Short answer: A demat account is generally considered safe because it does not store your shares with your broker. Instead, the securities are held by a central depository, either NSDL or CDSL, and a depository participant administers them on the depository’s behalf. Whether your holdings stay protected also depends on how well you guard your own login, which is the part you control.
Last reviewed: 12 November 2026
At a glance
| Term | What it means |
|---|---|
| Demat account | An account that stores securities electronically, replacing physical share certificates |
| Central depository | The institution, NSDL or CDSL, that holds the securities |
| Depository participant | A SEBI-registered intermediary that administers your holdings on the depository’s behalf |
| Two-factor authentication | A login step that requires an extra code beyond your password |
| One-time password (OTP) | A single-use code that confirms a login or transaction |
What does a demat account actually hold?
A demat account, short for dematerialised account, keeps securities in electronic form. Securities means financial instruments such as shares. Before this system, owners had to keep paper share certificates and prove ownership with them.
Because the records are electronic, you no longer need to keep physical certificates safe at home or in a bank locker. The account holds a record of what you own, and that record is maintained by the depository. Your statement shows the holdings it lists, so it is worth checking it regularly.
Who actually holds your shares?
Your shares are held by a central depository, which is either NSDL or CDSL. Your broker does not hold them. This separation matters because the broker’s own finances or operations do not determine where your securities sit.
A depository participant, or DP, is the intermediary that administers your account on the depository’s behalf. Your broker may work with a DP, but the securities are still held by the depository. Knowing this helps you read your account statements and understand which institution to contact for which question.
How is the account protected?
Protection comes from three layers: the depository structure, the choice of participant, and your own login security. Investors should choose a SEBI-registered depository participant with a good reputation and a proven security record. SEBI means the Securities and Exchange Board of India, the regulator for the securities market.
Two-factor authentication adds a second check to your login. Investors should enable it so that an extra code is required beyond the password. Login credentials and one-time passwords should never be shared with anyone, including the depository participant or broker.
Here is a hypothetical example, with all figures invented for illustration. Suppose an investor holds 100 shares, each valued at ₹500, so the holding is worth 100 × ₹500 = ₹50,000 at that price. If someone learned the password but not the one-time code, the extra step would still stand in the way.
Where can it still go wrong?
The most common weakness is the login itself. Anyone who obtains your password and OTP can act as you, so a fraudster who asks for them is asking for access to the account. Sharing either code, even with someone who claims to be from your broker or DP, removes the protection the codes provide.
A demat account protects the record of ownership, not the value of what you own. If a hypothetical investor holds 100 shares worth ₹50,000 and their price falls to ₹400 each, the holding is then worth ₹40,000, and the demat account does not change that. Market losses are a separate risk from security risks.
Choosing a participant with a weak security record also carries risk, because your login and records pass through its systems. That is why reputation and track record are part of the choice, not a formality.
Frequently asked questions
Does a demat account hold my shares directly?
No. The securities are held by a central depository, NSDL or CDSL, and depository participants administer them on the depository’s behalf rather than the broker doing so.
Should I turn on two-factor authentication?
Investors should enable two-factor authentication on their demat accounts, which requires an extra code beyond the password.
Can my broker ask for my OTP?
No. Login credentials and one-time passwords should never be shared with anyone, including the depository participant or the broker.
How do I judge a depository participant?
Choose a SEBI-registered depository participant with a good reputation and a proven security record.
Sources and last check
Facts in this article were checked against the sources below on 12 November 2026. Rules and figures can change; check the primary source before acting.
- icicidirect.com (broker education)
- upstox.com (broker education)
- 5paisa.com (broker education)
This article is general information, not investment advice. MyFinanceBandhu is not a SEBI-registered investment adviser.