Algo Trading in India Changed on 1 April 2026

If you automate trades from India, the rules you learned two years ago no longer apply. SEBI’s retail algorithmic trading framework — issued as circular SEBI/HO/MIRSD/MIRSD-PoD/P/2025/0000013 in February 2025 — became fully mandatory for all stockbrokers on 1 April 2026.

This guide covers what actually changed, what it means in practice for a retail trader running a Python script, and how to place your first compliant automated order through Zerodha’s Kite Connect API. Every figure here comes from SEBI’s framework and Zerodha’s own documentation, not from a forum post.

Who this is for. Indian residents trading on Indian exchanges (NSE, BSE, MCX, MSEI) through a SEBI-registered broker. If you were planning to automate an offshore binary options or CFD account instead, read the section on offshore platforms first — the legal position there is very different, and the penalties are real.

The Rollout Timeline

Date What happened
February 2025 SEBI issues the retail algo trading circular
1 April 2025 Static IP becomes mandatory for order placement via Kite Connect
October 2025 Brokers begin registering retail algo products with the exchanges
5 January 2026 Non-compliant brokers barred from onboarding new retail API clients
1 April 2026 Full framework mandatory for all stockbrokers

What the Framework Actually Requires

1. Every algo order carries an Algo-ID

From 1 April 2026, every order placed by an algorithm must carry an exchange-assigned identifier. This lets the exchange trace any automated order back to the specific strategy that produced it. You do not generate this yourself — your broker registers the algo with the exchange and the tagging happens on their side.

The practical consequence: you can no longer run an unregistered strategy through a broker API and expect the orders to go through. Retail algo strategies have to be registered and routed through exchange-approved systems.

2. The broker is the principal, you are the agent

The framework establishes a principal–agent relationship. The stockbroker is the principal. Any algo provider operating through the broker’s API is treated as the broker’s agent — which means the broker is legally responsible for every algo order on their platform.

This is why brokers now run due diligence on algo providers before onboarding them, and why algo providers cannot connect directly to exchanges. Everything routes through a registered broker.

3. White box vs black box

White box Black box
Logic Transparent, rule-based, disclosed Proprietary, not disclosed
Approval Straightforward Heavier scrutiny
Licence needed None beyond broker onboarding SEBI Research Analyst licence
Ongoing duty — Periodic performance disclosure

If you are writing your own strategy for your own account, you are in white-box territory. The black-box requirements bite when you start distributing a strategy to other people without revealing how it works.

4. Technical controls

  • Static IP — orders must originate from a registered, fixed IP address
  • OAuth-based login and two-factor authentication
  • Automatic session logout before the next market pre-open

The Static IP Requirement, In Practice

This is the requirement that stops most people on day one, so it is worth being concrete.

Since 1 April 2025, you must configure a static IP address to place orders via the Kite API. All other endpoints — WebSocket market data, order book, positions — remain accessible from any IP. Order requests from unregistered IPs are simply rejected.

Where to get one

Three realistic options:

  • Your ISP — some Indian ISPs sell a static IP as an add-on to a business connection
  • A cloud VM — AWS, GCP, Azure or any VPS provider gives you a fixed public IP. This is what most people do, and it has the side benefit that your bot keeps running when your laptop sleeps
  • A VPN or VPC service with a dedicated egress IP

The rules around it

  • You can register up to two static IPs: one primary (mandatory) and one secondary (optional)
  • Configuration is at the developer account level, not per app — all apps under that account share the same IP set
  • You can change it once per calendar week, and changes take effect instantly
  • Both IPv4 and IPv6 are supported
  • You may share an IP only with immediate family — spouse, dependent children, dependent parents. Sharing outside that can get your account and all associated API keys suspended

The most common failure. Orders get rejected even though a static IP is configured, because the whitelisted IP does not match the actual public egress IP of your requests. The classic case: your infrastructure routes over IPv6 but you only whitelisted the IPv4 address. Check your real egress IP before debugging anything else.

Kite Connect: What It Costs and What You Get

Zerodha’s Kite Connect is the most widely used retail trading API in India. The pricing is genuinely simple, and the free tier is more useful than people expect.

Personal (Free) Connect (₹500/month per API key)
Order placement Yes Yes
GTT and alerts management Yes Yes
Margin computation, portfolio Yes Yes
Live market data (WebSocket) No Yes
Historical candle data No Yes

Historical and live data are both included in the paid plan at no extra cost — you do not pay separately for them. But you cannot subscribe to the historical API on its own; Kite Connect comes first.

Two things worth knowing before you commit:

  • There is no sandbox environment. Zerodha does not provide one. You test against the live API, which means testing with tiny quantities on liquid instruments, outside volatile windows.
  • Zerodha will not help you code. API support does not go through phone or the ticket system. Technical questions go to the community forum at kite.trade/forum.

Your First Python Bot on Kite Connect

Zerodha maintains official SDKs for Python, Java, Node.js, C#/.NET, Go, Rust, PHP and C++. We will use the Python one.

pip install kiteconnect

Step 1 — Authenticate

Kite Connect uses an OAuth-style flow. You send the user to a login URL, they authenticate, and you get back a request_token which you exchange for an access_token.

from kiteconnect import KiteConnect

kite = KiteConnect(api_key="your_api_key")

# 1. Open this URL in a browser and log in
print(kite.login_url())

# 2. After login you are redirected to your redirect URL
#    with ?request_token=XXXX in the query string
data = kite.generate_session("REQUEST_TOKEN_HERE", api_secret="your_api_secret")

kite.set_access_token(data["access_token"])
print("Logged in as:", data["user_name"])

The access token is valid for the trading day and expires before the next pre-open — that is the mandated automatic logout. Any production bot needs a routine that re-authenticates each morning.

Step 2 — Place an order

order_id = kite.place_order(
    variety=kite.VARIETY_REGULAR,
    exchange=kite.EXCHANGE_NSE,
    tradingsymbol="INFY",
    transaction_type=kite.TRANSACTION_TYPE_BUY,
    quantity=1,
    product=kite.PRODUCT_CNC,
    order_type=kite.ORDER_TYPE_LIMIT,
    price=1500,
    validity=kite.VALIDITY_DAY
)

print("Order ID:", order_id)

Market orders need market protection. Unprotected market orders — those with a market protection value of 0 — are rejected via the API. This is a deliberate safety rail. Use limit orders where you can, and set an explicit protection percentage where you cannot.

Step 3 — Pull historical candles for a backtest

This requires the paid plan.

from datetime import datetime, timedelta

# instrument_token comes from kite.instruments()
records = kite.historical_data(
    instrument_token=408065,          # INFY on NSE
    from_date=datetime.now() - timedelta(days=60),
    to_date=datetime.now(),
    interval="5minute"
)

for candle in records[:5]:
    print(candle["date"], candle["open"], candle["high"],
          candle["low"], candle["close"], candle["volume"])

Step 4 — Stream live ticks

from kiteconnect import KiteTicker

kws = KiteTicker("your_api_key", data["access_token"])

def on_ticks(ws, ticks):
    for t in ticks:
        print(t["instrument_token"], t["last_price"])

def on_connect(ws, response):
    ws.subscribe([408065])
    ws.set_mode(ws.MODE_FULL, [408065])

kws.on_ticks = on_ticks
kws.on_connect = on_connect
kws.connect()

Rate Limits and Gotchas That Cost People Money

  • 10 orders per second, per client account — not per app. Exceed it and you get HTTP 429. If you run multiple strategies on one account, they share this budget.
  • Iceberg orders count as one order towards the OPS limit, regardless of how many legs they have.
  • Rejected orders still count against your request limit. If you hit “maximum allowed order request exceeded” without placing anywhere near that many trades, you almost certainly have a bug generating invalid parameters. Invalid orders never reach your order book but they do burn quota.
  • MCX does not support IOC in the algo segment. Use Day validity for MCX orders.
  • You cannot redistribute Kite Connect data. Displaying or republishing the API’s market data on an external platform violates exchange data vending policies. Kite Connect is an execution platform, not a data vendor.

One useful exemption

If you use Kite Publisher for order placement, your setup does not fall under SEBI’s algo trading framework — because the end user clicks to place each order manually. That is a legitimate route for anyone building a signal or research product who does not want to take on algo registration.

What Is Not Legal: Offshore Platforms and the RBI Alert List

A large share of the “algo trading India” content online quietly points readers towards offshore binary options and CFD platforms. It is worth being direct about where that stands, because the consequences fall on the trader.

The RBI maintains an Alert List of entities that are neither authorised to deal in forex under FEMA nor authorised to operate an electronic trading platform for forex transactions in India. As of the update dated 19 November 2025, it contains 95 entities. Among them:

Binomo (#4), Exness (#6), FTMO (#13), IQ Option (#25), Olymp Trade (#28), Quotex (#35), Pocket Option (#37), MetaTrader 4 (#46), MetaTrader 5 (#47), FundedNext (#83) — alongside many others.

Three things follow from this:

  1. Absence from the list is not authorisation. The RBI states explicitly that the list is not exhaustive and that an entity not appearing on it should not be assumed to be authorised. Authorisation status has to be checked against the RBI’s list of authorised persons and authorised ETPs.
  2. The penalties are on the resident. Undertaking forex transactions with unauthorised persons, or for purposes not permitted under FEMA, exposes you to penal action. That can reach three times the amount involved in the contravention, plus up to ₹5,000 per day for a continuing contravention.
  3. Binary options have no SEBI framework at all. SEBI has not recognised or regulated them, and no platform offering them is authorised to operate in India under SEBI supervision. The absence of a framework is not a loophole — it means no investor protection, no grievance mechanism, and no recourse.

The Alert List also covers websites that promote unauthorised entities, including through advertising or by claiming to provide training and advisory services. That is worth knowing whether you are a trader or someone publishing about trading.

A Realistic Starting Path

  1. Open an account with a SEBI-registered broker and confirm they are compliant with the algo framework
  2. Sign up at developers.kite.trade and start on the free Personal tier
  3. Provision a cloud VM and register its IP as your primary static IP
  4. Get authentication working end to end, including the daily re-login
  5. Place one limit order for one share and confirm it appears in your order book
  6. Upgrade to the ₹500 plan when you need historical data to backtest
  7. Backtest on out-of-sample data before risking anything
  8. Register the strategy through your broker before running it in size

Frequently Asked Questions

Is algo trading legal for retail traders in India?

Yes, on Indian exchanges through a SEBI-registered broker, provided the strategy is registered and routed through exchange-approved systems. Since 1 April 2026 that registration is mandatory rather than optional.

Do I need a static IP if I place fewer than 10 orders per second?

Yes. The static IP requirement is independent of your order rate. It applies to all order placement via the API.

Can I test my bot without risking money?

Zerodha does not offer a sandbox. The practical approach is to backtest offline against historical candles, then go live with minimum quantity on a liquid instrument until you trust the execution path.

Does the free Kite Connect tier work for a trading bot?

It can place, modify and cancel orders and manage your portfolio, so a bot driven by an external data source can run on it. What you do not get is live WebSocket ticks or historical candles — for most strategies, that is what pushes you to the ₹500 plan.

What happens if my strategy is not registered?

Orders that should carry an Algo-ID but do not are not going to make it through. Your broker is the principal in this relationship and carries the regulatory responsibility, so brokers enforce this at their end.

Do I need a SEBI Research Analyst licence?

Not for trading your own account with your own transparent, rule-based strategy. It becomes relevant if you distribute a black-box strategy — one whose logic you do not disclose — to other people.

Risk and accuracy note. This article is educational and does not constitute investment advice. Regulatory requirements, API pricing and technical limits change; verify against SEBI circulars, your exchange, and your broker’s official documentation before acting. Algorithmic trading does not reduce market risk — it executes your decisions faster, including the wrong ones. Figures in this article reflect SEBI’s framework and Zerodha’s published documentation as of August 2026.

Sources: SEBI circular SEBI/HO/MIRSD/MIRSD-PoD/P/2025/0000013 (February 2025); Zerodha Kite Connect pricing and FAQ documentation; RBI Alert List updated 19 November 2025.

Similar Posts