SEBI's New Algo Rules Are Here. Here's Exactly What Changes for You.
The NSE circular on API operating procedures is the most significant regulatory shift for algo traders since DMA. We break down every requirement — and what you actually need to do before April 1, 2026.
If you run a Python script that places orders through a broker API — or even use a third-party tool like Stoxoo, AlgoBaba, or any scanner with auto-execute — SEBI's new framework touches you directly. This isn't a rule aimed at HFT firms. It's aimed at the retail algo trader. That's you.
Here's everything that matters, stripped of the circular's bureaucratic language.
How We Got Here
Three deadline extensions tell you something important: this is genuinely complex to implement at the broker level. The static IP requirement alone required changes to order routing infrastructure that brokers share with a common vendor. Even large brokers like Zerodha confirmed they were waiting on those vendor-side changes.
The Three Rules That Change Everything
Every API order request must originate from a pre-registered static IP address. You'll register up to two IPs (one primary, one backup) on your broker's developer console. Orders arriving from any other IP will be rejected.
This applies to all API users — not just high-frequency traders. Even if you send 2 orders a day, you need a static IP. The check is only on order placement endpoints; WebSocket data feeds and other read-only endpoints are unaffected.
The API rate limit for order placement is capped at 10 orders per second, per client account. If you exceed this, the broker will return a 429 (Too Many Requests) error and reject the excess orders. This is enforced at the exchange level, not just the broker's API.
Important clarification from Zerodha: the 10 OPS limit is per client ID, not per app or API key. If you run multiple strategies under one Zerodha login, they collectively share the same 10 OPS budget. Iceberg orders count as a single order toward the limit.
If your strategy genuinely needs to place more than 10 orders per second, you must formally register it with your broker. Registration requires a strategy writeup, an RMS (Risk Management System) writeup, and an auditor certificate (Annexure 7 under the NSE circular).
Broker community has pushed back on the auditor certificate requirement — Zerodha, among others, has made representations to the exchange to remove it. Pricing for exchange-level registration will be passed on to the trader; exact fees haven't been fixed yet.
The Market Order Restriction Nobody Noticed
Buried in the same set of changes: market orders via API will no longer be allowed in the commodity segment at all. For equity, index, and currency segments, market orders will continue — but with automatic market protection applied. This means your order_type=MARKET call will be converted to a limit order with a price band around the last traded price before hitting the exchange. Zerodha confirmed this will be applied automatically without requiring any change to your code.
What this means practically: if you run a strategy that fires market orders during highly illiquid moments (pre-open, circuit filters, thin options strikes), your fills may now behave differently. Test this explicitly before April 1.
"The operational modalities were only published in July with an August go-live. Even brokers building this found it genuinely complex. Don't assume your setup is compliant just because orders went through last month."
Impact by Trader Type
| You Are | Static IP | Registration | Market Orders |
|---|---|---|---|
| Retail API user, <10 OPS Python/AFL scripts, scanners with auto-execute | Required | Not needed | Protected |
| Third-party tool user Stoxoo, AlgoBaba, etc. via your own API key | Required | Not needed | Protected |
| Data-only API user WebSocket feeds, charting, no order placement | Not needed | Not needed | No change |
| High-frequency / >10 OPS Market making, scalping, multi-account mirrors | Required | Required | Restricted |
| Commodity segment traders MCX strategies via API | Required | If <10 OPS, no | Blocked |
What You Need to Do Before April 1
- →Get a static IP. Contact your ISP for a dedicated IP, or deploy your algo on a cloud VM (AWS EC2, GCP, DigitalOcean) and assign a reserved static IP to it. Budget ₹500–₹2,000/month depending on approach.
- →Register the IP on your broker's developer console once the feature goes live. Zerodha confirmed a March 2026 rollout. You can register one primary and one backup IP.
- →Audit your OPS. Add logging to count orders placed per second at peak. If you're breaching 10 OPS even briefly, restructure your execution logic — batch orders where possible, add rate limiting in code.
- →Test market order behaviour. After the update goes live, run paper tests specifically on your market order fills to understand how market protection affects your average fill price.
- →If you're in commodities (MCX), replace all API market orders with limit orders immediately. Don't wait for the deadline — start testing now.
- →If you manage family accounts on a shared IP, confirm with your broker that joint-family IP sharing is supported in their implementation. The NSE circular permits this but implementation varies by broker.
The April 1 deadline is firm. SEBI has extended twice already and has made clear this is the final date. Brokers who miss compliance risk exchange penalties. Traders whose setups aren't ready will simply have their order API calls rejected from that date — not gracefully warned, just rejected.
SEBI's intent here is traceability, not restriction. A static IP creates a verifiable audit trail linking every order to a specific machine and account. The 10 OPS cap prevents retail API infrastructure from being used as a disguised HFT vehicle. These are reasonable goals. The compliance cost for the vast majority of retail algo traders — getting a static IP and staying under 10 OPS — is genuinely low. Don't let the complexity of the circular distract from how straightforward most of the actual requirements are.