Stock / Commodity Broker Audit (NSE, BSE, MCX)

It is a family of related but distinct audit and certification obligations that a SEBI-registered stock or commodity broker faces because of its exchange membership — principally the half-yearly Internal Audit mandated by SEBI for all trading/clearing members and Depository Participants, alongside periodic System Audit (for members meeting specified technology/algo-trading criteria), Net Worth Certification, and the entity's own Companies Act statutory audit if it is incorporated as a company. PNPC typically scopes these together for a client so the overall compliance picture is coherent, even though each has its own periodicity and reporting format to the relevant exchange or regulator.

The Internal Audit of stock brokers and Depository Participants is a half-yearly obligation under SEBI's applicable circulars, meaning it is conducted twice a year, with the report and follow-up compliance status typically required to be placed before the broker's Board or governing body and reported to the relevant exchange within the timeline that exchange's circular prescribes for that half-year cycle. Exact submission windows are set by exchange circulars, which PNPC confirms as current before each cycle rather than assuming a fixed calendar date applies indefinitely.

SEBI and exchange circulars require the internal auditor to be an independent practising professional — a Chartered Accountant, Company Secretary, or Cost Accountant holding a valid Certificate of Practice — who is not part of the broker's day-to-day dealing or back-office operations. Since the half-year ended March 2024, exchanges have also tightened this further: the audit firm must be formally empanelled with an exchange, hold a minimum prescribed audit track record, and have a partner or employee holding the relevant securities-market certification, and exchanges accept internal audit reports only from firms on this empanelled list. Not every practising CA/CS/Cost Accountant automatically qualifies any more. PNPC confirms and documents this empanelment and independence position at the engagement letter stage for every broker audit we accept.

The scope spans client onboarding and KYC/UCC compliance, order and trade management controls (including checks for unauthorised trading), margin collection and reporting accuracy against exchange records, client fund and securities segregation, contract note and brokerage compliance, Risk Management System (RMS) functioning, and investor grievance redressal turnaround including reconciliation with SCORES complaints. The precise checklist and its emphasis areas are periodically updated by SEBI and the exchanges, and PNPC scopes each cycle against the currently applicable framework for the member's specific segment mix.

Segregation refers to SEBI's requirement that a broker keep client funds and client securities in designated accounts that are legally and operationally distinct from the broker's own (proprietary) funds and securities, so that client money cannot be commingled with, or used to meet, the broker's own obligations or another client's shortfall. This is the single most important investor-protection mechanism in the broking framework, because a broker in financial difficulty that has kept segregation intact leaves client assets largely unaffected, whereas commingling can expose client money directly to the broker's own solvency risk. The internal audit specifically tests bank and demat account segregation, running account settlement discipline, and the absence of any client-to-client or client-to-proprietary fund movement.

The UCC is the unique identifier every client must have, allotted before any order is placed on their behalf, so that every trade on the exchange can be traced to the specific client for whom it was executed. Placing an order under the wrong UCC, using a UCC that has not been properly KYC-verified, or allowing trades to be modified between client codes after execution without proper authorisation are all treated as serious compliance failures, because they undermine the exchange's ability to attribute trades correctly and can be a vector for unauthorised proprietary trading dressed up as client activity. The internal audit specifically tests UCC allotment records and order-level UCC usage.

A System Audit is a technology-focused examination of a broker's trading systems, cybersecurity controls, data centre and disaster recovery arrangements, and — where applicable — algorithmic trading controls (strategy approval process, risk controls, kill-switch mechanisms). It is mandated by SEBI for brokers meeting specified criteria, which can include factors such as offering algo trading facilities, holding colocation/proximity hosting access, or crossing prescribed turnover thresholds — it is not universally required for every broker regardless of scale and technology footprint. PNPC confirms applicability for each client against the current SEBI framework rather than assuming either that it is or is not required.

A Net Worth Certificate is a Chartered Accountant's certification of the broker's computed net worth as at a specific date, submitted to the exchange to demonstrate continued compliance with the minimum net worth prescribed for the member's specific category — which differs by segment (cash, F&O, currency derivatives, commodity derivatives) and by whether the member is a trading member, self-clearing member, or professional clearing member. Exchanges prescribe the periodicity at which an updated certificate must be filed, and additional certification is typically required when a member applies for a new segment or membership category.

Broadly yes, in framework — since commodity derivatives exchanges came under SEBI's direct regulation, MCX members are subject to materially the same internal audit, net worth, risk management, and client-fund segregation discipline that applies to NSE and BSE members, with MCX's own circulars governing the exact reporting formats, timelines, and any commodity-specific nuances (such as delivery-related processes for physically settled commodity contracts). A member active across NSE, BSE, and MCX typically needs a coordinated audit approach that respects each exchange's specific submission requirements rather than a single generic report.

Late or non-submission of the mandated internal audit report is treated by exchanges as a compliance default, and depending on the exchange's specific enforcement framework and the extent of the delay, can attract a monetary penalty, a formal notice, or be factored into the exchange's broader risk assessment of the member during subsequent inspections. Repeated defaults across cycles compound the member's compliance risk profile with the exchange. PNPC builds in enough runway before each submission window specifically to avoid this outcome.

This needs to be approached carefully, in the same spirit as the independence expectations under the Companies Act framework for statutory auditors. SEBI and exchange circulars expect the internal auditor to be independent of the broker's day-to-day operations, so PNPC structures engagements — where we also provide accounting or other advisory services to a broking client — to preserve that independence, including by using a separate, appropriately independent engagement team, or recommending a different independent firm for the internal audit where that better protects the credibility of the audit for the client's own regulatory standing.

Yes. The SEBI/exchange internal audit obligation attaches to the trading/clearing membership itself, not to the legal form of the entity holding it — partnership firms, LLPs, and companies that hold SEBI registration and exchange membership are all subject to the same half-yearly internal audit requirement. The entity's legal form does, however, affect which other audits apply — for instance, a company additionally requires a Companies Act statutory audit, while a partnership firm does not, though it may still require a tax audit under Section 44AB depending on turnover.

An Authorised Person is an individual or entity engaged by a registered trading member to provide broking-related services to clients on the member's behalf — effectively an extension of the broker's distribution — operating under an agreement with, and under the regulatory umbrella of, the principal trading member's registration. While APs are not separately SEBI-registered as brokers in their own right, the internal audit of the principal trading member typically extends to reviewing AP-level client onboarding practices, order routing arrangements, and brokerage-sharing compliance, because the principal member remains responsible for the AP's conduct under exchange rules.

Running account settlement refers to the periodic settlement of the credit balance in a client's trading account back to the client, at a frequency the client has elected (commonly monthly or quarterly, subject to the prescribed maximum interval), rather than the broker holding client funds indefinitely. SEBI's framework is designed to prevent brokers from retaining client credit balances beyond what is operationally necessary, since prolonged retention increases the client's exposure to the broker's own financial health. The internal audit tests whether settlements are actually occurring at the elected frequency and whether any client's running account shows an unexplained pattern of retained balances.

We first map the complete membership and segment matrix — trading member/clearing member status on each exchange, each segment (cash, F&O, currency derivatives, commodity derivatives), and any DP registration — and identify the specific circular framework applicable to each. We then run a coordinated audit programme that tests common control areas (KYC, segregation, RMS, grievance redressal) once across the entity while still producing the segment-specific and exchange-specific reports each exchange separately requires in its own prescribed format and submission window.

At minimum: your SEBI registration certificate and exchange membership approvals, the prior half-year's internal audit report (if this is not your first cycle) and evidence of closure of its observations, a client master data extract with UCC details, bank statements for designated client accounts, margin reporting files submitted to the exchange for the period, and Board/governing body minutes discussing the previous audit's findings. PNPC issues a tailored document request at the engagement letter stage based on your specific membership, segment mix, and whether algo trading or DP operations are involved.

PNPC provides both, where appropriate, structured to respect the independence expectations that apply to each. A broking entity incorporated as a company requires its Companies Act statutory audit under Section 143 in addition to the SEBI/exchange internal audit — these are separate, non-substitutable engagements with different scopes, appointing authorities, and reporting destinations. Where PNPC is engaged for both, we ensure the two engagements are properly delineated and, where independence considerations require it, staffed by separate teams within our practice.

Findings of this nature are reported to the broker's Board/governing body as part of the audit process and, depending on the exchange's own framework and the severity of the lapse, may need to be reported to the exchange as part of the audit submission or flagged for the exchange's separate attention. Depending on severity, exchanges can respond with monetary penalties, enhanced monitoring, additional inspection, or in serious and repeated cases, restrictions on the member's trading or client onboarding activity — the specific enforcement action is at the exchange's and SEBI's discretion based on the facts.

The internal audit obligation is applied broadly across registered trading/clearing members and Depository Participants rather than being scaled purely on business size, though the depth and complexity of testing naturally reflects the scale and nature of the member's actual operations. A newly registered broker with a small client base still needs a properly scoped internal audit for its first applicable half-yearly cycle. PNPC confirms current applicability and any specific relief that may exist for a given category directly against the exchange's current circulars rather than assuming a blanket exemption based on size alone.

For India-registered brokers with NRI clients based in the UAE, or a broking group that also operates a related entity in Dubai (for instance, under DFSA or other UAE regulatory frameworks for financial services), PNPC's Dubai office coordinates with our India audit team so that client onboarding for UAE-resident clients, any intercompany arrangements between the Indian and UAE entities, and cross-jurisdictional regulatory correspondence are handled consistently rather than by two disconnected advisors.

A trading member is registered to place orders and execute trades on the exchange on behalf of clients or itself. A clearing member additionally has the responsibility (either for itself as a self-clearing trading member, or on behalf of other trading members as a professional clearing member) for settling trades with the clearing corporation — managing margin obligations, settlement obligations, and default fund contributions at the clearing level. A clearing member's audit scope typically extends further into clearing-level margin and settlement controls, in addition to the trading-member-level scope that applies regardless.

Fees are structured based on the number of exchange memberships and segments covered, client base size and transaction volume (which drives sample sizes for KYC, order, and margin testing), whether System Audit coordination is required, whether DP operations are also in scope, and the quality and organisation of records provided. PNPC provides a written scope and fee estimate before the engagement letter is signed for each half-yearly cycle, so there are no surprises once the engagement begins.

Exchanges conduct their own periodic or trigger-based inspections of trading members, independent of the member's own internal audit process, examining many of the same control areas — KYC, segregation, margin, RMS — often with direct access to the exchange's own trade and margin data. A member's internal audit reports and the evidence of closure of prior observations are typically reviewed by the inspection team as part of assessing the member's overall compliance culture — a consistent pattern of thorough internal audits with promptly closed findings is viewed very differently from a pattern of superficial audits or unresolved recurring observations.

Yes. Where a broking client receives a show-cause notice or inspection finding from SEBI or an exchange, PNPC can support the preparation of the factual and documentary response — reconciling the specific transactions or periods at issue, coordinating with the client's legal counsel where the matter has legal/enforcement dimensions, and helping identify and implement the corrective action the regulator or exchange is likely to expect as part of the resolution.

A signature-only internal audit — minimal sampling, boilerplate observations, quick turnaround to unlock the exchange submission — creates the appearance of compliance without the underlying protection the audit exists to provide. If a segregation lapse, margin misreporting, or UCC misuse is present but not caught because the audit was superficial, the broker remains fully exposed to it surfacing later through an exchange inspection or, worse, an investor complaint — at that point with the added complication of an internal audit report on file that did not flag it. PNPC's audits test the actual control environment, document findings clearly, and follow through to confirm closure before the next cycle — which is what genuinely reduces the broker's regulatory risk, not just the paperwork burden.

Membership and segment mapping across all your exchanges. Engagement letter with documented auditor independence. Full-scope internal audit covering KYC/UCC, order and trade management, margin collection and reporting, client fund and securities segregation, contract notes and brokerage, RMS, and grievance redressal/SCORES reconciliation. System Audit coordination where applicable. Draft findings shared with management and your Board/governing body before finalisation. Final report in the exchange-prescribed format with UDIN generated on the ICAI portal. Submission support within the exchange's window. Tracking of your next half-yearly cycle and monitoring of relevant regulatory circular updates in between.

We recommend engaging your internal auditor before your first client is onboarded, not after your first half-year cycle has already closed. Early engagement allows PNPC to review your KYC/UCC process design, client fund segregation account setup, RMS parameter documentation, and contract note templates before they go live — so the first internal audit cycle tests a properly designed control environment rather than uncovering foundational gaps after months of live trading activity.

A Depository Participant registered with NSDL and/or CDSL faces a separately mandated half-yearly internal audit of its DP operations, prescribed under the respective depository's byelaws and operating instructions — covering demat account opening (KYC), transmission and dematerialisation/rematerialisation requests, pledge and unpledge processing, delivery instruction handling, and account closure procedures. Where a broking entity is also a registered DP (a very common combination), PNPC coordinates both audits so that findings on client account handling are consistent across the broking and depository sides of the business, while still producing the two separate reports each regulator requires.

Upstreaming refers to SEBI's framework requiring brokers to place client funds collected for margin purposes with the clearing corporation (rather than holding them indefinitely with the broker or in bank fixed deposits/overnight instruments outside the clearing ecosystem), with downstreaming being the corresponding return flow of funds back to the broker or client as obligations are met or funds are no longer required as margin. This framework was specifically designed to reduce the risk of client margin funds being available for a broker to use inappropriately. The internal audit tests whether the broker's upstreaming/downstreaming practice is being followed as prescribed, rather than funds being retained outside the permitted structure.

Not necessarily. An internal audit finding is simply the auditor's observation that a specific process did not operate as prescribed for the sample or period tested — it could range from a minor documentation gap (a missing signature on a KYC form) to a serious control failure (evidence of client fund commingling). The audit report itself is a diagnostic tool: findings, management's response, and the corrective action taken are what the exchange and, if escalated, SEBI actually evaluate. A broker that identifies issues through its own internal audit and closes them promptly is generally viewed far more favourably than one where the same issue is later discovered externally.

Yes. Exchange and SEBI enforcement action is not solely complaint-driven — internal audit findings, exchange inspection observations, and system-level surveillance (such as margin reporting discrepancies detected through the exchange's own data, or UCC/order-pattern anomalies flagged by exchange surveillance systems) can independently trigger regulatory scrutiny and action, entirely apart from whether any specific client has raised a grievance. This is part of why the internal audit's testing of margin reporting accuracy and segregation, not just grievance-register review, carries real weight.

SEBI and exchange expectations treat presentation of the internal audit report to the Board (or equivalent governing body for a partnership/LLP) as a genuine governance checkpoint, not a formality — the Board is expected to discuss the findings, direct and track corrective action, and be able to demonstrate that it exercised oversight over the compliance function, not merely receive the report as an information item. This becomes particularly relevant if an issue later escalates to an exchange inspection or SEBI action, where the quality of Board-level engagement with prior audit findings is itself scrutinised.

Dormant or long-inactive client accounts are typically tested for continued KYC validity (since KYC records can lapse or require periodic re-verification), any residual credit balance that should have been settled under the running account framework, and whether any activity occurred on an account that appeared otherwise dormant — which can be a red flag for unauthorised use of an inactive client code. Brokers are expected to have a defined policy for handling and periodically reviewing dormant accounts rather than leaving them unexamined indefinitely.

A kill-switch is a control mechanism — required as part of SEBI's algo trading framework for brokers offering algorithmic trading facilities — that allows an algo strategy or a client's trading activity to be immediately halted if it breaches predefined risk parameters (such as an order-rate limit, a loss threshold, or erratic order patterns suggestive of a malfunctioning algorithm). Where a broker offers algo trading, the system audit and, to the extent operationally relevant, the internal audit test whether kill-switch mechanisms are properly configured, tested periodically, and have actually been triggered and logged where warranted.

Where a cybersecurity incident (unauthorised access attempt, data breach, denial-of-service event, or similar) occurred during the audit period, it falls within the scope of the internal audit's review of the broker's cybersecurity and incident-response framework, and separately within the System Audit where one applies — including whether the incident was reported to the appropriate authority (such as CERT-In, where its reporting framework applies) within the prescribed timeline, and whether remedial action was taken and documented.

SCORES (SEBI Complaints Redress System) is SEBI's centralised online platform through which investors can lodge complaints against SEBI-registered intermediaries, including brokers, with the complaint routed to the intermediary for response within prescribed timelines and escalated within SEBI's framework if unresolved. Exchanges separately maintain their own investor grievance redressal mechanisms (including arbitration facilities for monetary disputes). The internal audit reviews both channels together, reconciling the broker's own grievance register against complaints logged on SCORES and with the exchange, to confirm nothing is being handled informally outside these official channels.

The underlying regulatory expectation is that every order, regardless of the channel through which it was placed — desktop terminal, mobile app, API, or call-and-trade — must be traceable to the specific client and properly logged with a complete audit trail, rather than the channel itself dictating a different standard of record-keeping. The internal audit tests order logs across whichever channels the broker actually offers, verifying that multi-channel access has not created gaps in traceability or authorisation control.