Regulatory Guidance
SEBI Accessibility Audit Checklist for Investment Advisers and Research Analysts
A practical SEBI accessibility audit checklist for investment advisers and research analysts covering client journeys, BSE reporting, C3/C4 evidence, and remediation.
What should an IA or RA include in a SEBI accessibility audit?
An investment adviser (IA) or research analyst (RA) should identify every investor-facing digital platform it operates, define the tasks people need to complete, and test those tasks with manual and automated methods. Record the standards and platform versions used, document barriers with reproducible evidence, remediate them, and retest the affected journeys. Prepare the regulator's submission tables separately from the underlying audit reports.
This checklist interprets SEBI's published digital accessibility directions for planning purposes. It does not assume every IA and RA runs the same product or provides the same services. Confirm the latest circular and BSE submission instructions before filing.
Who reports to whom?
SEBI's July 31, 2025 circular addresses regulated entities, including registered intermediaries. Its August 29, 2025 update expressly sets BSE Ltd. as the accessibility reporting authority for both IAs and RAs. The September compliance guidelines repeat that route. Do not copy the direct-to-SEBI email procedure that applies to other regulated-entity categories into an IA or RA filing plan.
SEBI's December 8, 2025 clarification replaced the earlier December 14 auditor-appointment compliance milestone with a requirement to submit platform-wise readiness and compliance status by March 31, 2026 to the specified reporting authority. Its Annexure B provides a format including the digital-platform URL, an AA-level accessibility answer against the latest WCAG guidelines, and remarks. That status submission is not itself an accessibility audit or a substitute for evidence.
Define the actual client-facing boundary
Start with a digital inventory, not a scan of the public homepage. For an IA, relevant services might include client onboarding, risk-profile forms, advice delivery, portfolio-review portals, payment or subscription steps, and grievance channels. For an RA, they might include research-distribution pages, paid-access journeys, report downloads, disclosures, and account settings. Include each only when the entity actually offers it.
For every platform, record the URL or app version, owner, third-party dependency, user roles, documents published there, and any authenticated access needed for testing. SEBI's September format calls for a platform list; an incomplete inventory can undermine every later claim about scope.
- List public websites, authenticated portals, apps, and investor-facing document libraries.
- Identify critical journeys and their error, timeout, and recovery states.
- Name owners for content, engineering, accessibility, vendor handoffs, and complaints.
- Record exclusions explicitly so a reader does not mistake an untested service for a passed service.
Test advice and research access as complete journeys
A user may discover a service successfully but fail when completing a questionnaire, paying a fee, opening a research PDF, or reading a validation error. Test end-to-end tasks with keyboard navigation, screen readers, zoom or magnification, and clear focus and status feedback. Automated checks can find repeated detectable defects; they cannot establish that a user understands or completes the journey.
SEBI's original circular calls for usability testing by persons with disabilities as part of accessibility audits. The same circular addresses accessible alternatives for digital and video KYC where these processes are offered. A risk-based sample should therefore include both the expected path and the point where a client needs help or recovery.
- Can a keyboard user reach, operate, and leave menus, forms, dialogs, and document controls?
- Are advice or research choices, fees, warnings, and confirmation states understandable without relying on color or layout alone?
- Are form errors identified, explained, and connected to the right controls?
- Can clients access disclosures, reports, and support channels with assistive technology?
Include documents and vendor-operated steps
SEBI's July 2025 directions cover content published on regulated entities' digital platforms, including PDFs and other investor documents. Sample reports, advice material, forms, and disclosures for tags, logical reading order, headings, table structure, link purpose, and image alternatives. A visually readable PDF can still be unusable with a screen reader.
If a vendor provides onboarding, payment, publishing, or another client-facing step, identify that dependency in the audit. SEBI's procurement direction places responsibility for digital-platform accessibility with the regulated entity. Record who will fix a defect, but do not let a third-party boundary hide its effect on the client.
Which standards and governance controls matter?
SEBI's original directions name WCAG 2.1 or a later version, current Guidelines for Indian Government Websites (GIGW), IS 17802, and the Rights of Persons with Disabilities Act and corresponding rules as baseline references. The December 2025 readiness-status format asks whether each platform meets AA level against the latest WCAG guidelines. Specify the version and test scope used in the audit instead of making an unqualified compliance claim.
The original circular also calls for an accessibility nodal officer, management review, and an accessible grievance mechanism. The December clarification notes that accessibility complaints can be lodged through SCORES and that the regulated entity should remediate the issue for complaint closure. These are operating responsibilities as well as testing topics.
How do C3 and C4 relate to the audit reports?
SEBI's September 2025 compliance guidelines define Table C3 as the initial accessibility-audit submission format. It records auditor details, completion date, platforms covered, key findings, and an action plan. The terms of reference, scope, and consolidated initial audit report are attached separately. Table C3 is not the audit report.
Table C4 is the final-submission format. It records final observations, remediation measures, compliance status, and supporting evidence, with the consolidated final audit report attached separately. It should not be mislabeled a retest report. For IAs and RAs, use the BSE reporting route and confirm BSE's current operational instructions rather than assuming the direct-to-SEBI email mechanism applies.
What is the current timeline?
SEBI's July 31, 2026 circular extended the timeline for conducting accessibility audits of digital platforms and remediating audit findings to October 31, 2026, while leaving other provisions unchanged. As of October 26, 2026, teams should check for a later SEBI or BSE update before relying on that date for submission planning.
A deadline does not establish that a platform is accessible. Preserve a dated record of the inventory, tested build, initial findings, remediation decisions, final verification, and outstanding barriers. Do not mark an unresolved user-blocking issue as fully remediated.
Pre-submission checklist for IAs and RAs
The strongest submission package lets a reviewer follow each service from platform inventory through audit finding, fix, retest, and final status. Prioritize the journeys clients must use, and ensure that leadership can see what remains open.
- Confirm the legal entity, SEBI registration details, BSE reporting route, and current instructions.
- Reconcile the platform inventory with the auditor's terms of reference and scope.
- Test complete IA or RA client journeys and representative published documents.
- Keep standards mapping, observed user impact, severity, and reproducible evidence for each finding.
- Assign remediation owners and retain retest results, including unresolved limitations.
- Complete C3 and C4 as tables; attach the relevant initial and final audit reports as separate evidence.
Official sources and next step
SEBI original digital accessibility circular, July 31, 2025: https://www.sebi.gov.in/sebi_data/attachdocs/aug-2025/1754651443956.pdf
SEBI IA/RA reporting-authority update, August 29, 2025: https://www.sebi.gov.in/sebi_data/attachdocs/aug-2025/1756462899734.pdf
SEBI compliance guidelines and Tables C1-C4, September 25, 2025: https://www.sebi.gov.in/sebi_data/attachdocs/sep-2025/1758794128066.pdf
SEBI clarification and readiness-status format, December 8, 2025: https://www.sebi.gov.in/sebi_data/attachdocs/dec-2025/1765194149704.pdf
SEBI audit and remediation timeline extension, July 31, 2026: https://www.sebi.gov.in/legal/circulars/jul-2026/extension-of-timelines-with-repect-to-compliance-of-digital-accessibility-circulars-_103277.html
If your IA or RA needs a scoped, evidence-led review of client journeys and published content, IAAP Audit can help define the audit boundary, document findings, and verify remediation.