SEBI's Static IP Mandate Is Live: Fix Your Cloud Trading Bot Now

Important Update: Other QG Customers w/ Shared IPs Could Reject Yours (April 3, 2026)

Since the SEBI deadline hit on April 1, we've seen a surge of Indian algo traders signing up for QuotaGuard. That's great, but it's created an unexpected side effect. Because brokers require each IP to be uniquely tied to one trader, a shared static IP can be rejected if another QuotaGuard customer has already registered it with the same broker. The more customers we onboard, the more likely this becomes.

Our recommendation: For the most reliable setup, use our Shield Enterprise plan, which gives you a dedicated proxy with IPs that are exclusively yours. Lower-tier plans (Starter, Production, Business) can still work, and many customers are connecting successfully, but if your assigned IP has already been claimed by another QuotaGuard customer at your broker, you'll need a fresh one.

How the Enterprise setup works:

1. Sign up for the Shield Enterprise plan.
2. Reach out to our team.
3. We'll build your dedicated proxy infrastructure.
4. We'll work with you to rotate through IPs until we find ones that haven't been previously registered with your broker. QuotaGuard has been operating for 13 years with over 100,000 customers, so some IPs in our pool may have been registered by past users. We keep rotating until we find clean ones.
5. Once we find two working IPs, they're yours exclusively. No one else will ever be assigned them.

Have questions or want help choosing the right plan? Contact us and we'll get you sorted.

Route your broker API calls through QuotaGuard Shield, register the static IP with your broker, and your cloud trading bot passes SEBI's mandate. SSL passthrough means your financial data is never decrypted by the proxy.

The enforcement deadline was April 1, 2026. If your bot stopped placing orders on April 1 or 2, this is why. It's not a broker outage. It's not an API key problem. Every major Indian broker is now rejecting API calls from unregistered IPs, per SEBI's circular.

We ran connectivity tests against all nine major Indian broker APIs through QuotaGuard Shield on April 2, 2026. Every single one returned a server response through the proxy. No broker blocks AWS datacenter IPs at the network layer. The path is open.

Meet the Requirement: One Traceable Static IP Per Trader

In February 2025, SEBI issued Circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/0000013 on safer participation of retail investors in algorithmic trading. The core rule: any retail trader using an API to place orders must register a static IP with their broker. The broker's system only accepts order calls from that pre-registered IP. SEBI's exact language:

"not permit open APIs and allow access only through a unique vendor client specific API key and static IP whitelisted by the broker to ensure identification and traceability of the algo provider and the end user"

SEBI Circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/0000013, February 4, 2025

The deadline chain:

• February 4, 2025: SEBI issues the original circular.
• September 30, 2025: SEBI extends the implementation deadline via Circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/132.
• NSE implementation: NSE/INVG/67858 operationalizes the requirement at the exchange level.
• April 1, 2026: Enforcement begins. Brokers reject API calls from non-whitelisted IPs.

The regulation's intent is traceability. A static IP creates an auditable link between a trader's identity and their automated activity on the exchange. Shared rotating proxy pools don't qualify. The IP must be traceable to you specifically.

Why Cloud Platforms Break This Requirement

Heroku, Railway, Render, Fly.io, AWS Lambda, and Google Cloud Functions assign outbound IP addresses dynamically from large shared pools. Your app's outbound IP can change between requests. It can change between deployments. It can change mid-session as the platform scales your containers.

This isn't a flaw. It's how PaaS platforms run thousands of apps efficiently on shared infrastructure. But you can't whitelist a moving target. The moment your outbound IP changes, the broker's gateway rejects the call.

If you chose a cloud platform to avoid managing servers, that was a sound engineering decision. The regulatory change created the conflict, not your architecture. You don't need to abandon your platform. You need a static egress IP in front of it.

All Nine Major Brokers Accept QuotaGuard Connections

The SEBI mandate covers all retail brokers offering API access for order placement. Here's who's enforcing it:

• Zerodha (Kite Connect): India's largest retail broker. Zerodha published a detailed breakdown on Zerodha Z-Connect.
• Upstox: Second largest by developer volume. Their official announcement is at community.upstox.com.
• Kotak Neo: Published clear setup documentation at kotakneo.com. Note: Kotak Neo's trading API endpoint is firewalled to only accept connections from pre-registered IPs. You can't reach it at all before completing the whitelist step. That's expected and by design.
• Dhan (dhanhq): Growing broker with an active developer community and a well-maintained Python library.
• Angel One (SmartAPI): Popular in the Python trading community for systematic strategies.
• ICICI Direct (Breeze API): Enforcing.
• AliceBlue: Enforcing.
• Flattrade: Enforcing.
• Shoonya / Finvasia: Enforcing.
• Any broker on the Noren OMS platform: Noren is the backend OMS used by multiple Indian brokers. If your broker runs on Noren, the mandate applies.

If your broker isn't listed, check their developer documentation. The mandate is broad. Enforcement is active.

QuotaGuard tip: On April 2, 2026, we tested QuotaGuard Shield's AWS-based static IPs against all nine broker APIs listed above. Every broker returned a server response through the proxy. No broker blocks AWS datacenter IPs at the network layer. Here are the results:

Any non-zero HTTP response code means the request reached the server. A 401 or 404 from a financial API is an auth or routing error, not a network block. These results confirm the network path is open for all nine brokers.

Why QuotaGuard Shield (Not Static) for Broker API Traffic

QuotaGuard sells two products. Both give you a static IP. The difference is how they handle encryption.

QuotaGuard Static is the standard HTTP/HTTPS proxy. It terminates and re-establishes the SSL connection. That means QuotaGuard's infrastructure can see the traffic passing through. For most use cases, that's completely fine.

QuotaGuard Shield uses SSL passthrough. The TLS connection runs end-to-end between your app and your broker's API. QuotaGuard routes the encrypted packets but never decrypts them. Your broker credentials, auth tokens, and order data are never exposed to the proxy.

You're sending financial data to a regulated broker API. Shield is the right product here. Your broker sees the connection from your static IP. The content of that connection stays between you and the broker. No third party ever decrypts it.

QuotaGuard runs on AWS infrastructure. Sign up at quotaguard.com/products/pricing. For Indian broker compliance, we recommend the Enterprise plan ($219/month) for guaranteed IP exclusivity. See the broker-specific guides below for step-by-step setup on your platform.

The VPS Alternative Costs More Time Than Money

The forums recommend spinning up an AWS EC2 instance or a DigitalOcean Droplet with a reserved IP. The numbers: about $10/month for the server and the IP combined.

The real cost is time and maintenance. You own the server. You handle OS updates, security patches, SSH key rotation, and uptime monitoring. You need a deployment workflow to push code changes. If you're already on a cloud platform, you're giving up the deployment tooling you've built.

If you want to minimize monthly spend and you're comfortable with DevOps, the VPS route works. If you want to be back online today without learning server administration, the proxy route is faster. QuotaGuard Shield's Production plan is $49/month. That's the math.

Proxy Latency Won't Affect Your Strategy

QuotaGuard Shield adds roughly 10 to 50ms per request for the proxy hop. This comes up in every discussion about proxy-based trading solutions.

For HFT where execution timing is measured in microseconds, any proxy is disqualifying. But HFT firms use NSE co-location facilities and dedicated fiber. They don't run on cloud platforms. The traders hitting the static IP wall are running systematic intraday strategies, options plays, or daily-rebalancing bots on minute-level timeframes. For those strategies, 10 to 50ms is irrelevant.

The SEBI mandate is about authentication and identity verification, not execution speed. The static IP check happens at session establishment. Once you're authenticated through your registered IP, the mandate is satisfied.

From our support data: Many customers route all broker API calls through QuotaGuard Shield for simplicity. Others route only authentication and account management calls through the proxy and connect directly for order execution. Both approaches work. With Shield's SSL passthrough, routing everything through the proxy adds no security exposure. The goal is to establish your identity through a traceable, registered IP.

Get Your Bot Running Again

Sign up for QuotaGuard Shield. Get your static IP. Register it with your broker. You're compliant. Every day your bot sits idle is a day of missed execution.

Start here:

• QuotaGuard Shield. SSL passthrough. Your broker data stays encrypted end-to-end.
• Plans and pricing. Starter ($19/month) through Enterprise ($219/month).

Broker-specific setup guides (with code samples and step-by-step instructions for your platform):

• Zerodha Kite Connect: Static IP Setup for Cloud Deployments
• Upstox API: Fix the Static IP Restriction Error
• Kotak Neo Trade API: Static IP Compliance and Setup
• Dhan API: Static IP Setup for Cloud Platforms