Regulating the Black Box: Gaps in IFSCA's 2026 Algorithmic Trading Framework

[Sakshi is a student at School of Law, Christ deemed to be University (Bangalore).]

The International Financial Services Centres Authority's (IFSCA) January 2026 consultation paper on algorithmic trading arrives at a consequential moment. GIFT IFSC, India's sole international financial services centre, is being positioned as a serious competitor to Singapore and Dubai, and the regulatory choices made here will define how international capital perceives India's financial architecture. Getting algorithmic trading regulation right, therefore, is not merely a technical exercise. It is a signal.

The framework's stated ambition is sound: balance innovation against systemic risk, and promote transparency, accountability, and market stability. However, ambition and architecture are different things. A closer reading of the proposed guidelines reveals that while the framework succeeds in establishing procedural machinery, it leaves two critical gaps untouched. 

What the Framework Does

The IFSCA's proposed guidelines operate on three declared principles. First, accountability — stock exchanges are directed to tag all algorithmic trading orders with unique identifiers, creating an audit trail traceable to the level of individual market participants and trading algorithms. Exchanges are also empowered to impose financial penalties to deter market manipulation. Second, transparency — market participants must mandatorily disclose their trading algorithms to the relevant stock exchange and obtain prior approval before deployment. Members providing algorithmic trading facilities are additionally subject to system audits. Third, stability — the guidelines prescribe minimum risk controls, including pre-trade price and quantity checks, automated execution safeguards, and a kill switch obligation requiring exchanges to shut down dysfunctional algorithms and, where necessary, a participant's trading terminal entirely.

The circular defines a “dysfunctional trading algorithm” as a trading algorithm that “malfunctions and operates in an unintended way, including those leading to a loop or runaway situation”. This precise wording targets obvious technical failures but may overlook subtler threats. For example, if multiple AI-driven algorithms tacitly coordinate to influence prices, their behaviour might not trigger any overt malfunctions.

On paper, this is a workable baseline. The framework borrows sensibly from global practice — the audit trail requirements echo Markets in Financial Instruments Directive II (MiFID II)’s approach, and the order-to-trade ratio penalty mechanism reflects Securities Exchange Board of India (SEBI)’s existing domestic framework. The problem, however, is not what the framework borrows. It is what it leaves out.

Gap 1: Privatised Oversight and the Risk of Regulatory Capture

The IFSCA's transparency framework rests on a single obligation: market participants must disclose their trading algorithms to the relevant stock exchange and obtain prior approval before deployment. The consultation paper directs exchanges to subject algorithmic trading systems to conformance tests and empowers them to refuse permission to any trading algorithm they deem unfit for orderly trading. On the surface, this appears rigorous. In practice, it delegates the most consequential regulatory function of determining whether an algorithm is safe to deploy entirely to private, commercially driven entities.

Stock exchanges operating within Gujarat International Finance Tec-City International Financial Services Centre (or GIFT IFSC), namely NSE IX and BSE International Exchange, are not public regulators. They are commercial entities with their own competitive interests and member dependencies. Asking them to independently evaluate, approve, and surveil the very algorithms deployed by their paying participants creates a structural conflict of interest that the framework does not acknowledge, let alone address. Notably, the consultation paper only requires exchanges to inform IFSCA of rejections or modifications after the fact, meaning proactive regulatory visibility into deployed algorithms is absent entirely.

Compounding this is the absence of any centralised repository or independent technical audit at the regulatory level. Disclosed algorithms flow to the exchange and stop there. IFSCA itself has no mandated access to algorithm logic and no independent mechanism to evaluate systemic risk across the market as a whole. The regulator is, in effect, one step removed from the most critical information in the system.

This stands in sharp contrast to global best practices. The European Union's MiFID II framework under Article 17 requires investment firms to notify the competent regulatory authority directly of their algorithmic trading activity. That authority may at any time demand descriptions of trading strategies, risk controls, and system testing results. Disclosure runs to the regulator, not merely to the exchange. IFSCA's framework mirrors the form of MiFID II while hollowing out its substance.

For a jurisdiction positioning itself as a credible international financial centre, outsourcing the gatekeeping function to private exchanges without a corresponding supervisory layer at the regulatory level is a structural vulnerability. Transparency that stops at the exchange is not transparency, it is the illusion of it.

Gap 2: The Missing Liability Architecture

The IFSCA's 2026 consultation paper prescribes an elaborate set of risk controls — price checks, quantity limits, kill switches, and order-to-trade ratio penalties. What it does not prescribe is an answer to a more fundamental question: when a dysfunctional algorithm causes loss to third parties, who is legally responsible?

The concern is not theoretical. The 2010 Flash Crash in the United States — where market values plunged by approximately one trillion dollars in under thirty minutes — demonstrated how a single malfunctioning algorithm can trigger cascading losses across an interconnected market. As Professor Yesha Yadav argued in her Virginia Law Review article, "The Failure of Liability in Modern Markets", traditional liability standards struggle to deter or punish misbehaviour in automated markets precisely because harms originate in one venue and spread rapidly across the system before any human intervention is possible. The IFSCA framework, for all its operational detail, does not grapple with this reality at all.

The framework empowers exchanges to impose financial penalties on participants for order-to-trade ratio violations and to shut down dysfunctional terminals. These are useful deterrents against manipulation. But deterrence and compensation are different things. A market participant harmed by another's runaway algorithm has no express civil remedy under the proposed guidelines. The framework is silent on whether exchanges bear any supervisory liability for approving algorithms that subsequently malfunction, and equally silent on the liability of the deploying participant toward third parties.

Singapore's experience is instructive here. In Quoine Pte Ltd v. B2C2 Ltd, the Singapore Court of Appeal was confronted with losses arising from autonomous algorithmic trading of digital tokens. In the absence of a dedicated liability framework, the court was forced to apply traditional contractual principles of unilateral mistake to a dispute that was fundamentally about algorithmic malfunction. The outcome underscored what Singapore's own Law Reform Committee has since acknowledged: that the civil liability regime for algorithmic systems remains nascent and ill-equipped for the speed and complexity of modern automated markets.

A framework that mandates kill switches but says nothing about who bears the cost when the kill switch is triggered too late is an incomplete framework.

Recommendations

The gaps identified above do not call for a wholesale redesign of the IFSCA framework. They call for targeted additions that would bring the framework in line with the regulatory standards GIFT IFSC is benchmarking itself against.

First, algorithm disclosure must run directly to IFSCA, not merely to the exchange. A centralised regulatory repository of approved algorithms, accessible to IFSCA's surveillance teams, would eliminate the structural conflict of interest that currently sits at the heart of the transparency pillar. This need not be an onerous requirement. MiFID II's competent authority notification model offers a workable template that IFSCA could adapt without significantly increasing compliance costs for market participants.

Second, the framework must introduce an express civil liability provision governing third party harm caused by dysfunctional algorithms. At minimum, this should clarify whether the deploying participant, the exchange that approved the algorithm, or both bear responsibility when a malfunction causes quantifiable market harm. The silence on this question is not a neutral position. It is a choice to leave harmed parties without a clear remedy, and it is a choice that will become harder to defend as algorithmic activity at GIFT IFSC scales.

Conclusion

The IFSCA's January 2026 consultation paper is a meaningful first step toward building a credible algorithmic trading framework for GIFT IFSC. The intent is right, and the operational machinery it establishes is a workable baseline. However, a framework that privatises oversight to commercial exchanges and leaves third party harm without a clear legal remedy is not yet fit for the ambitions it is meant to serve.

GIFT IFSC's bid to rival Singapore and Dubai will ultimately be judged not by the volume of activity it attracts, but by the quality of the regulatory architecture that governs it. The two gaps identified in this piece are correctable before the guidelines take final effect.