SIM-linked, biometrics & QR code login: SEBI’s new mobile-centric plan for safer trading

Markets regulator SEBI on Tuesday proposed stringent technology-based measures, including SIM binding and biometric authentication, to bolster security in trading and demat accounts and prevent unauthorised transactions. In a consultation paper released on Tuesday, the Securities and Exchange Board of India (SEBI) outlined a framework aimed at strengthening the authentication mechanism for accessing trading accounts.

Why is SEBI pushing for a mobile-centric trading ecosystem?

With rapid technological advancements in online and mobile-based trading, incidents of hacking, SIM spoofing, unauthorised account modifications, and identity theft have been on the rise. Under the proposed framework, SEBI plans to introduce a SIM binding mechanism similar to the Unified Payments Interface (UPI) system.

The trading application would allow logins only when it recognises the Unique Client Code (UCC) in conjunction with the registered SIM and mobile device.

“The proposed framework would create secure and robust authentication for log-in into mobile application for trading,” the regulator said.

The first login can only take place through the registered mobile device, according to the proposal, which would ensure that only authorised users/UCC holders can access the trading account through the hard bind parameters of the mobile device, such as biometric authentication or facial recognition.

Key features of the proposed framework

1. SIM and device binding: Investors’ trading accounts will be accessible only through a registered mobile number (SIM) linked to their mobile device and UCC. This means logging in from an unauthorised device will not be possible.
2. Biometric authentication: Access to trading applications will require biometric verification (fingerprint or facial recognition) on the primary SIM-bound device.
3. Limited multi-device access: Investors can register a secondary device, but trading will only be allowed on one active device at a time. If the secondary device moves beyond a 100-meter range, it will be automatically logged out.
4. QR code-based login for web access: Users wishing to log in via desktops or laptops will need to authenticate the session using a QR code scanned from the registered mobile device, similar to secure login methods in social media apps.
5. Temporary account lock and session monitoring: Investors will be able to monitor all active sessions on their account, revoke access to unauthorised devices, and temporarily lock their trading accounts if needed.
6. Family account operations: A single registered mobile device can be authorised to manage multiple UCCs for family members, subject to necessary approvals.

For investors using call and trade services, orders will now require OTP-based verification unless the call is made from a registered mobile number. Walk-in trades at broker offices will need to be recorded via tamper-proof mechanisms like voice and video logs.

Implementation plan

The framework will be implemented in phases, starting with the top 10 Qualified Stock Brokers (QSBs). Initially, investors will have the option to opt into the secure authentication mechanism, but it will gradually become mandatory for all traders.

SEBI has invited public comments on these proposals until March 11, 2025, before finalising the framework.