SEBI digital accessibility circular deadline: 31 January 2027 audit plan

Summary. SEBI circular HO/53/12/13(2)2026-ITD5-M2IPC/I/24856/2026, dated 30 October 2026, gives regulated entities until 31 January 2027 to appoint an IAAP auditor, conduct the accessibility audit of their digital platforms and remediate the findings. It is the fourth timeline change since the 31 July 2025 mandate, and the audit date has moved 15 months from 31 October 2025. Two details matter more than the new date. First, the auditor appointment is back as a named milestone, after the December 2025 clarification swapped the old appointment date for a readiness report. Second, every other provision stays in force: WCAG 2.1 or latest version, the latest GIGW, IS 17802, usability testing by persons with disabilities, and an annual report first due 30 April 2027. From 1 November 2026, 91 days remain, and 31 January 2027 is a Sunday. Our verdict: treat Friday 29 January as the real date, sign the auditor in the first half of November, and plan mobile releases now, because app fixes take longest to reach users.

About this article. This is for compliance and product teams at SEBI-regulated entities. On 1 November 2026 we checked all six SEBI circulars (31 July 2025 to 30 October 2026) in SEBI's own PDFs, NSE's member circulars, the RPwD Act as gazetted on 28 December 2016, and W3C, NIC, BIS, Google and Apple documentation. We could read the draft 2026 RPwD rules only through published legal summaries. This is general information, not legal advice, and no vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

What the 30 October 2026 circular says, and what it changed

The circular is seven short paragraphs. Paragraph 3 extends auditor appointment, the audit and remediation to 31 January 2027. Paragraph 4 keeps all other provisions of the earlier circulars in force. It lists five earlier circulars and is issued under Section 11(1) of the SEBI Act, 1992.

The table tracks each milestone through the circulars.

The July 2025 dates come from SEBI's August 2025 table. It prints the remediation date as 31 January 2025, apparently a misprint: six months from 31 July 2025 is 31 January 2026, and the six-month extension it grants lands on 31 July 2026.

The auditor appointment is back. If your entity filed a readiness report in March 2026 and never formally appointed an IAAP-certified auditor, it now has to.

Three dependent tasks now share one date. You cannot audit before the auditor is engaged, and you cannot remediate what has not been found. The real deadline for appointment is the first half of November.

Do not plan on a fifth extension. The July 2026 extension came on the day the remediation date fell due, and the October 2026 one a day early. Both cite SEBI's look at how far entities have got, and nothing in the text promises more time.

Who is covered

The circular is addressed to all recognised stock exchanges, clearing corporations and registered depositories, all registered intermediaries, AMFI, APMI, and BSE Limited as the administration and supervisory body for investment advisers and research analysts. Reporting splits three ways:

• Stock brokers and depository participants report to their stock exchanges and depositories.

• Investment advisers and research analysts report to BSE Ltd, after the August 2025 change from BASL and SEBI.

• Market infrastructure institutions and the rest report directly to SEBI. Its lists name 15 categories: AIFs, bankers to an issue and SCSBs, clearing corporations, collective investment schemes, credit rating agencies, custodians, debenture trustees, depositories, KYC registration agencies, merchant bankers, mutual funds and AMCs, portfolio managers, registrars and share transfer agents, stock exchanges, and venture capital funds.

The September 2025 guidelines, with Tables C1 to C4, are written for entities that report directly to SEBI, by email. NSE members instead upload through the ENIT module, and NSE's 1 September 2026 notice set 31 October 2026 for that. We found no NSE, BSE or depository notice restating 31 January 2027 by 1 November 2026, so check your member circulars this week.

NSE, in consultation with SEBI, has also clarified vendor software. A member using a standard vendor platform, with no customisation affecting accessibility, may rely on the vendor's IAAP audit report. Customised and in-house platforms need an independent IAAP audit, and responsibility stays with the member. If you report elsewhere, ask whether the same route applies.

Digital platform is a broad term. The July 2025 annexure names websites, mobile apps and portals (section 5.1), investor documents published on them (section 2.2), and new or procured solutions including SaaS, where responsibility stays with the regulated entity (section 6.1). Re-check your filed list for white-label apps, partner portals, onboarding microsites and statement generators.

The standards your auditor will test against

The table sets SEBI's wording against the position on 1 November 2026.

On WCAG version, the safe engineering choice is to scope to WCAG 2.2 Level AA. It fits SEBI's wording, and W3C says content conforming to 2.2 also conforms to 2.0 and 2.1, though a policy naming those versions may still need 4.1.1 tested. Our guide to the earlier 31 October 2026 date lists criteria that often fail on trading screens, so we do not repeat them.

A draft rule to watch

In Rajive Raturi v. Union of India (8 November 2024), the Supreme Court told the government to separate mandatory accessibility rules from the guidelines in Rule 15. Draft notification S.O. 3962(E), gazetted on 20 July 2026, would replace Rule 15(1)(c). IndiaLaw, a law firm, reports that websites and apps would have to meet IS 17802 (Part 1):2021, tested under Part 2:2022, and publish an accessibility conformance report. Establishments with turnover of ₹500 crore or more would get one year from publication, and smaller ones 18 months. Comments ran to 19 August 2026, reports Lexplosion, a compliance firm.

We found no final notification by 1 November 2026. It does not move the SEBI date, but ask your auditor to record IS 17802 results in a reusable form.

Duties no WCAG checker tests

SEBI ties its annexure to the Supreme Court's 30 April 2025 ruling in Pragya Prasun v. Union of India, which held digital access to be part of the right to life. The annexure and the later clarification add these duties:

• Indian Sign Language videos, closed captions, descriptive audio and alt text on platform content.

• Alternatives in digital KYC, e-KYC and video KYC, such as human-assisted video KYC, scanned uploads or voice-assisted KYC.

• A mandatory disability-status field on KYC and registration forms, and human review before any application from a person with a disability is rejected. The officer must be able to override automated rejections.

• A nodal officer, an accessibility grievance channel with escalation, staff and vendor training, and accessibility weightage in RFPs.

• From December 2025: an accessibility complaint category on SCORES, a right to digital accessibility in investor charters, and periodic audits.

The disability-status field and recorded usability sessions are personal data, so design them with our DPDP engineering playbook in mind.

Appointing the IAAP auditor

Table C2 in the September 2025 guidelines asks for six things: the professional's name, the IAAP ID or certificate number, the appointment date, the audit scope across all platforms, whether the SEBI circular has been notified to the auditor, and contact details. NSE's module asks for the same.

What to put in the engagement letter:

1. Certificate evidence. The IAAP ID for each named auditor, checked before you sign. SEBI names no specific credential. BarrierBreak, an Indian accessibility vendor, points to WAS and CPWA, and to IAAP's directory for checks.

1. Full scope. Every filed platform, with web, Android, iOS, portals and document templates named separately.

1. Usability testing by persons with disabilities. Section 5.1 requires it. Recruiting participants takes time, so it belongs in week 1.

1. A retest. Table C4 records remediation measures, supporting evidence and a status of fully complied, partially complied or pending. You need the auditor back to verify fixes.

1. The right report format. Entities reporting to SEBI send consolidated PDFs named [Department]_Table-C3_[SEBI Reg No.]_DDMMYYYY.pdf for the initial report and the Table-C4 equivalent for the final one. Others use their authority's format.

SEBI's circulars do not say the auditor must be external. NSE does ask for an independent audit of customised platforms, and keeping the auditor separate from the team doing the fixes makes the report easier to defend.

A 13-week plan: 2 November 2026 to 29 January 2027

31 January 2027 is a Sunday, so treat Friday 29 January as the working deadline. Christmas, New Year and Republic Day (Tuesday 26 January) fall inside the window.

Level A failures go first, because Level AA conformance needs every Level A criterion. Shared components such as buttons, form fields, modals and charts go before individual screens, because one fix lands everywhere. Section 1.1 has the MD, managing partner or proprietor approve compliance, so book that time early.

Mobile apps: where the weeks get tight

Web fixes go live when you deploy. App fixes reach users only after store review and adoption, and investors on old versions keep using inaccessible builds.

Android. Google's guidance asks for a contentDescription on meaningful elements, Role semantics so screen readers announce buttons and switches correctly, touch targets of at least 48dp by 48dp, and text contrast of at least 4.5:1 below 18sp (or bold below 14sp) and 3:1 otherwise. It names the Accessibility Scanner app, Android Lint and Compose testing as checks. WCAG 2.2's own minimum, 2.5.8 Target Size, is 24 by 24 CSS pixels, so meeting Google's figure should comfortably clear it.

iOS. Apple advises testing main tasks with VoiceOver and other assistive settings, on each device type you support. Every control needs a meaningful label, layouts must reflow at the largest Dynamic Type sizes, and animation-heavy screens should respect Reduce Motion. Apple describes Accessibility Inspector as a supplement to testing, so use it for triage, not sign-off.

Cross-platform and WebViews. React Native exposes accessibility props such as accessibilityLabel. In Flutter, a custom painter adds nothing to the semantics tree unless you supply a semanticsBuilder, so custom-painted charts stay silent to screen readers. Content wrapped in a WebView is still web content, so test it to WCAG inside the app.

Release mechanics.

• Book two release trains, mid-December and mid-January, with a buffer for review.

• Use staged rollouts so a regression does not reach every investor.

• On Android, Play in-app updates can prompt users to move to the fixed build. On iOS, apps usually rely on their own version check and a link to the App Store.

• Check that any forced-update flow is itself accessible.

• Add Apple's iOS 27 SDK requirement to the same release calendar.

Authentication. W3C says time-limited two-factor tokens can count as essential and may be exempt from 2.2.1 Timing Adjustable, so a short OTP window is not automatically a failure there. The sharper risk is 3.3.8 Accessible Authentication (Minimum). W3C treats forced manual transcription of a code as non-compliant, expects pasting and autofill to work, and warns that one-digit-per-box inputs break pasting. Operating-system biometrics are not a cognitive function test, so they can help, but keep another path for those who cannot use them.

Worked example: sizing the work for a mid-size broker

Illustrative assumptions, not measurements. Replace them with your auditor's numbers.

• Scope: 35 website templates, 40 Android screens, 40 iOS screens, 20 portal screens and 30 PDF templates. Total: 35 + 40 + 40 + 20 + 30 = 165 units.

• Manual audit: at 6 units per auditor-day, 165 ÷ 6 = 27.5 auditor-days. With 2 auditors, about 14 working days, which fits weeks 3 to 6.

• Findings: at 10 per unit, 165 × 10 = 1,650. If 40% trace to shared components, 660 are fixed once in the design system and 990 need local fixes.

• Remediation capacity: weeks 5 to 11 hold 35 weekdays, 33 after 25 December and 1 January, so about 30 after leave. At 12 fixes per developer-day, 990 ÷ 12 = 82.5 developer-days, or about 3 developers (82.5 ÷ 30 = 2.75) on top of design-system work.

• Buffer: if the retest finds 15% incomplete, 990 × 0.15 = about 149 items return in week 11.

So the remediation window is about 6 weeks, not 13, and an audit that slips past mid-December pushes fixes into the second release train.

What happens after 31 January 2027

Four things carry on:

• Annual audit report. Due within 30 days of each financial year end, first by 30 April 2027, 89 days after the new deadline. Brief the auditor now.

• SCORES complaints. Investors can file under an accessibility category, and the entity has to remediate the issue to close the complaint.

• Recurring audits. The clarification requires periodic audits through certified professionals, and the annexure annual audits through IAAP-certified ones.

• New releases. Section 6.1 requires new or procured solutions to conform, so add accessibility checks to your CI pipeline.

None of the six circulars sets a SEBI penalty. The RPwD Act has its own: Section 89 allows a fine of up to ₹10,000 for a first contravention and ₹50,000 to ₹5 lakh for later ones, and Section 90 reaches those in charge of a company. Ask counsel about SEBI's general enforcement powers, which this article does not assess.

Compliance checklist

1. Appoint an IAAP-certified auditor in writing, record the six Table C2 fields, and share all six SEBI circulars plus your reporting authority's notices.

1. Reconcile your platform list with what is live today, including WebViews and PDFs.

1. Check whether a vendor audit route applies to any standard platform.

1. Scope the audit to WCAG 2.2 AA, the latest GIGW and IS 17802, and say so in the report.

1. Book usability sessions with persons with disabilities before December.

1. Add the KYC disability field, human-review override, ISL and captions, and confirm the grievance channel.

1. Get the auditor's retest, the final report and MD, partner or proprietor sign-off by 29 January.

1. Book the annual audit for the 30 April 2027 report.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. We fix what the audit finds across web, Android, iOS and Flutter, from shared design-system components and KYC flows to tagged-PDF pipelines, working alongside your IAAP-certified auditor through our accessibility audit and remediation service. Talk to us at /contact-us/.

Last updated: 1 November 2026.

References

1. Extension of timeline with respect to compliance of Digital Accessibility Circulars, circular dated 30 October 2026 — SEBI

1. Extension of timelines and update of reporting authority for IAs and RAs, circular dated 29 August 2025 — SEBI

1. Clarification on the Digital Accessibility circulars of SEBI, 8 December 2025 — SEBI

1. Rights of Persons with Disabilities Act, 2016 and rules made thereunder: mandatory compliance by all Regulated Entities, 31 July 2025 — SEBI

1. Compliance Guidelines for Digital Accessibility Circular, 25 September 2025 — SEBI

1. Extension of timelines with respect to compliance of Digital Accessibility Circulars, 31 July 2026 — SEBI

1. Submission of Accessibility Audit Report for Digital Platforms, NSE/COMP/76105, 1 September 2026 — National Stock Exchange of India

1. Compliance Guidelines for Digital Accessibility Circular, NSE/COMP/75240, 16 July 2026 — National Stock Exchange of India

1. Web Content Accessibility Guidelines (WCAG) 2.2, W3C Recommendation, 12 December 2024 — W3C

1. Introduction, Guidelines for Indian Government Websites and Apps (GIGW 3.0) — National Informatics Centre

1. IS 17802 (Part 1):2021, Accessibility for the ICT Products and Services Part 1: Requirements — Bureau of Indian Standards

1. The new accessibility conformance regime: key takeaways from the draft RPwD (Amendment) Rules, 2026, 29 July 2026 — IndiaLaw

1. DoSJE issues draft amendment to the Rights of Persons with Disabilities Rules, 2017, 5 August 2026 — Lexplosion Solutions

1. SEBI digital accessibility readiness guide — BarrierBreak

1. Make apps more accessible — Android Developers

1. Performing accessibility testing for your app — Apple Developer

1. Accessibility, Human Interface Guidelines — Apple Developer

1. Accessibility Inspector — Apple Developer

1. Accessibility — React Native

1. semanticsBuilder property, CustomPainter class — Flutter API documentation

1. In-app updates — Android Developers

1. Understanding Success Criterion 2.2.1: Timing Adjustable — W3C Web Accessibility Initiative

1. Understanding Success Criterion 3.3.8: Accessible Authentication (Minimum) — W3C Web Accessibility Initiative

1. The Rights of Persons with Disabilities Act, 2016, Gazette of India, 28 December 2016 — Department of Empowerment of Persons with Disabilities