Internal Audit & SEBI Compliance Review for Brokers

It is a mandatory, independent review — conducted by a practising Chartered Accountant, Company Secretary, or Cost Accountant who has no connection with the broker — of how well your broking or depository participant operations actually comply with SEBI and exchange rules on client money handling, margin, client registration, and risk management. It is separate from your annual statutory financial audit and your income-tax audit, and it is submitted to the exchange or depository within the timeline they prescribe.

SEBI's framework requires every registered trading member and depository participant to have their operations internally audited on a half-yearly basis by an independent practising professional, regardless of size — there is no small-broker exemption from the requirement itself, though the depth and complexity of the audit will naturally scale with the volume and nature of the broker's business.

Half-yearly, covering the two half-years of the financial year — broadly April to September and October to March — with the report to be placed before management and submitted to the relevant exchange or depository within the timeline stipulated by SEBI and exchange circulars in force at the time of the relevant cycle.

An independent practising Chartered Accountant, Company Secretary, or Cost Accountant who is not connected with the broker — meaning not an employee, and without the kind of relationship that would compromise independence, similar in spirit to the independence requirements for a statutory auditor. The person conducting the audit should also, in practice, have working familiarity with the SEBI and exchange regulatory framework specific to broking operations, since a generalist internal auditor without this specific domain exposure is unlikely to catch broker-specific control gaps.

Generally, no, if your broking entity is a company. Section 144 of the Companies Act, 2013 specifically bars a company's statutory auditor from also rendering internal audit services to that same company, precisely to preserve independence — and SEBI's internal audit is, in substance, an internal audit engagement. For broking entities structured as partnerships or other non-company forms where Section 144 does not directly apply, the same independence logic still generally counsels appointing a different CA firm for the two functions. We recommend confirming your specific position with your compliance officer and legal counsel, since the precise application can depend on your entity type and existing auditor engagement terms.

A standard bank reconciliation confirms that your books match your bank statement. Client fund segregation testing goes further — it verifies that client money was kept entirely separate from the broker's own (proprietary) funds throughout the period, was not used to fund the broker's own trading or operating expenses even temporarily, and that any client fund balance held by the broker corresponds to a genuine, currently valid client obligation. It is a substantive compliance test, not just an arithmetic reconciliation.

This is treated as a serious compliance breach under SEBI's client fund and securities segregation framework. Depending on severity and whether it is an isolated operational lapse or a pattern, consequences can range from a documented finding requiring immediate remediation, to exchange-level penalty action, to more serious regulatory consequences including restrictions on the broker's trading facility in egregious or repeated cases. The specific consequence depends on the facts, the amount involved, and whether the broker proactively identified and disclosed the issue.

A running account is the mechanism under which a broker can retain client funds and securities beyond a single settlement, rather than paying out or delivering after every trade, subject to the client's specific written authorisation and periodic mandatory settlement — either monthly or quarterly, as the client has opted. The audit tests whether the running account was actually settled at the periodicity the client selected, whether amounts retained beyond settlement were within the limits permitted for margin obligations, and whether the settlement calculation itself followed the prescribed methodology.

We reconcile the margin the broker actually collected from each sampled client — cash, fixed deposit receipts, bank guarantees, and pledged or re-pledged securities under the margin pledge mechanism — against the margin obligation the exchange reported for that client's positions. Any gap is a margin shortfall, which the broker is required to report to the exchange and which typically attracts a penalty. Margin discipline is central to systemic market stability — under-collateralised positions are exactly the exposure SEBI's margin framework is designed to prevent, which is why this is one of the most heavily tested areas in any broker internal audit.

Every client must be allotted a Unique Client Code before any trade can be executed on their behalf, and that code must be correctly mapped to the client's KYC-verified identity on the KYC Registration Agency (KRA) system. UCC testing verifies that trades in the sample were executed only against validly allotted, correctly mapped, and currently active client codes — and flags any instance of trading against a code that should have been blocked, was allotted to the wrong client, or lacked current KYC.

Yes. RMS testing is a core part of the engagement — we review the configured exposure limits, margin-based square-off trigger logic, and pre-trade risk checks, and test whether the system actually operated as configured during the period, including reviewing any manual overrides applied by the risk desk and whether those overrides were properly authorised and documented.

Where a broker also holds a Depository Participant registration with NSDL or CDSL, the internal audit separately tests demat account opening procedures (KYC and in-person verification), Delivery Instruction Slip processing controls, Basic Services Demat Account eligibility classification, and DP-level charge computation, against the SEBI (Depositories and Participants) Regulations, 2018 and the applicable depository bye-laws — this is scoped as an additional, specific stream of testing, not folded generically into the broking-side review.

SCORES (SEBI Complaints Redress System) is SEBI's centralised online platform through which investors can lodge complaints against registered intermediaries, including stock brokers. The audit reviews the broker's SCORES complaint log and resolution timeline for the period, alongside the exchange's own investor grievance mechanism, to verify complaints were acknowledged and resolved within the prescribed timelines and that recurring complaint patterns are being identified and addressed at a root-cause level, not just closed individually.

Broadly: client and proprietary bank statements, client securities/demat pool account statements, margin obligation and collection records, UCC allotment and KYC records, contract notes and brokerage computation records, RMS configuration documentation, SCORES and exchange grievance logs, and your prior internal audit reports with the status of open findings. PNPC provides a detailed, engagement-specific document request list at kick-off, scoped to your exact registration category and segments.

For a mid-sized broker with cash and F&O segments, a typical cycle runs roughly 4–6 weeks from fieldwork start to a submission-ready report, assuming documents are made available promptly. Brokers with additional depository participant registration, multiple exchange memberships, a larger or more complex client base, or open findings from the prior cycle requiring deeper follow-up testing should expect a longer cycle.

Yes. Every open finding from a half-yearly cycle is carried into the scope of the next cycle and specifically re-tested to confirm actual remediation, not accepted on management's word alone. A finding that recurs across multiple consecutive cycles is flagged distinctly in the report, since a persistent, unremediated finding is a materially different risk signal than a one-off operational lapse.

The half-yearly internal audit covers operational and financial compliance — client fund segregation, margin, UCC, RMS, grievance handling. The Cyber Security and Cyber Resilience Framework (CSCRF) audit and the separate System Audit are distinct, more technically specialised reviews of the broker's IT infrastructure, data security controls, business continuity and disaster recovery arrangements, and cyber-incident response readiness, each governed by its own SEBI circular framework and typically conducted by an auditor with specific systems-audit or CERT-In empanelment credentials in addition to CA qualification. These may be required of the same broker depending on its category and client base, but are generally scoped, quoted, and conducted as separate engagements from the half-yearly internal audit.

Exchanges conduct both scheduled, risk-based inspections and targeted inspections triggered by a specific surveillance alert, investor complaint pattern, or reported anomaly (such as a margin shortfall or unusual trading pattern). A consistent history of thorough, well-documented half-yearly internal audits — with findings properly rated, root-caused, and demonstrably remediated — is a meaningful mitigating factor: it signals a broker with functioning internal controls and gives the exchange team a documented trail to review rather than starting from a blank slate.

Yes. We support brokers in investigating the specific issue flagged, reconciling the underlying data, preparing a factual and well-evidenced response, and — where the issue points to a genuine control gap — designing and implementing the corrective action, which we then verify in the next internal audit cycle. Responding to a deficiency memo with a rushed or incomplete explanation typically escalates the matter; a thorough, evidenced response is the better path even when it takes a few extra days to prepare properly.

Yes, materially. While the core principles — segregation, margin, UCC, RMS — apply across segments, the specific margin methodology, product-level risk controls, and certain reporting formats differ between cash market, equity derivatives (F&O), currency derivatives, and commodity derivatives (MCX). A broker operating across multiple segments needs a scope that explicitly covers each segment's specific rules, not a single generic test applied uniformly.

Yes, typically. The first cycle for a newly registered broker often has a shorter operating history to test but tends to surface more foundational process gaps, simply because compliance processes, reconciliation discipline, and documentation habits are still being established. We treat the first cycle as an opportunity to help the compliance officer and operations team build the right habits from the outset, rather than only flagging what went wrong.

We sample-test contract notes and the underlying trade data to verify that brokerage was computed per the agreed client rate, and that statutory levies — Securities Transaction Tax (STT), stamp duty, exchange transaction charges, SEBI turnover fees, and GST on brokerage — were correctly computed, collected, and remitted. Errors here typically surface either as under-collection (a revenue leakage and potential compliance issue for the broker) or over-collection (a client-facing compliance and reputational issue).

PNPC supports brokers across the full audit and compliance calendar — the SEBI-mandated half-yearly internal audit, the annual statutory financial audit under the Companies Act, the applicable tax audit where the broker's turnover crosses the prescribed threshold (under the tax-audit provisions of the Income Tax Act, 2025, successor to the erstwhile Section 44AB), and, where the broker needs it, coordination with a specialised Cyber Security/System auditor. Running these under one coordinated engagement calendar, with one firm holding institutional knowledge of your operations across all of them, reduces duplicated document requests and keeps your compliance calendar coherent.

A typical engagement includes: registration and scope mapping against your exact SEBI/exchange registrations; review of prior audit history and open findings; client fund and securities segregation testing; running account settlement verification; margin collection and reporting reconciliation; UCC mapping and client registration review; RMS controls testing; contract note, brokerage, and statutory levy verification; depository participant operations testing where applicable; SCORES and grievance redressal review; a risk-rated findings report mapped to the specific SEBI regulation or circular; management review and sign-off support; and submission support within the prescribed deadline. Exact scope and fee are agreed in writing before the engagement begins, based on your registration category, segments, and client base size.

Fees depend on your registration category (trading member, clearing member, DP, or a combination), the number of exchanges and segments you operate in, your client base size and transaction volume, and whether the engagement is a fresh first-cycle audit or a continuing engagement with an established control baseline. We provide a written scope and fee proposal, structured as a per-half-yearly-cycle or annual retainer fee, before any engagement begins.

A genuinely useful broker internal audit requires an auditor with real working familiarity with SEBI and exchange circulars specific to broking operations — not a general-purpose internal auditor applying a generic checklist to a specialised, fast-moving regulatory framework. PNPC has been a practising CA firm since 1986, with teams across Chennai, Bangalore, Hyderabad, and Dubai, and we approach every broker internal audit with substantive segregation and margin testing, clear findings mapped to the specific regulation breached, and follow-up re-testing every cycle — the depth exchange reviewers actually expect to see.

Yes. PNPC operates from Chennai, Bangalore, and Hyderabad in India, and from Dubai in the UAE. For broking groups with an Indian SEBI-registered entity and a related UAE entity — for example, a UAE-based advisory or introducing arrangement feeding into the Indian broking business — we coordinate the India-side SEBI internal audit with the appropriate India-UAE cross-border and group-level compliance review, rather than treating the two as disconnected engagements handled by separate, uncoordinated firms.

Non-submission or late submission of the mandated half-yearly internal audit report is treated as a compliance lapse by the exchange/depository and can attract monetary penalties, formal deficiency communication, and, in the case of repeated or serious non-compliance, more significant regulatory consequences up to restrictions on the broker's trading facility. Beyond the direct penalty, skipping the audit also means genuine control gaps — segregation issues, margin shortfalls, UCC errors — go undetected internally until an external party, such as the exchange itself, finds them first.

Where a broker offers algorithmic trading facilities or has colocation arrangements with an exchange, these carry additional SEBI requirements around algo approval, risk controls specific to algorithmic order flow, and system audit obligations that go beyond the standard half-yearly internal audit scope. We scope this explicitly as part of the engagement for brokers offering these facilities, and coordinate with a specialised systems auditor where the technical depth required exceeds a standard operational internal audit.

Client trading data, personal KYC information, and financial records reviewed during the engagement are handled under the same professional confidentiality obligations that apply to all our audit and assurance work, governed by our engagement letter and applicable professional standards. Access to underlying systems and data is scoped to what is necessary for the specific testing being performed, and working papers are retained and secured per our firm's data-retention and confidentiality policy.

The margin pledge and re-pledge mechanism allows clients to pledge their securities held in their own demat account as collateral for margin, with the broker re-pledging that collateral (where structured to do so) to the clearing corporation, rather than the older system of securities being transferred into a broker-controlled account. The audit verifies that pledge creation, invocation (in case of a margin call default), and release are correctly processed and documented, and that the broker is not holding client securities as collateral outside this prescribed pledge mechanism.

That is the core value of a genuinely substantive internal audit — testing segregation, margin, and UCC controls proactively, on a representative sample, is designed to surface a control gap before it manifests as a client complaint, a margin default, or an exchange-detected anomaly. A checklist-only audit that merely confirms policy documents exist, without substantively testing whether those policies were followed in practice, will miss exactly the kind of operational gap that later surfaces as a real problem.

SEBI and the exchanges issue circulars on margin methodology, segregation reporting formats, running account rules, and related operational matters on an ongoing basis, and the applicable framework for a given half-yearly cycle should always be confirmed against circulars in force at that time rather than assumed to be static. PNPC's audit teams track circular updates relevant to the broking sector as part of maintaining our audit methodology, and we confirm the current applicable framework for each client's specific cycle before finalising scope.