Why a Spreadsheet Fails SEBI Regulation 25
Most independent analysts start with a spreadsheet and a WhatsApp history. It feels like enough, right up to the day a client disputes a call or SEBI asks for your records. Then the gap shows. The problem is not that a spreadsheet is messy. It is that it cannot prove the one thing Regulation 25 cares about: when you first made the call.
What Regulation 25 actually asks for
Regulation 25 requires you to keep research reports and recommendations, signed and dated, for five years. The unstated requirement underneath that is integrity: the record has to show when a recommendation was first made and that it was not quietly changed afterwards. A regulator is not just checking that a record exists. They are checking that they can trust it.
Why a spreadsheet cannot prove that
A spreadsheet's modified date changes every time you open and save it. A cell can be edited with no trace. You could, in theory, write a recommendation today and date it last month, and nothing in the file would contradict you. That is exactly the property that makes it useless as proof. The file records what you wrote; it cannot demonstrate when you first wrote it, which is the question that matters in a dispute.
WhatsApp is not the backup you think it is
The fallback is usually a WhatsApp history. It is fragile. Messages get deleted, exports can be edited, phones change, and reconstructing five years of client communication across devices is a nightmare you do not want during an inspection. A screenshot is weak evidence. It is far better than nothing and far worse than a real record.
What a tamper-evident record looks like
The fix is not discipline; it is design. Each record is hashed the moment it is created, so any later change is detectable. It is stored with a fixed timestamp, the recipient and the content. You can export the whole log, and a third party can verify that nothing was altered. That is the standard Regulation 25 is really reaching for, and it is the standard a spreadsheet cannot meet no matter how carefully you maintain it.
How Aktai does it
Every note you send through Aktai is SHA-256 hashed and stored for five years with its date, recipient and content. You can export the full audit log as a CSV and hand it straight to an auditor or an inspector. There is no separate record-keeping step to remember, because the record is created on send. When a client disputes a call, you show exactly what went out and when, and the conversation ends there. That is the difference between a spreadsheet and a record you can stand behind.
FAQ
Why is a spreadsheet not enough for Regulation 25?
Regulation 25 is about proving when a recommendation was made and that the record was not changed afterwards. A spreadsheet has a modified date that anyone can change, and a cell can be edited without a trace. It records what you wrote, but it cannot prove when you first wrote it, which is the whole point of the rule.
Is a WhatsApp history a valid record?
It is better than nothing, but it is fragile. Messages can be deleted, exports can be edited, and reconstructing a five-year history across devices is painful. In a dispute, a WhatsApp screenshot is weak evidence compared with a timestamped, hashed record.
What does a tamper-evident record look like?
Each record is hashed when it is created, so any later change is detectable, and stored with a fixed timestamp and the recipient and content. You can export the whole log and a third party can verify nothing was altered. That is the standard Regulation 25 is really asking for.
How does Aktai handle Regulation 25 record-keeping?
Every note you mark as sent is SHA-256 hashed and stored for 5 years with its date, recipient and content, and you can export the full audit log as a CSV. The record is tamper-evident by design, so you can prove what you sent and when without reconstructing anything.