dynamic IPs that change on router restarts and lease renewals, silently breaking your whitelist.
• Cloud servers fail — AWS, DigitalOcean, Heroku and Kubernetes rotate outbound IPs by design, so the address that worked yesterday may be gone today.
• A dedicated static IP works — you whitelist it once and it keeps working indefinitely.

Requirement #2: The 10 Orders/Second Threshold

Ten orders per second is the line SEBI draws between a retail algo that needs no approval and one that must be registered. Stay below it and you can run your strategy without prior exchange-level approval. Cross it — per exchange — and you move into territory that requires formal strategy registration and a broker-and-exchange audit, with the associated compliance overhead.

For the overwhelming majority of retail traders — swing systems, intraday signals, webhook-driven entries, copy strategies — you will never approach 10 orders per second. The threshold mainly affects high-frequency and market-making style strategies. If you are unsure, count the maximum orders your system could fire in a single second during a burst, not the average.

Requirement #3: API Order Tagging

From 1 April 2026, every API order is tagged so the exchange can identify it as an algo order rather than a manual one. This is largely handled for you by your broker and the app placing the order — you generally do not configure it yourself — but it is the mechanism that makes the whole framework work. Tagging is what lets the exchange separate automated flow from manual flow and apply the right rules to each.

Requirement #4: Market Protection

Plain market orders sent via API must include a non-zero market-protection value. Market protection defines a percentage band around the last traded price beyond which your market order will not fill, protecting you from catastrophically bad fills during thin liquidity or a fast move. Sending a protection value of zero is no longer accepted — you must specify a real band.

The Compliance Timeline

The framework did not arrive overnight. It rolled out in stages, with two deadline extensions before full enforcement:

• April 2025 — SEBI's retail algo framework is introduced.
• August 2025 — the initial compliance deadline, later extended.
• October 2025 — a second extension as brokers and traders prepared.
• 1 April 2026 — final enforcement: static IP and API order tagging become mandatory for all API trading.

Your Compliance Checklist

If you place orders through any Indian broker API, work through this list:

1. Get a dedicated static IP — not home broadband, not a rotating cloud IP.
2. Whitelist it with each broker whose API you use (one IP can cover all of them).
3. Confirm orders are tagged as algo orders — usually automatic via your broker/app.
4. Set a non-zero market-protection value on market orders.
5. Check your order rate. Under 10/sec? No registration needed. At or above? Register the strategy.
6. Send a test order and confirm it is accepted, not returned with a 403.

Frequently Asked Questions