Summary : SEBI’s circular dated 30 October 2026 gives regulated entities additional time until 31 January 2027 for three connected digital-accessibility milestones: appointing an IAAP-certified accessibility auditor, conducting accessibility audits of digital platforms, and remediating the findings. The extension is not a general suspension of the accessibility framework. SEBI expressly states that all other provisions of the earlier circulars remain unchanged and must continue to be followed. Entities should therefore treat the revised date as a controlled completion window, not as permission to defer governance, platform inventory, vendor coordination, documentation or ongoing accessibility. This guide maps the extended items, identifies what remains outside the extension, and sets out an evidence-led completion workflow for stock exchanges, clearing corporations, depositories, registered intermediaries and the industry bodies and supervisory structures named in the circular. It also explains why an audit report alone is insufficient: management must demonstrate scope completeness, remediation ownership, retesting, exception handling and submission through the applicable reporting channel.
- What SEBI Extended on 30 October 2026
- The Extension Is Limited, Not a Reset of the Framework
- Earlier Circulars Continue to Govern Scope and Reporting
- Platform Inventory Must Be Complete
- A Four-Stage Completion Plan Before 31 January 2027
- Stage 1: Governance and Auditor Appointment
- Stage 2: Audit, Triage and Ownership
- Stage 3: Remediation and Retesting
- Stage 4: Approval and Submission
- Special Attention for Outsourced and Frequently Changing Platforms
- Board and Senior Management Reporting
- Frequently Asked Questions
- What is the revised SEBI deadline?
- Does the circular postpone every digital-accessibility obligation?
- Can an entity audit only its main website?
- Is closing a technology ticket sufficient evidence?
- Who should receive the compliance submission?
- How should third-party platform issues be handled?
- What should management monitor until January 2027?
- Key Takeaways
What SEBI Extended on 30 October 2026
Circular No. HO/53/12/13(2)2026-ITD5-M2IPC/I/24856/2026 was issued on 30 October 2026 after representations from regulated entities and a review of compliance status. It extends the deadline to 31 January 2027 for appointment of an IAAP auditor, conduct of the accessibility audit for digital platforms and remediation of findings from that audit. The three items form one practical chain. The auditor must be appropriately engaged, the full platform population must be tested, and identified barriers must be corrected and evidenced.
The circular is addressed broadly to recognised stock exchanges, recognised clearing corporations, registered depositories, registered intermediaries, AMFI, APMI and BSE Limited in its supervisory roles for investment advisers and research analysts. An entity should confirm its reporting route under the earlier compliance guidelines instead of assuming that every report goes directly to SEBI. The extension changes the completion date for the named activities; it does not rewrite the allocation of reporting responsibility.
| Control area | Position after circular | Management evidence |
|---|---|---|
| IAAP auditor | Appointment permitted up to 31 January 2027 | Engagement letter, competence evidence and independence assessment |
| Accessibility audit | Complete audit of in-scope digital platforms by 31 January 2027 | Platform inventory, test plan, findings register and signed report |
| Remediation | Close or appropriately resolve audit findings by 31 January 2027 | Fix tickets, retest results, approvals and residual-risk decisions |
| Other obligations | No change unless covered by a separate instrument | Earlier submissions, policies, training and reporting records |
The Extension Is Limited, Not a Reset of the Framework
Earlier Circulars Continue to Govern Scope and Reporting
SEBI cites the accessibility circulars issued on 31 July 2025, 29 August 2025, 25 September 2025, 8 December 2025 and 31 July 2026. The 30 October circular must be read with that sequence. The earlier framework required identification of investor-facing digital platforms, an accessibility professional, an initial audit, remediation, and continuing reporting. Because the latest circular says all other provisions remain unchanged, completed requirements should remain completed and supported by records. An entity should not withdraw, overwrite or silently replace earlier submissions merely because a later deadline has been granted for three activities.
Platform Inventory Must Be Complete
The audit population should cover every investor-facing digital platform within the applicable framework, not only the principal website. Depending on the entity, the population may include mobile applications, web portals, onboarding interfaces, transaction screens, investor-service modules, downloadable forms, authentication flows, complaint facilities and electronic documents. The inventory should record the owner, public URL or application identifier, business purpose, technology stack, vendor, release status and whether the platform processes time-sensitive investor actions.
A Four-Stage Completion Plan Before 31 January 2027
Stage 1: Governance and Auditor Appointment
Management should nominate an accountable executive and a cross-functional working group covering compliance, technology, product, legal, information security, procurement and customer service. The engagement letter with the IAAP-certified professional should define the platform list, testing standards, assistive-technology coverage, sampling, access to test environments, treatment of third-party components, severity grading, retesting and the form of the final report. Certification or competence evidence should be retained with the appointment record.
Stage 2: Audit, Triage and Ownership
Findings should be entered into a controlled register rather than left only in the auditor’s report. Each entry should identify the platform, page or journey, accessibility barrier, severity, affected user group, applicable requirement, responsible owner, target date and dependency. The register should distinguish a design defect from a content defect, a code defect, a third-party limitation and a document-accessibility failure. This classification makes remediation measurable and prevents repeated fixes that address symptoms rather than the source component.
Stage 3: Remediation and Retesting
Closing a development ticket is not proof that an accessibility issue has been resolved. The corrected version should be deployed to the relevant environment and retested using the method appropriate to the original finding. Evidence should include the version number, deployment date, screenshots where useful, automated test output, manual keyboard checks, screen-reader results and auditor confirmation for material findings. Regression testing is important where a shared component, design system or document template has been changed.
Stage 4: Approval and Submission
Before the deadline, the compliance owner should reconcile the platform inventory to the audit scope and the audit findings to the remediation register. Open matters should be explained, risk-assessed and routed through the escalation process. The final submission package should contain the prescribed report, management approval, relevant annexures and evidence of transmission to the correct authority. A dated archive should preserve the exact version submitted, acknowledgements and later correspondence.
| Review question | Evidence to inspect | Failure indicator |
|---|---|---|
| Were all platforms audited? | Approved inventory matched to audit annexure | Apps, portals or PDFs omitted without rationale |
| Were all findings assigned? | Owner and target date for every finding | Unowned or duplicated tickets |
| Was remediation tested? | Retest record tied to deployed version | Ticket marked closed without verification |
| Was reporting complete? | Signed submission and acknowledgement | Draft report exists but no proof of filing |
Special Attention for Outsourced and Frequently Changing Platforms
Outsourcing technology or content does not remove the regulated entity’s responsibility for compliance. Contracts with application developers, cloud providers, website vendors, registrars, KYC service providers and document-generation vendors should support audit access, correction timelines and evidence sharing. Where the vendor controls a common component used by several journeys, the entity should verify that the corrected component is deployed across every relevant instance. Vendor assurances should be tested against actual production behaviour.
Digital platforms change continuously. A report based on an old build may not establish accessibility of the version available to investors on 31 January 2027. Release-management controls should flag accessibility-sensitive changes, require testing before deployment and preserve the build identifier reviewed by the auditor. Urgent patches after the audit should be screened for regression risk. New investor journeys launched during the extension window should be added to the inventory and assessed rather than deferred to the next annual cycle.
Board and Senior Management Reporting
A concise dashboard should report the number of in-scope platforms, audit completion, findings by severity, remediation progress, retest completion, vendor dependencies and submission readiness. Percent-complete measures must have clear denominators. For example, “90% remediated” is meaningful only if the total finding population is stable and retesting is included. Management should separately identify any high-impact barrier affecting login, onboarding, payment, order placement, redemption, complaint filing or access to mandatory disclosures.
Frequently Asked Questions
What is the revised SEBI deadline?
The revised deadline is 31 January 2027 for appointment of the IAAP auditor, completion of the accessibility audit and remediation of audit findings.
Does the circular postpone every digital-accessibility obligation?
No. SEBI states that all other provisions of the referenced circulars remain unchanged and must be complied with.
Can an entity audit only its main website?
The scope should follow the earlier framework and the entity’s complete investor-facing platform inventory, which may include apps, portals, forms and digital documents.
Is closing a technology ticket sufficient evidence?
No. The correction should be deployed and retested, with evidence tied to the relevant platform version and original finding.
Who should receive the compliance submission?
The reporting route depends on the entity type and the mechanism prescribed in the earlier SEBI accessibility guidelines and relevant supervisory arrangements.
How should third-party platform issues be handled?
They should be included in the audit population, assigned to an accountable owner, contractually escalated and retested after remediation.
What should management monitor until January 2027?
Management should monitor auditor appointment, scope completeness, findings, remediation, retesting, unresolved dependencies and evidence of timely submission.
Key Takeaways
- 31 January 2027 applies to the three activities expressly named in SEBI’s 30 October 2026 circular.
- Earlier completed requirements and all unaffected provisions remain operative.
- A complete platform inventory is the foundation for a defensible accessibility audit.
- Remediation requires deployment, retesting and evidence; a closed ticket alone is inadequate.
- The final package should be approved, filed through the correct channel and archived with acknowledgement.
*****
Disclaimer: This article is an editorial compliance guide concerning SEBI’s circular dated 30 October 2026 and the earlier digital-accessibility circulars referenced in it. It does not reproduce every requirement, technical standard, reporting format, exemption, supervisory instruction or entity-specific communication that may apply to a particular regulated entity, market infrastructure institution, intermediary, association, digital platform or outsourced service arrangement. The extension to 31 January 2027 is limited to the activities expressly stated in the circular and should not be interpreted as a suspension of other duties, a waiver of obligations already due, or confirmation that an entity’s existing platforms are compliant. Accessibility assessment requires technical testing, legal interpretation, user-journey analysis and professional judgment based on the actual platform version, content, assistive technologies and contractual arrangements. Entities should verify the operative circulars, exchange or depository notices, reporting channel and any subsequent clarification directly from official sources immediately before taking action or making a submission. Records should reflect actual testing and remediation rather than assumed or sample compliance. Readers should obtain advice from qualified legal, compliance, accessibility and technology professionals suited to their facts. TaxGuru accepts no responsibility or liability for any loss, regulatory action, missed deadline, technical defect, investor impact or other consequence arising from reliance on this article, incomplete implementation, later legal changes or differences between the general discussion and an entity’s specific obligations.
