(1) Any person acting as a certification body without obtaining a license issued by the controller in accordance with this Act shall be punished with a fine of up to one lakh rupees or imprisonment for a term of up to two years or both, depending on the seriousness of the offence.
(2) If a person does not obtain a license from a certifying body but publishes a false statement or a false license stating that such a license has been obtained, or provides a false license to a person by any other person, he shall be fined up to one lakh rupees in the event that he has not performed any act as per sub-section (1).
(3) If a person publishes such certificate knowing that the certifying body mentioned in the certificate has not issued the certificate or the client listed in the certificate has not accepted the certificate or the certificate has been suspended or revoked or makes it available to any other person for any reason. If he does, he will be punished with a fine up to one lakh rupees or imprisonment up to two years or both. However, if a suspended or revoked certificate is published or made available for the purpose of verifying a digital signature made before it was revoked or suspended, it shall not be deemed to have committed an offense under this sub-section.