← All legal documents

SEBI Algorithmic Trading Framework — Compliance Disclosure

Status: URGENT — KNOWN COMPLIANCE GAP, REMEDIATION IN PROGRESS. DO NOT REPRESENT THE SERVICE AS "SEBI COMPLIANT" UNTIL SECTION 4 IS RESOLVED.

Effective Date: [TO BE INSERTED ON PUBLICATION] Last Reviewed: 2026-06-15

1. Purpose of this Document

This document discloses, to users and to any reviewing regulatory authority, the regulatory framework applicable to algorithmic trading via broker APIs in India, and the current compliance posture of SMF Technologies LLP ("Company") and its Nexora platform ("Service") with respect to that framework.

2. The Regulatory Framework

This section is based on the primary circulars, copies of which are retained at legal/reference-circulars/:

  • SEBI-2025-0000013-2025-02-04-algo-trading-circular.pdf
  • NSE-INVG-67858-2025-05-05-implementation-standards.pdf

2.1 The operative framework is set out in SEBI circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/0000013 dated February 4, 2025, "Safer participation of retail investors in Algorithmic trading" (the "Algo Trading Circular"). Per its own Schedule of Implementation (para 7), the circular's provisions are applicable with effect from August 1, 2025 — a date that has now passed by over 10 months. NSE issued implementation standards under circular NSE/INVG/67858 dated May 5, 2025 (Annexure reproduced at legal/reference-circulars/NSE-INVG-67858-...pdf), formulated under para 7(a) of the SEBI circular.

2.2 The framework establishes a principal–agent structure (SEBI circular, para 5.I(a)):

  • The Stock Broker (Upstox, in Nexora's case) is the Principal and is fully responsible to the exchange for every order placed through its API, regardless of who or what generated that order (NSE Annexure, I.f).
  • Any "Algo Provider" (defined by SEBI as "any algo provider or fintech/vendor") acts as the broker's Agent when using the broker's API. Per SEBI para 5.III(a): "any algo provider, providing the facility to place algo orders with Brokers through API, shall require to be empaneled with Exchanges in a manner as stipulated by Exchanges." Per NSE Annexure E:
    • empanelled Algo Providers must register all their algos with the exchange, and the exchange assigns a unique Algo ID to each algo; this Algo ID may be used across brokers/members once issued;
    • the broker may enter into a commercial arrangement (including fee sharing) and a technical arrangement (API integration) with the Algo Provider; and
    • any change to an algo's logic requires re-registration.
  • Brokers must deal with empanelled Algo Providers only and are responsible for investor grievances relating to algo trading (SEBI para 5.I(d), II(c)).

2.3 "Tech-savvy retail investor" / self-deployed algos (SEBI para 5.I(c); NSE Annexure C, D): an investor who develops their own algo (including having it developed for them by a third party, per NSE Annexure C.4) may run it for themselves and their "family" (self, spouse, dependent children, dependent parents — NSE Annexure A.7) without exchange empanelment. Such algos:

  • require registration with the Exchange only if they cross the OPS threshold (2.4); below the threshold, orders are tagged "Algo" and receive a Generic Algo ID without individual registration (NSE Annexure B.3).

This category is not available to Nexora for the reason given in Section 3.0: Nexora does not build a separate, individually-owned algo per user — it operates one shared set of strategy implementations used by many unrelated clients, which is squarely the "Algo Provider" scenario in 2.2, not the "tech-savvy retail investor" scenario in 2.3.

2.4 Order-rate (OPS) threshold. The Threshold Order Per Second (TOPS) is initially 10 orders per second, per exchange/segment, measured on the broker server's calendar-clock second (NSE Annexure B.2, F). Orders below this threshold still require Algo ID tagging (a Generic Algo ID suffices for self-deployed algos below threshold); orders at or above the threshold require full individual algo registration regardless of category. This threshold does not change Nexora's empanelment obligation — empanelment is triggered by Nexora being an Algo Provider (2.2), independent of order rate.

2.5 White Box vs. Black Box categorization (SEBI para 5.V): every algo must be categorized as:

  • "Execution Algo" / "White Box" — logic is disclosed and replicable by the user; or
  • "Black Box" — logic is not known to the user and not replicable. For Black Box algos, the Algo Provider must register as a Research Analyst under the SEBI (Research Analyst) Regulations, 2014, and maintain a detailed research report for each algo, re-registering (with a fresh report) on any logic change.

This categorization is independent of, and additional to, empanelment — it determines whether RA registration is required for the algo itself, separate from any RA/IA question about Nexora's analytics (Section 4).

2.6 Technical/operational requirements (NSE Annexure, Sections A, H, I — these are the items Upstox has been rolling out operationally through 2025–2026, e.g. via the Upstox Community thread "Important Update: Regulatory Changes for API and Algo Trading are Now Live"):

  • Static IP whitelisting (mandatory, Annexure A.1–A.8). Clients must provide the broker a primary (and optionally secondary) static IP, mapped to their API key(s). For algos generated via an empanelled Algo Provider, the static IP may be the Algo Provider's ("vendor's") IP or the client's (Annexure A.5) — i.e., once Nexora is empanelled, Nexora's own server egress IP(s) can be registered as the static IP for its users' API access, rather than requiring each user to provide their own. IPs may be changed at most once per calendar week (A.6). Daily session logout is required (A.8).
  • X-Algo-Name header / Algo ID tagging (Annexure G). "All algo orders (below and above the threshold) shall be tagged with a unique identifier provided by the Exchange in order to establish audit trail." In practice (per Upstox's API), this is implemented via an X-Algo-Name header on order-placement calls.
  • Hosting (Annexure H.h). "All Retail Algorithms, including those provided by empanelled Algo providers, should be hosted on brokers' cloud servers." This is a major open question for Nexora's architecture (see Section 4) — it may mean Nexora's order-execution components need to run on infrastructure provided/approved by Upstox, or it may be satisfied by a more limited integration depending on how Upstox implements this requirement for its empanelled partners. This must be clarified directly with Upstox's Algo Partner desk — it is not something that can be inferred from the circular text alone.
  • Security/authentication (Annexure I.b–e): OAuth-only authentication (✅ Nexora already uses Upstox OAuth), two-factor authentication, unique vendor-specific API key + whitelisted static IP per Algo Provider, and compliance with SEBI's cybersecurity circular (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, Aug 20, 2024).
  • Audit trail (Annexure I.a). Brokers must maintain a sound audit trail for all API orders/trades, with identification of the actual user, for at least 5 years. Nexora's own order/trade logs should be retained consistently with this, even though the primary audit-trail obligation sits with the broker.
  • Fee/conflict disclosure (SEBI para 5.III(d)). Algo Providers and brokers may share subscription/brokerage fees, but all charges must be prominently and completely disclosed to the client, and the arrangement must not create a conflict of interest.

3. How Nexora Operates (Factual Basis for Assessment)

3.0 Determination: Nexora is an "Algo Provider" under SEBI para 5.III(a) / NSE Annexure E, not a "tech-savvy retail investor" under SEBI para 5.I(c) / NSE Annexure C–D. The Service implements and maintains one shared set of strategy algorithms (Iron Butterfly, Iron Condor, 0DTE, etc.), which are run for multiple, unrelated clients, each on their own account. The "tech-savvy retail investor" / self-deployed exemption is limited to an individual (and their immediate family) running an algo that is theirs — even if a third party coded it for them (NSE Annexure C.4), it remains a single client's algo, not a product offered to a client base. Nexora's model — the same strategy templates configured and activated by many independent users — is the latter, and therefore falls under the Algo Provider / empanelment track (Section 2.2), regardless of:

  • each user configuring their own parameters (capital %, thresholds) within the strategy templates — this is parameter selection, not algo authorship; or
  • the per-account flat billing model (Section 3, billing bullet below) — fee structure does not affect the Algo Provider determination, though it is separately relevant to RA/IA characterization (Section 4).

For the purposes of assessing the remainder of this framework, the following are the relevant facts about the Service as currently implemented:

  • Each user connects their own Upstox trading account via an OAuth authorization flow that the user initiates and can revoke at any time.
  • Each user independently selects and configures strategy parameters (capital allocation %, which strategies are active, entry/exit/adjustment thresholds) via the Platform's Settings.
  • Once configured and activated by the user, the Platform's backend (strategies/*/live.py, backend/app/engines/order_engine.py) places, monitors, and adjusts orders on NSE F&O on behalf of that user, using that user's OAuth token, without per-order manual confirmation.
  • The same underlying strategy logic (e.g., Iron Butterfly parameters) is offered to multiple users, each running it independently against their own account and capital.
  • The Company does not pool funds, does not place orders for its own account, and does not provide individualized buy/sell recommendations outside the configured strategy logic.
  • Billing model: subscription fees are charged per account, based on a flat plan tier selected at sign-up, where the plan tier corresponds to the user's declared capital allocation band (e.g., "up to ₹X deployed capital"). Fees do not vary by which strategies the user enables, are not charged per-strategy, and are not contingent on any specific buy/sell recommendation. This is structured as platform/infrastructure access pricing (analogous to a SaaS seat/usage tier), not as a fee for investment advice or research.

4. Current Compliance Status — URGENT, KNOWN GAP

As of the date of this document (last reviewed 2026-06-15), the framework described in Section 2 has been mandatory since August 1, 2025 — over 10 months — and the Company has confirmed the following gaps in Nexora's compliance:

  • Determined: Nexora's mode of operation constitutes "Algo Provider" activity (Section 3.0), requiring (a) empanelment with the exchange under the criteria referenced in NSE/INVG/67858 (and any exchange-specific empanelment circular issued thereunder), (b) registration of each distinct strategy (Iron Butterfly, Iron Condor, 0DTE, and any others) to obtain a unique Algo ID per strategy, and (c) an onward commercial/technical arrangement with Upstox as the broker-of-record.
  • Not yet completed: Algo Provider empanelment with NSE/BSE and Upstox. This is the single largest open item. The Company has not yet submitted an application for empanelment, and accordingly does not currently hold any Algo ID for its strategies.
  • Not yet determined: White Box vs. Black Box categorization (SEBI para 5.V) of each strategy. Nexora's strategies (Iron Butterfly, Iron Condor, 0DTE) appear to be "Execution Algo" / White Box candidates — the underlying logic (e.g., the structure of an Iron Butterfly, the configured entry/adjustment/exit rules) is described to users in product documentation and is, in principle, replicable. This should be confirmed per strategy as part of empanelment, since Black Box classification would additionally require RA registration and a maintained research report per algo — a materially heavier obligation than empanelment alone.
  • Not yet clarified: Annexure H.h hosting requirement ("All Retail Algorithms, including those provided by empanelled Algo providers, should be hosted on brokers' cloud servers"). It is not yet known whether this requires Nexora's order-execution backend (backend/app/engines/order_engine.py and related services) to run on Upstox-provided/approved infrastructure, or whether Upstox's empanelment process accommodates externally-hosted Algo Providers via API integration (as the bulk of NSE Annexure E/I would suggest, since it discusses "technical arrangement... via API or other means"). This must be raised explicitly with Upstox's Algo Partner desk — if literal on-broker-infrastructure hosting is required, this is a significant architecture item, not just a paperwork item.
  • Not yet implemented (engineering): X-Algo-Name header / Algo ID tagging. The Company's order-placement code (backend/app/engines/order_engine.py and related broker-integration modules) does not currently send an X-Algo-Name header or any Algo ID tag on any order request (NSE Annexure G). Once Algo ID(s)/Algo Name(s) are issued during empanelment, this must be added to every order-placement, modification, and cancellation call, per strategy.
  • Not yet implemented (engineering/operational): static IP registration. Per NSE Annexure A.5, once Nexora is empanelled, its own server egress IP(s) can be registered as the static IP for its users' API access (the static IP "shall be that of the vendor or the client"). This is not currently part of the broker-connection / onboarding flow described in the Broker API Authorization & Consent document and must be added, including the operational process for keeping the registered IP(s) current (changes limited to once per calendar week per Annexure A.6).
  • Open: audit trail retention. NSE Annexure I.a requires a 5-year audit trail with user/order identification. Confirm Nexora's order/trade logging (backend/app/data/storage.py order/trade tables) is retained for at least 5 years and is not subject to any shorter retention/cleanup job.
  • Open: RA/IA characterization of stock-scoring analytics. The flat, capital-tier-based, per-account subscription model (Section 3) is not priced per strategy and not contingent on any specific buy/sell recommendation, which substantially reduces — but does not eliminate — the risk of Research Analyst (RA) or Investment Adviser (IA) characterization under the IA/RA Regulations generally (separate from the per-algo RA question in 2.5/Section 4 above, which concerns Black Box algos, not general analytics). This must still be confirmed by counsel with specific reference to the stock-scoring / strategy-selection analytics shown on the Platform.

Required actions — in priority order

  1. Immediately stop describing, or avoid newly describing, the Service as "SEBI compliant," "regulatory approved," or similar in any marketing material, including BNI pitches, until items 2–6 below are resolved. The accurate description is: "a trading automation tool for your own brokerage account; the operator is in the process of completing exchange Algo Provider empanelment under SEBI's algorithmic trading framework (mandatory since August 1, 2025)."
  2. Contact Upstox's API/Algo Partner desk to: (a) confirm the empanelment route for third-party apps (Algo Providers) on its platform and the process/timeline for registering Nexora's strategies to obtain Algo ID(s)/Algo Name(s); (b) clarify the Annexure H.h hosting requirement for empanelled Algo Providers; and (c) confirm the static-IP arrangement (Annexure A.5 — vendor IP vs. client IP) Upstox supports for empanelled partners.
  3. Apply for Algo Provider empanelment with NSE/BSE per the criteria referenced in NSE/INVG/67858, providing the White Box / Execution Algo characterization for each strategy (Iron Butterfly, Iron Condor, 0DTE, etc.) as part of the application.
  4. Engineering — implement X-Algo-Name / Algo ID tagging support in backend/app/engines/order_engine.py (and any other order-placement paths), gated behind a configuration value per strategy, ready to populate once Algo ID(s)/Algo Name(s) are issued.
  5. Engineering/operational — add static IP registration to onboarding. Update the broker-connection flow (see Broker API Authorization & Consent) so that, once empanelled, the Company's server static IP(s) are registered against each user's Upstox account via the broker's static-IP API, with the user's consent obtained during OAuth linking.
  6. Confirm RA/IA position with counsel, covering both: (a) the per-algo White Box / Black Box determination (2.5) for each strategy, and (b) the general stock-scoring/strategy-selection analytics question. If RA registration is required for any strategy (Black Box) or for the analytics generally, obtain it before charging fees for the affected feature, or restructure it (e.g., gate behind the Investment Advice Disclaimer, remove prescriptive framing, or redesign the strategy to be fully disclosed/White Box).
  7. Update this document with the resulting Algo ID(s)/Algo Name(s), registering exchange, White Box/Black Box determination per strategy, and empanelment reference numbers once 2–3 are complete, and replace Section 5 below with the applicable disclosure language.

5. Disclosure to Users (interim, pending empanelment)

Until Algo Provider empanelment (Section 4, item 3) is complete, the Service should display the following interim disclosure to users (e.g., in the Broker API Authorization & Consent flow and on this page):

"Nexora is a trading automation tool that places orders in your own Upstox account based on strategies you configure and activate. Under SEBI's Algorithmic Trading Framework (SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/0000013, mandatory since August 1, 2025), platforms like Nexora that operate the same strategy logic for multiple users are required to be empanelled with the exchange as an 'Algo Provider' and to register each strategy for a unique Algo ID. SMF Technologies LLP has applied for / is completing this empanelment process [UPDATE STATUS]. Until empanelment is complete and Algo ID(s) are assigned, automated order placement through the Service may be limited or unavailable for some users, in line with Upstox's enforcement of the framework (including static-IP and Algo ID/X-Algo-Name requirements)."

Once empanelment is complete, this section should be replaced with:

"Nexora is empanelled with [Exchange] as an Algo Provider under SEBI's Algorithmic Trading Framework (ref: [EMPANELMENT REFERENCE]), operating through Upstox as broker. The following strategies are registered under Algo ID(s): [LIST — strategy name -> Algo ID -> Algo Name]."

6. Review Cadence

This document must be reviewed: (a) immediately upon any change in empanelment status (application submitted, approved, Algo ID(s) issued); (b) before any material change to how strategies are deployed or offered; (c) on any further SEBI/NSE/BSE circular amending the framework; and (d) at least every 3 months until empanelment (Section 4, item 3) is complete, then every 6 months thereafter.

Primary sources for this update (last reviewed 2026-06-15), retained at legal/reference-circulars/:

  • SEBI circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/0000013, "Safer participation of retail investors in Algorithmic trading," dated February 4, 2025 (SEBI-2025-0000013-2025-02-04-algo-trading-circular.pdf).
  • NSE circular NSE/INVG/67858 (Circular Ref. 471/2025), "Implementation Standards for safer participation of retail investors in Algorithmic trading," dated May 5, 2025 (NSE-INVG-67858-2025-05-05-implementation-standards.pdf).

Secondary sources (operational rollout context, not primary regulatory text — re-verify directly with Upstox before relying on specifics): Upstox Community — "Important Update: Regulatory Changes for API and Algo Trading are Now Live"; Upstox Developer Docs — "Algo Registration & Static IP Requirement" and "Configure Static IPs and Algo Trading App".