Analysing The Legal Challenges Being Faced By Investors In Digital Financial Markets

Author: LawSphereX

Category: Technology, Cyber & Privacy

Published: 2026-08-23T17:57:02.931724+00:00

Updated: 2026-08-26T17:12:12.63+00:00

ANALYSING THE LEGAL CHALLENGES BEING FACED BY

INVESTORS IN DIGITAL FINANCIAL MARKETS

Debamita Ray, BBA LLB (Hons.), Amity Law School, Amity University Kolkata. Srestha Mitra, B.COM LLB (Hons.), Amity Law School, Amity University Kolkata.

ABSTRACT

The evolution of online trading and the usage of demat accounts have transformed the traditional Stock Market trading. Only the benefits are highlighted but the disadvantages are not. It is an era where Demat Account is an essential tool for flawless paperless transaction especially at the time when digital financial market has revolutionized the traditional investment practices. While investing, an investor may face several challenges such as system glitch in their foreign brokerage app which can lead to a wrongful stock purchase and the problem will enhance if the broker denies responsibility. If an investor follows a stock tip and invests without knowing the fact that his promoter is artificially inflating the stock price he will face loss. The enforcement for remedy is slow in digital markets.

What happens if an investor's credentials are compromised while investing by using the demat account or the invested amount doesn't reflect in their account? The need for more efficient cyber security, investor protection and the importance and barriers of digital literacy is often not highlighted in the discussion of transition from traditional to digital trading system. Our intention is to look into the legal challenges in the digital financial market which are faced by investors in a daily basis. This paper critically examines several legal challenges in demat account such as cyber frauds, data security, regulatory loopholes and enforcement of investor rights.

It analyses whether the current regulations, and authorities like SEBI are adequate or not in safeguarding investor's safety and if there is any need for stronger legal mechanism to ensure transparency, with exploring the legal challenges and potential solutions. This article aims at understanding the importance of creating investor friendly, secure demat transactions. Although AI is a part of digitalization if used carefully and with precaution it can make digital transactions a better experience. Keywords: Demat account, Cyber frauds, Investor protection, Regulatory loophole.

Introduction Indian stock market has significantly revolutionized by transitioning from traditional paperbased trading to modern electronic system. Till 1995, Indian market used to follow a conventional form of trading which was unmanageable, risk oriented and was not approachable for retail investors. The traditional paper-based transaction system caused delays in settlements and had risk of loss or forgery which hampered the growth of market and connectivity with global financial systems therefore it was inefficient. To address all these inefficiencies India introduced the Depositories Act, 1995 which established the framework of dematerialisation, where share certificates are stored in dematerialised form and transaction is carried out through dematerialised account (demat account). This change enhanced efficiency, reduced risks and increased investor protection.

Although the usage of demat account has made the stock trading and settlement more efficient, it also presented new legal and regulatory issues in the digital financial ecosystem such as cyber fraud, system glitches, regulatory loopholes and enforcement delays. Issues in Digital Transactions faced by investors Majority of the retail investors especially who are new to the markets faces several legal issues like unauthorised transactions, unclear brokerage agreements and problems due to legislative gaps in investor protection. The digitalisation of the financial market has brought several issues pertaining to market manipulation, cybersecurity risks, investor dispute resolution and contractual transparency.

Investor confidence is weakened by issues in enforcement, jurisdictional conflicts, slow resolution of investor complaints though SEBI (Securities Board of India) and Depository Regulations continue providing a framework for regulating Demat transactions. Retail investors also face serious threats from emerging perils like algorithmic trading risks, cybercrimes which necessitate stronger and more efficient legal and regulatory changes. Existing legal framework addressing the issues in demat transactions There are several legal issues that an investor may face while making a digital transaction using a demat account, to name a few.

In the digital financial market, many unauthorised trades take place and investor fall victim to those traps before they even realize. Many investors lose lakhs of dollar in pump and dump scheme, some also lose money because their stocks were sold at unusually low price, which happens as the investor accesses the phony links that are send to them by hackers asking for login credentials posing as eligible sources like their banks, brokers or SEBI to obtain access to their demat accounts and thereafter causing the fraud. In Phishing and Sim swap fraud (2020)1 in order to evade detection by OTP based security the hackers used SIM swapping to acquire a duplicate SIM of the investor’s registered mobile number and then they transferred stocks and money to their account.

SEBI (Prohibition of Fraudulent and Unfair Trade Practices) Regulations, 20032 (regulation 3)3 makes such fraudulent activities illegal in the stock market. This can be constructed to include phishing because clause (d) mentions that no one should be involved in any practice that is intended to cause fraud or deceit while dealing with securities listed or intended to be listed in a recognized stock exchange that violates any law. Regulation 44 prevents manipulative, fraudulent and deceptive trade practices especially 4(1) and 4(2)(e), (k) and (o). SEBI (Depositories and Participants) Regulations, 20185, (regulation 26)6 can be interpreted that depositories must take adequate cyber security measures against unauthorised access. (Regulation 42(1))7 makes certain security measures mandatory such as two factor authentication.

And (regulation 678) makes it the responsibility of the brokers or any other Depository Participants to ensure that transactions are being made only by legitimate investors. SEBI Circulars on Cybersecurity and Cyber Resilience Framework, 20199 makes investor alerts mandatory and security monitoring for any suspicious activity. SEBI Circular on Investor Grievance Redressal Mechanism April 2023)10 makes compensation to investors mandatory by the brokers if any unauthorised trade happens due to the cyber security issues mandatory. In RBI’s Digital Payment Security Controls (Master

1 ZVELO, https://zvelo.com/phishing-trends-2020/ (last visited March 27, 2025).

2 Securities and Exchange Board of India, Securities and Exchange Board of India (Prohibition of Fraudulent and Unfair Trade Practices Relating to Securities Market) Regulations, 2003, No. 15, Issued on 17th July, 2003 (India).

3 Ibid.

4 Ibid.

5 Securities and Exchange Board of India, Securities and Exchange Board of India (Depositories and Participants) Regulations, 2018, No. SEBI/LAD-NRO/GN/2018/40, Issues on October 3, 2018 (India).

6 Ibid.

7 Ibid.

8 Ibid.

9 Securities and Exchange Board of India, SEBI Circular on Cybersecurity and Cyber Resilience Framework, No. SEBI/HO/MRD/DP/CIR/P/2019/43, Issued on March 2019 (India). 10 Securities and Exchange Board of India, SEBI Circular on Investor Grievance Redressal Mechanism, No. SEBI/HO/MIRSD/DOC/CIR/2023/55, Issued on April 2023 (India).

Direction on Digital Payment Security,11 certain sections like section 6. 2. 512, 8. 313 makes it mandatory for financial institution to implement fraud detection mechanism for unauthorised transaction and two factor authentication stronger than OTP verification. RBI Ombudsman Scheme for Digital Transactions, 201914 Clause 7(1)15 resolves any transaction complaints within 10 days. There is SEBI and RBI SCORES platform and RBI Ombudsman where victims can file complaints and seek compensation. A incident of social media fraud16 related to pump and dump scheme took place in the year 2022 where some social media influencers promoted fake stock tips and high return investment plans. SEBI (Prohibition of Fraudulent and Unfair Trade Practices) Regulations, 200317, regulation 4(2)(a)18, (e)19, (f)20, (k)21, (r)22 makes such acts punishable.

In the case of Upstox Hack (2020)23 credentials of millions of users were exposed due to a breach in the database and many unauthorised login attempts were made on the demat accounts and personal details was sold on the dark web. Though Upstox was forced by SEBI to increase the security protocols no major penalties were imposed on them by SEBI but investors faced privacy and financial losses. Another incident took place where investors especially the retail investors lost their entire stock and over 2,300 crore securities got affected, many investors did not come to know about this fraud (Karvy stock broking scam (2019- 2020))24 until the checked their demat account and found the shares missing.

20 broking firm misused Power of Attorney (PoA) documents which were signed by investors and illegally transferred their client shares to the own account and pledged those as collateral for loan. NSDL and CDSL deactivated Karvy's demat accounts. SEBI (Stock Brokers and Sub brokers) 11 Reserve Bank of India, Master Direction on Digital Payment Security Controls, Issued on April 2023 (India).

12 Ibid.

13 Ibid.

14 Reserve Bank of India, RBI Ombudsman Scheme for Digital Transactions, 2019, (India).

15 Ibid.

16 FORBES, https://www.forbes.com/sites/tylerroush/2022/12/14/eight-social-media-influencers-lied-to-theirfollowers-to-manipulate-stocks-sec-lawsuit-claims/ (last visited March 27, 2025). 17 Securities and Exchange Board of India, Securities and Exchange Board of India (Prohibition of Fraudulent and Unfair Trade Practices Relating to Securities Market) Regulations, 2003, No. 15, Issued on 17th July, 2003 (India).

18 Ibid.

19 Ibid.

20 Ibid.

21 Ibid.

22 Ibid.

23 THE HACKER NEWS, https://thehackernews.com/2021/04/indian-brokerage-firm-upstox-suffers.html (last visited March 27, 2025). 24 THE TIMES OF INDIA, https://timesofindia.indiatimes.com/city/hyderabad/karvy-scam-heres-how-itunfolded/articleshow/85471866.cms (last visited March 27, 2025).

Regulations, 199225(regulation 9(f)26 and 26(x))27 makes it mandatory for stock brokers to follow SEBI's direction and prevent illegal usage of investor securities and makes such acts punishable. According to SEBI Circular: Power of Attorney for Demat & Trading Accounts ,202028, Power of Attorney have to be specific to the trade that is being executed and it cannot be applied to any off-market transfer or pledging stocks and investors consent should be taken before hand. This circular also introduced Electronic Delivery Instructions Slip which can be used as an alternative to Power of Attorney. According to Framework for Segregation and Monitoring of Collateral at Client Level,202129 brokers have to keep the funds of client and their security separate from the own account and it cannot be pledged without the client’s consent.

Sometimes investors unknowingly pay higher prices for the stock which reduces the return, sometimes brokerage firm makes illegal profits by manipulating the movement of the stock, which was seen in Front running scam brokerage malpractice(2020)30 where a well-known brokerage firm (Reliance Securities Ltd. ) used Front running practices where they bought shares at a low price before executing a large client order (TATA Absolute Return Fund) which lead to stock price increase artificially and after executing client orders sold the shares at a profit. SEBI (Prohibition of Fraudulent and Unfair Trade Practices Relating to Security Market) Regulations, 200331 (regulation 4(2)(d))32 makes artificial inflation of price a punishable offence.

Regulation 333, 4(2)(q)34 can be interpreted to include Front running scams makes it punishable if someone with the non-public information about a big upcoming trade places their own trade first to make a profit from the expected movement of the price and regulation 4(1)35 also makes such fraudulent activities punishable. Section 11(1)36, 25 Securities and Exchange Board of India, SEBI (Stock Brokers and Sub brokers) Regulations, 1992, Issued on 23rd October, 1992 (India).

26 Ibid.

27 Ibid.

28 Securities and Exchange Board of India, SEBI Circular on Power of Attorney for Demat and Trading Accounts, No. SEBI /HO/MIRSD/DOP/CIR/P/2020/28, Issued on February 2020 (India). 29 Securities and Exchange Board of India, Framework for Segregation and Monitoring of Collateral at Client Level, No. SEBI/HO/MIRSD/DOP/P/CIR/2021/577, Issued on July 2021 (India).

BUSINESSLINE,

https://www.thehindubusinessline.com/markets/stock-markets/reliance-securities-sebiconfirms-ban-on-19-entities-in-front-running-case/article35078109.ece (last visited March 27, 2025). 31 Securities and Exchange Board of India, Securities and Exchange Board of India (Prohibition of Fraudulent and Unfair Trade Practices Relating to Securities Market) Regulations, 2003, No. 15, Issued on 17th July, 2003 (India).

32 Ibid.

33 Ibid.

34 Ibid.

35 Ibid.

36 Securities and Exchange Board of India Act, 1992, §11(1), No. 15, Acts of Parliament,1992 (India).

11(2)(e)37,12A(b)38 and (c)39 of SEBI Act, 1992 make such scams or such activities punishable. SEBI (Stock Brokers and Sub brokers) Regulations, 199240, (regulation 26(xiii))41 imposes penalty such as suspension or cancellation of registration if brokers are found engaged in such activities. Despite these Acts and SEBI’s strict guidelines, Axis Mutual Front Running Scam42 in 2022 took place. At times the National Stock Exchange can face technical glitch and can halt trading for many hours, technical glitches are in no one's hand but SEBI did not take any legal action in the year

2021 when such a thing happened and trading was nearly halted for 4 hours43. Many investors

could not modify or cancel trade and high frequency traders faced loss. Retail investors also could not sell any declining stocks or sell any stock at low prices. Large investors who practiced hedging strategies faced substantial financial loss. Under SEBI Act, 1992 Section 11(1)44, 11(2)(j)45 ,12A(b)46 and (c)47 SEBI has the power to regulate stock exchange and ensure there's smooth working it also has the power to prevent any trade disruption by prohibiting unfair practices that could be harmful and can affect transparency. Despite (SEBI Stock Exchanges and Clearing Corporations) Regulations, 201848 (regulation 3949,45(2)50 and 47)51 which makes robust risk management mechanism mandatory to prevent such system failure and makes it important for the Stock Exchanges to maintain business continuity plans. SEBI did not impose financial penalties on NSE.

There are instances when SEBI delayed in taking action which resulted in the loss of the investor who found unauthorised stock sales in their demat account (Mumbai based investor, 37 Securities and Exchange Board of India Act, 1992, §11(2)(e), No. 15, Acts of Parliament,1992 (India). 38 Securities and Exchange Board of India Act, 1992, §12A(b), No. 15, Acts of Parliament,1992 (India). 39 Securities and Exchange Board of India Act, 1992, §12A(c), No. 15, Acts of Parliament,1992 (India). 40 Securities and Exchange Board of India, SEBI (Stock Brokers and Sub brokers) Regulations, 1992, Issued on 23rd October, 2022 (India).

41 Ibid.

HINDUSTAN

TIMES,

https://www. hindustantimes. com/cities/mumbai-news/police-book-ex-axis-mfmanager-in-multi-crore-front-running-fraud-101735930930213. html (last visited March 27, 2025). 43 THE ECONOMIC TIMES, https://economictimes. indiatimes. com/markets/stocks/news/3-former-officialspay-over-rs-72-crore-to-settle-nse-2021-trading-glitch-issue/articleshow/101340945. cms? from=mdr (last visited March 27, 2025). 44 Securities and Exchange Board of India Act, 1992, §11(1), No. 15, Acts of Parliament,1992 (India). 45 Securities and Exchange Board of India Act, 1992, §11(2)(j), No. 15, Acts of Parliament,1992 (India). 46 Securities and Exchange Board of India Act, 1992, §12A(b), No. 15, Acts of Parliament,1992 (India). 47 Securities and Exchange Board of India Act, 1992, §12A(c), No. 15, Acts of Parliament,1992 (India).

48 Securities and Exchange Board of India, SEBI (Stock Exchanges and Clearing Corporations) Regulations, 2018, No. SEBI/LAD/-NRO/GN/2018/41, Issued on October 3, 2018 (India).

49 Ibid.

50 Ibid.

51 Ibid.

Investor complaint case 2022) despite of them filing complaints with SEBI in time. Due to the lack of strong legal action, they only recovered a small amount of money. Despite certain acts being in place such as SEBI Act 199252, SEBI (Stock Brokers and Sub brokers) Regulations 199253, SEBI (Investor protection and Education fund) Regulations, 200954 where brokers have to respond within 21 days or one month or as soon as possible if there is such an incident. The investor faced delay and this type of action can also happen in future.

SEBI Act 199255 does not explicitly have any authority over cryptocurrency, they can only issue warning related to unregulated investment platform but cannot enforce any rule or law on foreign entity for example in FTX in the year 202256, Indian investors invested without the SEBI oversight and FTX collapsed leading to losses of billions of investors, and many also lost their investment without any refund options. RBI Circular, Press Releases and the 2022 RBI Statement have put a ban directly on crypto because they may result in similar risks. The Foreign Exchange Management Act overseas foreign financial transaction but they do not strictly or directly deal with crypto currency exchange.

There is a need for SEBI to also oversee crypto (if they fall under security) Improvements that can be made in the Legislative and Regulatory measures to increase investor protection to ensure transparent and equitable transaction Here are certain proposed reforms that can be beneficial for strengthening investor protection. Regulations of SEBI (Depositories and Participants) Regulations, 2018 can be amended by SEBI so that if the same transaction exceed a certain threshold for example 5 lakhs, depositors and brokers have to give real time investor approval where biometric authentication other than OTP or email confirmation is done, AI fraud detection can be used to monitor if there is any unusual changes in the trading pattern and if there is any suspicious transaction or not.

This regulation already consist authentication like OTP but stronger security measures such as fingerprint or facial recognition, hardware security keys (Yubikey, Titan), time-based One-

52 Securities and Exchange Board of India Act, 1992, No. 15, Acts of Parliament,1992 (India).

53 Securities and Exchange Board of India, SEBI (Stock Brokers and Sub brokers) Regulations, 1992, Issued on 23rd October, 2022 (India). 54 Securities and Exchange Board of India, SEBI (Investor Protection and Education Fund) Regulations, 2009, No. LAD-NRO/GN/2009-10/05/163525, Issued on 19th May, 2009 (India).

55 Securities and Exchange Board of India Act, 1992, No. 15, Acts of Parliament,1992 (India).

56 Varsha Meghani, Nuts and Bolts: What is the India impact of FTX's fall, YouTube (December, 8, 2022), https://www.youtube.com/watch?v=yp4k7SQLlnE.

Time Password instead of SMS based OTP which can easily be used in SIM swap fraud. Currently, in the current regulations AI trade monitoring has not been fully implemented. Two factor authentications is in place but practice of advanced biometric system is limited. Under SEBI (Stock brokers and Sub-Brokers) Regulations, 1992 SEBI the concept of Cyber insurance can be introduced and made mandatory to get protection in case of unauthorised transaction which result because of security breaches. Currently in the context of demat Accounts single cyber insurance does not exist for investors. SEBI should work with TRAI and RBI to implement stronger measures like blocking of trading activities in case of detection of any fraud and applying 48 hours cooling period before activating a duplicate SIM.

SIM Swap Fraud Prevention can be introduced where telecom operators have to conduct additional verification other than OTP before supplying a duplicate SIM. Currently the guidelines for SIM swap are not followed and the collaboration has been done to the degree it needs to be done. AI based trade monitoring system can be implemented under SEBI (Prohibition of Fraudulent and Unfair trade practices) Regulations, 2003 Which can help monitoring coordinated trading activities that are linked with social media campaigns, can also detect front running activities analysing the trading patterns of brokers. Blockchain based trade verification can be introduced to implement that transactions are transparent and not tampered.

Regulation 4 of the same regulation can be amended to increase the monetary penalties minimum to rupees 50 crores and should also include jail for at least seven years and also should blacklist entities or individuals for repeated market manipulation. Currently to some extent AI is in use but has not been broadly implemented. Blockchain verification has not been adopted in Indian Stock Market and penalties have not been increased. Investor Grievance Redressal Mechanism (April 2023, Circular) can be improved by providing measures so that investor dispute gets dissolved within 3-5 days instead of delays and a special fraud recovery fund should be created to compensate those retail investors who suffered loss as a result of these scams. Currently dedicated fraud recovery fund is not in existence.

Under SEBI (Depositories and Participants) Regulations, 2018 Electronic Delivery Instructions Slip instead of PoA should be made mandatory, (it was already introduced in the past). Currently full adoption of Electronic Delivery Instructions Slip has not yet been done. SEBI (Stock Brokers and Sub-Brokers) Regulations, 1992 can be amended so that brokers have

to report all the pledged securities to SEBI on a daily basis, and also SEBI can maintain a public accessible verification system for those securities. Currently the practice of daily reporting and verification of publicly accessible system is not in place. SEBI (Circular on POA for Demat and trading account) 2020 can be amended to include instant SMS/email alert if there is any of security transfer and also investor should get a 24-hour window to dispute any unauthorised transaction. Currently alert system does exist but it is not instant and 24-hour window is not practiced. Under SEBI (Stock Exchanges and Clearing Corporation) Regulations, 2018 Penalty framework can be introduced to impose fine of 50 crores plus on stock exchanges if there is a failure of the system that halted trading for over 2 hours and investor should get automatic compensation who suffered due to this.

Regulation 39, 45(2) and 47 can be amended to require all stock exchanges to maintain live backup server if there is a technical failure, quarterly stress test can also be implemented to understand the high load conditions which can prevent technical crashes. Currently penalties for system failures are not applied. Stock exchanges have backup system but live backup system and stress test is not widely used. Securities Appellate Tribunal is not as fast track as needed so stricter laws can be introduced to resolve complaint within 7 days with penalty. SEBI Act 1992 can also be amended to impose liability on SEBI officers if they do not act on investor complaint within 30 days and thirdparty audits of SEBI’s enforcement action can also be conducted.

Currently dispute resolution process is still lengthy, third-party audits are not practiced and enforcing liability on SEBI officers is not common. The SEBI Act 1992 does not deal with Crypto exchanges directly, but if Crypto exchanges fall under security, SEBI should have the authority over cryptocurrency exchanges that operate in India and also the foreign platforms that serves the Indian investors. Provisions can be implemented where crypto exchanges have to register with SEBI before offering any services and also should comply with anti-fraud and KYC rules and they also have to maintain reserve funds in case of any fraud. SEBI can also establish a crypto investor protection fund in case of any exchange fraud or compensation for losses.

Foreign exchange management Act, 1999, should be amended to add provisions to regulate the cross-border crypto currency transactions directly and to prevent unregulated foreign entities from doing any fraud. Currently the Crypto currency and Regulation of Official Digital Currency Bill In 2021 was proposed by Indian

Government but it could not be passed. In 2023 The Prevention of Money Laundering Act was extended by the finance minister to include Virtual Digital Assets. In 2024 SEBI proposed a multi regulator framework to oversee cryptocurrency activities but regulatory framework is still not solidified to prevent any scams and is still evolving57. Lastly, SEBI and RBI can work together to create a single investor friendly grievance system where fraudulent entities across the banking and security market can be tracked and they can also share database of the financial frauds. Currently there is separate Grievance Mechanism system for banking and security market but sharing of data base has limitations.

Conclusion The transition from traditional trading system to digital financial markets has increased efficiency it also brought challenges such as investor complaints, regulatory loopholes, and Cyber frauds. Although there is SEBI and RBI guidelines cybersecurity and enforcement needs improvements. There is a need for stricter laws, faster dispute resolution and AI fraud monitoring which can be demonstrated in cases like Karvy scam or Upstox breach. SEBI's purview should be increased and interlinked with International best practices to improve transparency and investor protection. 57 IMPRI, https://www. impriindia. com/insights/crypto-india-regulatory-framework/ (last visited March 27, 2025).