Three things happened in fifteen months that quietly rewrote how Indian Investment Advisers, Research Analysts and finfluencers can legally use WhatsApp. SEBI published a verified-social-handle circular in March 2025 that forces your advisory persona to bind to the same phone number on file with the regulator. It then dropped a consolidated master circular for IAs and a parallel one for RAs on 17 February 2026, codifying audit-trail and compliance-audit expectations for every operational thing you do — including digital messaging. And in parallel, the crackdown on paid WhatsApp tip groups crossed from one-off enforcement orders into a steady drumbeat of disgorgement, market bans and crore-scale penalties. If you advise on, research, or distribute investment content over WhatsApp in 2026, this is the rulebook you needed yesterday.
Why now: the regulatory picture in mid-2026
SEBI's posture toward digital communication used to be implicit — the regulations were channel-agnostic, the enforcement was reactive. That changed when the regulator realised the bulk of Indian retail capital-markets engagement now flows through three apps: WhatsApp, Telegram and YouTube. The 2024 SEBI–MIB joint framework on unregistered finfluencers was the first overt acknowledgement that the channel matters. The March 2025 verified-handle circular operationalised it for registered intermediaries. The February 2026 master circulars stitch the operational expectations into a single reference each for the IA and RA functions.
For roughly 1,400 SEBI-registered Investment Advisers and a comparable population of Research Analysts, this is a window where the rules of the road are finally legible. For finfluencers without registration, it is also a window where the boundary — and the enforcement appetite — is clearer than at any prior point. We have spent the last quarter helping registered advisory tenants on RichAutomate align their WhatsApp Business Account setup with this new posture, and this is the synthesis.
The March 2025 verified social handle rule
What it actually says
The 22 March 2025 SEBI circular requires all registered intermediaries — IAs, RAs, stockbrokers, AMCs, AIFs, mutual fund distributors registered with associations — to use only those social media accounts whose registered phone/email matches what SEBI has on file for the entity. The implementation is via a binding step on the SEBI Intermediary (SI) Portal: you log in, you confirm the social handles and the WhatsApp Business phone number that represent your registered advisory persona, and SEBI thereafter treats unverified handles claiming to be you as impersonators.
What it means for your WhatsApp setup
The WhatsApp Business number you use for client communication must be the same number on file with SEBI under your registration. If you registered with your personal mobile number and now run advisory via a separate business number, you must either (a) update the SEBI record to the business number, or (b) move advisory communications back to the registered number. We see roughly 60% of new registrations on RichAutomate hit this exact mismatch during onboarding — it is fixable, but it has to be fixed before advisory traffic flows. Our guided WhatsApp Business Account setup includes a SEBI-number-alignment check.
Why this matters beyond compliance
Impersonation is the dominant attack vector against high-profile RIAs in 2026. A verified handle is your regulatory shield and your trust signal when a prospect Googles you and finds your real WhatsApp number versus the three lookalike accounts trying to push penny-stock tips under your name.
The February 2026 master circulars — what changed
On 17 February 2026 SEBI issued a consolidated master circular for Investment Advisers and a separate consolidated master circular for Research Analysts. These are not new rules so much as new structure: every operational direction issued under the IA Regulations 2013 and RA Regulations 2014 over the prior decade is now in one place. The operationally interesting deltas:
| Area | Pre-Feb 2026 | Post-Feb 2026 master circular |
|---|---|---|
| Compliance audit auditor | Chartered Accountant or Company Secretary in practice | Cost Accountant in practice now also accepted (alongside CA / CS) |
| Audit periodicity | Half-yearly, deadlines spread across notifications | Half-yearly, codified — H1 audit submitted within 6 months of period-end, H2 within 6 months |
| Digital-comms audit trail | Implicit under "books and records" | Explicit — covers messaging apps, requires retrievable timestamped records |
| Risk profiling refresh | Mandatory at onboarding, periodically thereafter | Periodicity clarified — minimum annually for active advisory clients |
| Fee structure transparency | Disclosed in agreement | Disclosed in agreement and on the registered handle/website with the exact slab |
The cost-accountant addition matters more than it sounds. The bottleneck for many small-shop RIAs was finding a CA willing to do a small compliance audit at a reasonable fee. Opening the pool to ICAI-Cost relieves that pressure. The audit-trail clarification matters more still: it means any inspection can now legitimately ask "show us your WhatsApp messages from this period, with timestamps and recipients" — and you must be able to produce them.
Education versus advice — the crackdown line
The single most important sentence in this entire piece: the moment a piece of content recommends a specific buy, sell, hold, target price or stop-loss to a specific person or closed group, it is investment advice. Everything else — explainers, market commentary, historical analysis, generic frameworks — is investor education. Education does not require SEBI registration. Advice does.
Since 2023, SEBI orders against paid WhatsApp/Telegram tips groups have rested on exactly this distinction. The operator argues "I am running an education community". SEBI examines the message history, finds explicit buy-X-at-Y-target-Z messages, and the defence collapses. Disgorgement, market bans and penalties follow.
The four signals SEBI looks for in tips-group cases
- Specific scrip/contract recommendations with entry/target/stop-loss
- Paid access — subscription, joining fee, or revenue share
- Closed-group distribution to identifiable subscribers
- Absence of valid IA/RA registration covering the activity
Hit all four and the enforcement outcome is essentially predictable. Registered IAs and RAs operate on the legal side of (1) and (2) precisely because (4) is in place.
RIA registration and WhatsApp distribution — the lawful pattern
Onboarding before personalised content
A SEBI-registered Investment Adviser can communicate personalised advice over WhatsApp, but only to clients with whom (a) a written advisory agreement is in place, (b) a documented risk profile has been completed, and (c) suitability of the recommendation to that risk profile is on file. The WhatsApp message itself is fine; the file behind it is what survives inspection. Our WhatsApp client-onboarding KYC workflow handles the agreement, risk profile and consent capture inside the same flow that brings the client onto your WhatsApp.
Segregation of marketing and advice
The IA Regulations require functional segregation between distribution and advisory activities. In practice this means your "general market update" Broadcast and your "personalised recommendation for client X" message should be different surfaces, with different audiences, ideally on different flows. RichAutomate tenants typically configure two flows: an opt-in education Broadcast and a per-client advisory channel, with the latter gated by an internal CRM check that the client is onboarded and risk-profiled.
Fee transparency on the registered handle
The Feb-2026 master circular wants your fee slab visible — not buried in an agreement PDF. A pinned message on your WhatsApp Business profile linking to a public fee-disclosure page is the cleanest pattern.
Research Analyst WhatsApp distribution — what is permitted
A registered RA's role is to publish research; distribution over WhatsApp is in scope provided the published report's mandated disclosures travel with the message. The pattern that works:
- Publish the full research note on your registered website with the RA disclosures block (analyst certification, conflicts of interest, holdings, compensation source).
- Distribute on WhatsApp as a short headline + link to the full note. The WhatsApp message itself carries a compressed disclosure footer.
- If the WhatsApp message states a price/target, include the as-of timestamp and link to the source report so the recipient can see the original context.
What is not permitted: an RA pushing a "buy now, target +12%" message into a WhatsApp group without the corresponding published note, without the disclosures, or to recipients who were promised personalised follow-up. The first crosses RA distribution norms; the third crosses into IA territory.
Finfluencers and the 2024 framework
For creators without SEBI registration who publish investment content, the 2024 SEBI–Ministry of Information and Broadcasting framework remains the operative reference. The principle is straightforward: you can educate, but you cannot advise; you cannot run paid tip groups; and you cannot enter financial-incentive arrangements with SEBI-registered entities that, in substance, transfer your unregistered activity onto their registered shoulders.
Where WhatsApp specifically comes in: a public-broadcast WhatsApp Channel for educational content is well within the line. A closed WhatsApp Group with paid access is squarely on the wrong side. The audit trail SEBI examines if it ever investigates is the same audit trail any tenant on RichAutomate generates by default — make sure your operating reality matches the educational posture you publicly claim.
Audit trail — what an inspection actually asks for
Based on the patterns visible in published SEBI orders, a digital-comms inspection typically requests the following for a defined period:
- Complete export of WhatsApp Business messages for the entity's registered number, with timestamps and recipient phone numbers (hashed is acceptable; resolvable on request).
- Mapping of recipients to the client master — i.e. for any personalised-advice message, the corresponding agreement, risk profile and suitability assessment must be retrievable.
- Marketing-message logs — every Broadcast or template message sent for marketing purposes, with the corresponding opt-in record and the template content.
- Disclosure-block presence in every research distribution message.
- For tenants using a platform like RichAutomate: a vendor letter or DPA confirming the messaging records are held on your behalf, with the retention duration and export commitment.
A tenant on our platform satisfies all five out of the box because every message — inbound and outbound — is stored against the tenant ID with a five-year minimum retention by default, exportable as a single CSV/JSON bundle keyed to your registration. For a deep dive on how the platform handles the broader Indian regulatory stack, see our India regulation pillar and the DPDP Act compliance guide.
DPDP Act overlap — do not ignore the data side
Every recipient on your WhatsApp list is a Data Principal under the Digital Personal Data Protection Act 2023 (with the draft Rules notified in November 2024). The five fast ways to a DPDP notice while running an advisory WhatsApp:
- Bundled consent — opting clients into marketing without a separate, explicit, withdrawable opt-in alongside the advisory consent.
- Indefinite retention with no defined purpose-limited deletion schedule.
- Unverifiable consent for minors — Data Principals under 18 require verifiable parental consent for personal-data processing.
- Cross-border transfer without satisfying the notified-country list (relevant if your platform vendor is offshore).
- No Grievance Officer published, no DPO appointed for significant data fiduciaries.
Tools that help: our DPDP Privacy Policy Generator and the DPDP Penalty Calculator. Tenants on RichAutomate get tenant-scoped retention, one-tap data-deletion fulfillment for any Data Principal request, and the Grievance Officer / DPO publication fields built into the platform onboarding.
A 30-minute compliance sprint for your WhatsApp advisory
- Bind your handles on the SI Portal. Confirm the WhatsApp Business number you actually use matches the SEBI record. Fix if needed.
- Separate marketing from advice. Two distinct flows: an opt-in education Broadcast and a per-client advisory channel. Do not mix.
- Publish your fee slab. A public page, linked from your WhatsApp Business profile and your registered website.
- Verify retention. Confirm your platform stores messages with timestamps for five years and can export on demand. If you are on RichAutomate, this is default-on.
- Schedule the half-yearly compliance audit. Pick your CA, CS or now-eligible Cost Accountant. Calendar the audit window so you do not slip.
- Wire DPDP basics. Privacy policy live, consent log captured per recipient, Grievance Officer published, deletion path documented.
- Document research distribution. Every WhatsApp research broadcast references the corresponding full published note URL and timestamp.
Comparing platforms for SEBI-fit WhatsApp advisory
Generic WhatsApp Business solutions do not think about the SEBI audit trail or DPDP retention as first-class features — they treat them as something the customer should "configure". When you are picking a platform, the questions worth asking your vendor sit alongside the obvious ones around pricing and templates:
- Can the platform export every message for my tenant, for any date range, in a single CSV/JSON bundle keyed to my SEBI registration number?
- Does it support a tenant-scoped retention policy I can set per regulatory requirement (five-year minimum)?
- Can I gate certain flows (e.g. personalised advisory) behind an internal check that the recipient is an onboarded, risk-profiled client?
- Does the platform publish a DPDP-compliant DPA I can sign?
- Is the messaging infrastructure aligned with the WhatsApp Business API rather than scraped/personal-account workarounds (which are independently SEBI- and Meta-unfriendly)?
Side-by-side, see how the major Indian providers handle this in our comparison pages: Wati vs RichAutomate, AiSensy vs RichAutomate, Interakt vs RichAutomate, and the 2026 best-API-for-India pillar.
Where this is heading
The trajectory is unambiguous. SEBI is treating WhatsApp as a first-class regulated channel, not a side-channel exempt from inspection. The verified-handle rule has closed the impersonation door for legitimate intermediaries. The Feb-2026 master circulars have given inspectors a single playbook to work from. The finfluencer framework continues to tighten, with each crackdown order narrowing the operating room for unregistered tip groups further. The 1,400 registered RIAs and the registered RAs alongside them now have, for the first time, a workable regulatory map for WhatsApp-led advisory. The cost of getting it right is small — bind your handle, separate the flows, retain the messages, publish your fees. The cost of getting it wrong has scaled steeply.
Get this set up
If you are a SEBI-registered IA or RA evaluating how to bring your WhatsApp practice into compliance with the 2026 posture — verified handle, segregated flows, five-year retention, half-yearly audit-ready export — we can have your tenant configured inside 30 minutes. Book a 30-minute setup call or message us on WhatsApp at +91 74349 01027.