The plain answer
The TPIN is the 6-digit authorisation code you enter whenever shares leave your demat account: selling delivery shares, pledging them, or transferring them to another account. SEBI introduced the TPIN in 2020 to replace the old power of attorney system, and the depository enforces the check at the debit itself. The code is yours alone, set and reset through your own registered mobile and email, and the broker cannot see it.
The name comes from Transaction Personal Identification Number. The operative word is personal: the code travels from you to the depository at the moment of the transaction, and no intermediary holds a copy it can reuse. In the CDSL system, the TPIN works together with an OTP sent to your registered mobile and email, which gives each debit two independent checks.
If you remember one sentence about the TPIN, make it this one: it guards exits, not entrances. Anything that moves shares out of your demat account asks for it; anything that moves shares in, or moves only money, does not.
What the TPIN authorises
| Action | Needs TPIN? | Why |
|---|---|---|
| Selling delivery shares | Yes | The sell debits the demat account on settlement day |
| Pledging shares for margin | Yes | A pledge is a demat debit instruction |
| Transferring to another demat account | Yes | An off-market debit from your account |
| Dematerialisation request | No | Physical certificates credit in; nothing leaves |
| Intraday and F&O orders | No | They settle in cash and never touch the demat |
| Buying shares | No | Buys credit the demat; they do not debit it |
The pattern holds across every row: the TPIN appears exactly when your holdings are about to leave the account, and nowhere else. That narrowness is the design. A code that authorised everything would be a password; a code that authorises only exits can stay a short 6 digits and still be safe.
Within the debit category, the TPIN covers the full spread of outbound movements. Selling on the exchange, pledging shares against a margin position, moving shares to a family member’s demat account, tendering shares in a buyback or open offer: all of them debit your account, and all of them go through the same authorisation gate.
Where it does not apply
The TPIN has nothing to do with logging in. Logging in uses your login PIN or password plus the two-factor OTP, and it protects access to the app rather than movement of holdings. A TPIN does not unlock anything at login, and a login PIN does not authorise a debit. Keeping the two separate is why losing one does not automatically expose the other.
The TPIN also has nothing to do with mutual fund units held in folio form with an asset management company, which live in the AMC’s records rather than in your demat. Those transactions use their own verification, typically a separate instruction or OTP through the fund house or the exchange platform.
It applies to one narrow, high-stakes lane: the depository debit. Every other control in the account, login, OTP, biometric unlock, protects your access. The TPIN is the only one that protects your holdings at the instant they move.
What existed before it
Before 2020, brokers collected a Power of Attorney at account opening, which gave them standing authority to debit client demat accounts for settlement and margin. The account holder authorised nothing per transaction; the broker acted on the paper and the client saw the debit later in a statement. SEBI moved against the arrangement in 2020 after the POA turned out to be unusable as a margin control and, worse, a source of misuse of inactive accounts.
SEBI’s February 2020 margin circular stopped treating a POA held by a broker as equivalent to collecting margin on client securities. Shares had to be pledged through the depository systems instead, a change that went live on 1 August 2020 after circular SEBI/HO/MIRSD/DOP/CIR/P/2020/90 set the date. In June 2020 SEBI introduced the TPIN as the per-transaction authorisation for demat debits.
The design difference is total. Under the POA, the broker held the authority and the depository followed the instruction. Under the TPIN, the authority stays with you, the broker cannot complete a debit without your code, and the depository enforces the check at the debit itself. The broker’s role shrank from holding authority to carrying your instruction.
A sell, step by step
The TPIN moment arrives on settlement day, not on the day you place the order. For Indian equities, settlement runs on T+1, the next working day after the trade. Here is the full chain for a delivery sell of 50 shares:
- You place a delivery sell order for 50 shares
- The exchange executes the order
- On settlement day, the app asks you to enter your TPIN
- The depository matches the TPIN you entered
- The shares debit from your demat account to the exchange settlement
Between the order and the TPIN, the position is a commitment, not yet a debit. That gap is useful: it means you always have a clear moment to check the quantity and the trade before the shares actually move. If the quantity on the TPIN screen does not match what you sold, stop and check with support before entering the code.
When the debit completes, the depository confirms it separately by email and SMS, and the broker settles the money side to your linked bank account. Upstox charges a DP charge of ₹20 plus GST per scrip per day on the sell side of demat debits, which appears in your contract note alongside brokerage and statutory charges.
Setting and resetting
The TPIN does not arrive in the welcome kit. You set it yourself after the account activates, which is a deliberate part of the design: the code is never generated by anyone but you.
- Setting. After the account opens, open the app’s demat or profile section and find the TPIN option. The app verifies you with an OTP on your registered mobile, after which you choose a 6-digit code and confirm it.
- Resetting. The same section resets the code. Forgotten or leaked, the path is identical: OTP to your registered mobile and email, then a new code. The reset works only on the channels registered to your account, which is what keeps it out of anyone else’s hands.
- Lockout. Repeated wrong attempts lock the TPIN for a cooling period, after which the reset path applies. The lockout is anti-guessing protection, not a penalty, and it recovers in minutes.
Two practical notes. First, set the TPIN in your first session after activation, before you need it. A sell on settlement day is a bad moment to discover the code is not set. Second, if you change your registered mobile or email, update the account records first and reset the TPIN afterwards, so the reset path always reaches you.
Keeping it safe
Treat the TPIN like an OTP: never share it, never write it where someone can read it, never enter it on a call, and never enter it on a screen you did not open yourself in the official app. No genuine broker employee asks for the TPIN, ever, because the broker has no use for a code it cannot see and must never hold.
The depository emails and texts you for every demat debit, so an unauthorised movement shows up in two channels within minutes. If a debit you never authorised appears, reset the TPIN immediately, review the app’s holdings history to see what left, and raise a dispute with the broker the same day. Speed matters because the money trail is easier to follow while the transaction is fresh.
The most common real-world loss is not brute force. It is the caller who says a pledge is stuck, a fee is pending, or an account is expiring, and asks you to read out the code or enter it on a screen they sent. The TPIN is never needed to receive anything, which means any request involving your TPIN is a debit in progress or a scam, and you should treat it as both until proven otherwise.
What people usually get wrong
The TPIN is just another password
It authorises one thing: demat debits. The narrow scope is why it stays a short code and why sharing it is never legitimate.
The broker needs my TPIN to execute my sell
You enter the TPIN yourself in the app on settlement day. No genuine broker employee will ever ask for it, and any caller asking is a scam in progress.
Intraday trades need the TPIN
Intraday never debits the demat, so no TPIN. An app asking for the TPIN during an intraday order is a sign the order is actually a delivery sell.
Setting the TPIN once means it can never be changed
It has no expiry but resets freely through OTP on your registered channels. If you suspect it leaked, reset it before anything else.
Questions people ask
No. Intraday and F&O positions settle in cash inside the trading account and never debit the demat, so no TPIN is asked. The moment an app asks for the TPIN, shares are about to move out of your demat account, which is exactly when the check should appear. If an intraday order asks for a TPIN, treat it as a delivery sell.
No. The reset runs through your own registered mobile and email with OTP verification, and the code itself is not stored where the broker can read it. Anyone offering to reset your TPIN on your behalf, especially over a call, is running a scam. The reset path exists so you can change the code without anyone else touching it.
No. The login PIN protects access to the app; the TPIN authorises demat debits. Different codes, different jobs, and sharing either one is dangerous. The depository also sends a separate confirmation for every demat debit, which is how you verify that both codes stayed in your hands.
The TPIN locks for a cooling period, and you reset it through the app with OTP verification on your registered channels. The lockout exists to stop brute-force guessing, and the reset path always runs through your own mobile and email. A lockout is an inconvenience, not a problem; a leaked TPIN is the problem.
Yes. An off-market transfer between demat accounts is a debit from your account, so the TPIN is required, either in the broker app or through the depository flow such as CDSL Easiest. Transfers received on the credit side never ask for your TPIN, because the code guards exits, not entrances.
Effectively no one in a readable form: the broker cannot see the code you set, and you enter it at the moment of each debit. The depository matches what you enter against its records at the debit. That is the whole point of the design, the authority for the debit lives with you until the transaction happens.
Sources
- Securities and Exchange Board of India. “Legal framework — circulars.” Accessed 16 August 2026.
- Zerodha Broking Ltd. “Update to CDSL’s TPIN authorisation process for selling stocks.” Accessed 16 August 2026.
- Central Depository Services (India) Limited. “Official website — demat account services.” Accessed 16 August 2026.
- National Securities Depository Limited. “Official website — depository services.” Accessed 16 August 2026.
- Upstox. “Open a free Demat account,” KYC and activation flow. Accessed 16 August 2026.