UPSI Leaks Start in Group Chats, Not Boardrooms: What SEBI's Insider Trading Rules Expect of Your Staff

Most listed companies treat insider trading compliance as a matter for the board, the Compliance Officer and a few dozen Designated Persons. The SEBI (Prohibition of Insider Trading) Regulations, 2015 are built on a wider premise: unpublished price sensitive information (UPSI) is dangerous wherever it travels, and the company is expected to control how it travels. In 2026, it travels through spreadsheets, email forwards, shared drives and messaging apps, and it passes through junior analysts, executive assistants, consultants and vendors long before it reaches a press release.

What do SEBI’s insider trading rules actually prohibit?

Regulation 4 bars an insider from trading in securities while in possession of UPSI. Regulation 3 goes a step earlier and prohibits communicating, providing or allowing access to UPSI except in furtherance of legitimate purposes, performance of duties or discharge of legal obligations. The test for who is an “insider” is not job title. A connected person, or anyone who has access to UPSI, qualifies. That includes people your organisation never designated.

UPSI covers information relating to the company or its securities that is not generally available and is likely to materially affect the price. The classic examples are financial results, dividends, changes in capital structure, mergers, demergers, acquisitions, and changes in key managerial personnel. SEBI has widened and clarified the definition through later amendments, so a list drawn up years ago may no longer be complete.

Where do insider trading compliance programmes fall short?

Most fall short because they are built around the Designated Persons list rather than around where UPSI actually travels. Five gaps recur.

1. Training stops at the Designated Persons list

Designated Persons receive pre-clearance rules, trading window notices and annual declarations. The finance associate who builds the results deck, the company secretarial intern, the IT administrator with access to the board folder and the vendor who prints the board papers usually receive nothing. Yet each can come into possession of UPSI, and each becomes an insider the moment they do.

2. The trading window is treated as the whole control

Under the model code in Schedule B, the trading window closes from the end of every quarter until 48 hours after the declaration of financial results. It also closes for other events the Compliance Officer decides are likely to involve UPSI. A closed window restricts Designated Persons. It does nothing to stop a leak, and it does not bind the people outside the window’s circulation list who nevertheless know the numbers.

3. The structured digital database is a register, not a habit

Regulation 3(5) requires a structured digital database recording the names of persons with whom UPSI is shared, along with the nature of the information, and the database must be time-stamped and tamper-resistant. In many companies it is updated retrospectively by one person, weeks after the information moved. Employees who share a draft with an external consultant do not know the entry is their responsibility, so the database captures a fraction of real sharing.

4. Digital channels sit outside the policy

Policies written for printed board papers do not address screenshots, forwarded Excel files, personal email, cloud drives or chat groups. SEBI has investigated leaks of quarterly results through messaging groups. If the policy does not tell an employee that a message to a friend is communication of UPSI, the employee will not see it that way.

5. Nobody knows what to do after a suspected leak

Regulation 9A requires listed companies to maintain internal controls and a written policy and procedure for inquiring into UPSI leaks, and to inform SEBI promptly of any leak, suspected or actual. A suspected leak is often noticed first by a manager or a colleague. If they do not know to report it to the Compliance Officer immediately, the inquiry begins late and the evidence is gone.

What are the penalties for insider trading in India?

Section 15G of the SEBI Act provides a penalty for insider trading of not less than ₹10 lakh, extending up to ₹25 crore or three times the profits made, whichever is higher. Section 24 adds criminal liability, with imprisonment of up to ten years, a fine of up to ₹25 crore, or both. Separately, a company that cannot show working controls under Regulation 9A faces regulatory action for the lapse itself, regardless of whether any individual trades.

How do you stop UPSI leaks in practice?

Follow the information, not the org chart: map where UPSI travels, log each share as it happens, write the policy for digital channels and rehearse the response to a suspected leak.

Map where UPSI actually travels

For each quarterly cycle and each significant event, list every team, tool and external party that touches the draft. You will almost always find people and systems that are not on any Designated Persons list. Add them to training, to confidentiality obligations and to the sharing log.

Log sharing as it happens

Make the structured digital database part of the workflow, so that adding a consultant or sending a draft to an auditor triggers an entry the same day, with a confidentiality undertaking attached. The employee who shares the information should know it is their duty to flag it.

Rewrite the policy for digital channels

State plainly that UPSI must not be shared through personal messaging, personal email, screenshots or unapproved cloud storage, and that a casual hint to a friend or family member counts as communication. Examples teach better than clauses.

Give employees a route and a rehearsal

Name the Compliance Officer, give a confidential channel, and run a short drill on a suspected leak so the first response is not improvised. Pair it with scenario-based learning so that employees recognise UPSI in their own work. Our Insider Trading Prevention course is built around exactly these situations (our insider trading training hub lists role-based options), and the broader Code of Conduct course reinforces the confidentiality expectations that sit around it.

Connect it to the rest of your governance

Related-party and board-level disclosures are another place where sensitive information crosses teams before it is public. See our piece on the related-party transaction disclosure gap audit committees miss for how the same discipline applies there.

How do you check whether your insider trading controls work?

Ask who, outside your Designated Persons list, would know your next quarter’s numbers two days before announcement, and whether each of them has been trained, bound by confidentiality and recorded in your database. If you cannot answer, that is where a leak will start. Insider trading compliance is not defined by how many people signed the code. It is defined by how well you control the information those people carry.