Mandatory Licensing Blocks Market Entry

This provision requires all cybersecurity service providers to obtain licenses from the Authority before offering services "for a reward," with penalties of 50,000-100,000 penalty units or damages plus financial gains for violations. Combined with 16 requiring individual practitioner accreditation, this creates a dual-layer gatekeeping regime that significantly raises barriers to market entry for startups, independent consultants, and smaller providers. The provision lacks defined licensing criteria, timelines, or appeal mechanisms, creating discretionary government control over who can participate in the cybersecurity market—a departure from OECD norms where such services operate in competitive markets with minimal pre-market licensing.