Trading in Public: SEBI and the Listed Company

Who You Are Telling

'Who exactly are we telling?' the chief financial officer asked.

He had come to Prabhat Road in December 2025 with a merchant banker's presentation, forty-odd slides that showed a line climbing from right now to listing in 2027 or 2028. The firm in Hinjewadi had grown since the POSH episode. It now employed a little over seventy people, processed payments for several hundred small merchants, and had two venture investors on its register. His question was the right one, and the presentation did not answer it.

A private company tells things to people who come and ask. The Registrar receives the AOC-4 and MGT-7 once a year. The bank asks for the borrowing resolution when the limit is renewed. A shareholder who wants the minutes of a general meeting may inspect them under Section 119 of the Companies Act, 2013. Every one of these readers is known, few in number, and able to pick up the telephone. Even the investors in the Hinjewadi firm, who had negotiated information rights into their shareholders' agreement, received their monthly management accounts because a contract said so. The statute did not require it.

A listed company tells things to people it will never meet. The moment its shares are admitted to trading on the National Stock Exchange or BSE, its readers become anyone with a demat account and a phone. They are a retired schoolteacher in Sangli, a mutual fund desk in Lower Parel and an algorithm in Singapore. None of them can ask. All of them are pricing the shares, every second the market is open, on whatever the company has said and whatever it has failed to say. The law's concern shifts from whether the record exists to whether everyone receives it at the same moment.

That shift is the whole design of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, which practitioners call LODR. They are made by the Securities and Exchange Board of India under the SEBI Act, 1992, and they sit on top of the Companies Act rather than replacing it. A listed company still holds its board meetings under Section 173 and its AGM under Section 96. It also takes on a second regulator with a different temperament. The Registrar of Companies is interested in whether a form was filed. SEBI wants to know when you knew, and when you told.

I explained the difference to the CFO with an example from his own business. Suppose the firm's largest merchant, which then accounted for about a fifth of its volume, gave notice to terminate. As a private company, the firm would tell its venture investors at the next monthly call and its bank at the next renewal, and there would be no breach in waiting. As a listed company, the loss of a contract of that size would very probably be a material event under Regulation 30, and the disclosure clock would start when the company learned of it. For an event that originates outside the company, the outer limit is twenty-four hours. For a decision of its own board, it is thirty minutes from the close of the meeting. A week's delay would not be a lapse in courtesy. It would be a week in which some people traded on knowledge that others lacked.

He asked whether a listing on the SME platform, which his bankers favoured, would be gentler. In some respects it would. Regulation 15(2) exempts companies listed on the SME exchange from the corporate governance provisions in Regulations 17 to 27, so there is no mandatory quota of independent directors under LODR and no quarterly governance report, and Regulation 33 allows half-yearly rather than quarterly results. That is the statutory floor for a small listed company, and it is lower. Regulation 30, though, applies in full. The insider trading regulations apply in full. The schoolteacher in Sangli is just as unable to ask.

He closed the presentation at slide nineteen, where the line began to climb.

'So the forty-three days we take to close the books,' he said. 'That becomes a problem.'

It does. Regulation 33 gives a main-board company forty-five days from the end of each quarter to publish its results, and the board must approve them first.

LODR in Practice

Forty-five days sounds generous until it is broken into its parts. The books must be closed, the statutory auditor must carry out a limited review (a lighter examination than a full audit, but one that ends with a signed report the company cannot publish without), the audit committee must examine the figures, and the board must approve them. For the fourth quarter, Regulation 33 allows sixty days, because the annual accounts are audited in full. A company that takes forty-three days merely to close has left itself two days for everything else, and auditors do not work at that speed for anyone.

Approval is not the end of it. Once the board has approved the results, the company must send them to the exchange within thirty minutes of the meeting closing. I acted in 2019 for a listed forging company in Chakan whose board rose at 5.40 in the evening. The company secretary then discovered that the PDF uploaded to the exchange portal was the draft with the auditor's tracked comments still visible in the margin. The corrected file went up at 6.23. The exchange's query arrived the next morning and asked, politely, for an explanation of the forty-three minutes. Nobody at the company had thought of the board meeting as the moment the clock started. Since then I have advised every listed client to keep the final results file open on a second laptop in the boardroom, with the upload screen loaded, before the chairperson reaches the item on the agenda. The regulations do not require this. It is a recommendation.

Governance has its own quarterly return. Regulation 27(2) requires a compliance report on corporate governance within twenty-one days of the end of each quarter, in the format SEBI prescribes. It states whether the board is composed as Regulation 17 demands. That means at least half independent directors where the chairperson is an executive, at least one third where the chairperson is non-executive, and at least one woman director. It also states whether the audit, nomination and remuneration, and stakeholders' relationship committees under Regulations 18 to 20 met, and with what quorum. The report is mostly a grid of yeses. Its value lies in the one cell that says no, because the company has to explain that cell in public, and the explanation remains on the exchange's website for anyone who looks.

Regulation 30 is where most of the difficulty sits. It divides events into two groups in Schedule III. Those in Part A are deemed material, so no judgement is involved. They include acquisitions, changes in directors or auditors, fraud by promoters or key managerial personnel, and the outcome of board meetings on results and dividends. Those in Part B are disclosed only if they are material. Before July 2023 that word was left largely to the company's own policy, and companies interpreted it generously in their own favour. SEBI's amendment notified on 14 June 2023 set a quantitative test. An event is material if its value exceeds the lowest of two per cent of turnover, two per cent of net worth or five per cent of the three-year average of absolute profit or loss after tax. A company may still treat a smaller event as material under its board-approved policy if a qualitative judgement points that way. It may not treat a larger event as immaterial.

The same amendment fixed the clocks. Thirty minutes applies to a board decision. Twelve hours applies to an event that emanates from within the company without a board decision. Twenty-four hours applies to anything that arises outside it. The merchant's termination notice in the CFO's hypothetical would fall into the last category, and the clock would start when the notice reached someone at the company who could understand what it meant. The regulations do not ask whether that person told the managing director. They ask when the company knew.

The CFO made a note on the back of slide nineteen and turned it over.

'Our largest merchant sends notices to a Gmail address,' he said. 'The founder's. From 2019.'

Insider Trading: Information, Windows and the Database

The Gmail address mattered more than he thought, though not for the reason he feared. A termination notice from the largest merchant is not only a Regulation 30 event. Until the company discloses it, it is unpublished price sensitive information, which Regulation 2(1)(n) of the SEBI (Prohibition of Insider Trading) Regulations, 2015 defines as information about a company or its securities that is not generally available and that would, once known, be likely to move the share price materially. The regulation lists the obvious cases: financial results, dividends, changes in capital structure, mergers and acquisitions, and changes in key managerial personnel. An amendment notified in March 2025, in force from 10 June 2025, lengthened that list so that it now tracks much of Schedule III to LODR. The two sets of regulations were written to meet in the middle. Something that must be disclosed quickly is, until that moment, something nobody may trade on.

Regulation 4 prohibits an insider from trading while in possession of such information. Regulation 3 prohibits anyone from passing it on, except for legitimate purposes, the performance of duties or the discharge of legal obligations. An insider is either a connected person (a director, an employee or a professional adviser with access) or anyone else who happens to hold the information. The second limb catches the driver who overheard a call and the brother-in-law who was told at dinner.

'So the founder's inbox is an insider,' the CFO said.

'The founder is. The inbox is evidence.'

The law asks the company to produce that evidence in advance. Regulation 3(5), inserted with effect from 1 April 2019, requires the board of every listed company to keep a structured digital database recording the name and PAN of each person with whom unpublished price sensitive information has been shared, along with the nature of what was shared. Regulation 3(6) requires the database to be maintained internally, with time-stamping and an audit trail that prevents tampering. It is the same principle as the edit log in the accounts. A record that can be quietly corrected does not count as a record.

In 2022 I reviewed the arrangements of a listed engineering company in Pimpri. Its database was an Excel workbook that the company secretary updated on Fridays from memory and emailed to himself. It held forty-one entries for the year. The board pack for a single acquisition had gone to more than forty people, counting the bankers, the valuers and two drivers who delivered printed copies to the independent directors' homes. The workbook had no time-stamps and no audit trail, and Friday was four days too late for any trade made on Tuesday. The company bought software within the month. The regulations do not name a product, and I do not recommend one. They do require that the entry be made when the information moves.

Trading windows are the bluntest instrument. Clause 4 of Schedule B requires the company to close the window for designated persons and their immediate relatives from the end of every quarter until forty-eight hours after the results are declared. The compliance officer may close it at other times, ahead of a merger or a fundraising, for instance. When the window is open, trades above the threshold in the company's code need pre-clearance. A designated person who buys may not sell within six months, since Schedule B prohibits such contra trades. Regulation 7(2) requires promoters, directors and designated employees to disclose trades exceeding ₹10 lakh in a calendar quarter within two trading days, and the company must then inform the exchange within a further two.

Insiders who hold information permanently, such as a founder who always knows how the quarter is going, can trade under a trading plan under Regulation 5. This is a schedule disclosed in advance, which cannot be changed and which takes effect only after a cooling-off period. The 2024 amendments reduced that period to 120 calendar days.

The penalties sit in the SEBI Act, 1992 rather than the regulations. Section 15G sets a minimum of ₹10 lakh and a maximum of ₹25 crore or three times the profit made, whichever is higher. In the orders I have read, the profit is usually small. The trades are timed to the day.

The CFO asked how SEBI would ever know about a trade placed from a relative's account in Nashik.

'Phone records,' I said. 'And the database you will have built.'

The BRSR: Reporting What the Balance Sheet Leaves Out

The last obligation on the CFO's slides was the one he had expected least, because it appeared to have nothing to do with money. Regulation 34(2)(f) of LODR requires the top 1,000 listed companies by market capitalisation to include a Business Responsibility and Sustainability Report in their annual report. SEBI prescribed its format by circular dated 10 May 2021. It was voluntary for 2021–22 and mandatory from 2022–23. Before that, a smaller group of companies had filed a Business Responsibility Report, which was shorter. I have read several dozen of those, and most of them could have been exchanged between companies without anyone noticing.

The BRSR is harder to fill with boilerplate. It is built around the nine principles of the National Guidelines on Responsible Business Conduct, which the Ministry of Corporate Affairs issued in 2019, and it has three sections. Section A asks for general disclosures: locations, employees by gender and category, subsidiaries, CSR applicability. Section B asks what policies the company has and who on the board is responsible for them. Section C works through the nine principles one at a time. Each has essential indicators and leadership indicators. The essential ones are compulsory. The leadership ones are voluntary, and here the distinction between the Statutory Floor and the Governance Ceiling appears on the face of the form. Energy consumed per rupee of turnover, water withdrawn, waste generated, the share of permanent workers covered by health insurance and complaints received under the POSH Act are essential. Life-cycle assessments of products are leadership. I advise clients to complete the essential indicators completely and well before they attempt any leadership indicator at all. A board that reports scope 3 emissions and leaves its gender pay data blank has its priorities the wrong way round.

Then there is assurance. SEBI's circular of 12 July 2023 created BRSR Core, a subset of key indicators that must be independently assured. A further circular of 28 March 2025 changed the requirement from 'reasonable assurance' to 'assurance or assessment' and pushed the timetable back. The top 150 companies began with 2023–24, the top 250 with 2024–25, and the requirement extends to the top 500 for 2025–26 and the top 1,000 for 2026–27. Disclosures about the company's value chain, meaning its significant suppliers and customers, apply to the top 250 on a comply-or-explain basis from 2025–26. That part is still settling, and I expect it to change again before it becomes mandatory.

'We will not be top thousand for years,' the CFO said.

The cut-off moves every year, because SEBI uses market capitalisation as at 31 March, and a company that enters the list stays bound for three years after it drops out under Regulation 3(2). In March 2024 the thousandth company had a market capitalisation of a few thousand crore. A payments firm that lists well and grows can reach that figure sooner than its board assumes. The data, though, cannot be gathered later. Electricity bills, attrition figures and complaint registers for the reporting year have to exist during that year. The BRSR records only what the company has already written down.

The calendar, for a listed company, adds the following to everything in the earlier chapters. Quarterly financial results go to the exchange within forty-five days of the end of each of the first three quarters under Regulation 33, and audited annual results within sixty days of the year end. The shareholding pattern under Regulation 31 and the corporate governance report under Regulation 27(2) are each due within twenty-one days of the end of every quarter. The trading window closes on the last day of each quarter and reopens forty-eight hours after results. The annual report, with the BRSR inside it, goes to the exchange no later than the day it is dispatched to shareholders. Regulation 30 events have no date at all, only the thirty-minute, twelve-hour and twenty-four-hour clocks.

The CFO photographed the whiteboard. On his way out he stopped at the door with his laptop bag half zipped.

'One more thing, madam. The Singapore fund that came in in 2021. Our earlier CA said there was some RBI form. I don't think anybody filed it.'