150 No. 4 of 2021] Electronic Communications and Transactions (3) The National Root Certification Authority shall, in considering an application for a licence made under subsection (1) have regard to the— (a) financial and technical capability of the applicant; (b) the ability of an electronic signature to— (i) uniquely be linked to the user; (ii) identify the user; (iii) be maintained under the sole control of the user; (iv) be linked to the data or data message to which it relates in a manner that any subsequent change of the data or data message is detectable; and (v) enable face to face identification of the user; (c) the quality of the hardware and software systems; (d) the procedures for the processing of products or services; (e) the availability of information to third parties relying on the certification service; (f) the regularity and extent of audits by an independent body; (g) the applicant’s ability to comply with the latest version of Request for Comments 3161 standard issued by the Internet Engineering Task Force; and (h) any other relevant factor that may be prescribed. (4) The National Root Certification Authority shall, where it rejects an application for a licence, inform the applicant, in writing, giving reasons for the decision. (5) Where the National Root Certification Authority fails to make a decision within the period specified under subsection (2), the application is considered to have been granted. (6) The National Root Certification Authority may request for further particulars in respect of an application. (7) Where the National Root Certification Authority requests for particulars referred to in subsection (6), the period referred to in subsection (2) shall stop running. Certification authority 29. (1) The following entities may apply to be licensed as a certification authority under the national public key infrastructure: (a) public companies; (b) private limited companies; or (c) statutory bodies.