Inside India’s Forex VPS Regulations: From FEMA to Algo Compliance

The RBI Alert List was updated on November 19, 2025. It names 95 entities that are not authorised to deal in forex under FEMA. They are also not authorised to operate an electronic trading platform. For any Indian resident running an EA on a VPS, the question is not whether the server works. The question is whether the platform it connects to is permitted.

What does FEMA actually allow, and where does a VPS fit in the compliance chain? DedicatedCore and DomainRacer host Forex VPS servers across India and globally. This article covers FEMA and SEBI rules, the static IP requirement for algo trading, CERT-In obligations for providers, and the penalties that apply when a setup crosses the line.

Onshore vs Offshore Forex VPS: What Indian Traders Need to Know

A practical Forex VPS compliance flowchart showing how broker, trading instrument, and payment method affect regulatory considerations for Indian residents.

A VPS is neutral infrastructure. Whether a setup is legal depends on what the server connects to and how money moves through the account.

• Onshore route — a VPS connects to a SEBI-registered broker for currency derivatives on NSE, BSE or MSE. This is permitted and useful for algo compliance
• Offshore route — a VPS connects to an unauthorised platform for spot forex, CFDs or binary options. Daily automated orders count as a continuing contravention
• Server location changes nothing — an Indian resident using a London VPS to trade on an unauthorised platform is still under FEMA. Compliance follows the money trail
• Continuing use increases exposure — an EA placing orders every day is a fresh contravention each day under Section 13

We handle the infrastructure layer with dedicated static IPs, KVM isolation and India-based hosting. We state on every plan that a VPS does not change your regulatory position. Jurisdiction rules across five markets are covered in Forex VPS Rules and Regulations.

FEMA and Forex Trading: Understanding Authorised Channels

The Foreign Exchange Management Act sets the boundary every Indian forex trader operates within.

• Authorised Persons only — Section 3 of FEMA says no person shall deal in foreign exchange except through an Authorised Person. For retail traders, this means a SEBI-registered broker
• Electronic Trading Platforms — the RBI ETP Directions of June 16, 2025 replaced the 2018 framework. Dealing through an unauthorised ETP is a FEMA contravention
• LRS does not cover margin trading — the LRS permits up to USD 250,000 per year. Margin deposits and overseas forex trading are excluded
• The rule covers the channel — EUR/USD through a SEBI broker on a recognised exchange is permitted. The same pair as a spot or CFD through an offshore platform is not

DedicatedCore is infrastructure, not a compliance shortcut. Every plan ships with a dedicated static IPv4, RDP hardening and firewall rules locked to the trader’s own IPs. Security controls applied before handover are detailed in Forex VPS How We Secure Trading Servers.

Indian Forex Trading: Permitted Pairs and Exchange-Ready VPS Locations

The restriction applies to the product and venue, not to forex as an activity.

• INR pairs — USD-INR, EUR-INR, GBP-INR and JPY-INR are traded as currency futures and options on NSE, BSE and MSE
• Cross-currency pairs — EUR-USD, GBP-USD and USD-JPY have been allowed on recognised exchanges since 2015.
• Contract specifications — monthly contracts expire two working days before the last business day. Trading runs 9:00 AM to 5:00 PM IST
• India-based hosting advantage — a VPS in India keeps routes shorter for onshore exchange trading. Proximity to the matching engine reduces latency, jitter and slippage

We host in Mumbai, Pune, Bangalore, Hyderabad, Delhi NCR and Noida. Onshore exchange trading benefits from short network paths to the matching engine. We measure latency and jitter on each route — details in Forex VPS How We Measure Proximity and Performance.

SEBI Retail Algo Trading Rules: Static IP and Broker Requirements

DedicatedCore provides dedicated static IPv4 addresses for VPS plans, supporting traders who need stable IP infrastructure for broker connectivity. SEBI regulates brokers and trading frameworks—not hosting providers.

The SEBI circular of February 4, 2025 covers retail algo trading. It applies to all brokers from April 1, 2026.

• No open APIs — every API connection needs a unique API key and a static IP whitelisted by the broker. OAuth and 2FA are required
• Static IP whitelisting — brokers allow a primary and a secondary static IP. Changes are limited to once a week. A sudden IP change can reject orders
• Algo registration threshold — any algo placing more than 10 orders per second must be registered with the exchange. It gets a unique algo ID
• Message-to-order ratios — exchanges monitor the ratio of order messages to executed trades. Excessive ratios trigger review
• VPS hosting is now part of compliance — API orders must come from a whitelisted static IP. The server providing that IP is part of the compliance chain

We assign a dedicated static IPv4 to every Forex VPS plan. We never call it “SEBI-approved” because SEBI does not approve hosting providers. Matching the right plan to algo requirements is covered in Forex VPS How to Choose.

Understanding FEMA Penalties for Unauthorised Forex Trading 

FEMA penalties are civil, not criminal. But they escalate quickly for continuing contraventions.

• Section 13(1) base penalty — up to three times the sum involved. Up to two lakh rupees where the amount cannot be quantified
• Daily continuation penalty — up to five thousand rupees for every day the contravention continues. An EA running unattended creates growing liability
• Section 13(2) confiscation — the money or property involved can be confiscated
• Section 14 civil imprisonment — if the penalty is not paid within 90 days, detention follows. Up to three years where the demand exceeds one crore rupees
• Section 15 compounding — a trader can settle the matter by paying a smaller amount, with no full hearing needed

We do not advise on FEMA penalties or compounding. We keep the hosting layer clean with dedicated static IPs, CERT-In log retention and isolated KVM. Provider-side obligations are explained in Forex VPS Support, Incident Response and Maintenance.

RBI’s Forex Alert List: Unauthorised Platforms and the IP Myth

The Alert List is a starting point for due diligence. It is not a complete register of every unauthorised platform.

• Not exhaustive — an entity missing from the list should not be assumed authorised. New platforms appear between updates
• Covers promoters too — anyone who promotes an unauthorised platform through ads, training or affiliate links is on the list too.
• MT4 and MT5 websites on the list — the MetaTrader 4 and 5 websites appear on the Alert List. The software itself runs on SEBI broker platforms, but the websites are listed
• Enforcement follows money, not IPs — the Enforcement Directorate follows the money trail, not the IP address. It traces those payments through banks, cards and payment gateways step by step. 
• The IP myth persists — forum advice claims a foreign VPS puts a trader outside Indian jurisdiction. It does not. FEMA applies to the person

We state plainly that server location does not alter a trader’s FEMA obligations. Our India locations exist because onshore exchange trading performs better with local hosting. Common misconceptions are addressed in Forex VPS Common Issues.

Forex VPS Compliance: Responsibilities of Traders and Providers

Both sides carry responsibilities. They do not overlap.

• KYC with broker — the trader completes KYC with a SEBI-registered broker before trading. The VPS provider cannot verify this
• Static IP registration — for API algos, the trader registers the VPS static IP with the broker. A backup IP should also be set
• Algo registration — algos exceeding 10 orders per second must be registered with the exchange through the broker
• CERT-In Directions for providers — the Directions of April 28, 2022 set the record rules for VPS providers. Providers must keep subscriber details and IPs for five years.  ICT logs stay for 180 days. Cyber incidents must be reported within six hours
• Data protection — the DPDP Act 2023 sets the data-protection context for personal data handled by both parties

We maintain subscriber records and IP logs for five years, ICT logs for 180 days, and reports incidents within six hours. These CERT-In obligations are part of how we run every plan. Data retention at end of life follows Server Decommissioning and Hardware Retirement.

Broker and Prop-Firm VPS Policies: IP Consistency and Account Risk

Proprietary trading firms set their own rules on top of the regulatory framework.

• Firm-specific VPS policies — some firms allow a VPS. Some limit it by account size. Some ban it entirely
• IP geolocation consistency — firms monitor login IPs. A VPS IP that shifts geolocation between sessions can trigger suspension. A dedicated static IP avoids this
• Strategy restrictions — firms often ban whole styles in their terms, and HFT is one of them. Latency arbitrage and some forms of scalping sit on the same banned list. 
• Shared IP risk — shared hosting can make login patterns look irregular and get accounts flagged. Isolated hosting removes this
• Payout compliance — prop-firm payouts arrive through AD banks with a purpose code. You receive a FIRA or FIRC. Confirm the procedure with your bank
• FEMA status is unsettled — whether prop-firm trading counts as dealing in forex under FEMA is not settled. Ask a legal adviser

We assign a dedicated IPv4 and isolated KVM to every Forex VPS. The conditions that come with a sponsored broker VPS versus a standalone plan are explained in Broker Forex VPS Hidden Tradeoffs.

VPS Security for Forex Trading: Stable Sessions and Safer Access

A stable server supports compliance by keeping the audit trail intact and the trading session running.

• RDP firewall whitelisting — restrict RDP access to your own IP addresses. This is the first defence against brute-force attacks on port 3389
• Change the default RDP port — moving off port 3389 reduces automated scanning attempts
• Investor password for trackers — give any third-party tracker the read-only investor password from MT4 or MT5. That password lets a tracker read the account but never place a trade. 
• Disconnect, don’t log off — disconnecting keeps all EAs running. Logging off terminates every program
• Schedule Windows Updates — set them for the weekend market close. Patches apply without hurting live trading or uptime

We ship Windows Server with RDP hardening and NVMe-backed storage already set up. Brute-force and volumetric attack prevention at the network edge is part of the stack we run, as covered in DDoS Attack Prevention.

Forex Trading in India: GIFT City IFSC and Tax Considerations

Two areas sit outside this article’s scope but deserve a brief mention.

• GIFT City IFSC — operates under the IFSCA. This is an institutional route separate from the SEBI and FEMA rules covering retail traders
• Taxation — tax treatment of currency derivatives and prop-firm payouts varies by instrument. Consult a chartered accountant

DedicatedCore does not advise on taxation or GIFT City structures. We handle the server environment with the High Performance power plan and NVMe storage pre-configured. Terminal settings are covered in Forex VPS Optimization for MT4 and MT5.

Comparing Forex VPS Providers on Compliance and Infrastructure in India

The specs that separate a compliance-ready provider from a budget host are measurable. This table shows what Indian traders should check before committing to a Forex VPS plan.

We built this comparison from what Indian traders ask when they switch from budget hosts. The difference is plain to check before a trader pays for any plan. The provider has its CERT-In obligations written down, not buried in fine print. It gives a real static IP and states its regulatory position honestly. 

Real-World Forex VPS Compliance Cases from Indian Traders 

We document these cases because compliance issues are easier to prevent than to fix after the fact. These cases come from our own onboarding records of Indian traders. Each trader had hit a regulatory or infrastructure problem before switching to us.

Case Study 1 — API orders rejected after the April 2026 deadline.

A trader running a self-built EA through a broker API from a home PC. After April 1, 2026, the broker rejected all orders. The orders did not come from a registered static IP. Home broadband assigned a dynamic IP that changed every few days.

Our solution: We set up a Mumbai-region VPS with a dedicated static IPv4. The trader registered the VPS IP as primary with the broker. The home IP was kept as backup.

The result: Orders went through at once. The home PC had worked for years. The regulatory change made it non-compliant overnight. The Hardware Replacement SLA guaranteed a 15–45-minute replacement if the server itself ever needed swapping.

Case Study 2 — A trader flagged for IP inconsistency on a shared VPS.

A trader using a budget shared VPS for a prop-firm evaluation. The firm suspended the account. Login IPs had appeared from three different geolocations in one week. The shared host rotated IPs across nodes without warning.

Our solution: We moved the trader to an isolated KVM VPS with a dedicated static IP in London. The IP matched the firm’s expected geolocation. We configured the server with the same security stack applied to all plans.

The result: The firm reinstated the account once the trader showed one consistent IP. The shared VPS had been cheaper. The suspension cost exceeded the price difference many times over.

Both cases came down to the same thing — under current rules, a VPS is part of the compliance chain. DedicatedCore handles the infrastructure side of that chain for the trader on every plan. Every plan carries a dedicated static IP and runs on isolated KVM. India server locations and documented CERT-In compliance come with the plan as well. 

DedicatedCore’s Expert Answers to India Forex VPS Compliance Questions

We hear these questions from Indian traders every week. The answers come from what we see on live customer setups.

Is a Forex VPS legal in India, and what decides whether my setup is compliant?

We host Forex VPS servers for Indian traders every day. The VPS itself is entirely legal. What decides compliance is the platform it connects to and how money moves through the account. 

A VPS connecting to a SEBI-registered broker is compliant. One connecting to an unauthorised offshore platform is not. Server location does not change that. Jurisdiction rules are covered in Forex VPS Rules and Regulations.

Does hosting my VPS in India give me an advantage for trading on Indian exchanges?

We see measurably lower latency when the VPS sits near the exchange. NSE and BSE matching engines operate in Mumbai. A VPS in the same metro area keeps the network path short. An overseas server adds international hops and routing variability. 

Every millisecond matters in algo trading. Local hosting is the practical choice. Testing the difference is straightforward with the method described in How We Measure Proximity and Performance.

Can I avoid FEMA by hosting my VPS offshore?

We hear this often. The answer is no. FEMA applies to Indian residents based on residency, not server location. The Enforcement Directorate traces transactions through banks and payment gateways.

 Forum advice claiming a foreign IP puts a trader outside Indian jurisdiction is wrong. The server is infrastructure, not jurisdiction. The relationship between server location and regulatory residence is explained in Forex VPS Proximity: Physical vs Network Distance.

The Right Forex VPS Starts with a Compliant Trading Setup

The server does not determine legality. The platform and the payment channel are what regulators examine. A VPS has quietly become part of the compliance setup for Indian traders. This spans the static IP requirement and the CERT-In obligations providers must meet. Keeping the VPS audit-ready between sessions is covered in Pre- and Post-Market Forex VPS Health Checklist.

DedicatedCore Forex VPS and DomainRacer Forex VPS provide dedicated static IPs, isolated KVM virtualisation, and India server locations across Mumbai, Pune, Bangalore, Hyderabad, Delhi NCR, and Noida. Start with a 30-day trial backed by a money-back guarantee. Verify the setup against your broker’s requirements.