SEBI PIT Compliance: What UPSI Risks and Trading-Window Violations Reveal

InsiderQ • SEBI PIT Compliance • 9 min read

"A company can have a code of conduct, a compliance officer, and a closed trading window, and still discover a control weakness it did not expect."

Written policies are necessary for SEBI PIT compliance, but they are not proof that the controls worked. Two developments this week show why. On 21 October 2026, media reports citing Bloomberg said an internal HDFC Bank investigation had found evidence that two senior executives shared confidential business information with outsiders. Separately, A-One Steels India reported a promoter-group entity's purchase of 500 shares while its trading window was closed. On the facts reported so far, neither story establishes insider trading. Both raise the question regulators and auditors ask: can a listed company show who had access to sensitive information, what restrictions applied, and whether its records can be trusted?

Confidential Information and SEBI PIT Compliance: Why Internal Controls Matter

Short answer: Confidential information is not automatically UPSI, and an alleged leak is not proven insider trading. The controls that separate the two are the same.

Reports published on 21 October 2026 say HDFC Bank's internal probe found evidence that two senior executives, who oversee key businesses or functions, disclosed confidential business strategies and potentially market-sensitive information to outsiders. The review reportedly began after senior leaders raised leak concerns, and the bank is still examining whether the information was misused. A bank spokesperson confirmed an internal review is underway, declined to comment on its findings, and said action would follow once it concludes. These are allegations from an unfinished process. No regulatory finding has been reported.

The legal distinction matters. Under Regulation 2(1)(n) of the SEBI (Prohibition of Insider Trading) Regulations, 2015, unpublished price sensitive information (UPSI) is information relating to a company or its securities that is not generally available and, once public, is likely to materially affect the price. A confidential strategy discussion may or may not meet that test. That is a question of fact, and whether anyone traded on the information is a further question.

For compliance teams, the lessons are about process:

• Authorised sharing: Who was entitled to hold the information, and for what legitimate purpose?
• Access restrictions: Could anyone outside the need-to-know circle see it?
• Escalation: Who receives a leak concern, and how is the inquiry documented?
• Classification: Who decides whether the information was UPSI, and when?

Trading-Window Violations Under SEBI PIT Regulations: Lessons From A-One Steels

Short answer: A closed-window trade breaches a company's code of conduct. Whether it is insider trading depends on whether the trader possessed UPSI, which is a different question.

According to A-One Steels India's 21 October 2026 filing, as summarised by market-data platforms, a promoter-group entity, Quality Stone and Steels, bought 500 shares on 12 October 2026, a reported value of ₹2,02,500. The company's trading window had been closed since 1 October, until 48 hours after its Q2 results. The entity reportedly described the trade as inadvertent. The company issued a written warning and collected no penalty.

Schedule B, read with Regulation 9(1), requires listed companies to maintain a code of conduct covering trading-window restrictions, with pre-clearance where the code provides for it. A SEBI circular of 23 July 2020 prescribes the format for reporting code violations to the exchanges. Two practical points follow:

• Coverage depends on your code. SEBI informal guidance has noted that window restrictions bind promoter-group members only where the company's code includes them as designated persons. Define this explicitly.
• Window breach and insider trading are separate tests. A closed-window purchase does not presume the buyer held UPSI, and an open-window trade does not guarantee innocence.

The disclosure itself shows detection, explanation, action and exchange reporting working in sequence. That is the sequence a regulator would want to see.

UPSI Management for Listed Companies: Where Compliance Processes Can Fail

Short answer: Processes usually fail at handoffs: who is told, who is reminded, and who can prove it later.

UPSI Access Controls and Information-Sharing Records

Identify recipients before information moves. If a draft results pack goes to an auditor, a merchant banker and a legal adviser, the compliance officer should record the sender, each recipient, the nature of the information, the purpose and the time, and confirm that recipients understand their confidentiality obligations. Reconstructing this from email threads after a leak concern is slow and unreliable.

Trading-Window Monitoring and Designated-Person Compliance

Prevention is mostly communication. Circulate each closure notice to designated persons and their immediate relatives, keep acknowledgements, and run pre-clearance where your code requires it. When a closed-window trade surfaces, the workflow should move the same day from query to explanation to decision to exchange reporting.

SDD Recordkeeping and Audit Trails Under SEBI PIT Regulations

Regulation 3(5) requires the board or head of every person handling UPSI to ensure a structured digital database (SDD) records the nature of UPSI and the names of persons with whom it is shared, with PAN or another legal identifier. The database cannot be outsourced and must carry internal controls, such as time stamping and audit trails, to ensure non-tampering. Regulation 3(6) requires retention for at least eight years after the relevant transactions, or until any investigation or enforcement proceedings conclude.

In practice, audit readiness means accurate timestamps, authorised-only access, corrections that leave a trace, and quick retrieval. Software can support these. It cannot decide what counts as UPSI or guarantee compliance.

SEBI PIT Compliance Checklist: What Company Secretaries and CFOs Should Review

Short answer: Seven checks, reviewed together, show whether your controls would survive scrutiny.

1. UPSI identification and access governance: a current list of UPSI categories and who may hold each.
2. Legitimate-purpose documentation: a recorded reason for every instance of sharing.
3. Trading restrictions: closure notices, designated-person coverage and pre-clearance controls that match your code.
4. SDD entries: timely, accurate entries with all required fields, including identifiers.
5. Audit trails: corrections that are traceable rather than overwritten.
6. Defined responsibilities: named roles for the compliance officer and authorised personnel.
7. Review and retrieval: periodic reviews, exception escalation, and the ability to produce records on request.

Assess these together, not as isolated administrative tasks. A closed-window breach cannot be properly evaluated unless you can also show whether the trader appears in any UPSI sharing record, whether pre-clearance was sought, and who received the closure notice.

SDD Compliance Software: How InsiderQ Helps Strengthen UPSI Recordkeeping

Short answer: Dedicated UPSI management software replaces edit-anywhere spreadsheets with time-stamped, access-controlled records.

InsiderQ, from Naapbooks Limited, is Structured Digital Database software built around Regulation 3(5). According to its product pages, it is deployed on the company's own server, which supports the requirement that the database be maintained internally. Its listed capabilities map to the gaps above:

• UPSI logging (source, recipient, purpose, timestamp) addresses sharing records.
• Tamper-evident records and audit trails address traceable corrections.
• Role-based access for compliance officers, designated persons and connected persons addresses authorised access.
• Connected-party database, trading window and request validation support closure-period monitoring.
• Pre-clearance request/approval and post-trading updates create workflow evidence.
• Audit-ready reports support record retrieval.

No tool guarantees compliance or catches every breach; your team still classifies UPSI and acts on exceptions. To see where your current process stands, take InsiderQ's free SDD readiness check or read how SDD software for listed companies works.

Strengthening SEBI PIT Compliance Before a Regulatory Review

One story asks how sensitive information was handled. The other shows why trading-window controls matter in practice. Together they point to the same standard: clear processes, accountable people, accurate records, and the ability to explain events with reliable evidence. This article is general information, not legal advice.

Is your organisation prepared to demonstrate who accessed UPSI, how it was shared, and whether trading restrictions were followed? Explore InsiderQ and book a demo to strengthen your SEBI PIT compliance workflows.

Krishna Thosar