CCI Closes Complaint Against CCA Over FIPS 140-3 Upgrade Allegedly Favouring Precision Biometric
The Competition Commission of India (CCI) on 31 August closed a complaint alleging that the Controller of Certifying Authorities' (CCA) decision to mandate migration to the FIPS 140-3 standard for USB cryptographic tokens favoured Precision Biometric India Private Limited.
A Bench comprising Chairperson Ravneet Kaur with Members Sweta Kakkad and Deepak Anurag was considering an Information filed by Advocate Ramkishan Saraswat alleging violations of Sections 3(4) (anti-competitive agreements) and 4 (abuse of dominant position) of the Competition Act, 2002 by the Ministry of Electronics and Information Technology (MeitY), the CCA and Precision Biometric. It held:
“….the Commission is of the opinion that no prima facie case of contravention of Sections 3(4) or 4 of the Act is made out against the Opposite Parties.”
The case concerned a January 2026 advisory issued by the CCA mandating migration from the FIPS 140-2 standard to the FIPS 140-3 technical standard for USB cryptographic tokens used for digital signatures, with a deadline of 21 September 2026.
The Informant alleged that the timeline was tailored to favour Precision Biometric's “InnalT” tokens. He claimed that Precision Biometric was the only vendor capable of supplying FIPS 140-3-compliant tokens in India, giving it an alleged 100% market share. He contended that the deadline created a regulatory entry barrier for competing vendors, whose FIPS 140-3 certification could take 18 to 24 months.
He further alleged that the move would make millions of Digital Signature Certificate (DSC) users, including legal professionals, businesses and citizens, dependent on Precision Biometric, leaving them without alternative suppliers. He also alleged that the CCA's implementation framework created a vertical arrangement favouring Precision Biometric and foreclosed competing suppliers.
Therefore, he sought an investigation into the alleged anti-competitive conduct, market foreclosure and abuse of dominance by Precision Biometric, besides an interim stay on the 21 September 2026 deadline.
The CCI noted that the grievance essentially concerned the CCA's decision to upgrade the technical standards applicable to USB cryptographic tokens used for digital signatures. It noted that the CCA's advisory laid down the scope, governance, timelines and execution phases for migration to FIPS 140-3. The advisory stated that the upgrade was aimed at aligning with standards prescribed by the International Organisation for Standardization and introducing updated requirements.
The CCI also noted that the CCA had directed Certifying Authorities to stop issuing DSCs in FIPS 140-2 modules after 21 September 2026. However, DSCs downloaded in FIPS 140-2 modules before that date could continue to operate until their expiry, but could not thereafter be used for renewal or fresh downloads.
Relying on the Delhi High Court's decision in Institute of Chartered Accountants of India v. CCI, the CCI observed that regulatory powers exercised by a regulator are not subject to review by the CCI.
It further noted that Section 18 of the Information Technology Act, 2000 empowers the CCA to perform functions including laying down standards to be maintained by Certifying Authorities. It held:
“It is noted that the impugned conduct of OP-2 of upgrading technical standards, is emanating by virtue of its exercising regulatory powers in discharge of functions as a statutory body, that inter alia include setting of standards, processes, conditions etc.”
The Commission concluded that the CCA's conduct was not amenable to scrutiny under the Competition Act as it stemmed from its statutory regulatory functions under the Information Technology Act.
It also found that the Informant had not provided any evidence of an agreement between the CCA and Precision Biometric to support the alleged understanding between them.
Accordingly, the CCI closed the Information.