INTRODUCTION

The recent frauds related to Artificial Intelligence (“AI”) based impersonations have revealed new vulnerabilities in financial markets. In India, a deepfake video was uploaded on the internet in which Sundararaman Ramamurthy, the Managing Director and Chief Executive Officer of the Bombay Stock Exchange, gave stock advice and assured huge returns. The exchange later explained that the video was made through deepfake technology and advised investors not to trust such content. Other doctored videos have emerged of the same kind of Ashishkumar Chauhan, the CEO of the National Stock Exchange of India, pitching investment plans on the basis of modified audio-visual messages. While these cases were mostly related to fraudulent promotions, they are good examples of how generative AI may use the trust in financial authorities and business leaders to make investors act in a certain way.

Generative AI has made it possible to fabricate convincing statements from corporate executives capable of influencing investor behaviour and affecting securities prices. Yet Indian securities law remains premised on the assumption that market manipulation originates from identifiable actors within the regulated ecosystem. This creates an attribution gap: when AI-generated disclosures move markets, who is the manipulator?

However, SEBI’s regulatory focus has largely remained confined to the use of AI by intermediaries, paying comparatively little attention to AI-generated corporate impersonation and synthetic disclosures. It is against this backdrop that this blog discusses the attribution difficulty presented by artificial disclosures of the corporations in Indian securities markets.

LEGAL FRAMEWORK

The securities market is governed by SEBI Act, 1992 and regulations administered by the SEBI. Section 11(1) of the Act provides that SEBI has the power to safeguard the interests of the investors and to regulate the securities market whereas Section 11B gives it the power to issue directions to any person to whom the provisions of the Act are found to have been violated.

To be more precise, the SEBI (Prohibition of Fraudulent and Unfair Trade Practices Relating to Securities Market) Regulations, 2003 (“PFUTP”) forbids manipulative conduct with the help of the Regulations 3(a)-(d) that do not allow using fraudulent devices in the process of securities trading. Moreover, Regulation 4(1) and 4(2)(k) preclude the spread of fake or distorted information, which is most likely to cause investors to buy or sell. Moreover, the SEBI (Prohibition of Insider Trading) Regulations, 2015 govern the communication and misuse of the UPSI in Regulation 3 and the listed companies are required to disclose material events to the market in a timely and accurate manner under Regulation 30.

The dependence on identifiable actors commonly runs through these provisions. The acts of a “person” that involve fraud, dissemination of misleading information, use of UPSI or the failure to comply with obligation to disclose triggers liability. The “identifiable actor” premise breaks down when generative AI is employed to create content that appears to be corporate disclosures or that impersonates executives, making it more difficult to determine who is behind the misinformation.

SEBI and the stock exchanges continued to enhance technological regulation with the adoption of a harmonised cross-exchange AI/ML, which obliges the intermediaries to provide information about the AI system use in trading and operational purposes. Nevertheless, such actions mainly control AI tools used by registered intermediaries, and do not resolve the case when generative AI is applied independently to create corporate messages or impersonate executives. This means that although the provisions can be theoretically used in matters of spreading of false information, it remains ill-equipped to address the attribution problem, i.e. who should be regarded as the manipulator when AI-generated corporate disclosures influence investor behaviour?

CHALLENGES

One of the biggest regulatory threats that AI-based impersonation has created is that it is difficult to attribute liability in cases where synthetic corporate disclosures affect investor behaviour. The SEBI Act, 1992 and the PFUTP Regulations, 2003 are structured on the premise that market manipulation is made by recognizable participants like promoters, directors or intermediaries. Nevertheless, generative AI can be used to generate high-quality deepfakes on anonymity and make it look that it was issued by a corporate executive or a member of the stock exchange and spread quickly across the internet. The presence of incidences where Sundarararaman Ramamurthy and Ashishkumar Chauhan are impersonated shows how such type of technology can be used to abuse the trust of financial authorities.

The gravity of the issue lies in the aspect that securities markets rely on corporate disclosures, which are true and timely, and any misleading information can largely affect the decision taken by investors. Artificial announcements about earnings, mergers or regulatory measures made by AI can cause rapid trading, prior to their verification, leading to price volatility and loss of investors.

The Supreme Court (“SC”) in SEBI v. Rakhi Trading Pvt. Ltd., recognised that any mechanism which distorts the natural price discovery process constitutes market manipulation and undermines market integrity. Similarly, in N. Narayanan v. Adjudicating Officer, SEBI, the Court stressed that maintaining investor confidence and transparency is central to the functioning of securities markets.

The challenge, however, extends beyond merely identifying the perpetrator. AI-generated misinformation destabilises the very concept of market manipulation because traditional doctrines assume a direct nexus between the speaker and the market participant. Where synthetic disclosures are created and disseminated by anonymous actors outside the regulated securities ecosystem, regulators struggle to identify the source of the misinformation or attribute liability under existing frameworks. This creates an enforcement gap that threatens market integrity, investor confidence, and the reliability of corporate disclosures in the Indian securities regime.

COMPARATIVE ANALYSIS

The attribution problem of AI-generated corporate disclosures is not new to India, but foreign jurisdictions have started to deal with the issue more squarely, albeit not holistically.

The US Securities and Exchange Commission (“SEC”), under Rule 10b-5 of the Securities Exchange Act, 1934, prohibits (a) the use of any device, scheme, or artifice to defraud, (b) making any untrue statement of a material fact or omitting material facts, and (c) engaging in any act that operates as a fraud in connection with the purchase or sale of securities. In the case of Janus Capital Group, Inc. v. First Derivative Traders, the court clarified that liability under Rule 10b-5(b) attaches to the person who has “ultimate authority” over the statement. But the fake Bitcoin ETF approval, in which the SEC’s official Twitter account was hacked to post fake approvals of Bitcoin ETFs highlighted the drawbacks of this strategy. The “maker” of the statement is hard to identify when the source of the misinformation is a compromised or synthetic source as opposed to an identifiable speaker. Therefore, Janus uncovered that attribution rules that depend upon the author will be difficult to apply to market-moving misinformation that is disseminated via hacked or AI media that isn’t clearly attributed to an author.

Likewise, the EU’s Market Abuse Regulation, 2014 prohibits misleading disclosures under Article 12(1)(c) and Article 15, but like Indian law, it is also premised on identifiable actors. In Jean-Bernard Lafonta v. Autorité des marchés financiers, the same premise was confirmed. The Digital Services Act, 2022 only tackles online misinformation at platform level, via its requirement for systemic risk assessment and mitigation under Articles 34 and 35. These obligations are still not connected with securities law enforcement, showing that governance of platforms is not enough to solve this attribution problem caused by impersonation using AI.

Therefore, the US or the EU is no panacea. Both, however, demonstrate however that securities regulation is not enough, and must be supported by mechanisms of platform governance and cyber-enforcement. India needs to focus on more than just compliance of intermediaries and identifiable actors, and tackle AI-fuelled market manipulation.

RECOMMENDATIONS AND CONCLUSION

First, SEBI needs to create a clear and unambiguous circular outlining the requirement for all listed companies to use verified channels when disclosing material information such as earnings calls, press releases and statements from the management. This will eliminate confusion and allow companies to have a standard procedure for using approved channels. Critics might argue that this will increase the compliance burden on companies. However, most listed companies already use stock exchange filing systems and official investor communication channels, so this would mainly streamline and strengthen existing practices rather than create an entirely new burden.

Second, SEBI should explicitly define synthetic media, deepfakes and AI-generated impersonation as cases of misleading market conduct in the PFUTP Regulations, 2003, which are similar to those in the US and EU. It could be said that current provisions would be sufficient to encompass such behaviour. Whilst this is correct as such, explicit recognition would decrease the interpretative uncertainty and enforceability ambiguity.

Third, SEBI could have a rebuttable attribution rule that misinformation spread through official corporate communication channels shall be presumed to be coming from the issuer, unless proved that it has taken reasonable steps to protect such communication. This may be perceived as strict liability, but the rebuttable presumption means that the issuer will not be unfairly impacted if they acted in good faith and responded to unauthorised compromises in a timely manner.

Fourth, there should be an arrangement with the stock exchanges, intermediaries and the major digital platforms with SEBI for the purpose of establishing a fast-track protocol for the misinformation, which will enable the immediate flagging of false information that moves the market and quick response of SEBI to the investors when such information is available on the platform. A counterpoint to this is that the speed of removals could lead to over censorship or suppression of legitimate speech. To address this concern, a removal mechanism should be in place that can only demonstrate false impersonation of securities disclosure content with adequate post-removal safeguards.

Fifth, SEBI should mandate listed companies to come up with corporate communication resilience policy, which should involve measures to monitor executive impersonation, maintain official verification badges and issue timely clarifications in case of fake disclosures. Smaller companies may say that the monitoring costs are excessive. However, a proportionate compliance based on market capitalisation can make it much more feasible and secure.

Finally, the fake SEC Bitcoin ETF tweet fiasco proves that securities regulators without technological and cyber-enforcement support are unable to do their job effectively. Hence, interagency coordination should be encouraged between SEBI, MeitY, CERT-In and law enforcement agencies to conduct forensic analysis and share information amongst the platforms to find out the identity of anonymous actors.

AI-generated disclosures not only possess technological but doctrinal challenges as well. As machines generate information that can impact the market, Indian securities law needs to identify who is creating it, who is controlling it, and who is accountable. If attribution requirements do not keep up with the AI era, the integrity of corporate disclosures and investor trust could grow weaker.