The Securities and Exchange Board of India (SEBI) has sought explanations from Borderless, formerly Stockal, over unauthorised trades in US stocks on its platform on October 15. The company has substantially responded to SEBI's queries, and its first priority is now to restore affected investors' portfolios to their positions before the incident, a Borderless spokesperson told NDTV Profit.
"We remain actively engaged with SEBI and other relevant authorities, including the exchange and cybercrime authorities. We have received queries from SEBI, have responded to substantially all of them, and continue to provide additional information as required," a Borderless spokesperson told NDTV Profit.
Borderless said it had written to its US brokerage and clearing partner, DriveWealth, to explore options for restoring customer accounts to their pre-incident positions as of October 14, 2026. It has also engaged a Tier-1 New York-based law firm to work on the restoration.
ALSO READ | SEBI To Review Closing Auction Rules After One Year, Chairman Pandey Reiterates
"From the outset, our objective has been to seek restoration of affected customers' holdings to their pre-incident positions as of October 14, 2026. We are actively engaging with the relevant institutions and working through the necessary legal and operational processes towards this objective," a Borderless spokesperson told NDTV Profit.
"While the outcome remains dependent on these processes, our efforts remain focused on achieving a resolution for affected customers," Borderless said.
The regulatory inquiry follows complaints from investors who allege that their US stock holdings were sold without their authorisation through the Stockal platform. Investors have alleged that, in a series of unauthorised transactions on October 15, long-term holdings in companies such as Apple, Tesla and Nvidia were liquidated, with the proceeds used to purchase shares of smaller companies, including Zhibao Technology.
The episode has raised questions about the security of investor accounts, trade authorisations and communication between Stockal and DriveWealth. Stockal, which rebranded as Borderless in 2025, operates the investment platform, while DriveWealth provides the US brokerage and clearing infrastructure.
In a fresh rejoinder to SEBI, one investor has sought to widen the scope of the investigation beyond the September cybersecurity breach at DriveWealth to include Stockal's own account-security and recovery controls.
The investor cites a November 4 communication from Borderless stating that the September breach occurred at DriveWealth. The investor says neither institution warned him before the unauthorised trades and has told SEBI that Stockal knew about the breach and had been informed by DriveWealth.
Borderless said it was informed in detail about the incident in mid-to-late September and subsequently sought details of the customer information affected. However, the company said India was not among the countries for which DriveWealth had identified the need for proactive customer notifications.
The rejoinder also questions Stockal's response to the October 15 incident. The investor says the platform's first email, sent at 1 am on October 18, flagged suspicious activity and possible financial impact but did not specifically identify the unauthorised trades.
The investor says he denied authorising the transactions to Stockal's Nigel Bajaj on October 18. On October 19, Zhibao shares were credited to the account against a debit of $275,422, according to the rejoinder.
The investor has also cited a November 5 email in which Stockal sought confirmation through the registered email address and offered an identity-verification call to facilitate an email change. The investor has asked SEBI to examine why comparable safeguards were absent or ineffective during the October account compromise.
The rejoinder seeks complete communication records between DriveWealth and Stockal, lists of affected customers, evidence of notifications and account-recovery logs. It also asks SEBI to reconcile the differing explanations provided by the two institutions and examine compliance with applicable cybersecurity incident-response requirements.
Borderless said it recognised the concerns and uncertainty experienced by affected customers and remained committed to cooperating with authorities and pursuing a resolution as quickly as possible.
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.