SEBI Research Analyst: Governance and Record-Keeping Checklist

SEBI Research Analyst: Governance and Record-Keeping Checklist. SEBI registration is only the starting point for a Research Analyst, as ongoing compliance depends heavily on strong governance and proper record-keeping. A registered RA should maintain a clear operational explaining how research is prepared, reviewed and communicated, how conflicts of interest are identified and managed, how clients are onboarded and how important decisions can later be verified through records.
The SEBI Master Circular for Research Analysts dated February 6, 2026 consolidates key requirements relating to client interactions, KYC, terms and conditions, annual compliance audits, grievance handling, RAASB supervision, cybersecurity, outsourcing and periodic reporting. BSE Limited currently functions as the Research Analyst Administration and Supervisory Body (RAASB). Effective governance therefore requires more than holding a registration certificate. Research Analysts should maintain organised policies, approvals, system records, client documentation and research evidence so that their activities can be demonstrated as compliant during audits, inspections or regulatory reviews.
What Does Governance Mean for a SEBI Research Analyst?
Governance refers to the internal through which a Research Analyst controls its research, compliance, client servicing, conflicts of interest, personnel, technology and regulatory reporting. For an individual RA, this may involve a relatively simple but well-documented internal system. For an LLP, company or other non-individual Research Analyst, governance generally becomes more structured because responsibilities may be divided between the principal officer, research personnel, compliance function, sales personnel and management.
A good governance structure should clearly establish who prepares research, who reviews it, who communicates with clients, who monitors regulatory compliance and who is responsible for maintaining the supporting records. The objective is not merely to create paperwork. It is to create an audit trail that can show what happened, who was responsible, what information was relied upon and whether the relevant SEBI requirements were followed.
Governance Starts With Clear Responsibility
A non-individual Research Analyst must establish responsibility for regulatory compliance. Regulation 26 currently permits a non-individual Research Analyst or research entity to appoint either a compliance officer or an eligible independent professional for monitoring compliance. Where an independent professional is appointed, the principal officer must provide the prescribed undertaking regarding responsibility for compliance.
This means governance responsibility cannot be treated as an informal function performed only when a filing becomes due. The organisation should maintain written responsibility matrices covering research preparation, client onboarding, KYC verification, complaints, fee collection, research disclosures, employee certification, record preservation, website compliance and regulatory reporting. Where an external professional is involved, management should still understand that outsourcing or external assistance does not remove the RA's underlying responsibility for regulatory compliance.
Maintain a Master Compliance Register
A practical starting point is to maintain a central compliance register. The register should identify every continuing obligation applicable to the RA and track its frequency, responsible person, supporting record and completion status. For example, annual compliance audits, half-yearly reports, NISM validity, deposit requirements, website disclosures, complaint reporting and regulatory filings should not be tracked through informal reminders alone.
A central register allows the RA to identify upcoming obligations before deadlines are missed. This becomes particularly useful during annual compliance audits because the auditor can quickly verify whether continuing obligations were completed and obtain the supporting evidence.
Research Reports Must Have a Documentary Basis
One of the core governance principles for an RA is that recommendations should arise from genuine research. The RA Regulations require a Research Analyst or research entity to have an adequate documentary basis supported by research for preparing a research report. The current also requires recommendations to be supported by relevant data and analysis forming the basis of the research service.
Accordingly, an RA should not preserve only the final recommendation. The underlying analytical material should also be maintained in an organised manner. For example, where a recommendation is based on company financial results, industry information, valuation assumptions, management commentary or publicly available market data, the working records should allow the RA to demonstrate how those inputs were converted into the final recommendation. This is particularly important where a recommendation subsequently performs poorly. Market performance by itself does not determine whether research was properly conducted; however, the RA should be capable of demonstrating that the recommendation was based on genuine analysis rather than an unsupported statement.
Maintain Signed and Dated Research Reports
Regulation 25 specifically requires maintenance of the research report duly signed and dated. It also requires preservation of the research recommendation and the rationale used for arriving at that recommendation. Accordingly, the internal file for each research recommendation should make it possible to establish when the report was prepared, who prepared or approved it, what recommendation was issued and what analysis supported that recommendation.
Where records required to be signed are maintained electronically, Regulation 25 provides for digital signing of such records. An RA should therefore avoid a system where research reports are continually edited without version control. The final published version and relevant earlier versions should be capable of being identified.
Maintain the Rationale Behind Every Recommendation
A recommendation such as “Buy”, “Sell”, “Hold” or a particular price target is only the final output of a research process. For compliance purposes, the reasoning behind that output is equally important. The internal record should explain the assumptions, relevant financial information, valuation approach and material factors considered in arriving at the recommendation.
Where the RA operates a rating system, the meaning of ratings, time horizon and benchmark should also remain consistently defined. The regulatory requires facts in research reports to be based on reliable information and rating terminology to be appropriately defined. Research methodology should therefore be standardised enough to produce consistent documentation while still allowing analyst judgment.
Maintain Records of All Research Recommendations
Research delivered to clients may not always take the form of a long PDF report. Recommendations may also be communicated through email, mobile applications, online dashboards, messages or other permitted channels. The underlying regulatory requirement remains that the research service should be supported by appropriate research and that relevant records should be maintained.
Accordingly, an RA should preserve the communication actually provided to clients along with the corresponding research document. If a recommendation was later revised, withdrawn or closed, the updated communication should also be preserved. This provides a complete history instead of a record containing only the original recommendation.
Client KYC Records Must Be Maintained
The current requires an RA to follow applicable KYC procedures for fee-paying clients and maintain relevant KYC records. The KYC record should correspond with the client appearing in the RA's client register and payment records. In practice, systems should be designed to avoid situations where research services are provided to one person while subscription payments are received from another person without an adequately documented basis.
KYC documentation should be accessible, secure and capable of being produced during audit or inspection. Because these documents contain personal information, access should also be restricted to personnel who require it for legitimate regulatory or operational purposes.
Maintain a Complete Client Register
Regulation 25 requires maintenance of a register or record containing details relating to clients. The records include the client's PAN, date and nature of the research service, products or securities for which research service was provided and the fee or consideration charged or received.
This client register should function as a central compliance record. It should allow an auditor or compliance officer to reconcile client onboarding, KYC, fees, research delivery, communications and termination of services. If these records are maintained in separate software systems, a common client identification system can help connect them.
Record Client and Prospective Client Communications
This is one of the most important developments in the modern RA compliance. SEBI's February 2026 Master Circular requires records of interactions with clients as well as prospective clients, including interactions before onboarding where the conversation concerns the RA's services. Recognised records include physical records written and signed by the client, telephone recordings, emails from registered email IDs, SMS records and other legally verifiable records. The records begin from the first interaction concerning the services and continue until completion of research services.
Therefore, compliance cannot begin only after the client makes payment. Sales and onboarding conversations can also form part of the regulatory audit trail. This is particularly important because claims relating to guaranteed returns, fee representations, service scope or past performance can arise during pre-sales communication.
Preserve Records for at Least Five Years
Regulation 25 requires relevant RA records to be preserved for a minimum period of five years. The Master Circular specifically reiterates the five-year requirement for records of client interactions. Where a dispute has been raised, the relevant records should be retained until the dispute is resolved. If SEBI requires particular records to be preserved, they must be retained until further intimation.
Accordingly, an RA should not operate with an automatic deletion policy that removes emails, calls or client data after a few months. Backup policies, email retention, cloud storage and CRM systems should be configured around the regulatory preservation period. The RA should also be able to prevent deletion of records once a complaint, inspection, investigation or dispute arises.
Terms and Conditions and Client Consent
The current RA requires prescribed terms and conditions to be disclosed to clients and client consent to be obtained. SEBI has also introduced Most Important Terms and Conditions (MITC) as part of the disclosure. Client consent may be obtained through legally acceptable methods, including recognised electronic methods.
The governance record should therefore establish exactly which terms were provided to the client and when consent was obtained. Simply updating terms on a website without retaining proof of the client's consent may not create the same evidentiary record. A version-controlled copy of applicable terms should therefore be retained alongside the client's acceptance record.
Conflict-of-Interest Governance
Research independence is a fundamental governance requirement. A Research Analyst or research entity is required to maintain an arms-length relationship between research activities and other activities. The Regulations also contain specific conflict-related disclosure obligations concerning financial interests, ownership, compensation relationships and other connections with subject companies.
For non-individual entities, controls should therefore prevent sales, trading, investment banking or other commercial teams from improperly influencing research conclusions. An RA should maintain a conflict register where relevant interests can be captured before a report is published. Conflict checks should ideally take place before the final approval of research rather than after publication.
Personal Trading Controls
Research personnel may possess knowledge about recommendations before those recommendations become available to clients or the public. Accordingly, SEBI's RA contains restrictions and controls relating to trading by Research Analysts and covered persons.
An effective governance system should therefore include employee declarations, disclosure of relevant trading accounts, restricted or watch lists where appropriate, review of personal trades and escalation procedures for potential breaches. Records of approvals and declarations are important because an internal policy that cannot be demonstrated through records may be difficult to verify during an audit.
Public Appearance Records
Regulation 25 expressly requires maintenance of a record of public appearances. Public appearances can include situations where a Research Analyst gives recommendations or opinions concerning securities through public media.
The regulatory also requires specified disclosures when recommendations or opinions are made through public media, including registration status and relevant financial interests. RAs appearing on television, YouTube, webinars, social media or similar channels should therefore maintain appropriate archives of their appearances. The record should make it possible to identify when the appearance took place, what securities were discussed and what disclosures were made.
Website Governance
A Research Analyst or research entity is required to maintain a functional website containing prescribed information. Website compliance should therefore form part of regular internal review rather than being treated as a one-time requirement at registration. Information relating to registration, grievance handling, Investor Charter, complaints and other prescribed disclosures should remain updated.
The compliance function should also review subscription pages, performance claims, testimonials, advertisements and service descriptions. An RA can create regulatory risk if its formal documents comply with SEBI requirements but its website contains contradictory claims.
Social Media Governance
Digital communication is increasingly relevant for Research Analysts. SEBI issued further guidance in February 2026 concerning disclosure of the registered name and registration number by regulated entities and their agents on social media platforms.
Accordingly, social media governance should cover not only what recommendations are published but also who is authorised to publish them, what registration information is displayed and whether promotional statements comply with applicable advertising requirements. Access credentials to official accounts should be controlled, and archived copies of significant regulatory or promotional content should be preserved wherever appropriate.
Artificial Intelligence Use Must Be Governed
AI tools can assist in data analysis, drafting, screening or other aspects of research, but the use of AI does not transfer regulatory responsibility away from the Research Analyst. Under the current, an RA using AI tools remains responsible for the security, confidentiality and integrity of client data and for research services based on AI outputs. The RA must also disclose to clients the extent of AI use in providing research services.
Governance should therefore address which AI tools may be used, what information can be uploaded, who verifies AI-generated outputs and how the extent of AI usage is disclosed. Human review remains particularly important where AI-generated material contributes to an investment recommendation.
Complaint and Grievance Records
Investor complaints should be treated as a governance matter rather than simply a customer-service issue. SEBI's Research Analyst includes requirements relating to investor grievance redressal, SCORES, Online Dispute Resolution and publication of complaint information. The Master Circular contains a prescribed structure for monthly complaint information, including complaints received, resolved, pending and average resolution time.
Each complaint should therefore have a complete file containing receipt date, issue raised, internal investigation, communication with the client, resolution and closure evidence. Recurring complaints should also be analysed to determine whether there is a broader compliance weakness.
Annual Compliance Audit
Every Research Analyst or research entity is required to undergo an annual compliance audit. The audit must examine compliance with the RA Regulations and relevant circulars and guidelines. The current requires the audit to be completed within six months from the end of each financial year, with the compliance audit report submitted to RAASB/SEBI within one month from the date of the report. Adverse findings and action taken must also be submitted within the prescribed timeline, with the providing an outside date of October 31 for the previous financial year.
SEBI also clarified in March 2026 the eligibility of members of the Institute of Cost Accountants of India to conduct the annual audit, alongside the professional categories contemplated under the amended. The audit should not be viewed as an exercise to begin shortly before the deadline. Records should be audit-ready throughout the year.
Publication of Compliance Audit Information
The governance requirement extends beyond merely conducting the audit. Under the February 2026 Master Circular, the RA or research entity must publish the status of the compliance audit report on its website. Where there are adverse findings, the findings and action taken must also be published. The compliance audit report is also to be provided to clients.
This makes deficiencies more visible and increases the importance of continuously maintaining compliant systems. Management should therefore review audit findings carefully and document the corrective action taken.
Half-Yearly Periodic Reporting
Research Analysts are also subject to periodic reporting. The current Master Circular requires periodic reports for the half-years ending September 30 and March 31, with reports generally due within 30 days from the end of the respective half-yearly period. RAs submit the report to RAASB in the format notified by RAASB in consultation with SEBI.
The information submitted should be reconciled with internal client registers, fee records and regulatory data. A common governance weakness is maintaining regulatory information separately from operational information, which can result in conflicting numbers being reported.
Cybersecurity and Technology Controls
The February 2026 Master Circular also includes the applicable Cybersecurity and Cyber Resilience within the RA compliance. Technology governance should therefore address user access, passwords, backups, malware protection, incident handling, vendor access and preservation of regulated records.
The importance of technology controls increases where an RA operates through a website, application, automated recommendation platform, cloud-based CRM or third-party subscription system. A system outage or cyber incident should not result in permanent loss of regulatory records.
Outsourcing Does Not Outsource Responsibility
Research Analysts may use external service providers for functions such as technology, cloud hosting, call recording, accounting or customer-support infrastructure. SEBI's Master Circular incorporates principles governing outsourcing by intermediaries.
An RA should therefore conduct appropriate due diligence before outsourcing important activities and maintain sufficient control over records and information held by vendors. A contract with a service provider should not result in a situation where the RA cannot retrieve records required by SEBI or RAASB. Vendor agreements should also address confidentiality, access, continuity and record availability.
Practical SEBI RA Governance and Record-Keeping Checklist

Compliance Area

Key Record or Control

Research reports

Signed and dated final research reports

Research rationale

Data, analysis, assumptions and documentary basis

Recommendations

Complete history of recommendations and revisions

Clients

Client register with PAN, services, securities/products and fees

KYC

KYC records of fee-paying clients

Client communications

Calls, emails, SMS and other legally verifiable interactions

Prospective clients

Records beginning from first service-related interaction

Terms & Conditions

Applicable T&C/MITC and evidence of client consent

Conflicts

Conflict declarations, financial interest disclosures and checks

Public appearances

Records of media appearances and relevant disclosures

Website

Current regulatory, grievance and prescribed disclosures

Complaints

Complaint register and resolution evidence

AI-use disclosure and internal controls over AI-generated output

Compliance function

Compliance officer/independent professional documentation

Annual audit

Audit report, findings and corrective actions

Periodic reports

Half-yearly RAASB reporting records

Technology

Backups, access controls and cybersecurity documentation

Record retention

Minimum five-year preservation and dispute holds

Common Record-Keeping Mistakes
A frequent problem is that records exist but cannot be connected. For example, the RA may have a research report in one folder, client information in a CRM, payment details in a bank account, recommendations on WhatsApp and call recordings with an external service provider. Unless these records can be linked and retrieved efficiently, the compliance system may become difficult to audit.
Another mistake is preserving only successful recommendations while deleting or ignoring recommendations that were later closed or performed poorly. Regulatory records should provide a complete history rather than a selectively favourable one. RAs should also avoid maintaining documents only immediately before the compliance audit. Many requirements involve contemporaneous records, meaning the evidence should be created when the underlying activity takes place.
How Long Should SEBI RA Records Be Kept?
The core rule under Regulation 25 is a minimum preservation period of five years. For communication records, the February 2026 Master Circular makes clear that if a dispute has been raised, records must continue to be preserved until the dispute is resolved. Where SEBI requires specific records to be retained, they must remain preserved until SEBI gives further intimation.
Therefore, five years should be treated as the minimum standard rather than an automatic deletion date. A legal hold mechanism should be available for disputed, investigated or otherwise relevant records.
Why Strong Record-Keeping Matters During Inspection
SEBI's regulatory permits inspection of the books, records and operations of Research Analysts. During an inspection, the central question is often not simply whether the RA states that it complied with a requirement, but whether it can demonstrate the compliance through evidence.
For example, if the RA says that a research recommendation was supported by detailed analysis, the underlying report and rationale should exist. If it says that the client accepted the terms, consent should be available. If it says a complaint was resolved, closure records should exist. If it states that conflicts were reviewed, the relevant internal records should demonstrate that review. Strong record-keeping therefore turns compliance from an assertion into evidence.
Building an Audit-Ready RA Compliance System
The most effective approach is to build compliance into daily operations. Client onboarding should automatically create the required KYC, terms and consent records. Research publication systems should preserve signed final reports and supporting rationale. Communication systems should retain calls and messages. Complaint systems should track closure. The compliance calendar should identify periodic reporting and audit deadlines.
This approach is more reliable than collecting documents retrospectively at the end of the financial year. An audit-ready system also reduces dependency on individual employees because important compliance records remain with the organisation even when personnel change.
Conclusion
Governance and record-keeping are essential parts of SEBI Research Analyst compliance. A registered Research Analyst should be able to show not only the recommendation provided to clients but also the research process behind it, the data and assumptions relied upon, the person responsible for preparing or approving it, the disclosures made and the communications connected with the service. Proper documentation creates a clear audit trail and helps demonstrate that research activities are being carried out in accordance with the applicable regulatory.
Research Analysts should maintain important research, client, KYC, consent, communication, complaint and public-appearance records for the prescribed period and ensure that continuing obligations relating to conflicts of interest, website disclosures, grievance handling, annual compliance audits and periodic reporting are properly monitored. A structured governance system can reduce compliance gaps, improve accountability and make regulatory audits or inspections easier to manage. Record-keeping should therefore be integrated into everyday research and client-service processes rather than treated as a separate administrative task.
Frequently Asked Questions
Q1. What records must a SEBI Research Analyst maintain?
Ans. A Research Analyst should maintain research reports, supporting rationale, client records, KYC details, fee records, communication records, public-appearance records, complaint records and other documents required under the SEBI Research Analyst.
Q2. How long should Research Analyst records be preserved?
Ans. Relevant records are generally required to be preserved for a minimum period of five years. Where a dispute, investigation or regulatory requirement continues beyond that period, the relevant records may need to be retained until the matter is resolved.
Q3. Is it necessary to maintain the research rationale behind every recommendation?
Ans. Yes. The Research Analyst should maintain adequate documentary evidence showing the data, analysis, assumptions and reasoning used to arrive at a recommendation. Keeping only the final “Buy”, “Sell” or “Hold” recommendation may not provide a complete audit trail.
Q4. Are client calls and messages required to be recorded?
Ans. Records of relevant interactions with clients and prospective clients should be maintained in legally verifiable forms. Depending on the mode of communication, this may include telephone recordings, emails, SMS or other permitted communication records.
Q5. Is KYC mandatory for Research Analyst clients?
Ans. Applicable KYC requirements generally apply to fee-paying Research Analyst clients. The RA should ensure that client identification and KYC records are properly maintained and linked with the relevant client account and service records.
Q6. Does a SEBI Research Analyst need to conduct an annual compliance audit?
Ans. Yes. Research Analysts are subject to an annual compliance audit under the applicable SEBI. The audit examines compliance with the Research Analyst Regulations, circulars and other regulatory requirements.
Q7. What governance controls should a Research Analyst have?
Ans. A Research Analyst should establish clear responsibility for research preparation, compliance monitoring, conflict management, client onboarding, complaints, record preservation, personal trading controls and regulatory reporting. Non-individual RAs should also clearly define the role of the principal officer and compliance function.
Q8. Are public appearances and social media recommendations covered by SEBI compliance?
Ans. Yes. Recommendations or opinions relating to securities communicated through public media may attract disclosure and record-keeping requirements. RAs should therefore maintain appropriate records of television appearances, webinars, YouTube content, social media posts and similar communications where applicable.
Q9. Can a Research Analyst use AI tools for preparing research reports?
Ans. AI tools may be used, but regulatory responsibility continues to remain with the Research Analyst. Appropriate controls should be maintained regarding client-data confidentiality, accuracy of AI-generated outputs, human review and disclosure of AI usage wherever required under the applicable SEBI.
Q10. Why is proper record-keeping important for a SEBI Research Analyst?
Ans. Proper record-keeping helps demonstrate compliance during audits, inspections, regulatory queries and client disputes. It allows the RA to establish how a recommendation was developed, what disclosures were made, which clients received the service and whether required regulatory procedures were followed.

SEBI registration is only the starting point for a Research Analyst, as ongoing compliance depends heavily on strong governance and proper record-keeping. A registered RA should maintain a clear operational explaining how research is prepared, reviewed and communicated, how conflicts of interest are identified and managed, how clients are onboarded and how important decisions can later be verified through records.

The SEBI Master Circular for Research Analysts dated February 6, 2026 consolidates key requirements relating to client interactions, KYC, terms and conditions, annual compliance audits, grievance handling, RAASB supervision, cybersecurity, outsourcing and periodic reporting. BSE Limited currently functions as the Research Analyst Administration and Supervisory Body (RAASB). Effective governance therefore requires more than holding a registration certificate. Research Analysts should maintain organised policies, approvals, system records, client documentation and research evidence so that their activities can be demonstrated as compliant during audits, inspections or regulatory reviews.

What Does Governance Mean for a SEBI Research Analyst?

Governance refers to the internal through which a Research Analyst controls its research, compliance, client servicing, conflicts of interest, personnel, technology and regulatory reporting. For an individual RA, this may involve a relatively simple but well-documented internal system. For an LLP, company or other non-individual Research Analyst, governance generally becomes more structured because responsibilities may be divided between the principal officer, research personnel, compliance function, sales personnel and management.

A good governance structure should clearly establish who prepares research, who reviews it, who communicates with clients, who monitors regulatory compliance and who is responsible for maintaining the supporting records. The objective is not merely to create paperwork. It is to create an audit trail that can show what happened, who was responsible, what information was relied upon and whether the relevant SEBI requirements were followed.

Governance Starts With Clear Responsibility

A non-individual Research Analyst must establish responsibility for regulatory compliance. Regulation 26 currently permits a non-individual Research Analyst or research entity to appoint either a compliance officer or an eligible independent professional for monitoring compliance. Where an independent professional is appointed, the principal officer must provide the prescribed undertaking regarding responsibility for compliance.

This means governance responsibility cannot be treated as an informal function performed only when a filing becomes due. The organisation should maintain written responsibility matrices covering research preparation, client onboarding, KYC verification, complaints, fee collection, research disclosures, employee certification, record preservation, website compliance and regulatory reporting. Where an external professional is involved, management should still understand that outsourcing or external assistance does not remove the RA's underlying responsibility for regulatory compliance.

Maintain a Master Compliance Register

A practical starting point is to maintain a central compliance register. The register should identify every continuing obligation applicable to the RA and track its frequency, responsible person, supporting record and completion status. For example, annual compliance audits, half-yearly reports, NISM validity, deposit requirements, website disclosures, complaint reporting and regulatory filings should not be tracked through informal reminders alone.

A central register allows the RA to identify upcoming obligations before deadlines are missed. This becomes particularly useful during annual compliance audits because the auditor can quickly verify whether continuing obligations were completed and obtain the supporting evidence.

Research Reports Must Have a Documentary Basis

One of the core governance principles for an RA is that recommendations should arise from genuine research. The RA Regulations require a Research Analyst or research entity to have an adequate documentary basis supported by research for preparing a research report. The current also requires recommendations to be supported by relevant data and analysis forming the basis of the research service.

Accordingly, an RA should not preserve only the final recommendation. The underlying analytical material should also be maintained in an organised manner. For example, where a recommendation is based on company financial results, industry information, valuation assumptions, management commentary or publicly available market data, the working records should allow the RA to demonstrate how those inputs were converted into the final recommendation. This is particularly important where a recommendation subsequently performs poorly. Market performance by itself does not determine whether research was properly conducted; however, the RA should be capable of demonstrating that the recommendation was based on genuine analysis rather than an unsupported statement.

Maintain Signed and Dated Research Reports

Regulation 25 specifically requires maintenance of the research report duly signed and dated. It also requires preservation of the research recommendation and the rationale used for arriving at that recommendation. Accordingly, the internal file for each research recommendation should make it possible to establish when the report was prepared, who prepared or approved it, what recommendation was issued and what analysis supported that recommendation.

Where records required to be signed are maintained electronically, Regulation 25 provides for digital signing of such records. An RA should therefore avoid a system where research reports are continually edited without version control. The final published version and relevant earlier versions should be capable of being identified.

Maintain the Rationale Behind Every Recommendation

A recommendation such as “Buy”, “Sell”, “Hold” or a particular price target is only the final output of a research process. For compliance purposes, the reasoning behind that output is equally important. The internal record should explain the assumptions, relevant financial information, valuation approach and material factors considered in arriving at the recommendation.

Where the RA operates a rating system, the meaning of ratings, time horizon and benchmark should also remain consistently defined. The regulatory requires facts in research reports to be based on reliable information and rating terminology to be appropriately defined. Research methodology should therefore be standardised enough to produce consistent documentation while still allowing analyst judgment.

Maintain Records of All Research Recommendations

Research delivered to clients may not always take the form of a long PDF report. Recommendations may also be communicated through email, mobile applications, online dashboards, messages or other permitted channels. The underlying regulatory requirement remains that the research service should be supported by appropriate research and that relevant records should be maintained.

Accordingly, an RA should preserve the communication actually provided to clients along with the corresponding research document. If a recommendation was later revised, withdrawn or closed, the updated communication should also be preserved. This provides a complete history instead of a record containing only the original recommendation.

Client KYC Records Must Be Maintained

The current requires an RA to follow applicable KYC procedures for fee-paying clients and maintain relevant KYC records. The KYC record should correspond with the client appearing in the RA's client register and payment records. In practice, systems should be designed to avoid situations where research services are provided to one person while subscription payments are received from another person without an adequately documented basis.

KYC documentation should be accessible, secure and capable of being produced during audit or inspection. Because these documents contain personal information, access should also be restricted to personnel who require it for legitimate regulatory or operational purposes.

Maintain a Complete Client Register

Regulation 25 requires maintenance of a register or record containing details relating to clients. The records include the client's PAN, date and nature of the research service, products or securities for which research service was provided and the fee or consideration charged or received.

This client register should function as a central compliance record. It should allow an auditor or compliance officer to reconcile client onboarding, KYC, fees, research delivery, communications and termination of services. If these records are maintained in separate software systems, a common client identification system can help connect them.

Record Client and Prospective Client Communications

This is one of the most important developments in the modern RA compliance. SEBI's February 2026 Master Circular requires records of interactions with clients as well as prospective clients, including interactions before onboarding where the conversation concerns the RA's services. Recognised records include physical records written and signed by the client, telephone recordings, emails from registered email IDs, SMS records and other legally verifiable records. The records begin from the first interaction concerning the services and continue until completion of research services.

Therefore, compliance cannot begin only after the client makes payment. Sales and onboarding conversations can also form part of the regulatory audit trail. This is particularly important because claims relating to guaranteed returns, fee representations, service scope or past performance can arise during pre-sales communication.

Preserve Records for at Least Five Years

Regulation 25 requires relevant RA records to be preserved for a minimum period of five years. The Master Circular specifically reiterates the five-year requirement for records of client interactions. Where a dispute has been raised, the relevant records should be retained until the dispute is resolved. If SEBI requires particular records to be preserved, they must be retained until further intimation.

Accordingly, an RA should not operate with an automatic deletion policy that removes emails, calls or client data after a few months. Backup policies, email retention, cloud storage and CRM systems should be configured around the regulatory preservation period. The RA should also be able to prevent deletion of records once a complaint, inspection, investigation or dispute arises.

Terms and Conditions and Client Consent

The current RA requires prescribed terms and conditions to be disclosed to clients and client consent to be obtained. SEBI has also introduced Most Important Terms and Conditions (MITC) as part of the disclosure. Client consent may be obtained through legally acceptable methods, including recognised electronic methods.

The governance record should therefore establish exactly which terms were provided to the client and when consent was obtained. Simply updating terms on a website without retaining proof of the client's consent may not create the same evidentiary record. A version-controlled copy of applicable terms should therefore be retained alongside the client's acceptance record.

Conflict-of-Interest Governance

Research independence is a fundamental governance requirement. A Research Analyst or research entity is required to maintain an arms-length relationship between research activities and other activities. The Regulations also contain specific conflict-related disclosure obligations concerning financial interests, ownership, compensation relationships and other connections with subject companies.

For non-individual entities, controls should therefore prevent sales, trading, investment banking or other commercial teams from improperly influencing research conclusions. An RA should maintain a conflict register where relevant interests can be captured before a report is published. Conflict checks should ideally take place before the final approval of research rather than after publication.

Personal Trading Controls

Research personnel may possess knowledge about recommendations before those recommendations become available to clients or the public. Accordingly, SEBI's RA contains restrictions and controls relating to trading by Research Analysts and covered persons.

An effective governance system should therefore include employee declarations, disclosure of relevant trading accounts, restricted or watch lists where appropriate, review of personal trades and escalation procedures for potential breaches. Records of approvals and declarations are important because an internal policy that cannot be demonstrated through records may be difficult to verify during an audit.

Public Appearance Records

Regulation 25 expressly requires maintenance of a record of public appearances. Public appearances can include situations where a Research Analyst gives recommendations or opinions concerning securities through public media.

The regulatory also requires specified disclosures when recommendations or opinions are made through public media, including registration status and relevant financial interests. RAs appearing on television, YouTube, webinars, social media or similar channels should therefore maintain appropriate archives of their appearances. The record should make it possible to identify when the appearance took place, what securities were discussed and what disclosures were made.

Website Governance

A Research Analyst or research entity is required to maintain a functional website containing prescribed information. Website compliance should therefore form part of regular internal review rather than being treated as a one-time requirement at registration. Information relating to registration, grievance handling, Investor Charter, complaints and other prescribed disclosures should remain updated.

The compliance function should also review subscription pages, performance claims, testimonials, advertisements and service descriptions. An RA can create regulatory risk if its formal documents comply with SEBI requirements but its website contains contradictory claims.

Social Media Governance

Digital communication is increasingly relevant for Research Analysts. SEBI issued further guidance in February 2026 concerning disclosure of the registered name and registration number by regulated entities and their agents on social media platforms.

Accordingly, social media governance should cover not only what recommendations are published but also who is authorised to publish them, what registration information is displayed and whether promotional statements comply with applicable advertising requirements. Access credentials to official accounts should be controlled, and archived copies of significant regulatory or promotional content should be preserved wherever appropriate.

Artificial Intelligence Use Must Be Governed

AI tools can assist in data analysis, drafting, screening or other aspects of research, but the use of AI does not transfer regulatory responsibility away from the Research Analyst. Under the current, an RA using AI tools remains responsible for the security, confidentiality and integrity of client data and for research services based on AI outputs. The RA must also disclose to clients the extent of AI use in providing research services.

Governance should therefore address which AI tools may be used, what information can be uploaded, who verifies AI-generated outputs and how the extent of AI usage is disclosed. Human review remains particularly important where AI-generated material contributes to an investment recommendation.

Complaint and Grievance Records

Investor complaints should be treated as a governance matter rather than simply a customer-service issue. SEBI's Research Analyst includes requirements relating to investor grievance redressal, SCORES, Online Dispute Resolution and publication of complaint information. The Master Circular contains a prescribed structure for monthly complaint information, including complaints received, resolved, pending and average resolution time.

Each complaint should therefore have a complete file containing receipt date, issue raised, internal investigation, communication with the client, resolution and closure evidence. Recurring complaints should also be analysed to determine whether there is a broader compliance weakness.

Annual Compliance Audit

Every Research Analyst or research entity is required to undergo an annual compliance audit. The audit must examine compliance with the RA Regulations and relevant circulars and guidelines. The current requires the audit to be completed within six months from the end of each financial year, with the compliance audit report submitted to RAASB/SEBI within one month from the date of the report. Adverse findings and action taken must also be submitted within the prescribed timeline, with the providing an outside date of October 31 for the previous financial year.

SEBI also clarified in March 2026 the eligibility of members of the Institute of Cost Accountants of India to conduct the annual audit, alongside the professional categories contemplated under the amended. The audit should not be viewed as an exercise to begin shortly before the deadline. Records should be audit-ready throughout the year.

Publication of Compliance Audit Information

The governance requirement extends beyond merely conducting the audit. Under the February 2026 Master Circular, the RA or research entity must publish the status of the compliance audit report on its website. Where there are adverse findings, the findings and action taken must also be published. The compliance audit report is also to be provided to clients.

This makes deficiencies more visible and increases the importance of continuously maintaining compliant systems. Management should therefore review audit findings carefully and document the corrective action taken.

Half-Yearly Periodic Reporting

Research Analysts are also subject to periodic reporting. The current Master Circular requires periodic reports for the half-years ending September 30 and March 31, with reports generally due within 30 days from the end of the respective half-yearly period. RAs submit the report to RAASB in the format notified by RAASB in consultation with SEBI.

The information submitted should be reconciled with internal client registers, fee records and regulatory data. A common governance weakness is maintaining regulatory information separately from operational information, which can result in conflicting numbers being reported.

Cybersecurity and Technology Controls

The February 2026 Master Circular also includes the applicable Cybersecurity and Cyber Resilience within the RA compliance. Technology governance should therefore address user access, passwords, backups, malware protection, incident handling, vendor access and preservation of regulated records.

The importance of technology controls increases where an RA operates through a website, application, automated recommendation platform, cloud-based CRM or third-party subscription system. A system outage or cyber incident should not result in permanent loss of regulatory records.

Outsourcing Does Not Outsource Responsibility

Research Analysts may use external service providers for functions such as technology, cloud hosting, call recording, accounting or customer-support infrastructure. SEBI's Master Circular incorporates principles governing outsourcing by intermediaries.

An RA should therefore conduct appropriate due diligence before outsourcing important activities and maintain sufficient control over records and information held by vendors. A contract with a service provider should not result in a situation where the RA cannot retrieve records required by SEBI or RAASB. Vendor agreements should also address confidentiality, access, continuity and record availability.

Practical SEBI RA Governance and Record-Keeping Checklist

Compliance Area	Key Record or Control
Research reports	Signed and dated final research reports
Research rationale	Data, analysis, assumptions and documentary basis
Recommendations	Complete history of recommendations and revisions
Clients	Client register with PAN, services, securities/products and fees
KYC	KYC records of fee-paying clients
Client communications	Calls, emails, SMS and other legally verifiable interactions
Prospective clients	Records beginning from first service-related interaction
Terms & Conditions	Applicable T&C/MITC and evidence of client consent
Conflicts	Conflict declarations, financial interest disclosures and checks
Public appearances	Records of media appearances and relevant disclosures
Website	Current regulatory, grievance and prescribed disclosures
Complaints	Complaint register and resolution evidence
AI	AI-use disclosure and internal controls over AI-generated output
Compliance function	Compliance officer/independent professional documentation
Annual audit	Audit report, findings and corrective actions
Periodic reports	Half-yearly RAASB reporting records
Technology	Backups, access controls and cybersecurity documentation
Record retention	Minimum five-year preservation and dispute holds

Common Record-Keeping Mistakes

A frequent problem is that records exist but cannot be connected. For example, the RA may have a research report in one folder, client information in a CRM, payment details in a bank account, recommendations on WhatsApp and call recordings with an external service provider. Unless these records can be linked and retrieved efficiently, the compliance system may become difficult to audit.

Another mistake is preserving only successful recommendations while deleting or ignoring recommendations that were later closed or performed poorly. Regulatory records should provide a complete history rather than a selectively favourable one. RAs should also avoid maintaining documents only immediately before the compliance audit. Many requirements involve contemporaneous records, meaning the evidence should be created when the underlying activity takes place.

How Long Should SEBI RA Records Be Kept?

The core rule under Regulation 25 is a minimum preservation period of five years. For communication records, the February 2026 Master Circular makes clear that if a dispute has been raised, records must continue to be preserved until the dispute is resolved. Where SEBI requires specific records to be retained, they must remain preserved until SEBI gives further intimation.

Therefore, five years should be treated as the minimum standard rather than an automatic deletion date. A legal hold mechanism should be available for disputed, investigated or otherwise relevant records.

Why Strong Record-Keeping Matters During Inspection

SEBI's regulatory permits inspection of the books, records and operations of Research Analysts. During an inspection, the central question is often not simply whether the RA states that it complied with a requirement, but whether it can demonstrate the compliance through evidence.

For example, if the RA says that a research recommendation was supported by detailed analysis, the underlying report and rationale should exist. If it says that the client accepted the terms, consent should be available. If it says a complaint was resolved, closure records should exist. If it states that conflicts were reviewed, the relevant internal records should demonstrate that review. Strong record-keeping therefore turns compliance from an assertion into evidence.

Building an Audit-Ready RA Compliance System

The most effective approach is to build compliance into daily operations. Client onboarding should automatically create the required KYC, terms and consent records. Research publication systems should preserve signed final reports and supporting rationale. Communication systems should retain calls and messages. Complaint systems should track closure. The compliance calendar should identify periodic reporting and audit deadlines.

This approach is more reliable than collecting documents retrospectively at the end of the financial year. An audit-ready system also reduces dependency on individual employees because important compliance records remain with the organisation even when personnel change.

Conclusion

Governance and record-keeping are essential parts of SEBI Research Analyst compliance. A registered Research Analyst should be able to show not only the recommendation provided to clients but also the research process behind it, the data and assumptions relied upon, the person responsible for preparing or approving it, the disclosures made and the communications connected with the service. Proper documentation creates a clear audit trail and helps demonstrate that research activities are being carried out in accordance with the applicable regulatory.

Research Analysts should maintain important research, client, KYC, consent, communication, complaint and public-appearance records for the prescribed period and ensure that continuing obligations relating to conflicts of interest, website disclosures, grievance handling, annual compliance audits and periodic reporting are properly monitored. A structured governance system can reduce compliance gaps, improve accountability and make regulatory audits or inspections easier to manage. Record-keeping should therefore be integrated into everyday research and client-service processes rather than treated as a separate administrative task.

Frequently Asked Questions

Q1. What records must a SEBI Research Analyst maintain?

Ans. A Research Analyst should maintain research reports, supporting rationale, client records, KYC details, fee records, communication records, public-appearance records, complaint records and other documents required under the SEBI Research Analyst.

Q2. How long should Research Analyst records be preserved?

Ans. Relevant records are generally required to be preserved for a minimum period of five years. Where a dispute, investigation or regulatory requirement continues beyond that period, the relevant records may need to be retained until the matter is resolved.

Q3. Is it necessary to maintain the research rationale behind every recommendation?

Ans. Yes. The Research Analyst should maintain adequate documentary evidence showing the data, analysis, assumptions and reasoning used to arrive at a recommendation. Keeping only the final “Buy”, “Sell” or “Hold” recommendation may not provide a complete audit trail.

Q4. Are client calls and messages required to be recorded?

Ans. Records of relevant interactions with clients and prospective clients should be maintained in legally verifiable forms. Depending on the mode of communication, this may include telephone recordings, emails, SMS or other permitted communication records.

Q5. Is KYC mandatory for Research Analyst clients?

Ans. Applicable KYC requirements generally apply to fee-paying Research Analyst clients. The RA should ensure that client identification and KYC records are properly maintained and linked with the relevant client account and service records.

Q6. Does a SEBI Research Analyst need to conduct an annual compliance audit?

Ans. Yes. Research Analysts are subject to an annual compliance audit under the applicable SEBI. The audit examines compliance with the Research Analyst Regulations, circulars and other regulatory requirements.

Q7. What governance controls should a Research Analyst have?

Ans. A Research Analyst should establish clear responsibility for research preparation, compliance monitoring, conflict management, client onboarding, complaints, record preservation, personal trading controls and regulatory reporting. Non-individual RAs should also clearly define the role of the principal officer and compliance function.

Q8. Are public appearances and social media recommendations covered by SEBI compliance?

Ans. Yes. Recommendations or opinions relating to securities communicated through public media may attract disclosure and record-keeping requirements. RAs should therefore maintain appropriate records of television appearances, webinars, YouTube content, social media posts and similar communications where applicable.

Q9. Can a Research Analyst use AI tools for preparing research reports?

Ans. AI tools may be used, but regulatory responsibility continues to remain with the Research Analyst. Appropriate controls should be maintained regarding client-data confidentiality, accuracy of AI-generated outputs, human review and disclosure of AI usage wherever required under the applicable SEBI.

Q10. Why is proper record-keeping important for a SEBI Research Analyst?

Ans. Proper record-keeping helps demonstrate compliance during audits, inspections, regulatory queries and client disputes. It allows the RA to establish how a recommendation was developed, what disclosures were made, which clients received the service and whether required regulatory procedures were followed.