• Download a copy of the consultation paper here. 

The Securities and Exchange Board of India (SEBI) has proposed opening up Direct Market Access (DMA) to all categories of investors as part of a broader overhaul of technology and trading infrastructure rules for stock exchanges. DMA allows investors to place orders directly into an exchange’s trading system through a broker’s infrastructure, without manual intervention from the broker’s dealing desk. It is currently available only to institutional clients.

On June 22, SEBI released a consultation paper titled “Consultation Paper on Draft Circular for Trading Software and Technology at Stock Exchanges and Draft Consolidated Circular on Common Information Technology (IT) Related Provisions for MIIs”. The paper proposes changes to technology, cybersecurity, audit, disaster recovery, algorithmic trading, and market access requirements. It also seeks to consolidate several existing provisions applicable to stock exchanges, clearing corporations, and depositories. Public comments on the proposals can be submitted until July 13, 2026.

This consultation paper is the fourth in a series stemming from the Finance Minister’s FY2023-24 budget announcement to simplify and reduce compliance costs in the financial sector. 

Investment managers using DMA need not be SEBI-registered: The draft proposes removing the requirement that investment managers acting on behalf of clients be registered with SEBI. However, clients would remain responsible for ensuring that their investment managers comply with the applicable terms and conditions. Exchanges and brokers would also be required to maintain audit trails that can identify both the ultimate client and the investment manager at all times.

Single-window approval proposed for Smart Order Routing: SEBI has proposed replacing the current system under which brokers must apply separately to each stock exchange for Smart Order Routing (SOR) approval, with a unified common portal. Under the draft, a broker would submit a single application listing all exchanges where it intends to offer SOR, and only one exchange would be responsible for processing that approval. The responsibility would be allocated on a round-robin basis across exchanges.

Stock exchanges, in consultation with the Industry Standards Forum, would be required to develop the portal and an accompanying standard operating procedure (SOP) within three months of the circular coming into effect.

Cybersecurity provisions updated

The draft proposes:

• Replacing references to specific technologies, such as SSL with a broader requirement to use “strong and latest security/cryptographic protocols”.
• Mandating two-factor authentication for system access.
• Requiring port whitelisting based on business use.
• Requiring network segmentation between public-facing systems and core trading infrastructure.
• Requiring audits of firewall configurations, web application firewalls (WAFs), and intrusion detection and prevention systems (IDS/IPS).

The regulator has also proposed prohibiting the storage of sensitive authentication information, including user IDs, passwords, keys, hashes, hard-coded references, and session login details, on trading devices.

Backup and disaster recovery requirements revised: The paper proposes making adequate backup and restore systems mandatory for brokers, rather than merely advisable.

It also proposes changes to disaster recovery requirements. Stock exchanges and other market infrastructure institutions (MIIs) would be allowed to seek SEBI approval for exceptions to the requirement of maintaining one-to-one correspondence between production and disaster recovery infrastructure.

In addition, MIIs would be permitted to submit disaster recovery drill reports with comments from their technology committee first and provide board comments at a later stage.

Annual system audit framework streamlined

Under the proposed framework:

• System audit reports would have to be submitted within three months of the end of the audit period.
• Comments from the Standing Committee on Technology (SCOT) could accompany the report initially, with board comments submitted later.
• Follow-up audits would be required by the next quarter.
• Auditors could conduct audits for up to three consecutive years, subject to cooling-off requirements.

Certain routine submissions relating to algorithmic trading, simulated trading environments, cybersecurity incidents, and other technology-related matters would be routed to SCOT instead of being filed directly with SEBI.

Changes proposed for algorithmic trading: The draft introduces several modifications to algorithmic trading requirements. Instead of requiring all approved user IDs to participate in mock trading sessions, exchanges would require participation from all approved algorithms and related application servers. The proposal also removes the phrase “after market hours” from testing-environment requirements and adds Enhanced Trading Interface (ETI) to existing audit provisions covering trading connectivity systems.

Also read:

• Finance Ministry: SEBI is not using AI tools to track misleading securities content on social media
• SEBI forms task force, orders immediate cybersecurity overhaul amid Claude Mythos concerns
• SEBI asks Google to verify stock trading apps, use AI to track finfluencers