Is algo trading legal in India?

Algorithmic trading is legal for retail participants in India. The question people are usually asking, though, is narrower than the one they say out loud: they want to know whether running their own script against a broker API will get their account flagged. The answer is that it is permitted, and it operates inside a framework SEBI defined specifically because retail API trading had grown well ahead of the rules governing it.

How the framework came about

Institutional algo trading has been regulated in India since 2012, when SEBI issued its first broad guidelines covering exchange approval, risk controls, and audit requirements. Retail was a different story. As brokers opened HTTP and WebSocket APIs through the late 2010s, a large volume of retail automation grew up in a space that had no framework written for it — traders ran their own scripts, and a substantial third-party industry sold ready-made 'algos' with performance claims nobody was obliged to substantiate.

SEBI moved to close that gap with a dedicated framework for retail algorithmic trading, issued in early 2025 and phased in over the following months. Its central idea is straightforward: every algorithmic order should be traceable to a registered algorithm, and the broker whose API carried it is accountable for it.

What the framework covers

The provisions that matter most to an individual running their own code are these:

• Algo orders must be tagged. Orders originating from an algorithm carry a unique identifier so the exchange can attribute them to a specific registered algo rather than to generic manual activity.
• An order-rate threshold separates casual API use from algo trading proper. Beyond a defined rate of orders per second from a single client, activity is treated as algorithmic and attracts registration requirements. Occasional API orders below that threshold are not treated the same way.
• Brokers are accountable for API access. They are expected to control how API access is granted, including measures such as static IP whitelisting, and to supervise what flows through their infrastructure.
• Third-party algo providers must be empanelled. Vendors selling algos to retail clients work through brokers under exchange oversight, rather than distributing strategies directly to the public.
• Exchanges provide testing facilities so algos can be validated in a simulated environment before they touch live capital.

Self-developed algorithms — code you wrote for your own account — are permitted. Above the threshold, they come with registration obligations handled via your broker. The practical effect is that a trader placing a handful of automated orders a day is in a very different position from one firing hundreds per minute, which is roughly the distinction the framework was designed to draw.

Where retail traders actually get caught out

In practice, the problems we see are rarely about the legality of automation itself. They are operational:

• Unintentional order flooding. A retry loop with no backoff can emit hundreds of orders in seconds after a single API timeout, pushing an otherwise modest strategy across a threshold and triggering broker-side intervention.
• Sharing credentials. API keys tied to one account being used to trade another person's funds moves the activity into territory that attracts a different and much heavier set of obligations.
• Treating a vendor's claims as verified. Empanelment governs the distribution channel; it is not a regulator's endorsement that a strategy is profitable.
• Assuming rules are static. Thresholds, deadlines, and broker-level implementation details have shifted more than once. Code written against last year's understanding may not match this year's requirements.

A reasonable compliance posture

For an individual automating their own trading, a sensible baseline looks like this. Trade only your own capital through your own credentials. Rate-limit your own order flow deliberately rather than discovering a limit by breaching it. Put hard caps in code on orders per minute and on total daily exposure. Keep a durable log of every order your system sends, with timestamps and the broker's response — if a question is ever raised, that record is what answers it. And read what your broker publishes about API terms, because the operational rules you will actually be held to are largely enforced at that layer.

None of this is burdensome, and most of it is what you would want for your own debugging regardless. The systems that run into trouble are almost never the carefully rate-limited ones.