Licensing a Certifying Authority

In one line

Becoming a Certifying Authority takes five crore rupees of capital, fifty crore rupees of net worth, facilities located in India, an audit before you may start, and the Controller's licence.

In the wording a student can write in an exam: section 21 of the Information Technology Act, 2000 permits any person to apply to the Controller for a licence to issue Electronic Signature Certificates but forbids the issue of a licence unless the applicant fulfils the prescribed requirements as to qualification, expertise, manpower, financial resources and other infrastructure facilities, and provides that a licence is valid for the prescribed period, is not transferable or heritable and is subject to the terms and conditions specified by regulations; section 22 prescribes the contents of the application; section 23 governs renewal; and section 24 empowers the Controller to grant or reject after considering the accompanying documents and such other factors as he deems fit, no rejection being made without a reasonable opportunity of presenting the applicant's case.

Why the entry requirements are so heavy

Because the whole of section 5 rests on the certificate, and the certificate rests on the Authority. Chapters 300 and 320 set that out. An Authority that fails takes with it every signature that depends on its certificates.

And because the risk is not confined to its customers. A relying party who accepts a signature has no relationship with the Authority at all, and no way of assessing it. The licensing requirements are the substitute for that assessment.

Section 21: who may hold a licence

Section 21(1): "Subject to the provisions of sub-section (2), any person may make an application, to the Controller, for a licence to issue Electronic Signature Certificates."

Section 21(2): "No licence shall be issued under sub-section (1), unless the applicant fulfils such requirements with respect to qualification, expertise, manpower, financial resources and other infrastructure facilities, which are necessary to issue Electronic Signature Certificates as may be prescribed by the Central Government."

Five heads of requirement: qualification, expertise, manpower, financial resources and other infrastructure facilities. Each is prescribed by the Certifying Authorities Rules 2000.

Section 21(3): "A licence granted under this section shall (a) be valid for such period as may be prescribed by the Central Government; (b) not be transferable or heritable; (c) be subject to such terms and conditions as may be specified by the regulations."

Clause (b) is worth pausing on. A licence is neither transferable nor heritable. So the business of a Certifying Authority cannot be sold with its licence, and the death of an individual licensee ends it. That is a serious constraint on the commercial structure of the industry and explains why licensed Authorities in India are companies rather than individuals.