SEBI's Insider Trading Rules Face a Second Bank Leak This Year

On September 23, 2026, a Morgan Stanley employee accidentally sent clients an internal document listing more than 100 investment-banking deals the firm is working on across Asia. The file was sent by Mohamed Atmani, Morgan Stanley's Asia-Pacific head of financial sponsors in its investment-banking division, according to people familiar with the matter. A copy of the document reviewed by Bloomberg showed prospective IPO candidates spanning China, South Korea and India, and the same list also carried a smaller slice of deals across Europe, the Middle East and Africa, so the leak's reach was never only an Asia story. The employee tried to recall the email, but a blurred copy of the document surfaced separately on Instagram, the document already outrunning the recall meant to erase it. Read as a single event, this is exactly what it looks like: a senior banker's misdirected email, awkward for the world's most storied dealmaking franchise, fixed with an apology and a scramble to contain the damage.

It is worth slowing down on that reading. SEBI is conducting its own internal assessment of the incident and will decide whether any action is required once it has reviewed the findings, Bloomberg reported. That is a low bar as regulatory language goes: an "assessment," not a formal notice, and no specific Indian company or stock has been named as compromised. But India's regulator is not treating this purely as an internal HR problem, and it has been here before, in the same year.

SEBI needed only one leaked deal, not a hundred, to issue a formal notice in January 2026, eight months before this one. A Reuters dispatch carried by MarketScreener reported that SEBI's show-cause notice against Bank of America found the bank's deal team had its own broking arm send a valuation report on the $177 million Aditya Birla Sun Life AMC share sale to a potential investor, Enam Holdings, before the deal was publicly announced, an arrangement the regulator called a failure to maintain "Chinese walls," the internal barriers meant to stop a bank's dealmakers from passing what they know to anyone who might trade on it. Republic World reported the notice separately alleged Bank of America "tried to make untrue statements or suppress material facts" when SEBI asked about the leak. One document naming more than a hundred deals has just landed in the same regulatory lane where a single deal already earned a global bank a formal notice.

The rulebook India already enforces

None of this needs a new law to matter. SEBI's own regulations page shows the Securities and Exchange Board of India (Prohibition of Insider Trading) Regulations, 2015 were last amended on December 6, 2024: the standing rulebook against trading on unpublished price-sensitive information, whatever the leak's channel. And SEBI has already shown it will punish a leak that travelled through an informal, personal channel rather than a bank's own deal desk. A June 2020 SEBI adjudication order penalized an individual for circulating Bata India's unpublished price-sensitive information over WhatsApp messages. A misdirected email is a newer failure mode than a phone forwarded to the wrong WhatsApp group, but it sits in the same category the regulator has already been willing to act on: confidential, market-moving information reaching people who should never have had it.

Three cases, three leak channels, one regulator's escalating response.

Sources: SEBI adjudication order (2020); MarketScreener, citing Reuters (2026); Outlook India, citing Bloomberg (2026).

Why scale should not decide this

The instinct is to treat a hundred-deal leak as automatically the graver case. It may not be, on SEBI's own recent record. The Bank of America notice rested on a single, identifiable transaction: one deal, with a named recipient and a specific broking arm accused of crossing the wall. Morgan Stanley's list spanned deal candidates across China, South Korea and India without any of them being individually identified as compromised in the reporting so far. A regulator that already moved on one narrow, well-evidenced leak has more work, not less, to do before it can say whether a hundred-name document produced anything a trader could act on. Scale makes headlines. It does not, by itself, make a case.

What does carry over from the Bank of America episode is the theory of the failure. SEBI's notice there was not just about information reaching an outsider; it was about the bank's own internal wall failing to hold, and about how the bank answered the regulator afterward. Those are exactly the two questions an assessment of Morgan Stanley's email has to answer: did the bank's own controls let this happen, and does its account of what happened hold up.

The honest objection

The strongest case against reading much into this is that SEBI's own language is measured. An "internal assessment" is not the show-cause notice SEBI issued Bank of America, and nobody has named a single Indian company whose stock moved on information from the leaked list. It is entirely possible the review turns up nothing more than an accidental email that reached the wrong recipients, exactly the outcome Morgan Stanley itself would expect. Judged only by what has been alleged so far, this looks like a smaller regulatory event than the Bank of America case, not a bigger one.

That case is real, but it undersells what the comparison actually shows. The Bank of America notice did not start out looking large either: it began as a review of one bank's one deal. It became a formal notice, with an added allegation of misleading answers to the regulator, only once SEBI had looked closely enough to write down what the wall failure actually was. A document naming well over a hundred deals is a wider thing to look closely at, not a narrower one, and SEBI has already shown this year that it is willing to follow that kind of review to a notice rather than let it stay an internal review.

The Signal

The size of Morgan Stanley's leak will not decide what SEBI does with it. The shape of the failure will: whether the bank's own controls let confidential deal information cross to people who should not have had it, and whether the bank's account of that failure survives scrutiny, the same two questions that turned one leaked valuation report into a formal notice against Bank of America eight months earlier. Watch what SEBI's "assessment" becomes. If it turns into a notice the way the Bank of America review did, a leak naming dozens of deals at once, rather than one, will carry a weight a single misdirected email was never built to hold. A leak stops being an accident the moment a regulator decides it is worth measuring.

Reporting basis: the Morgan Stanley leak is per Investing.com's report citing Bloomberg, the banker's identity per Business Today's report citing people familiar with the matter, and the deal list's geographic spread per American Bazaar's account of Bloomberg's review of the document; all three describe the same underlying Bloomberg reporting of the single September 23, 2026 leak. SEBI's internal assessment of that leak is per Outlook India, also citing Bloomberg. The Bank of America precedent is per a Reuters dispatch carried by MarketScreener, with the additional allegation of misleading SEBI per Republic World; both describe the same January 2026 show-cause notice and are treated here as one origin, Reuters, as also carried by Republic World. The regulatory rulebook and the WhatsApp-leak precedent are drawn directly from SEBI's own published regulations page and its own June 2020 adjudication order, the two primary sources in this piece. The month-by-month timing comparison in the second chart is The Signal's calculation from those four dated sources.