Description

BSE mandates system audit requirements for stockbrokers and trading members covering API-based terminals, order tracking, CTCL/IBT/DMA/SOR/ALGO systems and compliance verification for the half year ending September 30, 2025.

Summary

BSE has issued detailed Terms of Reference (TOR) for mandatory system audits of stockbrokers and trading members for the half year ended September 30, 2025. The audit covers comprehensive verification of system controls, capabilities, and compliance related to API-based trading terminals including CTCL, IBT, SOR, STWT, ALGO, and DMA systems. Auditors must verify order tracking, client verification, system parameters, and order execution logic to ensure compliance with Exchange norms.

Key Points

  • System auditors must verify order tracking processes at all API-based terminals (CTCL/SOR/IBT/STWT/ALGO/DMA)
  • Systems must capture order ID, time stamping, order type, scrip details, action, quantity, price and validity
  • Order rejection capability must be verified at both broker and Exchange server levels
  • Trade confirmation and order status communication to clients via email and trade log viewing must be audited
  • Client ID verification and mapping of user IDs to predefined locations for proprietary orders is mandatory
  • System must distinguish order types with unique flags/tags and populate 15-digit CTCL field for Exchange orders
  • CTCL/IBT/STWT/ALGO/DMA/SOR system parameters must comply with Exchange norms including approved software versions
  • IP address capture of order entry terminals must be verified
  • System-based controls over order input, modification, cancellation and outstanding order checks required

Regulatory Changes

No new regulatory changes introduced. This circular reiterates existing system audit requirements with detailed TOR specifications for the current audit period.

Compliance Requirements

For Stockbrokers/Trading Members:

  • Submit half-yearly system audit report covering September 30, 2025
  • Ensure all API-based trading systems comply with Exchange-specified parameters
  • Maintain proper controls for client ID verification and proprietary order segregation
  • Configure systems to restrict/allow proprietary account orders from CTCL terminals with proper approval process
  • Use Exchange-approved CTCL/IBT/DMA/SOR software versions and maintain version documentation
  • Document server locations for all CTCL/IBT/DMA/SOR/STWT/ALGO systems
  • Implement system features for price broadcast, order processing, trade confirmation and trade history

For System Auditors:

  • Verify compliance with all TOR clauses covering system controls and capabilities
  • Check gateway parameters including Trader ID, Market Segment (CM), CTCL ID, and IP Address
  • Validate order logic execution and system-based control facilities
  • Confirm order placement controls match system parameters
  • Verify order modification, cancellation and outstanding order check capabilities

Important Dates

  • Audit Period: Half year ended September 30, 2025
  • Submission Deadline: Not specified in the provided content (refer to main circular)

Impact Assessment

High Impact on:

  • All stockbrokers and trading members with API-based trading infrastructure
  • Firms using CTCL, IBT, DMA, SOR, STWT, and ALGO trading systems
  • System auditors conducting compliance reviews

Operational Impact:

  • Requires comprehensive technical documentation and system parameter verification
  • May necessitate system configuration reviews to ensure Exchange compliance
  • Firms must maintain detailed records of software versions, server locations, and order routing logic

Compliance Risk:

  • Non-compliance with system audit requirements may result in regulatory action
  • Inadequate controls over order tracking and client verification could lead to operational penalties
  • Failure to implement proper segregation between client and proprietary orders poses regulatory risk

Impact Justification

Mandatory system audit requirement affecting all stockbrokers and trading members with comprehensive technical and operational compliance checks for API-based trading systems