Redefining Market Security - Sebi’s Proposed Tech Initiatives To Secure Trading And Demat Accounts
Author: LawSphereX
Category: Corporate & Insolvency
Published:
Updated:
REDEFINING MARKET SECURITY: SEBI’S PROPOSED
TECH INITIATIVES TO SECURE TRADING AND DEMAT ACCOUNTS Sayali Kshirsagar, Vivekanand Education Society’s College of Law, Mumbai.
ABSTRACT
The Indian securities market (‘Market’), with its rapid digitalisation and escalating number of trading platforms, has become a dynamic place for both domestic and foreign investors. However, the widespread adoption of mobile based trading applications with technology increasingly becoming the medium for executing trades and managing trading and demats accounts, concerns about cyber threats, unauthorised transactions, identity theft have become pressing concerns and illegal activities have surged. There has been increased exploitation of loopholes affecting significant financial losses for the investors. In order to overcome these difficulties the market regulator, Securities and Exchange Board of India (‘SEBI’) has recently published a consultation paper.
In an era where digital security is paramount, this article analyses the proposed measures stated in the consultation paper and offers insights into how they might enhance investor safety and strengthen the overall trading environment. Keywords: SEBI, Online Trading, Securities Market, Investor Protection
INTRODUCTION
On February 18, 2025, SEBI published a consultation paper1 outlining a series of technology based measures to secure the trading environment and to prevent unauthorised transactions in investor’s trading and demat accounts. Recognising the urgent need to protect digital investments, SEBI’s proposed measures range from SIM card binding and biometric authentication to temporary account lock-in options. By implementing these measures, SEBI aims to ensure that only authorised individuals can access their trading or demat accounts, by mitigating risks associated with it. This consultation paper seeks comments from public and market expert on the proposed measures to share their perspective on the matter.
BACKGROUND
AND NEED FOR MODERN SECURITY MEASURES The rapid digital transformations in the market have developed investor’s way of operating the trading and demat accounts. Over the past few years there has been significant rise in online trading platforms and mobile based trading applications such as Upstox, Groww, Zerodha etc which has made investing more accessible to all kinds of investors in the market. Due to this advancement, market today consist of experienced professional traders, as well as of new retail traders.
However as it is said there is no rose without a thorn, similarly the advancement has also introduced difficulties such as unauthorised transactions, SIM spoofing (to divert OTPs), unauthorised account updates, fraudulent share transfers and due to lack of adequate technology based controls, the web based or mobile based trading platforms are prone to hacking, identity theft and frauds etc. These difficulties have highlighted the need for new robust and technologically advanced framework. Today majority of investors rely on digital transactions for trading and account management and any kind of lapse in security might destroy investors trust in the market because of which the need to enhance protection of digital assets of investors has become significantly important.
Considering all these factors SEBI has recognised that modernising the regulatory framework with time is not just desirable but essential for maintaining market integrity and protecting investor interests. The proposed measures in the consultation paper aim to bridge the gap between the digital advancement and trading practices. 1 Securities and Exchange Board of India, Consultation Paper on technology based measures to secure trading environment and to prevent unauthorized transactions in trading/demat account of investors (February 18, 2025).
EXISTING REGULATORY FRAMEWORK
Till date the market regulator, SEBI has published multiple circulars to enhance security in trading and protect investors from fraud such as initial introduction to Internet based trading (‘IBT’)2 wherein it was made mandatory for brokers to implement systems that ensure security, reliability, and confidentiality of data through use of encryption technologies. They also required providing alternative means of communication for order placement in case of internet connectivity issues, ensuring uninterrupted trading capabilities for clients. Additional mandatory measures include user identifications, authentication and access control.
Thereafter SEBI refined the framework by including and reviewing Securities Trading using Wireless Technology (‘STWT’) and IBT3 which mandated brokers to capture the internet protocol (‘IP’) address from which the order is executed and to incorporate two-factor authentication (‘2FA’) for all kinds of trading whether initiated through IBT or STWT. In addition to these technical mandates the stock exchanges also require to improve their complaint handling mechanism with a special emphasis on IBT-related concerns of unauthorised access. SEBI has also mandated investors to complete their Know Your Customer (‘KYC’) verification4 before opening trading or demat accounts with help of technological innovations like eSign, Digilocker, and electronic signatures.
These applications enable investors to complete KYC procedures online, therefore investors no longer need to physically visit intermediary’s office in order to complete KYC requirements. This procedure entails providing legitimate documentation, such as proof of address and identity card issued by the government. In order to strengthen the cyber security framework of stockbrokers and depository participants, SEBI has issued guidelines5 which ensures that only authorised individuals have access to crucial client data by encrypting sensitive data while it is in transit and at rest to prevent unauthorised access and breaches; further by implementing intrusion detection systems, firewalls, and regular vulnerability assessments to protect against cyber threats; and, lastly by establishing protocols for the timely detection, reporting, and management of cyber security incidents.
2 Securities and Exchange Board of India, Policy Circular on Internet Based Trading (January 31, 2000). 3 Securities and Exchange Board of India, Policy Circular on review of Internet Based Trading and Securities trading using Wireless Technology (June 30, 2011). 4 Securities and Exchange Board of India, Press Release on SEBI eases the Know Your Client (KYC) Process by enabling online KYC, use of Technology/ App by the registered intermediary (April 29, 2020).
5 Securities and Exchange Board of India, Master Circular for Stock Brokers (May 17, 2023).
Despite these existing measures, there is increase in cyber fraud highlighting the need for additional protective measures. PROPOSED MEASURES IN THE CONSULTATION PAPER FOR ENHANCED TRADING SECURITY Unique Client Codes Unique Client Codes (‘UCC’) acts as personalised identifiers for each investor. It can be termed as digital fingerprint as the UCC shall distinguish one trader from another so that every activity is segregated and shall linked to the specific individual performing the activity. This segregation is very useful to market regulators and broker while keeping a track, audit and to pinpoint any kind of suspicious transaction with the help of unique identifier which provides an immediate reference enabling investigation.
Adoption and mandating UCC is tagged with every transaction in the digital trading system provides transparency by ensuring that every investor’s history is clearly documented and accessible for review this enforces accountability among the investors as it ties every trading action back to the verified identity of the investor. SIM Card Binding Mechanism The SIM card binding mechanism links an investor’s trading account directly to their registered mobile number and device. This mechanism works on the principle of One UCC-One Device- One SIM. It recognises two devices viz. Primary SIM bound device and Secondary SIM bound device. The primary SIM bound device is inspired by Unified Payments Interface (‘UPI’) payment application ensuring that only the account owner can initiate and execute the trade.
The UPI payment application recognises mobile number via SIM card along with mobile device and bank account details for carrying out UPI transactions, similarly here investor can log-in into the trading account only if the trading application recognises the UCC along with mobile number via SIM card and mobile device. While secondary SIM bound device acts as an option to register one more SIM card and mobile device with the UCC. Trading can be done only through one device at a time provided the device is within 100-meter distance. Additionally, investor can log-in into web based one device at a time apart from the SIM bound device. This can be executed by scanning QR code for which an access control shall be implemented in the trading applications to prevent scanning of QR code through phone gallery or messaging apps.
One of the key benefits of this mechanism is the enhanced control which it gives to both; the regulator and investor. For regulator it gives high level of traceability as each trade is linked to a verified mobile number and device, and for investor it ensures their account is protected as logging in is difficult without the SIM card and registered mobile device which are under the investor’s control. Biometric Authentications Biometric Authentication is a security framework consisting of characters such as fingerprints, facial recognition or iris pattern to verify the investor’s identity. When the investor attempts to log-in to their trading account, the system cross refers their biometric input ensuring that only the legitimate account holder can gain access.
The paper highlights this as essential measures and mandates it as a primary authentication mechanism followed by SIM card binding mechanism and UCC. In cases where the biometric option fails due to technical issues or some other reasonable reasons there is alternative secure methods for authentication which ensures in one hand the investors are not locked out of their account, while maintaining security on the other hand. Temporary Lock-In Options Temporary Lock-in options as the name suggests, this mechanism allows the investor to temporarily disable the trading functions preventing any unauthorised transaction while an investigation is going on. It acts as an emergency mechanism which provides investor to secure their trading account in case any suspicious activity is noticed such as unusual log-in attempts or unexpected trading behaviour.
This immediate preventive action is designed to stop all trading activities, ensuring that no further transaction is carried on until the account’s safety is confirmed. Additionally this mechanism also serves as signal for the regulatory bodies and brokers to initiate an investigation when suspicious activity is recorded. This mechanism enhances trust and transparency by providing direct control to the investors over their account access. POTENTIAL CHALLENGES & SUGGESTIONS While the proposed framework introduces various development in the security measures, its implementation may face various technical and operational hurdles such integrating SIM card binding in the existing trading platforms shall require significant system overhaul and brokers may experience transitional disturbance in their as they have to upgrade their infrastructure in order to align with the new standards.
Additionally, investors who are not very tech-savvy may find it difficult to understand features like the temporary lock-in option or to manage several registered devices as part of the new authentication methods. Furthermore, with the increasing reliance on personal data, including biometric data and UCC, which ensure that all information is handled and stored securely, strict data protection rules are also required. Any failure to do so could result in privacy violations and diminish the trust of investors. To take full advantage of the benefits of this proposed framework, addressing these issues will require extensive user education programs and a robust cyber security framework.
CONCLUSION
SEBI's proposed security framework is an important step in safeguarding investors, maintaining the integrity of the market, and securing the rapidly changing digital trading system. The framework resolves significant vulnerabilities and provides strong protection against fraudulent transactions and unauthorized access by using modern technologies like SIM card-binding, biometric authentication, and UCC. Although there will be operational, technological, and user adaption difficulties to overcome during implementation, these will surely be overcome in the long run by the advantages of a more transparent and safe trading environment.
These measures represents forward thinking step securing the digital trading environment by integrating advanced authentication methods and real-time control measures and will gain more trust of investors, create a safer market, and create the way for a robust digital trading environment. Ultimately, this robust framework underscores a collaborative effort between regulators, brokers, and investors to create a secure and resilient trading ecosystem that can confidently meet the demands of an increasingly digital landscape.