SEBI's 31 October 2026 accessibility deadline: audit and remediation now share one date

Summary. On 31 July 2026, SEBI issued circular HO/(411)2026-ITD-5_DIV2/I/17922/2026 granting an extension for "Conduct of Accessibility Audit for the digital platforms and Remediation of findings from the audit" to 31 October 2026. That single sentence merged two milestones that were originally three months apart, 30 April 2026 for the audit and 31 July 2026 for the fixes. Any regulated entity that has not yet audited must now audit and remediate inside the same window. The mandate covers 15 categories of entity reporting directly to SEBI plus stock brokers, depository participants, investment advisers and research analysts reporting through exchanges and BSE Ltd. It requires WCAG "2.1 or latest version", the latest GIGW, IS 17802 and the Rights of Persons with Disabilities Act 2016, and the audit must include usability testing by persons with disabilities, which no automated scanner satisfies. SEBI has published no penalty for non-compliance in any of the five circulars. The RPwD Act itself does carry one: Section 89 sets a fine up to ₹10,000 for a first contravention and not less than ₹50,000 rising to ₹5 lakh for subsequent ones, and Section 90 extends liability to company officers. That is 12 weeks from today to audit, fix and report.

This guide is written for the engineering team that has to do the work, not the compliance team that has to file the form. It covers what the circulars actually say, where the widely-repeated summaries are wrong, and which specific WCAG success criteria break on trading and investment platforms.

The circular chain, with the numbers

There are five circulars, and the differences between them matter because the later ones change deadlines and reporting channels set by the earlier ones.

Circular number	Date	What it did
SEBI/HO/ITD-1/ITD_VIAP/P/CIR/2025/111	31 July 2025	The original mandate, with relative deadlines only (1 month, 45 days, 3 months, 6 months)
SEBI/HO/ITD-1/ITD_VIAP/P/CIR/2025/121	29 August 2025	Converted the relative deadlines to absolute dates; moved investment adviser reporting to BSE Ltd.
SEBI/HO/ITD-1/ITD_VIAP/P/CIR/2025/131	25 September 2025	Compliance guidelines in Annexure-A, including submission formats Tables C1 to C4
HO/13/19/13(2)2025-ITD-1_VIAP/I/187/2025	8 December 2025	Replaced the 14 December 2025 auditor-appointment deadline with a 31 March 2026 readiness status; added accessibility complaints to SCORES
HO/(411)2026-ITD-5_DIV2/I/17922/2026	31 July 2026	Extended audit and remediation to 31 October 2026

A small but consequential detail on the last one. The circular number is rendered on SEBI's own page with capital letters, ITD for Information Technology Department and DIV for Division. Several secondary write-ups reproduce it with digits (1TD, D1V2) because of OCR. If you are citing it in a board note, use SEBI's form.

The extension circular is short. Paragraph 3 grants the extension "for 'Conduct of Accessibility Audit for the digital platforms and Remediation of findings from the audit' by October 31, 2026", and paragraph 4 states that "All other provisions of the aforementioned circulars shall remain unchanged and shall be complied by REs."

That second sentence is the one people skim past. Nothing else was relaxed. The nodal officer designation, the grievance mechanism, the staff and vendor training, the procurement clauses and the annual reporting obligation all stand exactly as written.

Two corrections to what you have probably read

Two claims circulate widely enough that a compliance plan built on them will be scoped wrongly.

The extension applies to all regulated entities, not only to investment advisers and research analysts. Some trade coverage headlines the extension as being for IAs and RAs. That framing belongs to the 29 August 2025 circular, which genuinely did change investment adviser reporting from BASL to BSE Ltd. and research analyst reporting from SEBI to BSE Ltd. The 31 July 2026 extension is addressed to recognised stock exchanges, clearing corporations, depositories, registered intermediaries, AMFI, APMI and BSE Ltd., and paragraph 3 grants the extension to "REs" with no category restriction.

"WCAG 2.1 Level AA" is not what the original circular says. The scope section of the July 2025 circular requires adherence to "Web Content Accessibility Guidelines ('WCAG') 2.1 or latest version", "Accessibility guidelines as described in the latest version of Guidelines for Indian Government Websites ('GIGW')", "IS 17802: Indian Standards on Accessibility Requirements for Information and Communication Technology ('ICT') Products and Services", and the provisions of the RPwD Act 2016. No conformance level appears anywhere in that circular. The level "AA" enters the chain only in the December 2025 circular, as a column header on a reporting form asking whether the "minimum level of accessibility at AA level as per latest WCAG guidelines" has been met.

Note also that SEBI cites IS 17802 bare, with no year and no part number. The Bureau of Indian Standards catalogue lists IS 17802 (Part 1):2021, "Accessibility for the ICT Products and Services Part 1: Requirements", under committee LITD 35, and that standard normatively references ISO/IEC 40500:2012, which is WCAG 2.0. Writing "IS 17802:2021" as SEBI's stated requirement is an inference, not a quotation.

The floating target problem, and why it is an engineering decision

"WCAG 2.1 or latest version" plus "latest WCAG guidelines" means the conformance target is not pinned to a version. Both WCAG 2.1 and WCAG 2.2 are current W3C Recommendations; 2.2 reached Recommendation status on 5 October 2023 with a revision on 12 December 2024, and 2.1 was itself revised on 6 May 2025.

Scoping an audit to 2.1 AA is defensible on the circular's plain wording. Scoping it to 2.2 AA is what "or latest version" points at. The gap between them is five Level A and AA success criteria, and one obsoletion.

New in WCAG 2.2	Level	Why it matters on an investment platform
3.2.6 Consistent Help	A	Help, chat and contact entry points must appear in a consistent relative order across pages
3.3.7 Redundant Entry	A	Re-entering PAN, bank or address data already supplied earlier in an onboarding flow
2.4.11 Focus Not Obscured (Minimum)	AA	Sticky ticker bars and order footers that cover the focused element
2.5.7 Dragging Movements	AA	Drag-to-set stop-loss or drag-to-adjust price on a chart needs a single-pointer alternative
2.5.8 Target Size (Minimum)	AA	Dense buy and sell buttons and chart handles below the minimum target size

4.1.1 Parsing is obsolete in 2.2 and should not be raised as a finding.

There is a trap here worth naming, because we have seen it in audit reports. 2.5.7 Dragging Movements exists only in WCAG 2.2. Guideline 2.5 in WCAG 2.1 stops at 2.5.6. An audit scoped explicitly to WCAG 2.1 AA cannot legitimately raise a 2.5.7 finding; the nearest 2.1 hook is 2.5.1 Pointer Gestures at Level A, which covers multipoint and path-based gestures rather than plain dragging. If your auditor's report contains 2.5.7 findings against a 2.1 scope, the scope statement and the findings disagree, and that is worth resolving before you sign off on a remediation budget.

Our recommendation is to scope to 2.2 AA and say so in the report. It satisfies "or latest version" on its face, it survives the next revision of the reporting form, and the five extra criteria are cheap relative to re-auditing.

The criteria that actually fail on trading and investment platforms

This is the part a generic accessibility checklist gets wrong, because a broking app is not a content site. Names and levels below are as published by W3C.

Success criterion	Official name	Level	How it fails here
1.4.1	Use of Color	A	Green and red for profit and loss, buy and sell, or up and down ticks, with no text or symbol carrying the same meaning
2.2.1	Timing Adjustable	A	OTP windows and trading session timeouts that cannot be turned off, adjusted or extended
4.1.3	Status Messages	AA	"Order executed" or "Order rejected" toasts that never reach a screen reader
1.3.1	Info and Relationships	A	Price tables built from div elements with no table semantics, no header cells, no scope
2.1.1	Keyboard	A	Chart drawing tools and order pads reachable only with a mouse
1.4.11	Non-text Contrast	AA	Candlestick bodies, gridlines and order-type toggles below a 3:1 contrast ratio
1.4.3	Contrast (Minimum)	AA	Dense watchlists in light grey on white, below 4.5:1 for normal text
2.5.1	Pointer Gestures	A	Pinch-to-zoom-only charts and swipe-only actions with no single-pointer alternative
1.4.13	Content on Hover or Focus	AA	Chart tooltips that cannot be hovered, dismissed or kept visible
4.1.2	Name, Role, Value	A	Custom dropdowns and order-type toggles with no accessible name or state
1.1.1	Non-text Content	A	Chart images, icon-only action buttons, and CAPTCHA on login
2.4.7	Focus Visible	AA	Focus rings removed for visual polish across the order flow
3.3.1	Error Identification	A	An order rejection communicated only by turning a field border red
1.3.4	Orientation	AA	Apps locked to portrait, or charts locked to landscape
1.4.10	Reflow	AA	Price tables that force two-dimensional scrolling at 320 CSS pixels wide

The two with the widest blast radius are 2.2.1 and 4.1.3.

2.2.1 Timing Adjustable is a Level A criterion and it collides directly with how broking sessions are built. W3C's requirement is that the user can turn the time limit off, or adjust it to at least ten times the default, or be warned before it expires with at least 20 seconds to extend it and the ability to extend at least ten times. There are exceptions for real-time events, for cases where the limit is essential, and for limits longer than 20 hours. A regulator-mandated session timeout has a genuine "Essential" argument; an OTP entry window of 30 seconds with no warning and no extension usually does not. That is a legal and product argument, not just a code change, so start it early.

4.1.3 Status Messages is where live financial data becomes actively hostile. The criterion requires that status messages "can be programmatically determined through role or properties such that they can be presented to the user by assistive technologies without receiving focus". On a page where prices update every few hundred milliseconds, a naive aria-live="polite" on the whole table produces a screen reader that never stops talking. The fix is to scope live regions tightly to state changes the user asked about, order confirmations, rejections, margin warnings, and to leave streaming price cells outside any live region entirely, exposing them through an on-demand control instead.

Real-time price tables have no dedicated success criterion. They fail through 4.1.3, 1.3.1 and 1.4.1 in combination, and an audit report that invents a criterion for them is a report to question.

What the audit has to cover, beyond the website

The scope is wider than most remediation budgets assume.

Websites, mobile apps and portals, all three, named explicitly in the circular.

Usability testing by persons with disabilities. The July 2025 circular states that "The said accessibility audit shall include usability testing by persons with disabilities." This is the requirement automated tooling cannot satisfy at any price. Recruiting and scheduling participants takes weeks, which is why it belongs at the front of a 12-week plan rather than the end.

PDFs and investor documents. The circular requires that "All circulars, notices, and investor documents ... in PDF or other formats must follow accessible document standards, such as tagged PDFs, logical reading order, proper use of headings, and alt text." Contract notes, capital gains statements and factsheets are usually generated by a reporting pipeline nobody has touched in years, and retrofitting tagging into that pipeline is often the single largest line item.

Multimedia, including Indian Sign Language videos, closed captioning, descriptive audio and alt text.

e-KYC, which gets its own section, requiring alternatives such as human-assisted video KYC, scanned uploads or voice-assisted KYC.

Governance items that need no code at all but do need a named person: a designated nodal officer, with the compliance officer or proprietor deemed to hold the role by default; a grievance mechanism covering email, helpline, web forms and escalation; accessibility clauses in RFPs and procurement contracts; staff and third-party vendor training on accessible-by-design practice; and compliance reviewed and approved by the managing director, managing partner or proprietor.

One thing the circulars do not require, contrary to several vendor checklists: there is no obligation to publish an accessibility statement. If your plan has that as a deliverable, it is good practice rather than a SEBI requirement.

Who reports where

The obligations are the same across categories. The reporting channel is not.

Entity type	Reports to	Cadence
Stock brokers, depository participants	Their stock exchange or depository	Annually, within 30 days of financial year end
Investment advisers, research analysts	BSE Ltd. (IAASB and RAASB)	Annually, within 30 days of financial year end
Market infrastructure institutions and the remaining 15 categories	SEBI, at [e-mail]	Annually, within 30 days of financial year end

The 15 categories reporting directly to SEBI, from the December 2025 annexure, are AIFs, bankers to an issue and SCSBs, clearing corporations, collective investment schemes, credit rating agencies, custodians, debenture trustees, depositories, KYC registration agencies, merchant bankers, mutual funds and AMCs, portfolio managers, registrars and transfer agents, stock exchanges, and venture capital funds.

On penalties: what SEBI has said, and what the RPwD Act says

SEBI has published no penalty, fine, sanction or adjudication clause in any of the five circulars. All five are issued under Section 11(1) of the SEBI Act 1992, the general functions provision. Any article quoting a specific SEBI fine for accessibility non-compliance is inventing it.

What does exist is an investor-complaint route. The December 2025 circular adds an "Accessibility" category to SCORES, and states that the regulated entity "shall remediate the accessibility related issue for the closure of the complaint". It also adds a right to digital accessibility to SEBI's investor charters. In practice that means every unremediated defect is a potential complaint that cannot be closed without fixing the defect.

Separately, and independently of SEBI, the RPwD Act 2016 carries its own penalty regime. Section 89 provides that a person contravening the Act or its rules "shall for first contravention be punishable with fine which may extend to ten thousand rupees and for any subsequent contravention with fine which shall not be less than fifty thousand rupees but which may extend to five lakh rupees". Section 90 extends liability to any person in charge of a company at the time of the offence, and to a director, manager or secretary where the offence is attributable to their neglect, with a due-diligence defence available.

The underlying obligation is not new. SEBI's circulars follow a Supreme Court judgment dated 30 April 2025 in the joined writ petitions Pragya Prasun and Others v. Union of India and Amar Jain v. Union of India and Others, which SEBI summarises in its own words as establishing that "the right to Digital Access is an intrinsic component of right to life and personal liberty". The RPwD provisions SEBI cites are Sections 40, 42 and 46, and Rule 15(1)(c) of the RPwD Rules 2017.

A 12-week plan from 3 August to 31 October 2026

Twelve weeks is workable if the long-lead items start now.

Weeks 1 to 2. Appoint or confirm the nodal officer, in writing. Start recruiting participants for the usability testing with persons with disabilities, because that is the scheduling constraint everything else waits on. Inventory every digital surface in scope: web, iOS, Android, investor portals, the document-generation pipeline and any white-labelled partner front end.

Weeks 2 to 4. Run an automated pass across the inventory to establish a baseline and to catch the volume defects, contrast, missing labels, heading structure. Automated tooling typically catches around a third of criteria; treat the output as triage, not as an audit.

Weeks 3 to 6. Manual audit against WCAG 2.2 AA, with the criteria table above as the starting checklist rather than a generic template. This is where 2.2.1 and 4.1.3 findings surface, and both may require product decisions rather than code fixes.

Weeks 5 to 8. Usability testing with persons with disabilities, running in parallel with remediation of the automated findings. Findings from this stage tend to be architectural, not cosmetic.

Weeks 6 to 11. Remediation. Sequence by criterion level: Level A first, since 1.4.1, 2.2.1, 2.1.1, 1.3.1, 4.1.2, 1.1.1 and 3.3.1 all sit there. The document pipeline work runs on its own track because it usually involves a different team.

Weeks 10 to 12. Verification pass, then the report through the correct channel, with sign-off by the managing director, managing partner or proprietor as the circulars require.

The honest constraint: if remediation surfaces a session-timeout or live-region redesign in week eight, 12 weeks is not enough for a full rebuild. Document the finding, ship a mitigation, and record the remediation plan. A documented, in-progress fix is a materially different position from an undetected defect.

India-specific considerations

Two points about how this sits alongside other obligations.

Firms already working through the EU Accessibility Act and WCAG 2.2 audit requirements for Indian SaaS will find the technical work largely overlapping. Scope one audit to WCAG 2.2 AA and it serves both, since the EU regime already points at 2.2. What does not transfer is the India-specific layer: the usability testing requirement, the GIGW and IS 17802 references, the Indian Sign Language provision and the SEBI reporting formats.

Under the Digital Personal Data Protection Act 2023, usability testing with persons with disabilities involves collecting session recordings and, potentially, disability status, which is sensitive by any reasonable reading. Run the testing under a data processing agreement with the recruitment partner, minimise what is recorded, and set a retention period before the first session rather than after.

There is a performance dimension too. Accessible price tables built with real table semantics and tightly scoped live regions usually render fewer DOM nodes and fewer accessibility-tree recalculations than div-based grids with a blanket live region, which is why we treat this work as adjacent to web performance and Core Web Vitals rather than as a separate compliance track, and why it belongs in the same release planning as the rest of the web platform work.

FAQ

What exactly is due on 31 October 2026?

Both the accessibility audit and the remediation of its findings. SEBI's 31 July 2026 circular grants the extension for "Conduct of Accessibility Audit for the digital platforms and Remediation of findings from the audit" by that date, merging two milestones that were previously 30 April 2026 and 31 July 2026.

Does the extension apply only to investment advisers and research analysts?

No. The 31 July 2026 circular is addressed to recognised stock exchanges, clearing corporations, depositories, registered intermediaries, AMFI, APMI and BSE Ltd., and grants the extension to regulated entities generally. Coverage framing it as IA and RA specific is describing the separate 29 August 2025 circular instead.

Which WCAG version and level does SEBI require?

The July 2025 circular says WCAG "2.1 or latest version" and names no conformance level. Level AA appears only in the December 2025 reporting form, phrased as "AA level as per latest WCAG guidelines". Scoping an audit to WCAG 2.2 Level AA satisfies both wordings and survives the next form revision.

Can an automated accessibility scan satisfy the SEBI audit?

No. The circular requires that the audit include usability testing by persons with disabilities. Automated tooling catches roughly a third of success criteria and cannot evaluate criteria such as 2.2.1 Timing Adjustable or 4.1.3 Status Messages in context. Treat automated output as triage before the manual audit.

Does SEBI require an IAAP-certified auditor?

The July 2025 circular refers both to auditing through the International Association of Accessibility Professionals and to IAAP-certified accessibility professionals. The December 2025 circular refers only to "certified accessibility professionals", dropping IAAP. Whether that is a deliberate relaxation is not stated, so the safer reading is IAAP certification.

What is the penalty for missing the SEBI accessibility deadline?

SEBI has published no penalty in any of the five circulars, which are issued under Section 11(1) of the SEBI Act 1992. Unremediated defects do become SCORES complaints that cannot be closed without a fix. Separately, RPwD Act Section 89 sets fines up to ₹10,000, then ₹50,000 to ₹5 lakh.

Do mobile trading apps fall within scope?

Yes. The circular names websites, mobile apps and portals explicitly. The word "trading" never appears, so trading apps are covered as a broker's mobile app rather than through any app-specific clause. Investor documents generated as PDFs, including contract notes and statements, are separately in scope.

Is drag-to-adjust price on a chart an audit finding?

Only under WCAG 2.2. Success criterion 2.5.7 Dragging Movements is a Level AA criterion that exists in 2.2 and not in 2.1, where Guideline 2.5 stops at 2.5.6. Because SEBI says "or latest version", scoping to 2.2 makes drag-based order entry auditable and it needs a single-pointer alternative.

How eCorpIT can help

eCorpIT is a Gurugram-based technology consulting organisation whose senior engineering teams run WCAG audits and remediation on financial platforms, including the parts most audits under-scope: live-region design for streaming price data, session and OTP timeout redesign, and tagged-PDF generation pipelines for contract notes and statements. We are CMMI Level 5, MSME certified and ISO 27001:2022 certified, and we design applications aligned with DPDP requirements where usability-testing data is collected. To scope the work against the 31 October 2026 date, contact us.

References

1. Extension of timelines with respect to compliance of digital accessibility circulars, SEBI, circular HO/(411)2026-ITD-5_DIV2/I/17922/2026, 31 July 2026.
2. Clarification on the digital accessibility circulars of SEBI, SEBI, 8 December 2025.
3. SEBI circular on digital accessibility, full text, circulated by NSE, covering SEBI/HO/ITD-1/ITD_VIAP/P/CIR/2025/111 dated 31 July 2025.
4. Extension of timelines, digital accessibility circular, 29 August 2025, circular SEBI/HO/ITD-1/ITD_VIAP/P/CIR/2025/121, hosted by APMI.
5. Clarification on the digital accessibility circulars, 8 December 2025, full text, hosted by APMI.
6. SEBI circular for compliance to digital accessibility, 25 September 2025, circular SEBI/HO/ITD-1/ITD_VIAP/P/CIR/2025/131.
7. SEBI extends digital accessibility audit and remediation timeline to 31 October 2026, TaxGuru, carrying the verbatim circular text.
8. Web Content Accessibility Guidelines (WCAG) 2.1, W3C Recommendation, revised 6 May 2025.
9. Web Content Accessibility Guidelines (WCAG) 2.2, W3C Recommendation 5 October 2023, revised 12 December 2024.
10. What's new in WCAG 2.2, W3C Web Accessibility Initiative.
11. Understanding success criterion 4.1.3: Status messages, W3C Web Accessibility Initiative.
12. Understanding success criterion 3.3.1: Error identification, W3C Web Accessibility Initiative.
13. IS 17802 (Part 1):2021, Accessibility for the ICT Products and Services, Bureau of Indian Standards.
14. Rights of Persons with Disabilities Act 2016, Chapter 16, Offences and Penalties, full text of Sections 89 to 95.

Last updated: 3 August 2026.