SEBI call recording rules for brokers, and what CSCRF means for calling vendors

What SEBI's call recording rule requires

If a client can place an order with you by phone, you must record that call. The rule comes from SEBI's work on preventing unauthorised trading, where a broker trades in a client's account without the client's instruction. Its starting point is simple: a broker may execute a client's trade only after keeping evidence that the client placed the order (para 35.2 of the Master Circular for Stock Brokers).

For phone orders, that evidence must be a recording. Where the order comes by phone, the broker "shall mandatorily use telephone recording system to record the instructions and maintain telephone recordings as part of its records" (Master Circular for Stock Brokers, para 35.4). Orders that arrive another way can be evidenced in other forms. SEBI lists six examples, "inter alia" (para 35.2): a physical record written and signed by the client, a telephone recording, an email from the client's authorised email ID, a log for internet transactions, a record of SMS messages, or any other legally verifiable record.

Where the rule comes from, and the 2017 circular today

The "SEBI call recording circular" that many pages cite is the circular of 26 September 2017 on preventing unauthorised trading by stock brokers (CIR/HO/MIRSD/MIRSD2/CIR/P/2017/108). It was due to start on 1 January 2018, but SEBI moved the start to 1 April 2018 after brokers asked for more time (circular of 11 January 2018).

In between, SEBI's clarification of 30 November 2017 (CIR/HO/MIRSD/MIRSD2/CIR/P/2017/124) set the three-year retention period. A circular of 22 March 2018 (SEBI/HO/MIRSD/DOP1/CIR/P/2018/54) then consolidated the rules and rescinded the earlier circulars. That text, retention period included, now forms para 35 of the Master Circular for Stock Brokers (SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/90), dated 17 June 2025.

The 2017 circular is no longer the text to cite. In March 2026 SEBI confirmed, in an informal guidance letter, that it is superseded by the master circular, so policies and vendor contracts should cite the master circular. One detail to watch: the letter dates the master circular 17 July 2025, but SEBI's own page and the circular itself say 17 June 2025.

The SEBI (Stock Brokers) Regulations, 2026, published on 7 January 2026, replaced the 1992 regulations. They do not cancel the master circular. Any reference to the 1992 regulations in a SEBI circular is now read as a reference to the 2026 regulations (regulation 51(3)), and SEBI's March 2026 letter still cites para 35 as the rule.

When an AI voice agent takes the order

SEBI has not said anything about AI agents taking orders. The rule applies "wherever the order instructions are received from clients through the telephone", whoever or whatever answers. So if an AI agent accepts a buy or sell instruction, the safe reading is that the call must be recorded and kept like any other phone order.

The recording must also hold up as evidence. In its March 2026 informal guidance on WhatsApp orders, SEBI said records must be "retrievable and legally verifiable" for any investigation or legal proceedings. In a dispute, the broker must prove this under the law on electronic evidence. That is where an AI setup can fall short. A transcript alone, or a recording that cannot be tied to the client's registered number and the time of the order, may not be enough.

Three habits make the record easier to defend, although none is itself a SEBI rule. The first is recording the whole call rather than the moment of confirmation, because a client often gives the instruction early and the agent confirms it later, and partial clips are harder to defend in arbitration. The second is having the agent read back the scrip, quantity, price and buy or sell, and wait for a clear yes before placing the order. The third is linking each recording to the client code, registered number, order ID and confirmation time, and testing that any one of them can be found quickly.

Platforms that run AI voice agents, Sonex among them, keep both a call recording and a transcript. For SEBI's purposes the audio is the record, and the transcript is a search aid. SEBI's provisions covered here require the recording itself, and we did not find a requirement in them to announce it, but telling the client costs one sentence, such as "This call is recorded for your order records". Exchange rules and the client agreement may say more.

How CSCRF came in, and which category your firm is in

The recording rule tells you what to keep. CSCRF decides what you must demand from the vendor that records, stores or transcribes those calls. It is SEBI's Cybersecurity and Cyber Resilience Framework for SEBI Regulated Entities, issued on 20 August 2024 (circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113), and it replaces SEBI's earlier cybersecurity circulars, including the 2018 framework for stock brokers and depository participants.

Oddly, the June 2025 Master Circular for Stock Brokers still reproduces that 2018 framework (para 62) without saying how it fits with CSCRF. We treat CSCRF as the text that applies, since it says it supersedes the 2018 circulars, but that is our reading. CSCRF applies to brokers, depository participants, mutual funds, portfolio managers and other regulated entities. Investment advisers and research analysts registered only in that capacity were exempted in April 2025 (circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/60, paras 2.3 and 2.4).

What CSCRF expects from calling and AI voice vendors

Once CSCRF applies, the vendor question follows quickly, because outsourcing a task does not outsource the responsibility for it. CSCRF says "the responsibility, accountability and ownership of outsourced activities lies primarily with REs", meaning regulated entities. The broker must monitor vendors against the framework and certify this in its periodic reports to SEBI (standard GV.SC.S4, guideline 3).

Incidents show what that means in practice. Incidents covered by the cybersecurity directions of CERT-In, India's national computer emergency response team, must be reported to SEBI and CERT-In within six hours of noticing them. Brokers must also tell the stock exchanges within the same six hours (RS.CO guideline 1). Full details go on SEBI's incident reporting portal within 24 hours, and other cybersecurity incidents must be reported within 24 hours.

A breach at your calling vendor is your incident, and the six hours start when you notice it, so the contract should require the vendor to tell you well inside that window, for example within two hours. The vendor questionnaire has questions to put to a provider, and the guide to RBI's outsourcing rules for AI voice vendors covers the banking equivalent. More generally, a vendor that hosts call recordings or speaks to clients should expect to be held to the same controls as the broker:

• Background checks, a non-disclosure agreement and cybersecurity compliance for every third-party service provider (GV.SC.S4, guideline 4).
• A confidentiality and integrity agreement with third-party service providers, and due diligence on every provider that accesses the broker's IT systems (GV.RR.S5 and GV.RR.S6, guideline 2).
• A software bill of materials (SBOM), meaning a list of the components inside the software, for any new critical software or SaaS application at procurement (GV.SC.S5).
• Audits and inspections of vendors' IT resources, and SEBI's right to search and seize data that third-party service providers hold for the broker (GV.OC.S2).
• A check on concentration risk where many brokers rely on one vendor, for all but small-size and self-certification brokers (GV.SC.S7).
• At qualified brokers: source code or a source code escrow for critical applications, and SLA deadlines for fixing vulnerabilities (PR.DS.S6).

Keeping recordings and AI processing in India

The question vendors are asked most is where the data sits. Call recordings stored or processed in the cloud have to stay in India: SEBI's cloud framework of 6 March 2023 says data, including logs, "should reside/be processed within the legal boundaries of India" (circular SEBI/HO/ITD/ITD_VAPT/P/CIR/2023/033).

The same framework allows cloud services only from providers empanelled by MeitY, the Ministry of Electronics and Information Technology. A SaaS (software as a service) provider must run on that empanelled infrastructure. It must also host and process the broker's data only in MeitY-empanelled data centres that hold a valid STQC audit, STQC being the government's testing and certification body.

CSCRF's own data localisation standard (PR.DS.S2) is on hold. SEBI put it in abeyance on 31 December 2024 pending further consultation, and its August 2025 clarification still calls it "currently in abeyance" (circulars 2024/184 and 2025/119). As written, it kept Regulatory Data in India and exempted only IT and cybersecurity data sent to a global security operations centre or a SaaS security tool.

CSCRF still asks brokers to classify data. Its "Regulatory Data" includes communication between investors and the entity through applications, and any data SEBI or government rules require to be kept. Phone-order recordings fit the second group, so expect them to be treated as Regulatory Data if the localisation standard returns; that is our reading, not SEBI's statement.

Which numbers brokers and mutual funds must call from

The last set of rules governs the outgoing call itself rather than the record it leaves. The Telecom Regulatory Authority of India (TRAI) set deadlines on 19 November 2025 to move service and transaction calls to the 1600 number series (TRAI press release 135/2025). Mutual funds and asset management companies (AMCs) had to finish by 15 February 2026, and qualified stock brokers by 15 March 2026. TRAI's direction let other SEBI-registered intermediaries move voluntarily "for the time being", so check whether TRAI has since set a date for your type of firm.

Promotional calls from any sector use the 140 series, and the guide to the 140, 1600 and 1601 number series explains which calls belong where. TRAI's Third Amendment of 18 September 2026 defines an A2P (application-to-person) call as one started by software without a person dialling, including calls using pre-recorded or artificial voice. An AI voice agent that places calls is therefore likely to be an A2P caller, which the sender must declare to its operator in advance.

That declaration rule starts on 27 November 2026, 60 days after the amendment was published in the Gazette on 28 September 2026 (Gazette of India, Extraordinary, Part III, Section 4, CG-DL-E-28092026-276548). TRAI's 2026 rules for AI and automated calls cover the declaration in detail.

Key dates