Competition Commission of India Order Regarding FIPS 140-3 Cryptographic Token Migration

COMPETITION COMMISSION OF INDIA

Case No. 26 of 2026

In Re:

CORAM

Ravneet Kaur Chairperson

Sweta Kakkad Member

Deepak Anurag Member

Order under Section 26(2) of the Competition Act, 2002

1. The present Information has been filed by Advocate Ramkishan Saraswat (‘Informant’) under Section 19(1)(a) of the Competition Act, 2002 ('Act') against the abovementioned Opposite Parties (‘OPs’) alleging contravention of the provisions of Sections 3(4) and 4 of the Act.

2. Based on the publicly available information, it is noted as follows:

   • a. Ministry of Electronics and Information Technology, Government of India (‘MeitY’/ ‘Opposite Party No. 1’/ ‘OP-1’), is a stand-alone ministerial agency, responsible for formulating and implementing national policies and programs aimed at enabling the continuous development of electronics and IT industry. OP-1’s focus areas include the development, promotion, and regulation of electronics and IT industry in India, fostering digital governance, enabling innovation in emerging technologies and promoting cybersecurity initiatives within the country.
   • b. The Controller of Certifying Authorities (‘CCA’/‘Opposite Party No. 2’/ ‘OP-2’) is an authority appointed by the Central Government under Section 17 of the Information Technology Act, 2000 (‘IT Act’). It aims at promoting the growth of E-Commerce and E-Governance through the wide use of digital signatures.
   • c. M/s Precision Biometric India Pvt. Ltd. (‘Opposite Party No. 3’/ ‘OP-3’) was established in 1996. It provides biometric, IoT, cloud & system integration solutions and IT infrastructure management services.

3. The Informant has stated that in January, 2026, OP-2 issued an advisory, whereby it mandated immediate and compulsory migration from the globally accepted FIPS 140-2 technical standard to the FIPS 140-3 technical standard for all USB cryptographic tokens. OP-2 prescribed a cut-off date of 21.09.2026 for commercial and private entities to implement this migration. It is alleged that while technological upgradation is a policy matter, the manner, sequencing, and timing of this implementation have been custom-tailored to align exclusively with the product readiness of a single commercial brand, the "InnalT" token line owned by OP-3.

4. As per the Informant, OP-3 is the only vendor empanelled or capable of supplying FIPS 140-3 compliant tokens in the domestic market, and has been handed a 100% market share by OP-2. The Informant has alleged that, this has completely driven out all existing cryptographic token manufacturers, establishing an insurmountable regulatory entry barrier, eliminating consumer choice, and inflicting severe pecuniary harm on professionals and digital ecosystem stakeholders across India.

5. The Informant has submitted that these physical tokens form a distinct product segment characterized by mandatory technical standards, specialized cryptographic chip architectures, and an absence of direct interchangeability or substitutability with standard commercial USB flash drives. Therefore, the relevant product market is the "Market for FIPS-compliant USB Cryptographic Tokens used for Digital Signature Certificates (DSC)". Further, as per the Informant, the relevant geographic market is the "Territory of India" as the advisory, regulations, and compliance frameworks mandated by OP-2 under the aegis of OP-1 apply uniformly to all Certifying Authorities (‘CA’), intermediaries, and subscribers across the entire geographical territory of India, creating homogenous conditions of competition. The Informant has submitted that the relevant market is "Market for FIPS-compliant USB Cryptographic Tokens used for Digital Signature Certificates (DSC) in India".

6. The Informant has alleged that by virtue of the regulatory intervention of OP-2, OP-3 has instantly acquired an unassailable position of dominance within the relevant market. This dominance is allegedly demonstrated by OP-3, as it commands a 100% market share for the newly mandated FIPS 140-3 standard tokens. It is alleged that the impugned advisory creates a technical and regulatory entry barrier as the testing, evaluation, and obtaining a FIPS 140-3 cryptographic module validation certificate requires a lead time of 18 to 24 months. The cut-off date of 21.09.2026, has allegedly locked out competing entities leaving OP-3 as the sole source provider. This has consequently made millions of legal professionals, corporate entities, trade professionals, and citizens, requiring DSCs for statutory filings, entirely dependent on OP-3 without option to switch to alternative suppliers.

7. The Informant has further alleged that the regulatory apparatus of OP-2 has been utilized to create a commercial conduit exclusively benefitting OP-3. Such a tailored implementation framework points to a concerted practice or vertical understanding under Section 3(4) of the Act, which controls the downstream supply chain of CAs. CAs are prohibited from issuing DSCs on any hardware other than the single-sourced FIPS 140-3 token line supplied by OP-3. As per the Informant, this vertical tie-in agreement and exclusive distribution effect completely forecloses the downstream market.

8. According to the Informant, the collective impact of the Opposite Parties' actions satisfies the statutory threshold of Appreciable Adverse Effect on Competition (‘AAEC’) under Section 19(3) of the Act, as dozens of established open-market vendors who supply stable FIPS 140-2 cryptographic tokens are being forced to completely exit the business by 21.09.2026, destroying their commercial investments. Consumers are forced to purchase an expensive, single-source product with zero alternative options in terms of configuration, price points, service levels, or technical specifications, violating the fundamental consumer right to free market choice.

9. The Informant has prayed for the following reliefs: (i) to direct an investigation under Section 26(1) of the Act into the anti-competitive conduct, market foreclosure, and abuse of dominance by OP-3 in active coordination with the regulatory implementation of OP-2, (ii) to issue orders to OP-3 to cease and desist from exploiting its state-mandated 100% market monopoly through unfair pricing or exclusive supply criteria, (iii) exercise competition advocacy powers to recommend that OP-1 and OP-2 provide a fair, proportional, and non-discriminatory transitional timeline (minimum 18-24 months) to enable multi-vendor ecosystem to develop FIPS 140-3 tokens and (iv) any other order that the Commission deems fit in the interest of maintaining free, open, and fair market competition in India.

10. In addition to the above prayers, the Informant has filed an Interlocutory Application (‘IA’) No. 179 of 2026 in the present matter and prayed for interim relief under Section 33 of the Act, that the Commission may stay the operation of the migration cut-off date of 21.09.2026 prescribed in the January, 2026 advisory issued by OP-2.

11. The Commission considered the present matter in its ordinary meeting held on 19.08.2026 and decided to pass an appropriate order in due course.

12. At the outset, the Commission observes that there is no allegation made against OP-1 in the Information. OP-1 is responsible for formulating national policies with respect to electronics and IT Industry.

13. The Commission notes that the gravamen of the matter is the advisory issued by OP-2 in January, 2026, for migration from FIPS-140-2 standard to FIPS-140-3 for the USB cryptographic tokens used for digital signatures, allegedly resulting in technical and regulatory entry barriers, abuse of dominance by OP-3, etc.

14. The website of OP-2 inter alia describes itself as follows: