CCI Closes Case No. 26 of 2026: No Prima Facie Violation Found in FIPS 140-3 Token Migration Dispute

Background and Overview

The Competition Commission of India (CCI) has passed an order under Section 26(2) of the Competition Act, 2002 closing a complaint that challenged the regulatory advisory issued by the Controller of Certifying Authorities (CCA) mandating migration from FIPS 140-2 to FIPS 140-3 for USB cryptographic tokens used in digital signature infrastructure. The Commission concluded that no prima facie contravention of Section 3(4) or Section 4 of the Competition Act, 2002 was established, and accordingly directed closure of the matter.

The case arose from an Information filed by Advocate Ramkishan Saraswat (the Informant) under Section 19(1)(a) of the Competition Act, 2002, naming three Opposite Parties: the Ministry of Electronics and Information Technology (MeitY) as OP-1, the Controller of Certifying Authorities (CCA) as OP-2, and M/s Precision Biometric India Pvt. Ltd. as OP-3.

Parties to the Dispute

Opposite Party No. 1 — MeitY

MeitY functions as a stand-alone ministerial agency under the Government of India. Its mandate encompasses the formulation and implementation of national-level policies and programs directed at the development of the electronics and information technology sectors. Its areas of focus include regulation of the IT and electronics industry, advancement of digital governance, facilitation of innovation in emerging technologies, and promotion of cybersecurity initiatives.

Opposite Party No. 2 — Controller of Certifying Authorities (CCA)

The CCA is a statutory authority appointed by the Central Government under Section 17 of the Information Technology Act, 2000. Its primary institutional objective is to promote the expansion of e-commerce and e-governance through the widespread adoption of digital signatures. The CCA licenses and regulates Certifying Authorities (CAs), and has established the Root Certifying Authority of India (RCAI) under Section 18(b) of the Information Technology Act, 2000 to digitally sign the public keys of CAs operating in the country.

Opposite Party No. 3 — M/s Precision Biometric India Pvt. Ltd.

This entity, incorporated in 1996, operates in the domains of biometrics, IoT solutions, cloud and system integration, and IT infrastructure management.

The Allegations Raised by the Informant

The Core Complaint

In January 2026, OP-2 issued an advisory mandating compulsory migration from the FIPS 140-2 technical standard to FIPS 140-3 for all USB cryptographic tokens used in connection with Digital Signature Certificates (DSCs). A cut-off date of 21.09.2026 was prescribed for compliance by commercial and private entities.

The Informant acknowledged that technological upgradation falls within the domain of policy. However, the crux of the complaint was that the manner, sequencing, and timing of the implementation appeared to have been designed in a way that aligned exclusively with the product readiness of a single commercial entity — specifically, the "InnalT" token line manufactured and supplied by OP-3.

Alleged Market Dominance and Entry Barriers

The Informant contended that OP-3 was the sole vendor either empanelled or technically capable of supplying FIPS 140-3 compliant tokens within the domestic market, thereby effectively acquiring a 100% share of the relevant market as a consequence of the advisory.

It was further submitted that:

  • The process of testing, evaluation, and obtaining a FIPS 140-3 cryptographic module validation certificate requires a lead time of 18 to 24 months
  • The cut-off date of 21.09.2026 effectively locked out all competing vendors from the market
  • The regulatory entry barrier thus created was insurmountable for other manufacturers within the prescribed timeframe

Relevant Market Defined by the Informant

The Informant defined the relevant market as follows:

  • Relevant Product Market: "Market for FIPS-compliant USB Cryptographic Tokens used for Digital Signature Certificates (DSC)"
  • Relevant Geographic Market: "Territory of India"
  • Composite Relevant Market: "Market for FIPS-compliant USB Cryptographic Tokens used for Digital Signature Certificates (DSC) in India"