AI Structured Summary
Not yet generated for this judgment
Judgment
Order under Section 26(2) of the Competition Act, 2002
The present Information has been filed by Advocate Ramkishan Saraswat (‘Informant’) under Section 19(1)(a) of the Competition Act, 2002 ('Act') against the abovementioned Opposite Parties (‘OPs’) alleging contravention of the provisions of Sections 3(4) and 4 of the Act.
Based on the publicly available information, it is noted as follows:
a. Ministry of Electronics and Information Technology, Government of India (‘MeitY’/ ‘Opposite Party No. l’/ ‘OP-l’), is a stand-alone ministerial agency, responsible for formulating and implementing national policies and programs aimed at enabling the continuous development of electronics and IT industry. OP-1’s focus areas include the development, promotion, and regulation of electronics and IT industry in India, fostering digital governance, enabling innovation in emerging technologies and promoting cybersecurity initiatives within the country.
b. The Controller of Certifying Authorities (‘CCA’/‘Opposite Party No. 2’/ ‘OP-2’) is an authority appointed by the Central Government under Section 17 of the Information Technology Act, 2000 (‘IT Act’). It aims at promoting the growth of E-Commerce and E-Governance through the wide use of digital signatures.
c. M/s Precision Biometric India Pvt. Ltd. (‘Opposite Party No. 3’/ ‘OP-3’) was established in 1996. It provides biometric, IoT, cloud & system integration solutions and IT infrastructure management services.
The Informant has stated that in January, 2026, OP-2 issued an advisory, whereby it mandated immediate and compulsory migration from the globally accepted FIPS 140-2 technical standard to the FIPS 140-3 technical standard for all USB cryptographic tokens. OP-2 prescribed a cut-off date of 21.09.2026 for commercial and private entities to implement this migration. It is alleged that while technological upgradation is a policy matter, the manner, sequencing, and timing of this implementation have been custom-tailored to align exclusively with the product readiness of a single commercial brand, the "InnalT" token line owned by OP-3.
As per the Informant, OP-3 is the only vendor empanelled or capable of supplying FIPS 140-3 compliant tokens in the domestic market, and has been handed a 100% market share by OP-2. The Informant has alleged that, this has completely driven out all existing cryptographic token manufacturers, establishing an insurmountable regulatory entry barrier, eliminating consumer choice, and inflicting severe pecuniary harm on professionals and digital ecosystem stakeholders across India.
The Informant has submitted that these physical tokens form a distinct product segment characterized by mandatory technical standards, specialized cryptographic chip architectures, and an absence of direct interchangeability or substitutability with standard commercial USB flash drives. Therefore, the relevant product market is the "Market for FIPS-compliant USB Cryptographic Tokens used for Digital Signature Certificates (DSC)". Further, as per the Informant, the relevant geographic market is the "Territory of India" as the advisory, regulations, and compliance frameworks mandated by OP-2 under the aegis of OP-1 apply uniformly to all Certifying Authorities (‘CA’), intermediaries, and subscribers across the entire geographical territory of India, creating homogenous conditions of competition. The Informant has submitted that the relevant market is "Market for FIPS-compliant USB Cryptographic Tokens used for Digital Signature Certificates (DSC) in India".
The Informant has alleged that by virtue of the regulatory intervention of OP-2, OP-3 has instantly acquired an unassailable position of dominance within the relevant market. This dominance is allegedly demonstrated by OP-3, as it commands a 100% market share for the newly mandated FIPS 140-3 standard tokens. It is alleged that the impugned advisory creates a technical and regulatory entry barrier as the testing, evaluation, and obtaining a FIPS 140-3 cryptographic module validation certificate requires a lead time of 18 to 24 months. The cut-off date of 21.09.2026, has allegedly locked out competing entities leaving OP-3 as the sole source provider. This has consequently made millions of legal professionals, corporate entities, trade professionals, and citizens, requiring DSCs for statutory filings, entirely dependent on OP-3 without option to switch to alternative suppliers.
The Informant has further alleged that the regulatory apparatus of OP-2 has been utilized to create a commercial conduit exclusively benefitting OP-3. Such a tailored implementation framework points to a concerted practice or vertical understanding under Section 3(4) of the Act, which controls the downstream supply chain of CAs. CAs are prohibited from issuing DSCs on any hardware other than the single-sourced FIPS 140-3 token line supplied by OP-3. As per the Informant, this vertical tie-in agreement and exclusive distribution effect completely forecloses the downstream market.
According to the Informant, the collective impact of the Opposite Parties' actions satisfies the statutory threshold of Appreciable Adverse Effect on Competition (‘AAEC’) under Section 19(3) of the Act, as dozens of established open-market vendors who supply stable FIPS 140-2 cryptographic tokens are being forced to completely exit the business by 21.09.2026, destroying their commercial investments. Consumers are forced to purchase an expensive, single-source product with zero alternative options in terms of configuration, price points, service levels, or technical specifications, violating the fundamental consumer right to free market choice.
The Informant has prayed for the following reliefs: (i) to direct an investigation under Section 26(1) of the Act into the anti-competitive conduct, market foreclosure, and abuse of dominance by OP-3 in active coordination with the regulatory implementation of OP-2, (ii) to issue orders to OP-3 to cease and desist from exploiting its state-mandated 100% market monopoly through unfair pricing or exclusive supply criteria, (iii) exercise competition advocacy powers to recommend that OP-1 and OP-2 provide a fair, proportional, and non-discriminatory transitional timeline (minimum 18-24 months) to enable multi-vendor ecosystem to develop FIPS 140-3 tokens and (iv) any other order that the Commission deems fit in the interest of maintaining free, open, and fair market competition in India.
In addition to the above prayers, the Informant has filed an Interlocutory Application (‘IA’) No. 179 of 2026 in the present matter and prayed for interim relief under Section 33 of the Act, that the Commission may stay the operation of the migration cut-off date of 21.09.2026 prescribed in the January, 2026 advisory issued by OP-2.
The Commission considered the present matter in its ordinary meeting held on 19.08.2026 and decided to pass an appropriate order in due course.
At the outset, the Commission observes that there is no allegation made against OP-1 in the Information. OP-1 is responsible for formulating national policies with respect to electronics and IT Industry.
The Commission notes that the gravamen of the matter is the advisory issued by OP-2 in January, 2026, for migration from FIPS-140-2 standard to FIPS-140-3 for the USB cryptographic tokens used for digital signatures, allegedly resulting in technical and regulatory entry barriers, abuse of dominance by OP-3, etc.
The website of OP-2 inter alia describes itself as follows:
As per Section 3 of The Information Technology Act, 2000 provides the required legal sanctity to the digital signatures based on asymmetric cryptosystems. The digital signatures are now accepted at par with handwritten signatures and the electronic documents that have been digitally signed are treated at par with paper documents.
The IT Act provides for the Controller of Certifying Authorities(CCA) to license and regulate the working of Certifying Authorities. The Certifying Authorities (CAs) issue digital signature certificates for users' electronic authentication.
The Controller of Certifying Authorities (CCA) has been appointed by the Central Government under section 17 of the Act for purposes of the IT Act. The Office of the CCA came into existence on November 1, 2000. It aims at promoting the growth of E-Commerce and E-Governance through the wide use of digital signatures.
The Controller of Certifying Authorities (CCA) has established the Root Certifying Authority (RCAI) of India under section 18(b) of the IT Act to digitally sign the public keys of Certifying Authorities (CA) in the country. The RCAI is operated as per the standards laid down under the Act.
The CCA uses its private key to certify the public keys of Certification Authorities (CAs), allowing users to verify that a certificate has been issued by a licensed CA. To carry out this function, it operates the Root Certifying Authority of India (RCAI). Additionally, the CCA manages the Repository of Digital Certificates, which stores all certificates issued to CAs within the country.
From a perusal of the said advisory issued by OP-2, it is noted that it lays down the scope, governance, timelines and execution phases for the migration. The implementation of FIPS 140-3 is said to be done to align with International Organization for Standardization (‘ISO’) standards and to introduce updated requirements, which would enhance security for:
a. Non-invasive attack mitigation;
b. Software module validation;
c. Entropy and random bit generation;
d. Lifecycle assurance;
e. Reduction of compliance and audit risk;
f. Improved cryptographic assurance and resilience, Non-proprietary Standards; and g. Alignment with modern platforms (containers, virtualization).
It is further noted that the same is stated to have been issued for the benefit of all the stakeholders, Original Equipment Manufacturers (‘OEMs’), Distributers, Vendors, association of persons/company etc. operating in India who are being advised to switch to FIPS 140-3 validation for all in-scope cryptographic modules (Crypto Tokens, HSM, Secure elements etc) before 21.09.2026, to ensure uninterrupted service for products and internal systems. Furthermore, while OP-2 has directed the CAs to stop issuance of DSCs in FIPS 140-2 modules by 21.09.2026, it has further directed that the DSC which are downloaded in FIPS 140-2 modules on or before 21.09.2026 will remain in operation till the expiry of such DSCs and can no longer be used for renewal or fresh download of DSCs thereafter.
In this regard, it may be relevant to refer to the order of Hon`ble High Court of Delhi in Institute of Chartered Accountants of India Vs CCI & Ors, W.P.(C) 2815/2014 wherein it was held as follows:
“47.In view of the above, this Court is unable to accept that ICAI does not fall within the definition of an “enterprise” within the meaning of Clause (h) of Section 2 of the Competition Act. The functions being performed by ICAI in respect of providing education to chartered accountants or to students, cannot be termed as sovereign functions. However, even if it is accepted that the function of regulation of a profession is relatable to the sovereign functions of the Government, the same is also not excluded from the definition of the term
“enterprise” as it excludes only activities of “the Government” which are relatable to the sovereign functions of the Government. ICAI cannot be considered the Government and, therefore, even if it carries on regulatory functions, it is not excluded from the wide definition of the term “enterprise” as defined under Clause (h) of Section 2 of the Competition Act.”
Further,
“62.…. However, a decision in exercise of regulatory powers is required to be taken by the regulator and its discretion to do so can only be fettered by the provisions of the statute, which clothes the regulator with such powers. The regulatory powers are not subject to review by the CCI.”
In the facts of the present case, it is noted that the grievance of the Informant pertains to setting of a new standard by OP-2 for USB cryptographic tokens used for digital signatures. Hence, it is considered relevant to refer to the regulatory functions of OP-2, under Section 18 of the IT Act reproduced as follows:
“18.Functions of Controller.–The Controller may perform all or any of the following functions, namely:–
(a)exercising supervision over the activities of the Certifying Authorities;
(b)certifying public keys of the Certifying Authorities;
(c)laying down the standards to be maintained by the Certifying Authorities;
(d)specifying the qualifications and experience which employees of the Certifying Authority should possess;
(e)specifying the conditions subject to which the Certifying Authorities shall conduct their business;
…
(g)specifying the form and content of a 2 [electronic signature] Certificate and the key; …”
It is noted that the impugned conduct of OP-2 of upgrading technical standards, is emanating by virtue of its exercising regulatory powers in discharge of functions as a statutory body, that inter alia include setting of standards, processes, conditions etc. The alleged conduct of OP-2 is thus not found to be amenable to scrutiny under the Act, as it is rooted in its core regulatory mandate under the IT Act. Therefore, the allegation of violation of Section 4 of the Act is found to be without any merit.
As regards the allegation of an understanding between OP-2 and OP-3, as per Section 3(4) of the Act, the Commission notes that the Informant has not provided any evidence of an agreement between them in support thereof. Therefore, the allegation of violation of Section 3(4) of the Act is found to be without any merit.
In view of the above, the Commission is of the opinion that no prima facie case of contravention of Sections 3(4) or 4 of the Act is made out against the Opposite Parties.
Accordingly, the Information is directed to be closed forthwith under Section 26(2) of the Act. Consequently, no case for grant of any relief(s) as sought under Section 33 of the Act arises and the same is also rejected. Accordingly, IA No. 179 of 2026 also stands disposed of.
The Secretary is directed to communicate the order to the Informant, accordingly.