UPSI and Insider Trading Compliance in 2026: Where Listed Companies Are Getting Caught

Summary: SEBI’s insider trading framework requires listed companies, designated persons, compliance officers and professional advisers to maintain effective controls over unpublished price sensitive information (UPSI). This article examines developments identified in the source material through October 2026, including the expanded illustrative UPSI definition, Structured Digital Database (SDD) practices, trading-window restrictions, disclosure reporting and enforcement action. It discusses the consequences of trading while in possession of UPSI, the importance of legitimate-purpose documentation, the responsibilities of immediate relatives and the risks arising from incomplete compliance records. The article also considers judicial decisions concerning the relevance of trading motives, proof of communication of UPSI and the obligations of connected persons. Practical sections address recurring weaknesses in SDD maintenance, pre-clearance, contra trades, reporting of violations, confidentiality and board oversight. Separate action points are provided for audit committees, company secretaries, compliance officers, chartered accountants and practising company secretaries. A 20-point self-assessment checklist helps listed entities review their policies, data records, monitoring procedures and staff training before the next financial-results cycle. Readers should verify the cited 2026 circulars, orders, judicial decisions and current regulatory requirements against the relevant primary sources before relying on individual legal propositions or deadlines.

Why This Matters Now

In 2026, insider trading enforcement moved from “big-ticket fraud” to everyday compliance lapses. The exposure now sits with ordinary designated persons, compliance officers and even intermediaries.

Four developments make this the right moment for every listed company, CA and CS to review their PIT framework:

• Supreme Court, August 2026: In SEBI v. Rajeev Vasant Seth, the Court held that the purpose of a trade is irrelevant once an insider trades while in possession of UPSI. A “bona fide reason” is no longer a defence.
• NSE, 7 August 2026: NSE issued Circular NSE/CML/2026/19 to all listed entities on SDD best practices, “in light of the observations made in certain cases”.
• NSE, 4 May 2026: Code of Conduct violations and Regulation 7 disclosures must now be filed in XBRL format, so every lapse becomes machine-readable data for surveillance.
• SEBI orders through 2026: penalties on individual designated persons, a ₹58.50 lakh settlement for SDD failure, and cautionary letters to listed entities.

This article explains what has changed, where companies are actually getting caught (with case references), and a practical checklist to close the gaps.

Who should read this: Compliance Officers and Company Secretaries of listed companies; Boards and Audit Committees; Chartered Accountants acting as statutory, internal or tax auditors (who are themselves “connected persons”); and Practising Company Secretaries certifying SDD compliance.

The Regulatory Framework As It Stands In October 2026

The PIT Regulations, 2015 have been tightened in three steps over the last 18 months. The table below lists the instruments every compliance team should have on file.

The Expanded Upsi Definition (Regulation 2(1)(N))

Before June 2025, the definition listed only five illustrative items: financial results, dividends, change in capital structure, M&A and similar transactions, and changes in KMP. The 2025 amendment added items (vi) to (xvi), drawn from Regulation 30 material events. These include:

• change in credit rating (other than ESG rating);
• proposals to raise funds;
• agreements affecting management or control;
• fraud or default by the company, its promoter, directors or KMP, and arrest of such persons;
• resolution plans, restructuring and one-time settlements;
• admission of insolvency applications;
• forensic audit initiation and outcome;
• actions by regulators or courts, and litigation outcomes;
• award or termination of orders/contracts not in the normal course of business;
• resignation of the statutory auditor or secretarial auditor.

The Reg 30 materiality guidelines apply in identifying these events as UPSI. Practitioners such as Vinod Kothari Consultants point out that the list is illustrative. It does not mean such events were not UPSI before June 2025, and price sensitivity must still be tested.

Penalty Exposure Under The SEBI Act

• Section 15G (insider trading): not less than ₹10 lakh, extending up to ₹25 crore or three times the profit made, whichever is higher.
• Section 15HB (residual, including Code of Conduct and SDD lapses): ₹1 lakh up to ₹1 crore.
• Section 15A(b) (failure to file disclosures): a separate penalty applies for missed Reg 7 disclosures.
• Section 24: criminal prosecution in serious cases.

Where Listed Companies Are Getting Caught: Seven Trouble Spots

Most 2026 enforcement is not about classic tipping. It is about weak systems: an SDD that is not maintained, a trading window that a junior employee did not know about, or a violation that was not reported. Each trouble spot below is backed by an order, settlement or exchange filing.

1. Structured Digital Database (SDD) Not Maintained Or Incomplete

What goes wrong: SDD entries are made after the event, PANs are missing, entries cover only board meetings and not other UPSI, or the database is an editable Excel file without an audit trail.

Case reference: In May 2026, BofA Securities India paid ₹58.50 lakh to settle SEBI proceedings alleging failure to maintain an SDD in its role as a merchant banker. The show cause notice was issued on 26.05.2025 under Section 15HB, and SEBI’s whole-time members approved the settlement on 02.04.2026. If an intermediary is penalised for SDD lapses, the listed company sharing UPSI with it is equally exposed.

Exchange action: NSE’s circular dated 11.08.2026 lists securities moved to restricted, trade-for-trade trading and flags certain scrips as “SDD Suspended”. SDD non-compliance can therefore affect the liquidity of the company’s shares, not just bring a fine.

Fix: Use a non-tamperable tool with time-stamping and an 8-year retention capability. Log every UPSI item, not only results, and enter externally sourced UPSI within 2 calendar days.

2. Trading During Window Closure, By “Unaware” Designated Persons

What goes wrong: Plant-level or junior employees are classified as designated persons but do not know it, or ignore the closure email.

Case reference: In September 2026, SEBI imposed ₹1 lakh each on two designated persons of Jindal Steel & Power for trading during window closure and without pre-clearance, under clauses 4 and 6 of Schedule B read with Reg 9(1). One employee argued he worked in plant operations and was unaware of his designation. SEBI rejected this, noting he was listed as a designated person in company records and had received the closure email. A designated person’s obligations do not depend on whether he personally understood them.

Pattern in exchange filings: 2026 Code of Conduct violation reports filed by Turtlemint (07.08.2026), Jindal Saw (29.04.2026) and Basilic Fly Studio (03.02.2026) show the same lapse repeating: trading during window closure even after closure emails were circulated.

Fix: Confirm designated-person status annually in writing. Train employees, not just circulate emails. Get brokers’ demat data periodically and use the depositories’ automated freeze, which now extends to immediate relatives.

3. Contra Trades

What goes wrong: A designated person buys and sells (or sells and buys) within six months, often across different family demat accounts.

Case reference: In May 2024, SEBI imposed ₹5 lakh under Section 15HB on the erstwhile MD of Kwality Ltd for contra trades and trading during window closure. The company’s insolvency moratorium did not protect him. Contra-trade violations also appear repeatedly in Mphasis’s July 2026 violation report.

Fix: Run a six-month look-back on every pre-clearance request, including immediate relatives’ holdings, and disgorge any profit to the SEBI IPEF.

4. Immediate Relatives And Family Members

What goes wrong: Designated persons comply themselves, but spouses, parents or dependants trade.

Case reference: On 01.10.2026, Punjab National Bank disclosed a cautionary letter from SEBI’s Investigations Department for PIT violations by three designated persons and their immediate relatives (six individuals in total) while trading in the bank’s shares in 2024. No penalty was imposed, but the matter became a public Reg 30 disclosure.

Fix: Keep updated records of immediate relatives’ PANs and demat accounts, and make the annual declaration mandatory.

5. Sharing Upsi Without A “Legitimate Purpose” Trail

What goes wrong: UPSI goes to bankers, valuers, lawyers, consultants, rating agencies or prospective investors on email or WhatsApp without a confidentiality notice or an SDD entry.

What the 07.08.2026 NSE circular demands: where UPSI is shared with intermediaries or fiduciaries, the names and identifiers of the individuals handling it must be recorded, not just the firm’s name. The circular also requires periodic training for fiduciaries, not only employees.

Fix: Before sharing, issue a written notice that the recipient becomes an insider. Use a wall-crossing log, and record the individual names and PANs at the receiving firm.

6. Not Reporting Violations, Or Reporting Them Late

What goes wrong: The company detects a violation but the Audit Committee does not act, or it delays reporting to the exchanges.

Why it matters now: Since 04.05.2026, Code of Conduct violation reports are filed in XBRL. Exchanges can now cross-match them against their own surveillance alerts. A violation that surveillance flags but the company never reported will invite questions on the compliance officer’s and the board’s oversight.

Fix: Place violations before the Audit Committee promptly, decide the action, collect the penalty, remit it to the IPEF and file the XBRL report.

7. Leaks Before Disclosure, And Missing Reg 30 Discipline

What goes wrong: Price or volume moves before an announcement, or media reports precede the company’s disclosure. The 2025 amendment linked UPSI directly to Reg 30 events, so a delayed Reg 30 disclosure now extends the period during which insiders hold UPSI.

Case reference: In SEBI v. Rajeev Vasant Seth (Supreme Court, August 2026), insiders sold shares while holding UPSI. They argued the sale was to prevent the company from becoming an NPA. The Supreme Court held that this purpose was irrelevant (details in the next section).

Fix: Keep a leak-inquiry procedure under Reg 9A, and disclose Reg 30 events within the time limits. Close the trading window for internal UPSI from the moment the information comes into existence, not from the board meeting date.

What The Courts Have Said: Key Precedents

The August 2026 Supreme Court ruling largely settles the long debate on “intent” under the 2015 Regulations. Read with earlier rulings, the position is as follows.

SEBI V. Rajeev Vasant Seth (Supreme Court, August 2026) – The Purpose Of Trade Is Irrelevant

• Facts: Insiders sold shares while in possession of UPSI. The SEBI Adjudicating Officer imposed penalties. SAT reversed, accepting that the sales were made for a corporate reason, namely to prevent the company’s account from being classified as an NPA, and that there was no mens rea.
• Held: The Supreme Court set aside the SAT order and restored SEBI’s order. Relying on the Note to Regulation 4(1) of the 2015 Regulations, it held that the reasons for a trade, and the purposes to which the proceeds are applied, are irrelevant to whether insider trading occurred. It also held that little or no profit is of no consequence.
• Distinguished: The Court distinguished SEBI v. Abhijit Rajan, noting that the 1992 Regulations had no equivalent Note.
• Practical takeaway: The formula is now simple: insider + possession of UPSI + trade, with no Regulation 4 defence = violation. Intent and purpose may still affect the quantum of penalty, but not liability. (Source: judgment; analysis)

SEBI V. Abhijit Rajan (Supreme Court, 19.09.2022) – 1992 Regulations

The chairman and MD of Gammon Infrastructure Projects sold shares while holding information on the termination of shareholder agreements. He used the proceeds to fund the promoter’s contribution under a corporate debt restructuring. The Court held that the motive to make unfair gains, the direction of the trade and its reason were relevant. This principle now applies only to cases under the 1992 Regulations.

Balram Garg V. SEBI (Supreme Court, 2022) – Burden Of Proof And Connected Persons

The case concerned the MD of PC Jeweller and family members alleged to have traded on UPSI in 2018. The Court held that SEBI must prove communication of UPSI with direct or substantial evidence. Family or business relationships alone, such as living in the same building, do not make a person a “connected person” or prove tipping. This remains the main defence precedent where SEBI relies only on circumstantial links.

Refex Industries Ltd. (SEBI Adjudication Order, December 2025)

SEBI reiterated that intent is not relevant, and that trading on UPSI, whatever its size, creates an uneven playing field for other investors.

What This Means In Practice

The lesson for compliance teams: you cannot rely on explaining a trade after the event. Prevention through trading plans, pre-clearance and window closures is the only reliable protection.

Action Points By Role

Board And Audit Committee

• Under Reg 9A(4), the Audit Committee must review PIT compliance at least once a financial year and verify that internal controls are adequate and working. Minute a real review, not a one-line noting.
• Approve the updated Code of Conduct and Fair Disclosure Code reflecting the June 2025 UPSI list and the August 2026 NSE best practices.
• Decide on Code of Conduct violations promptly. Delay itself is a governance failure.
• Make sure the company has a written leak-inquiry policy under Reg 9A(5) and that it has actually been used when a leak was suspected.

Compliance Officer / Company Secretary

• Re-map UPSI events to the expanded definition and create an “event-to-trading-window” matrix.
• Review the designated persons list at least annually. Obtain written acknowledgement of designation, and collect PAN, demat and immediate-relative details.
• Audit the SDD every quarter: completeness, time stamps, PANs, named individuals at fiduciaries, and entries for external UPSI within 2 days.
• Run training sessions every year and keep attendance records. The NSE circular expressly mentions training for fiduciaries too.
• File Code of Conduct violation reports and Reg 7 disclosures in XBRL within timelines.

Chartered Accountants – Statutory, Internal And Tax Auditors

Auditors and their team members are connected persons under Reg 2(1)(d), and are usually fiduciaries receiving UPSI (draft results, impairment, frauds). Therefore:

• Expect the client to record your name, and each team member’s name and PAN, in its SDD. Cooperate with this.
• Do not trade in clients’ securities. Firms should maintain an internal restricted list.
• Keep audit working papers, emails and WhatsApp groups containing UPSI secure.
• While auditing, check whether trades by promoters or KMP took place during closure periods. These can carry financial-reporting and governance implications.

Practising Company Secretaries

• When issuing the SDD compliance certificate, test actual entries against board agendas, Reg 30 disclosures and the trading window record. Do not certify on the basis of a declaration alone.
• In the secretarial audit (MR-3) and Annual Secretarial Compliance Report, report PIT lapses specifically: delayed Reg 7 disclosures, trading window breaches and SDD gaps.
• Advise clients on the June 2025 UPSI changes and the NSE best practices, especially smaller listed and SME-listed companies with no full-time compliance team.

20-Point Self-Assessment Checklist

A “No” against any item is a gap worth closing before the next results season.

Policies and codes

• Code of Conduct and Fair Disclosure Code updated for the 16-item UPSI definition (effective 10.06.2025)
• Policy on “legitimate purpose” for sharing UPSI in place and on the website
• Written leak-inquiry procedure under Reg 9A(5), approved by the Board
• Audit Committee review of PIT internal controls minuted for FY 2025-26

Structured Digital Database

• SDD is non-tamperable, time-stamped, with audit trail and 8-year retention
• Every UPSI item captured, not only financial results
• Names and PANs of individuals at banks, auditors, advisers and other fiduciaries recorded (NSE circular 07.08.2026)
• Externally sourced UPSI entered within 2 calendar days
• Quarterly SDD compliance certificate filed on time

Designated persons and trading window

• Designated persons list reviewed in the last 12 months; written acknowledgement obtained
• PANs and demat details of designated persons and immediate relatives updated and shared with the depositories
• Trading window closed from the date internal UPSI arises, not only for quarterly results
• Pre-clearance system checks six-month contra-trade history, including family accounts
• Trading plans (Reg 5) used by promoters or KMP who trade regularly

Disclosures and reporting

• Reg 7(2) disclosures received within 2 trading days and filed with exchanges in XBRL
• Code of Conduct violations placed before the Audit Committee and reported in XBRL
• Penalties collected remitted to SEBI IPEF
• Reg 30 events disclosed within prescribed timelines (UPSI period not extended by delay)

People

• Annual PIT training held for employees and fiduciaries, attendance recorded
• Confidentiality notices issued before sharing UPSI with any outsider

Closing Note

The message from SEBI, the exchanges and the Supreme Court in 2026 is consistent: PIT compliance is judged by systems, not explanations. A good reason for a trade will not save an insider, and an employee’s ignorance will not save a designated person. A Code of Conduct that exists only on paper will not protect the compliance officer or the board.

The quarter ending 31 December 2026 is a natural point to run the checklist above. Then fix the SDD, refresh the designated persons list and train the people who handle UPSI before the Q3 results.