SEBI algo-trading rules 2025: the static-IP requirement, explained

If you connect to your broker API to run algos, SEBI’s 2025 framework and NSE’s implementation standards change how you connect: no more open APIs, and access only through a unique API key plus a static IP your broker has whitelisted. This applies whether you write your own code or use a no-code GUI, web, web-UI, or mobile tool that connects from your end.

This guide explains the static-IP rule in plain language, with the exact clauses, and shows where a dedicated AlgoIP static IP fits. It is general information, not legal advice; verify with your broker and the official circulars.

Not legal or investment advice. This page is general information to help you understand the SEBI and NSE framework for retail algorithmic trading. It is not legal, compliance, tax, or investment advice, and it is not a recommendation to trade or to use algorithms. Rules change and have nuances, so always verify against the official SEBI and NSE circulars (linked on this page) and with your stockbroker before you act. AlgoIP provides internet infrastructure (a dedicated static IP / proxy) only. We do not generate, place, modify, or execute orders or trades, we make no trading decisions, and we do not provide trading strategies, signals, or advice. We are not a stockbroker, trading member, exchange-empanelled algo provider, or SEBI-registered intermediary. Last reviewed: June 2026.

Key rules at a glance

  1. A broker-whitelisted static IP for API algo access. A broker must not permit open APIs and must allow API access only through a unique vendor-client-specific API key and a static IP whitelisted by the broker, to ensure identification and traceability. Per the NSE FAQ, this client static IP applies to the tech-savvy investor using the API to place orders. Source: SEBI para I(d); NSE para I(e); NSE FAQ Q3, Q6.
  2. Primary plus an optional secondary IP. A client may give one static IP (primary), or add a second static IP (secondary) for connectivity redundancy. Multiple API keys can map to the same or to separate primary/secondary IPs. Source: NSE para A.2, A.3.
  3. One IP per client, with family sharing allowed. A static IP can be mapped to only one client at a time, but it may be shared between clients of one family, defined as self, spouse, dependent children and dependent parents, with a written request, registered-email request or a 2FA-validated request to the broker. Source: SEBI para I(c); NSE para A.7.
  4. Change your mapped IP at most once a calendar week. Clients can update their mapped static IP as needed, but not more than once a calendar week. In extraordinary circumstances you can ask your broker after you have already changed it that week. A stable, dedicated static IP means you rarely need to. Source: NSE para A.6.
  5. OAuth-only authentication plus two-factor. Brokers must use OAuth (Open Authentication) based authentication only, and authenticate API access through two-factor authentication. Source: SEBI para I(d); NSE para I(c), I(d).
  6. Daily session logout. All API sessions must be compulsorily logged out every day before the start of the next trading day. Source: NSE para A.8.
  7. The orders-per-second threshold (TOPS). The Threshold Orders Per Second is initially set at not exceeding 10 orders per second per exchange or segment. If your order flow stays below it you do not need to register the algo; above it you must register the algorithm with each exchange where it is used. Brokers may set a lower per-client limit. Source: NSE para B.2, C.1, F.
  8. Every algo order is tagged for audit trail. All algo orders, below and above the threshold, are tagged with a unique identifier provided by the exchange in order to establish an audit trail. Source: SEBI para I(b), II(b); NSE para G.
  9. Records kept for at least 5 years. Audit-trail data for API, IBT and STWT orders must be available for at least 5 years, with identification of the actual user for all such orders and trades. Source: NSE para I(a).
  10. Broker is principal, algo providers are empanelled agents. For algo trading through APIs the broker is the principal and any algo provider or vendor acts as its agent. The broker is solely responsible for grievances and for monitoring APIs, and any algo provider must be empanelled with the exchange. Source: SEBI paras I(a), II(c), III; NSE para E.
  11. Exchange kill switch. Exchanges retain the ability to use a kill switch on orders from a particular algo id, and have the authority to kill any rogue algo that is impacting the market. Source: SEBI para IV(a)(iii); NSE para J.3.
  12. Direct Market Access is exempt. These standards do not apply to trading under Direct Market Access (DMA), which remains governed by the relevant provisions. Source: NSE para J.1.

Why this matters in practice

The points below are AlgoIP’s observation of how the market works, not a SEBI or NSE rule.

The framework expects an empanelled algo provider’s strategies to run on the broker (Trading Member) server, in which case the IP used is the broker server IP. But the regulation also explicitly allows a tech-savvy client to host the algo at their own end using a static IP.

In practice an empanelled vendor often cannot host its infrastructure at every broker. There are 200+ brokers, many do not support third-party hosting, and some operate their own algo platforms and may not onboard a competing third-party vendor. So many vendors route the client through the client-API plus static-IP path instead.

This includes the large no-code segment: desktop GUIs, web platforms, web UIs, mobile apps, strategy builders, algo builders and manual high-speed scalping front-ends. The client writes no code, but the tool still connects to the broker API from the client endpoint (a PC, laptop, mobile, or a cloud VM or VPS), so it needs the whitelisted static IP. These are exactly the tools we document in our setup guides.

Net effect: a retail user can need a static IP even without writing the algo themselves. The determining factor is where the API connection originates: from your endpoint means you need a static IP; a vendor connecting server-side from the broker infrastructure uses the broker IP.

How AlgoIP helps

AlgoIP provides the one piece you cannot get from your broker: a dedicated static IPv4 (or IPv6), mapped to your account alone, that you whitelist with your broker, with an optional second IP for redundancy. Because it is dedicated to one account, not shared or rotating, it fits the rule that a static IP maps to one client at a time and supports identification and traceability. AlgoIP supplies the static IP only; whitelisting it with your broker is your step, and your broker and the exchange handle registration, tagging, OAuth and 2FA, risk management and the audit trail.

Official sources

The SEBI framework applies to all recognized stock exchanges. NSE, BSE and MCX each issued implementation standards in May 2025 carrying the same requirements. The exact clauses quoted on this page are from NSE; MCX (CTCL/235/2025) is materially identical and BSE issued its own (Notice 20250506-3).

SEBI, NSE, BSE, MCX and other Indian exchanges now require a broker-whitelisted static IP for API-based algo trading. Get a dedicated static IP · Find your plan · Compliance hub · Use your IP with MyAlgoMate, Stoxxo, StocksDeveloper · Broker compatibility