Advocate Ramkishan Saraswat Vs Secretary Ministry of Electronics and Information Technology (MeitY) (Competition Commission of India)
Summary: The Competition Commission of India (CCI), in Case No. 26 of 2026, considered an Information filed by Advocate Ramkishan Saraswat under Section 19(1)(a) of the Competition Act, 2002 against the Ministry of Electronics and Information Technology (MeitY), the Controller of Certifying Authorities (CCA) and M/s Precision Biometric India Pvt. Ltd. The Informant alleged contravention of Sections 3(4) and 4 of the Act in connection with migration of USB cryptographic tokens from the FIPS 140-2 technical standard to FIPS 140-3.
According to the Informant, OP-2 issued an advisory in January 2026 mandating immediate and compulsory migration to the FIPS 140-3 standard for USB cryptographic tokens, with a cut-off date of 21.09.2026. The Informant alleged that the manner, sequencing and timing of the implementation had been tailored to the readiness of the “InnalT” token line owned by OP-3. It was further alleged that OP-3 was the only vendor empanelled or capable of supplying FIPS 140-3 compliant tokens in the domestic market and had consequently obtained a 100% market share.
The Informant identified the relevant product market as the “Market for FIPS-compliant USB Cryptographic Tokens used for Digital Signature Certificates (DSC)” and the relevant geographic market as the “Territory of India”, resulting in the relevant market being stated as the “Market for FIPS-compliant USB Cryptographic Tokens used for Digital Signature Certificates (DSC) in India”. The Informant alleged that the regulatory intervention created technical and regulatory entry barriers because testing, evaluation and obtaining FIPS 140-3 cryptographic module validation certification required a lead time of 18 to 24 months.
The Informant further alleged that the regulatory apparatus of OP-2 had been utilised to create a commercial conduit exclusively benefitting OP-3 and that the arrangement amounted to a concerted practice or vertical understanding under Section 3(4). It was also alleged that Certifying Authorities were prohibited from issuing DSCs on hardware other than the single-sourced FIPS 140-3 token line supplied by OP-3, resulting in foreclosure of the downstream market. The Informant invoked the Appreciable Adverse Effect on Competition (AAEC) considerations under Section 19(3) and sought investigation under Section 26(1), directions against OP-3, competition advocacy concerning a transitional timeline and other appropriate reliefs.
The Informant also filed IA No. 179 of 2026 seeking interim relief under Section 33 of the Act by way of a stay of the 21.09.2026 migration cut-off date.
The Commission noted at the outset that there was no allegation against OP-1. It observed that the gravamen of the matter was the January 2026 advisory issued by OP-2 concerning migration from FIPS 140-2 to FIPS 140-3 for USB cryptographic tokens used for digital signatures.
The Commission considered the regulatory role of OP-2 and reproduced material from the CCA’s website explaining its statutory functions. It noted that the advisory laid down the scope, governance, timelines and execution phases for migration to FIPS 140-3, which was stated to align with International Organization for Standardization (ISO) standards and introduce updated requirements intended to enhance security through non-invasive attack mitigation, software module validation, entropy and random bit generation, lifecycle assurance, reduction of compliance and audit risk, improved cryptographic assurance and resilience, non-proprietary standards, and alignment with modern platforms.
The Commission further noted that OP-2 had stated that the migration was for the benefit of stakeholders including OEMs, distributors, vendors and associations operating in India. The advisory required in-scope cryptographic modules, including crypto tokens, HSM and secure elements, to obtain FIPS 140-3 validation before 21.09.2026. While CAs were directed to stop issuance of DSCs in FIPS 140-2 modules after that date, DSCs downloaded in FIPS 140-2 modules on or before 21.09.2026 were stated to remain operational until their expiry, although they could not thereafter be used for renewal or fresh download.
In examining whether OP-2’s conduct was amenable to scrutiny under the Competition Act, the Commission referred to the Delhi High Court’s decision in Institute of Chartered Accountants of India Vs CCI & Ors., W.P.(C) 2815/2014. The Commission reproduced observations from that decision concerning regulatory functions and the limits on review by the CCI of decisions taken in exercise of regulatory powers.
The Commission then referred to Section 18 of the Information Technology Act, 2000 and reproduced the functions of the Controller, including supervision over Certifying Authorities, certification of their public keys, laying down standards to be maintained by Certifying Authorities, specifying qualifications and experience of employees, specifying conditions for conducting business, and specifying the form and content of electronic signature certificates and the key.
On that basis, the Commission held that OP-2’s upgrading of technical standards emanated from its exercise of regulatory powers in discharge of functions as a statutory body, including setting standards, processes and conditions. It therefore found that the alleged conduct of OP-2 was not amenable to scrutiny under the Competition Act because it was rooted in its core regulatory mandate under the Information Technology Act, 2000. The allegation of violation of Section 4 was accordingly found to be without merit.
As regards the alleged understanding between OP-2 and OP-3 under Section 3(4), the Commission noted that the Informant had not provided any evidence of an agreement between them in support of the allegation. It therefore found the allegation of violation of Section 3(4) to be without merit.
The Commission concluded that no prima facie case of contravention of Sections 3(4) or 4 of the Competition Act was made out against the Opposite Parties. Accordingly, the Information was directed to be closed forthwith under Section 26(2) of the Act. Since the Information was closed, the Commission held that no case for grant of relief under Section 33 arose and rejected the interim relief sought. IA No. 179 of 2026 was consequently disposed of. The Secretary was directed to communicate the order to the Informant.
Cases Discussed
- Institute of Chartered Accountants of India Vs CCI & Ors., W.P.(C) 2815/2014 — referred to regarding the treatment of regulatory functions and the proposition that regulatory powers exercised by a regulator are not subject to review by the CCI.
FULL TEXT OF THE ORDER OF COMPETITION COMMISSION OF INDIA
Order under Section 26(2) of the Competition Act, 2002
1. The present Information has been filed by Advocate Ramkishan Saraswat (‘Informant’) under Section 19(1)(a) of the Competition Act, 2002 (‘Act’) against the abovementioned Opposite Parties (‘OPs’) alleging contravention of the provisions of Sections 3(4) and 4 of the Act.
2. Based on the publicly available information, it is noted as follows:
a. Ministry of Electronics and Information Technology, Government of India (‘MeitY’/ ‘Opposite Party No. l’/ ‘OP-l’), is a stand-alone ministerial agency, responsible for formulating and implementing national policies and programs aimed at enabling the continuous development of electronics and IT industry. OP-1’s focus areas include the development, promotion, and regulation of electronics and IT industry in India, fostering digital governance, enabling innovation in emerging technologies and promoting cybersecurity initiatives within the country.
b. The Controller of Certifying Authorities (‘CCA’/‘Opposite Party No. 2’/‘OP-2’) is an authority appointed by the Central Government under Section 17 of the Information Technology Act, 2000 (‘IT Act’). It aims at promoting the growth of E-Commerce and E-Governance through the wide use of digital signatures.
c. M/s Precision Biometric India Pvt. Ltd. (‘Opposite Party No. 3’/‘OP-3’) was established in 1996. It provides biometric, IoT, cloud & system integration solutions and IT infrastructure management services.
3. The Informant has stated that in January, 2026, OP-2 issued an advisory, whereby it mandated immediate and compulsory migration from the globally accepted FIPS 140-2 technical standard to the FIPS 140-3 technical standard for all USB cryptographic tokens. OP-2 prescribed a cut-off date of 21.09.2026 for commercial and private entities to implement this migration. It is alleged that while technological upgradation is a policy matter, the manner, sequencing, and timing of this implementation have been custom-tailored to align exclusively with the product readiness of a single commercial brand, the “InnalT” token line owned by OP-3.
4. As per the Informant, OP-3 is the only vendor empanelled or capable of supplying FIPS 140-3 compliant tokens in the domestic market, and has been handed a 100% market share by OP-2. The Informant has alleged that, this has completely driven out all existing cryptographic token manufacturers, establishing an insurmountable regulatory entry barrier, eliminating consumer choice, and inflicting severe pecuniary harm on professionals and digital ecosystem stakeholders across India.
5. The Informant has submitted that these physical tokens form a distinct product segment characterized by mandatory technical standards, specialized cryptographic chip architectures, and an absence of direct interchangeability or substitutability with standard commercial USB flash drives. Therefore, the relevant product market is the “Market for FIPS-compliant USB Cryptographic Tokens used for Digital Signature Certificates (DSC)”. Further, as per the Informant, the relevant geographic market is the “Territory of India” as the advisory, regulations, and compliance frameworks mandated by OP-2 under the aegis of OP-1 apply uniformly to all Certifying Authorities (‘CA’), intermediaries, and subscribers across the entire geographical territory of India, creating homogenous conditions of competition. The Informant has submitted that the relevant market is “Market for FIPS-compliant USB Cryptographic Tokens used for Digital Signature Certificates (DSC) in India”.
6. The Informant has alleged that by virtue of the regulatory intervention of OP-2, OP-3 has instantly acquired an unassailable position of dominance within the relevant market. This dominance is allegedly demonstrated by OP-3, as it commands a 100% market share for the newly mandated FIPS 140-3 standard tokens. It is alleged that the impugned advisory creates a technical and regulatory entry barrier as the testing, evaluation, and obtaining a FIPS 140-3 cryptographic module validation certificate requires a lead time of 18 to 24 months. The cut-off date of 21.09.2026, has allegedly locked out competing entities leaving OP-3 as the sole source provider. This has consequently made millions of legal professionals, corporate entities, trade professionals, and citizens, requiring DSCs for statutory filings, entirely dependent on OP-3 without option to switch to alternative suppliers.
7. The Informant has further alleged that the regulatory apparatus of OP-2 has been utilized to create a commercial conduit exclusively benefitting OP-3. Such a tailored implementation framework points to a concerted practice or vertical understanding under Section 3(4) of the Act, which controls the downstream supply chain of CAs. CAs are prohibited from issuing DSCs on any hardware other than the single-sourced FIPS 140-3 token line supplied by OP-3. As per the Informant, this vertical tie-in agreement and exclusive distribution effect completely forecloses the downstream market.
8. According to the Informant, the collective impact of the Opposite Parties’ actions satisfies the statutory threshold of Appreciable Adverse Effect on Competition (‘AAEC’) under Section 19(3) of the Act, as dozens of established open-market vendors who supply stable FIPS 140-2 cryptographic tokens are being forced to completely exit the business by 21.09.2026, destroying their commercial investments. Consumers are forced to purchase an expensive, single-source product with zero alternative options in terms of configuration, price points, service levels, or technical specifications, violating the fundamental consumer right to free market choice.
9. The Informant has prayed for the following reliefs: (i) to direct an investigation under Section 26(1) of the Act into the anti-competitive conduct, market foreclosure, and abuse of dominance by OP-3 in active coordination with the regulatory implementation of OP-2, (ii) to issue orders to OP-3 to cease and desist from exploiting its state-mandated 100% market monopoly through unfair pricing or exclusive supply criteria, (iii) exercise competition advocacy powers to recommend that OP-1 and OP-2 provide a fair, proportional, and non-discriminatory transitional timeline (minimum 18-24 months) to enable multi-vendor ecosystem to develop FIPS 140-3 tokens and (iv) any other order that the Commission deems fit in the interest of maintaining free, open, and fair market competition in India.
10. In addition to the above prayers, the Informant has filed an Interlocutory Application (‘IA’) No. 179 of 2026 in the present matter and prayed for interim relief under Section 33 of the Act, that the Commission may stay the operation of the migration cut-off date of 21.09.2026 prescribed in the January, 2026 advisory issued by OP-2.
11. The Commission considered the present matter in its ordinary meeting held on 19.08.2026 and decided to pass an appropriate order in due course.
12. At the outset, the Commission observes that there is no allegation made against OP-1 in the Information. OP-1 is responsible for formulating national policies with respect to electronics and IT Industry.
13. The Commission notes that the gravamen of the matter is the advisory issued by OP-2 in January, 2026, for migration from FIPS-140-2 standard to FIPS-140-3 for the USB cryptographic tokens used for digital signatures, allegedly resulting in technical and regulatory entry barriers, abuse of dominance by OP-3, etc.
14. The website of OP-2 inter alia describes itself as follows:
As per Section 3 of The Information Technology Act, 2000 provides the required legal sanctity to the digital signatures based on asymmetric cryptosystems. The digital signatures are now accepted at par with handwritten signatures and the electronic documents that have been digitally signed are treated at par with paper documents.
The IT Act provides for the Controller of Certifying Authorities(CCA) to license and regulate the working of Certifying Authorities. The Certifying Authorities (CAs) issue digital signature certificates for users’ electronic authentication.
The Controller of Certifying Authorities (CCA) has been appointed by the Central Government under section 17 of the Act for purposes of the IT Act. The Office of the CCA came into existence on November 1, 2000. It aims at promoting the growth of E-Commerce and E-Governance through the wide use of digital signatures.
The Controller of Certifying Authorities (CCA) has established the Root Certifying Authority (RCAI) of India under section 18(b) of the IT Act to digitally sign the public keys of Certifying Authorities (CA) in the country. The RCAI is operated as per the standards laid down under the Act.
The CCA uses its private key to certify the public keys of Certification Authorities (CAs), allowing users to verify that a certificate has been issued by a licensed CA. To carry out this function, it operates the Root Certifying Authority of India (RCAI). Additionally, the CCA manages the Repository of Digital Certificates, which stores all certificates issued to CAs within the country.
15. From a perusal of the said advisory issued by OP-2, it is noted that it lays down the scope, governance, timelines and execution phases for the migration. The implementation of FIPS 140-3 is said to be done to align with International Organization for Standardization (‘ISO’) standards and to introduce updated requirements, which would enhance security for:
a. Non-invasive attack mitigation;
b. Software module validation;
c. Entropy and random bit generation;
d. Lifecycle assurance;
e. Reduction of compliance and audit risk;
f. Improved cryptographic assurance and resilience, Non-proprietary Standards; and
g. Alignment with modern platforms (containers, virtualization).
16. It is further noted that the same is stated to have been issued for the benefit of all the stakeholders, Original Equipment Manufacturers (‘OEMs’), Distributers, Vendors, association of persons/company etc. operating in India who are being advised to switch to FIPS 140-3 validation for all in-scope cryptographic modules (Crypto Tokens, HSM, Secure elements etc) before 21.09.2026, to ensure uninterrupted service for products and internal systems. Furthermore, while OP-2 has directed the CAs to stop issuance of DSCs in FIPS 140-2 modules by 21.09.2026, it has further directed that the DSC which are downloaded in FIPS 140-2 modules on or before 21.09.2026 will remain in operation till the expiry of such DSCs and can no longer be used for renewal or fresh download of DSCs thereafter.
17. In this regard, it may be relevant to refer to the order of Hon`ble High Court of Delhi in Institute of Chartered Accountants of India Vs CCI & Ors., W.P.(C) 2815/2014 wherein it was held as follows: :contentReference[oaicite:3]{index=3}
“47. In view of the above, this Court is unable to accept that ICAI does not fall within the definition of an “enterprise” within the meaning of Clause (h) of Section 2 of the Competition Act. The functions being performed by ICAI in respect of providing education to chartered accountants or to students, cannot be termed as sovereign functions. However, even if it is accepted that the function of regulation of a profession is relatable to the sovereign functions of the Government, the same is also not excluded from the definition of the term “enterprise” as it excludes only activities of “the Government” which are relatable to the sovereign functions of the Government. ICAI cannot be considered the Government and, therefore, even if it carries on regulatory functions, it is not excluded from the wide definition of the term “enterprise” as defined under Clause (h) of Section 2 of the Competition Act.”
Further,
“62. …. However, a decision in exercise of regulatory powers is required to be taken by the regulator and its discretion to do so can only be fettered by the provisions of the statute, which clothes the regulator with such powers. The regulatory powers are not subject to review by the CCI.”
18. In the facts of the present case, it is noted that the grievance of the Informant pertains to setting of a new standard by OP-2 for USB cryptographic tokens used for digital signatures. Hence, it is considered relevant to refer to the regulatory functions of OP-2, under Section 18 of the IT Act reproduced as follows:
“18. Functions of Controller.–The Controller may perform all or any of the following functions, namely:–
(a) exercising supervision over the activities of the Certifying Authorities;
(b) certifying public keys of the Certifying Authorities;
(c) laying down the standards to be maintained by the Certifying Authorities;
(d) specifying the qualifications and experience which employees of the Certifying Authority should possess;
(e) specifying the conditions subject to which the Certifying Authorities shall conduct their business;
…
(g) specifying the form and content of a 2 [electronic signature] Certificate and the key; …”
19. It is noted that the impugned conduct of OP-2 of upgrading technical standards, is emanating by virtue of its exercising regulatory powers in discharge of functions as a statutory body, that inter alia include setting of standards, processes, conditions etc. The alleged conduct of OP-2 is thus not found to be amenable to scrutiny under the Act, as it is rooted in its core regulatory mandate under the IT Act. Therefore, the allegation of violation of Section 4 of the Act is found to be without any merit.
20. As regards the allegation of an understanding between OP-2 and OP-3, as per Section 3(4) of the Act, the Commission notes that the Informant has not provided any evidence of an agreement between them in support thereof. Therefore, the allegation of violation of Section 3(4) of the Act is found to be without any merit.
21. In view of the above, the Commission is of the opinion that no prima facie case of contravention of Sections 3(4) or 4 of the Act is made out against the Opposite Parties.
22. Accordingly, the Information is directed to be closed forthwith under Section 26(2) of the Act. Consequently, no case for grant of any relief(s) as sought under Section 33 of the Act arises and the same is also rejected. Accordingly, IA No. 179 of 2026 also stands disposed of.
23. The Secretary is directed to communicate the order to the Informant, accordingly.
