From April 2026, every algo order needs a unique Algo ID, and API users must use static IPs, two-factor authentication, and maintain daily audit trails.