Who the algorithmic trading guidelines apply to
The circular is addressed to the stock exchanges in the IFSC, all broker-dealers, and remote trading participants through their exchanges. It was issued under sections 12 and 13 of the IFSCA Act, regulation 72 of the Market Infrastructure Institutions Regulations, 2021 and regulation 45 of the Capital Market Intermediaries Regulations, 2025. Earlier SEBI circulars on algorithmic trading applicable in the IFSC are superseded.
Algorithmic trading means trading in listed securities where a computer algorithm or automated system determines one or more order parameters (initiation or cancellation, timing, price, quantity, type, or later modification) with limited or no human intervention. Systems that only process or confirm orders, or handle post-trade processing, without independently setting parameters, are excluded.
What a market participant must do
- Exchange approval before deploying, offering or facilitating algorithmic trading, with initial conformance testing. Participants already running algorithms on 16 October 2026 must be tested within three months if they have not been.
- Governance. Governance, oversight and risk controls proportionate to the activity, and staff who understand each system's design, risk controls, failure modes and escalation arrangements, with training and periodic assessment.
- Minimum risk controls: price, quantity and order-value checks against exchange limits; an optional client-level cumulative open order value check; automated execution checks that stop loops and runaway order flow; a kill switch that halts outgoing orders and cancels live orders, tested periodically with records kept; and load and stress testing.
- Undertaking to the exchange covering controls, protection of trading logic, real-time monitoring with instantaneous reporting of anomalies, logs and audit trail, prior notice of any logic or system change, and a designated compliance or risk officer.
- Audit trail. Every algorithmic order carries the exchange's unique identifier, traceable to the client and the specific algorithm.
- Annual system audit by a CISA, DISA, CISM or CISSP holder (or an auditor with 10 years' algo-audit experience), with rotation after three audits. Deficiencies are reported to the exchange within one month and a closure report filed within two months. For broker-dealers the audit forms part of the system audit under the master circular of 12 May 2026.
- Third parties. Where a vendor designs, tests or operates the algorithm, the participant needs arrangements giving it access to the information needed to show compliance.
- DMA and sponsored access clients must also have their algorithms approved by the exchange, keep records, and undergo an annual system audit.
AI and explainability
Where artificial intelligence, machine learning, adaptive or self-learning models are used in connection with algorithmic trading, the participant 'shall remain responsible for adequately explaining the impact of AI on the decision-making' of the algorithm (paragraph 19). A participant cannot rely on the model's complexity, or on a vendor, to avoid explaining what the algorithm does. Exchanges may also ask for details of the trading strategies used.
What exchanges will do
Exchanges must put in place approval procedures, order-level price and quantity controls, real-time throttling, systems to identify dysfunctional algorithms (with power to shut down a terminal in an exigency), surveillance of algorithmic orders, and a framework of charges for excessive order-to-trade ratios. A participant penalised for its order-to-trade ratio more than ten times in a rolling 30 days may lose proprietary trading for the next session's opening hour. Exchanges had three months from 16 October 2026 to implement the circular and amend their bye-laws, so participants should watch for exchange-level procedures.
Automated decisions beyond trading
Outside algorithmic trading, IFSCA has not issued a general framework for AI in financial services. Existing rules already apply to automated systems:
- The frontier-AI cyber advisory of 4 June 2026 requires authorisation and data safeguards for AI tools that receive code, logs or regulated data, and human oversight with rigorous testing of AI-generated code before production. See cyber security.
- A significant data fiduciary under the DPDP framework must verify that algorithmic software it uses to process personal data is not likely to pose a risk to individuals' rights (Rule 13(3), from 13 May 2027). See data protection.
- Conduct rules apply whether a decision is made by a person or a model: suitability, disclosure and fair treatment duties in the activity regulations do not change because a model makes the recommendation.
What to plan for: governance over each model used in a regulated activity, pre-deployment and periodic testing, explainability that a supervisor would accept, and records of model versions, parameters and decisions.