Power of Attorney: How Brokers Can Misuse Your Shares

Power of Attorney misuse is when a stockbroker uses the PoA you signed at account opening — meant for routine trade settlement — to pledge your shares or move them without your consent. Karvy did this with roughly ₹2,300 crore of client securities before SEBI caught up in 2019.

Most people sign the PoA without reading it. Years later, when the broker has a problem, their shares turn out to be the cheapest collateral in the building.

What you actually authorise when you sign a PoA

When you buy and sell shares through a broker, two accounts are involved. The trading account sits with the broker; the demat account sits with a depository (CDSL or NSDL), accessed through a Depository Participant, which is usually the same broker.

When you sell a share, the share has to physically move from your demat to the exchange's clearing pool by the next morning, or the trade fails. Pre-2010, the only way to do that was to sign a paper Delivery Instruction Slip every single time. Painful for active traders.

The Power of Attorney was the workaround. Sign one document; the broker can debit shares from your demat to settle your sell trades, and pledge them as margin for trades you initiated. That's the operational job, and SEBI's 2010 PoA guidelines explicitly limited the document to those purposes.

How brokers can quietly misuse it

SEBI's 2010 rules narrowed the legal scope of PoA. The actual PoA forms brokers asked clients to sign were often broader, with blanket "operate the demat for any and all purposes" language. That gap between what SEBI permitted and what the document said is what made the misuse possible.

The Karvy mechanics are the cleanest example.

The mechanics behind those numbers were almost embarrassingly simple. Karvy was operating a brokerage with twelve lakh clients on the books, of whom roughly three lakh were active. The dormant accounts (clients who hadn't logged in for months or years) were sitting on shares that nobody was watching.

The audit trail had been hiding in plain sight the whole time. Every share movement triggered an SMS from CDSL. But most clients had outdated phone numbers on file, or simply never read the messages. The lenders took the pledge at face value because the PoA looked valid on paper.

Most clients who lost shares to Karvy weren't unlucky. They had stopped looking at their own demat statements years before the fraud started.

It wasn't a one-off

Karvy was the largest, but not the only one. Anugrah Stock & Broking was found to have misused around ₹119 crore of client funds; later, 3,454 of its clients filed claims totalling ₹1,383 crore. BMA Wealth Creators, Modex International, Allied Financial, Fairwealth Securities. The National Stock Exchange has expelled more than thirty brokers for similar violations in the last six years.

The NSE's Investor Protection Fund has paid out roughly ₹1,118 crore to settle ~70,000 claims from clients of defaulting brokers. The cap per investor is ₹35 lakh. Plenty of clients lost more than that and are still in arbitration.

The structural problem was simple. A general PoA, signed once and never re-read, gave brokers a key that could open more doors than it should have been able to open. SEBI's response was not to discipline individual brokers harder, but to take the key away.

SEBI's response: PoA is being phased out

The cleanup happened in stages. The shorthand version: SEBI didn't reform the PoA — it replaced it with a narrower instrument called DDPI (Demat Debit and Pledge Instruction), expanded its scope through a clarification, and made it the default for new accounts from late 2022 onwards.

• April 2010
  First PoA guidelines

  SEBI issued the original PoA framework (CIR/MRD/DMS/13/2010), narrowing what brokers could do under a PoA: settlement deliveries and margin pledging only. Off-market transfers and trading without consent were explicitly prohibited.

• August 2020
  PoA Guidelines reiterated — and Karvy fallout

  After the Karvy bust, SEBI re-issued the framework, hammering home that PoA is optional, scope is narrow, and clients can revoke any time. By itself, this was a paper change. The underlying document was still a PoA.

• April 2022
  DDPI introduced

  SEBI's circular SEBI/HO/MIRSD/DoP/P/CIR/2022/44 created the Demat Debit and Pledge Instruction. Same operational job as a PoA, but with a much narrower legal scope. Initial scope: settlement deliveries and pledge / re-pledge of securities for margin only.

• October 2022
  DDPI scope clarified

  A follow-up SEBI clarification expanded DDPI's scope to also cover mutual fund transactions on stock exchange platforms and tendering shares in open offers. Four permitted actions in total — no more, no less.

• November 18, 2022
  DDPI becomes the default for new clients

  From this date, brokers shifted new clients from broad PoA documents to the narrower DDPI framework. DDPI is still voluntary; clients can also opt to use eDIS or physical DIS for every trade. Existing PoAs remain valid until the client revokes them.

The DDPI permits only four actions: transfer of securities for settlement, pledging or re-pledging for margin, mutual fund transactions on the exchange platform, and tendering shares in open offers. Nothing else. Whatever paperwork the broker hands you, the law caps DDPI at those four uses.

PoA vs DDPI — the practical difference

For practical purposes: if you opened your trading account before September 2022, you almost certainly have a PoA. If you opened after November 2022, you most likely have a DDPI — though it is voluntary, so a few brokers may have offered eDIS-only accounts instead. The two documents look similar on the screen but behave very differently under stress.

If you have an old PoA, you don't have to revoke it the moment you finish reading this. But you should know it exists, what it permits, and how to switch to a DDPI when you want to. That's a phone call to your broker.

How to revoke PoA in your demat account

Revoking is straightforward. The PoA itself includes a clause stating it can be revoked in writing at any time, and that revocation takes effect from the date your broker receives the notice (subject to any pending settlement obligations from trades already placed).

The actual steps with most brokers in 2026:

1. Print the broker's PoA / DDPI revocation form. Most brokers (Zerodha, Angel One, Upstox, ICICI Direct, Kotak Securities, etc.) host this form in their support section. The format is standard.
2. Fill in your client code, demat account number(s), and the date. Sign with the same signature you used at account opening.
3. e-Sign or courier. If your Aadhaar is linked to your phone number, you can scan and e-Sign the form digitally. Otherwise, courier the physical signed form to the broker's address listed on the form.
4. Wait for confirmation. Most brokers process revocation in 24–72 hours. You'll get an email or SMS confirmation. Until then, the PoA is still active.

One caveat. If you revoke the PoA without setting up a DDPI or eDIS to replace it, every sell trade afterwards will require you to manually authorise the share movement — usually via a CDSL T-PIN or NSDL OTP at the moment of sale. For active traders that's friction; for long-term holdings it's barely a nuisance.

Four habits that protect your account

Most of broker safety isn't regulatory. It's habit. The clients who lost shares to Karvy weren't unlucky — they had stopped reading their depository alerts.

1. Read the SMS alerts from the depository

CDSL and NSDL (the depositories) send out alerts directly for debits and certain pledge events — including pledge initiation, confirmation, and invocation, and PoA registration changes. These are independent of the broker. The broker cannot turn them off or modify them.

Make sure your phone number and email registered with the depository are current. If you change phones, update both. Not just the broker. An SMS for a pledge you didn't authorise is the only signal you'll get before things go wrong.

2. Pull the depository's own statement (CDSL Easi vs NSDL IDeAS)

Once a quarter, log into CDSL Easi (if your demat is with CDSL) or NSDL IDeAS / NSDL CAS (if your demat is with NSDL) directly and download your Consolidated Account Statement. The broker's app shows what the broker wants you to see; the CAS shows what's actually in your account.

For most readers, those two reports will match exactly, every time. The point is not to catch your broker — it's to know how to catch them, and to do the check often enough that you'd notice within a quarter if something didn't match.

3. Use a separate demat account for long-term holdings

Open a second demat account, with the same broker or a different one. Don't sign a PoA or DDPI on it. Shares can come in but cannot leave without your physical or eDIS signature on every transaction.

Cumbersome? Yes. But for stocks you intend to hold for years, that friction is the point.

The shares Karvy moved were precisely the ones nobody was watching. Holdings parked in a no-PoA demat are functionally untouchable.

4. Use the freeze facility

Both CDSL and NSDL let you freeze your demat account, or specific holdings within it, until you actively unfreeze them. Useful for inherited shares, multibaggers you'll never sell, or anything you want zero ambient risk on.

The freeze is free, takes about ten minutes to set up, and does nothing visible most of the time. You only notice it on the day you actually need it.

The reflexive habit underneath all four points: do your own checking. Most retail investors look at the broker's dashboard, see a number, and call it the truth. The number on the dashboard is a truth, but only as good as the broker is honest. The depository's record is what's actually there.