SEBI's algo rules turn your execution log into a compliance artifact

SEBI's algo trading norms took effect on April 1, 2026, requiring brokers to implement two-factor authentication for algo orders and to maintain audit trails of every automated decision ^[1]. The rules separate the retail participant who codes a strategy from the broker who executes it, and they put the broker on the hook for the plumbing ^[2] - which means the log you kept for your own debugging is now somebody's regulatory evidence.

One caveat on provenance before the mechanics. The account used here is a dev.to post by Shakti Tiwari dated 2026-08-15, published as educational material and explicitly not investment advice, which attributes the substance of the rules to livemint and Liquide coverage rather than to circular text ^[1][7]. Read what follows as reported, not as read off the regulator's page.

The 2FA requirement, as described, means an automated strategy cannot fire without an authenticated session behind it, with the stated intent of stopping runaway bots and unauthorized scripts ^[3]. The engineering consequence is that session lifecycle becomes a production dependency with the same blast radius as your market data feed. A strategy that assumed a long-lived credential now has a component that can expire mid-session, and an expiry during an open position is not a failed login, it is an unmanaged book. If you run algos, the practical checklist from the same source is to confirm your broker supports the new flow, keep your own logs alongside the broker's, and treat the 2FA session as a pre-trade check rather than a setup step ^[5].

The audit-trail mandate is the more interesting half, because it specifies a schema. Every algo order is to be logged with its inputs, time, and outcome ^[4], which is the minimum record needed to reconstruct why an order existed rather than merely that it did. That is the difference between knowing a strategy lost money and knowing which input it was looking at when it decided to ^[4]. Firms that already keep this for backtest reproducibility absorb the requirement by existing; firms that log fills and nothing else are now building a data pipeline under a deadline that has already passed.

What the source does not carry matters as much. There is no stated log retention period, no enforcement or penalty schedule, and no threshold defining which orders count as algorithmic ^[8], and no enforcement action is described ^[9]. Those three gaps determine cost: retention sets storage and export obligations, the algo definition sets scope, and the penalty schedule sets how carefully the first two get read. The same post frames the FY26 agenda - loss curbs, an STT hike, and the algo rules - as one theme of making uninformed trading visible and frictionful ^[6], which is the author's reading rather than a regulatory statement.

As of the article's date the rules had been in force 136 days ^[10]. Watch three things: whether the trail is expected to cover rejected, modified, and cancelled orders or only accepted ones, since the described schema mentions outcomes but not order lifecycle events ^[4]; whether brokers implement 2FA as a session that survives a trading day or one that must be renewed inside it ^[3]; and what retention window emerges in practice, because that number sets the real build ^[8].