What do SEBI's rules require when you distribute pre-deal research?
Four sets of SEBI rules, and the DPDP Act, shape pre-deal research in India. ICDR bars giving any group of investors, or a research analyst, information that is not in the offer document. The Research Analysts Regulations set how long a syndicate bank must wait before publishing after pricing. The insider-trading rules require a record of who received unpublished price-sensitive information. Since 3 January 2026, a merchant banker must keep records for eight financial years and keep all data inside India.
| When research can go out | How long records must be kept |
|---|---|
| A manager or co-manager must not publish research for 40 days after an IPO is priced, or 10 days after an FPO is priced (Research Analysts Regulations 2014, Reg. 18). There is no post-listing blackout in ICDR. Nothing outside the offer document may go to any group of investors or to a research analyst (ICDR Sch. IX(10)). | Merchant-banker records: 8 financial years (Merchant Bankers Reg. 16(1)). Insider-information database: 8 years (PIT Reg. 3(6)). Research-analyst records: 5 years (RA Reg. 25(2)). |
What do the India rules say, and where does each come from?
SEBI (ICDR) Regulations 2018 — Reg. 42 and Schedule IX: nothing outside the offer document
Regulation 42 brings research reports within Schedule IX. Schedule IX(10) is the central rule: nothing extraneous to the offer document may be given to one section of investors or to a research analyst. Schedule IX(11) requires the lead managers to file a compliance certificate on news reports from the filing of the draft offer document (DRHP) until the issue closes. The consolidated text was last amended on 21 March 2026. Read the consolidated ICDR Regulations
SEBI (Research Analysts) Regulations 2014 — Reg. 18: when research can be published
The waiting periods are set here, not in ICDR. A manager or co-manager must wait 40 days after the day an IPO is priced, and 10 days after an FPO is priced. An underwriter must wait 25 days from the date of the offering. Around a lock-up agreement, research is restricted for 15 days before the agreement is entered into and 15 days after it expires, is waived or is terminated. The 40-day, 10-day and 15-day periods can be set aside with prior written approval from legal or compliance under the firm's internal policy. The proviso to Reg. 18(6) expressly allows pre-deal research as investor education. Reg. 25(2) requires research-analyst records to be kept for at least five years. RA Regulations · Master Circular, 27 June 2025
SEBI (Prohibition of Insider Trading) Regulations 2015 — Reg. 3(5)–3(6): a record of who had access
Under Reg. 3(5), anyone who receives unpublished price-sensitive information must be recorded in a structured digital database, with the identifiers the regulation lists, and the database shall not be outsourced: the firm must maintain it internally. The record must be kept for at least eight years, and until any SEBI investigation or enforcement proceeding ends (Reg. 3(6)). Since 10 June 2025, the definition of unpublished price-sensitive information expressly includes a proposed fund raising, so a contemplated IPO is price-sensitive from an early stage. PIT Regulations
SEBI (Merchant Bankers) Regulations 1992 — Reg. 16: eight-year retention and India data residency
Substituted with effect from 3 January 2026. Records under Reg. 14, which include pre-issue and post-issue due-diligence records (Reg. 14(e)), must be kept for at least eight financial years, and all data and information must be maintained within the territorial limits of India. This, not the DPDP Act, is the data-residency duty for a merchant banker. SEBI has not yet issued the detailed localisation norms Reg. 16(2) refers to, so the plain duty is what applies today. Amendment Regulations, notified 5 December 2025
DPDP Act 2023 and the DPDP Rules: personal data of investors
The Rules were notified by G.S.R. 846(E) on 13 November 2025. The main duties — notice, consent, security safeguards, breach notification, erasure, data-principal rights and penalties — start on 13 May 2027. Consent Manager registration starts on 13 November 2026. The Act permits personal data to be kept where another law requires it (s.8(7)), even after an erasure request. DPDP Rules · Commencement notification
Not legal advice. Every figure above carries the instrument and provision it comes from, and links to the primary source; where we could not verify one, the text says so rather than guessing. Confirm your own obligations with your counsel or compliance team.
Last reviewed 5 October 2026
How India compares with other jurisdictions
| Jurisdiction | When research can go out | How long records must be kept |
|---|---|---|
| India | A manager or co-manager must not publish research for 40 days after an IPO is priced, or 10 days after an FPO is priced (Research Analysts Regulations 2014, Reg. 18). There is no post-listing blackout in ICDR. Nothing outside the offer document may go to any group of investors or to a research analyst (ICDR Sch. IX(10)). | Merchant-banker records: 8 financial years (Merchant Bankers Reg. 16(1)). Insider-information database: 8 years (PIT Reg. 3(6)). Research-analyst records: 5 years (RA Reg. 25(2)). |
| United States | Regulation S: no selling effort aimed at the US. Under the SEC’s 1998 guidance, a website is not treated as aimed at the US if it names the countries it is meant for, excludes the US, and has procedures to prevent sales to US persons. Whether a waiting period applies depends on the offering’s Rule 902 category: none for Category 1, up to one year for Category 3. FINRA Rule 2241: a manager or co-manager must observe a quiet period of at least 10 days after an IPO and at least 3 days after a secondary offering. | Not stated. We have not verified the retention periods in SEC Rule 17a-4(e). |
| United Kingdom | Research must not be disseminated until the approved prospectus or registration document has been published under PRM 9.5 (COBS 11A.1.4F). The 7-day wait was removed on 5 August 2026 (PS26/16). | At least 5 years (SYSC 9.1.2R). The FCA may require up to 7 under the onshored MiFID Organisational Regulation. |
| European Union | No fixed waiting period at EU level. Research must be correctly labelled as research or as a marketing communication, with conflicts controls (Del. Reg. (EU) 2017/565 Arts. 36–37). A recommendation must carry the content and disclosures in MAR Art. 20 and Del. Reg. 2016/958. | 5 years; up to 7 if the regulator requests (MiFID II Art. 16(7) with 2017/565 Art. 76(8)) |
| Hong Kong | A manager, sponsor, listing agent or underwriter must not issue research for 40 days after an IPO is priced, or 10 days after a secondary offering is priced (SFC Code para. 16.5(g)). There is no pre-listing quiet period in the Code. | Not set in paragraph 16. Not yet verified elsewhere, so we quote none |
| Singapore | Not summarised. The commonly quoted Singapore rule rests on a secondary source: we could not confirm that SFA 2001 s.251(9) exists, and as reported it is a deadline to distribute before lodgement, not a blackout. We will summarise it once the section has been read in full. SFA 2001 | |
Common questions about the India rules
Is there a research blackout after an Indian IPO lists?
No. SEBI's ICDR Regulations contain no post-listing research blackout; that is a common misreading. The waiting periods are in Reg. 18 of the Research Analysts Regulations 2014 and run from the pricing date: 40 days after an IPO and 10 days after an FPO for a manager or co-manager, and 25 days from the date of the offering for an underwriter. If you see a different Indian day count quoted, ask which instrument it comes from.
Must a merchant banker keep its data in India?
Yes. From 3 January 2026, SEBI (Merchant Bankers) Reg. 16(2) requires a merchant banker to maintain all data and information within the territorial limits of India. SEBI has not yet issued the detailed localisation norms the regulation refers to, so the plain duty applies today. Records under Reg. 14 must also be kept for at least eight financial years.
Can the structured digital database be outsourced?
No. SEBI PIT Reg. 3(5) says the structured digital database shall not be outsourced and must be maintained internally, with controls such as time-stamping and audit trails. Reg. 3(6) requires it to be kept for at least eight years, and until any SEBI investigation or enforcement proceeding ends.
When do the DPDP duties start to apply?
The DPDP Rules were notified on 13 November 2025. The substantive duties — notice, consent, security safeguards, breach notification, erasure and data-principal rights — commence on 13 May 2027. Consent Manager registration starts on 13 November 2026.
Bring this page to your compliance team, and us with it.
We will take a session with legal or compliance alone if that is more useful than a product demo. Most desks do both.