Is my demat account safe in India?

A demat account is an electronic record of the securities you own. SEBI's FAQ on the depository system names the two depositories registered with it: National Securities Depository Limited (NSDL) and Central Depository Services (India) Limited (CDSL). The depository keeps the record. The same FAQ describes a depository participant (DP) as an agent of the depository, through which it deals with investors and provides depository services.

When you open an account at Zerodha or Upstox you usually get two things at once: a trading account, which lets you place orders on the exchanges, and a demat account, which the broker opens for you in its capacity as a DP. The trading account is the broker's relationship with you. The demat account is your holding at the depository, opened through the broker.

That split is the main reason the answer to this question is mostly reassuring. The broker can see your demat account and, with your authorisation, move shares out of it to settle trades you made. It does not own what is in it. If a broker closes or loses its licence, the securities are still recorded at NSDL or CDSL against your name, and they can be shifted to a demat account with another participant.

Cash is different. Money you add to a broker's trading account and leave unused sits with the broker, not the depository, and the rules that protect it are separate. They are covered further down.

The Karvy case is the one people remember, and it shows where the gap was. In November 2019, SEBI found that Karvy Stock Broking had used the power of attorney its clients had signed to move client securities, worth about Rs 2,300 crore, into its own account. SEBI barred it from taking new clients and from using client powers of attorney, and directed NSDL to transfer securities back to clients who had paid for them in full. NSDL reported that about 82,600 clients received their securities that way. NSE later expelled Karvy and declared it a defaulter in November 2020.

The weak point was the blanket power of attorney, which let a broker move shares without the client confirming each movement. SEBI's response came in several pieces:

• Pledge only, confirmed by OTP. Since September 2020, stock brokers can accept securities as margin from clients only by way of a pledge in the depository system. Zerodha's site footer repeats the instruction regulators require brokers to show: keep your email and phone updated so the OTP to create a pledge comes directly from the depository.
• DDPI instead of a power of attorney. SEBI's circular of April 2022 introduced the Demat Debit and Pledge Instruction, a narrower authorisation that lets the broker and DP debit your demat account to meet settlement obligations for your own trades and to create pledges, rather than a general power over the account. It applied from September 2022 after an extension.
• Client level collateral. SEBI's circular of July 2021 on segregation and monitoring of collateral requires collateral to be reported down to each client, so one client's margin cannot quietly be used for another client or for the broker's own book.
• Running account settlement. Brokers must periodically return unused client funds. Under SEBI's circular of December 2023, settlement happens on a Friday and/or Saturday on an annual calendar the exchanges publish, quarterly or monthly depending on what the client chose.

None of these make fraud impossible. They narrow what a broker can do with your holdings without you being asked, and they put the depository, not the broker, in the loop when your shares move.

Zerodha Broking Limited states on its own website that it is a member of NSE, BSE, MCX and MSEI with SEBI registration INZ000031633, and that it offers depository services under SEBI registration IN-DP-431-2019. In plain terms, it is both a registered stock broker and a registered depository participant, so the demat account it opens for you is held at the depository in your name.

The same footer carries the regulatory notices every broker has to display: securities can be taken as margin only by pledge, the OTP to create a pledge comes directly from the depository, and you should check your holdings in the Consolidated Account Statement that NSDL or CDSL issues. Zerodha also states that it does not give stock tips and has not authorised anyone to trade on behalf of others, which is worth remembering when a stranger on a messaging app claims to be from the company.

Our Zerodha page covers what it charges and how its Kite MCP connector works with AI assistants.

Upstox's About page lists Upstox Securities Pvt. Ltd. with SEBI registration INZ000315837, trading memberships of NSE, BSE and MCX, and a CDSL depository participant registration, IN-DP-761-2024. So shares you buy through Upstox sit in a demat account at CDSL, opened through Upstox as the participant.

The structure is the same as Zerodha's, and the same rules apply: pledges confirmed by OTP, a DDPI rather than a blanket power of attorney, client level collateral reporting and periodic return of unused funds. The registration numbers differ, and Upstox uses CDSL as its depository. Our Upstox page covers its charges and its read-only MCP server.

On the question of whether the shares are safe from the broker, the two are set up the same way. The legal entity and registration numbers are what to look for on a contract note or a regulator's lookup, since app names and legal names often differ.

Each stock exchange runs an Investor Protection Fund. It comes into play when a trading member is declared a defaulter or expelled and its own assets are not enough to settle the claims clients file against it.

NSE describes the process this way: a member committee distributes whatever is available in the defaulter's account to admitted claims on a pro rata basis, and the Investor Protection Fund Trust then compensates investors for the part that the defaulter's account could not meet. NSE raised the ceiling from Rs 25 lakh to Rs 35 lakh per investor for claims against trading members declared defaulter or expelled from August 2024 onward. BSE's claims page lists a limit of Rs 15 lakh per client for members declared defaulter since December 2009.

Three limits on that protection matter. It pays admitted claims, so you need records of what you were owed. It covers a broker's default, not an investment going down. And because shares in your demat account were never the broker's property, the fund mostly matters for things that were in the broker's hands, such as unsettled funds or securities a broker had wrongly moved, rather than holdings sitting untouched at the depository.

• A fall in the price of anything you own, for any reason.
• A company you invested in failing, or a bond issuer defaulting.
• Trades you placed and regret, including trades on tips from strangers.
• Someone else logging in with your password and OTP. That is a matter for the broker's own policies and, if it comes to it, the complaint process.
• Products a broker distributes that sit under a different regulator. Zerodha's footer, for example, notes that fixed deposits are regulated by the Reserve Bank of India.

The practical reading is that India's system is designed against one particular failure, a broker misusing or losing client assets. It does not insure returns, and the strongest defence against account takeover is still the boring one: your own email and phone on file, and an OTP you never share.

1. Read your Consolidated Account Statement

SEBI's investor site explains that the Consolidated Account Statement (CAS) is built from your PAN and covers your demat holdings and mutual fund transactions. Under SEBI's master circular for depositories, as amended in February 2025, NSDL or CDSL sends it monthly if there was any transaction, within twelve days of the month end by email (fifteen for a paper copy), and by email half yearly if there was none. It comes from the depository, not the broker, which makes it the cleanest independent check that what your app shows matches what is recorded in your name.

2. Keep your contact details current

The pledge OTP and the CAS both reach you only if the email and mobile number registered with your broker and DP are yours. An old number, or a relative's, quietly switches off the main safeguards.

3. Know what you have authorised

If you signed a DDPI, it lets the broker debit shares to settle your own sales and to create pledges. Check whether you have one, and whether you still need it, in your broker's account settings or by asking the DP.

4. Look up the broker's registration

Compare the SEBI registration numbers on the broker's website with SEBI's list of intermediaries. Fraud groups regularly borrow real brokers' names, so the number on the regulator's site is worth more than a logo in a chat message.

5. Know where to complain

A complaint goes to the broker first. If it is not resolved, SEBI's SCORES system and the SMART ODR online dispute resolution portal are the routes Zerodha's footer points to, and the exchange's investor grievance cell handles claims against a defaulted member.

Walnut is an AI investing app, not a broker or a depository participant, and it never holds your shares or your money. Your holdings stay in your demat account at NSDL or CDSL whatever happens to Walnut.

Zerodha and Upstox connect to Walnut read-only. Once connected, Walnut reads what you hold, shows each holding's price return against the S&P 500 (neither broker passes cost basis, so it is a price return rather than profit and loss), gives a keep, trim or exit read on each position, and lets you ask the AI assistant about what you actually own. You can group holdings into baskets with target weights and see how far each one has moved from its targets. Walnut places no orders at Zerodha or Upstox.

Where Walnut does place orders, it does so only when you approve them: at Public and Robinhood (through a Robinhood Agentic account), and also at E*Trade, tastytrade, Webull (US and Canada), moomoo, Questrade, Wealthsimple, Trading 212 and Stake (Australia). Every other connected broker is read in full without trading. How the connection itself is secured is covered in Is Walnut safe? and Is it safe to connect your brokerage to an AI?

"My shares are with Zerodha." They are recorded at the depository in your name. Zerodha is the participant you reach the depository through.

"If my broker goes bust, I lose everything." Holdings in your demat account are not the broker's assets, and in the Karvy case SEBI directed NSDL to return securities to clients who had paid in full. Funds left with the broker are the part with more exposure, which is why periodic settlement of running accounts exists.

"The investor protection fund insures my portfolio." It pays admitted claims after a member defaults, up to a limit. It does not pay for a market fall.

"A broker can pledge my shares without asking." Since September 2020, a pledge needs your confirmation through an OTP sent by the depository. A request you did not start is a reason to call your broker immediately.

Depositories and the role of a depository participant: SEBI, Frequently asked questions on the depository system. Consolidated Account Statement: SEBI, Consolidated Account Statement, and the SEBI master circular for depositories, with the CAS timelines revised by SEBI circular SEBI/HO/MRD/PoD1/CIR/P/2025/16 (February 2025). DDPI: NSDL operational guidelines on DDPI. Client level collateral: SEBI, Segregation and monitoring of collateral at client level. Running account settlement: SEBI circular SEBI/HO/MIRSD/MIRSD-PoD1/P/CIR/2023/197, summarised in the MSEI settlement calendar circular. NSE compensation limit: NSE, increase in ceiling amount payable out of the Investor Protection Fund Trust, and NSE, about the defaulter section. BSE compensation limit: BSE, claim against defaulter. Karvy expulsion: NSE circular as reported by Moneylife. Broker registrations and pledge notices: Zerodha website footer and About Upstox. Figures as published in October 2026. Walnut is not a registered investment adviser, and this guide is educational, not personalized financial advice.