Do I need written internal policies, and what must they cover?
In force
Yes, and this is one of the most common inspection findings.
Regulation 15 requires written internal policies and control procedures governing dealing and trading by you and anyone associated with your research. They must address conflicts, protect the objectivity of your research, and prevent your reports being used to manipulate the market.
You also need mechanisms that keep your research independent of your other business activities.
Separately, the general conflict-of-interest guidelines for intermediaries require a written conflict policy and an internal code of conduct, communicated to everyone concerned. They set out standards on treating clients fairly, putting the client's interest first, raising information barriers, and never using client information for your own benefit.
This matters beyond the paperwork. The only lawful way out of the trading blackout is a prior written approval given under these approved policies. Without the policy, the exception does not exist for you.
If you have any staff, you are responsible for educating them on these guidelines.
What SEBI says, word for word
Regulation 15(1)“Research analyst or research entity shall have written internal policies and control procedures governing the dealing and trading by any research analyst”Source: SEBI (Research Analysts) Regulations, 2014 — Regulation 15 Open document ↗
Master Circular, ¶16.4“lay down, with active involvement of senior management, policies and internal procedures to identify and avoid or to deal or manage actual or potential conflict of interest, develop an internal code of conduct governing operations”Source: SEBI Master Circular No. HO/38/12/11(1)2026-MIRSD-POD/I/4360/2026, dated February 6, 2026, originally CIR/MIRSD/5/2013 dated August 27, 2013 Open document ↗
Master Circular, ¶16.2“They shall be responsible for educating their associated persons for compliance of these guidelines.”Source: SEBI Master Circular No. HO/38/12/11(1)2026-MIRSD-POD/I/4360/2026, dated February 6, 2026 Open document ↗
More on Governance
- Do I need to appoint a compliance officer?
- What are the rules if I use AI tools in my research process?
- Who can conduct my annual compliance audit — does it have to be ICAI or ICSI?
- Do I need an accessibility audit of my website? (deadline 31 January 2027)
- Does the cyber security framework (CSCRF) apply to me?
- What must I do with the compliance audit report once it is done?
- What may I outsource, and what stays my responsibility?