eMudhra Limited — Q2 & H1 FY27 — November 5, 2026

1. Overall Tone of Management

Cautious. Management emphasized strong underlying growth and said the incident’s effect should be temporary, but the certificate-security incident drove a material downgrade to FY27 guidance. Management also acknowledged reputational spillover beyond the TLS business and some delayed customer discussions. Confidence in the long-term strategy remained firm, but near-term visibility is less certain.

2. Key Themes from Management Commentary

Core growth and mix: Q2 income rose 19.6% YoY and H1 income 23.4%. Enterprise solutions grew 36% and now represent two-thirds of revenue; international markets also account for two-thirds.
TLS incident and exit: Weak keys were found in eight intermediate certificates from a 2024 ceremony. They were revoked the next day; management said none had issued end-customer certificates, root keys were unaffected, and no data was breached. eMudhra is exiting publicly trusted TLS, which management says was about 1% of revenue.
Reputational impact: Management described the direct impact as limited, but forecast a ₹20–25 crore FY27 revenue reduction and ₹10–12 crore lower PAT. It also acknowledged some delays and lost TLS-tied deals.
Trust Services: Conventional digital-signature/token activity is subdued, partly due to delayed availability of FIPS-compliant tokens and a lack of new government use cases. eSign volumes have risen sharply, which management sees as an offsetting growth driver.
New opportunities: Management highlighted DPDP privacy software, post-quantum cryptography (PQC), private PKI, machine identity and AI-related security needs. It cited one DPDP win and one PQC order, with more opportunities expected.
Cash and investment: Receivables rose with the business while days remained broadly stable; lower payables weighed on H1 operating cash flow. Incremental planned capex for FY27 is about ₹23 crore, mainly for the data-privacy stack and product enhancements.

3. Q&A Analysis

TLS incident, customer retention and reputation

Analyst questions: How much of the US/private PKI opportunity is affected? Are existing customers or contracts at risk? Is the revenue reduction driven by customer losses or deals not pursued?
Management response: It said the directly affected university federation will continue using eMudhra’s Cert-Next product, with TLS certificates sourced from another provider. Management reported no existing contract terminations and said the main revenue impact comes from exiting TLS and abandoning a few TLS-linked opportunities. Some prospective customers have experienced delays.
Assessment: Management repeatedly stressed that only one customer was directly affected and that other platforms were not impacted. However, its own guidance implies spillover beyond TLS: projected lost revenue of ₹20–25 crore exceeds the stated roughly 1% TLS revenue contribution. The full extent and duration of reputational effects remain uncertain.
Quote: “Some business may still be lost, but predominantly all the customers and all the conversations are continuing.”

Trust Services performance

Analyst questions: Was the earlier disruption expected to normalize in Q3? Will weakness persist through the year, and should disruptions be considered normal?
Management response: Token revenue was affected by the timing of FIPS-compliant product availability; management expects improvement in Q3 and Q4. Conventional digital-signature services may be flat to 8–10% growth, while eSign is growing significantly—management cited 7–8 lakh eSigns per day versus 1–2 lakh about a year ago.
Assessment: The answer tempered earlier normalization expectations: conventional Trust Services is now described as having limited growth, with eSign expected to compensate. The transcript contains an apparent “FY25” reference in this FY27 call, likely a transcription error.

DPDP and PQC opportunities

Analyst questions: What are likely deal sizes, revenue timing and market opportunity for DPDP? Are PQC inquiries converting?
Management response: One DPDP deal was won; management expects greater traction next year as enforcement approaches. Typical deals range from roughly ₹40–50 lakh to ₹1–2 crore for larger entities. It cited a first-year target of 40–50 clients. Several PQC proofs of concept are underway, with one order already secured.
Assessment: Opportunity claims are specific on deal size and target customer count, but timing remains weighted toward next year and no material revenue contribution was quantified.

Margins, capex and growth mix

Analyst questions: What margins are sustainable, and how will the ₹23 crore capex be used?
Management response: Management expects EBITDA margins to remain around 25%, citing the higher gross margins of solutions. Capex is mainly for completing the data-privacy stack, adding AI capabilities to M-Signer and building identity-verification capabilities.
Assessment: The margin statement is a medium-term aspiration, not a detailed FY27 quarterly outlook; it should be viewed alongside the lower FY27 PAT guidance.

Cryptas and international growth

Analyst questions: How is Cryptas performing, and what is the international growth outlook?
Management response: Cryptas generated about ₹30 crore revenue for the quarter; management expects its margin profile to improve as it sells more eMudhra products. The response did not give a clear consolidated profitability or contribution breakdown.
Assessment: The answer offered a run rate but limited visibility on contribution and profitability.

4. Guidance / Outlook

Quantitative guidance

FY27 revenue: Revised from about ₹825 crore to ₹800 crore.
FY27 PAT: Revised from about ₹137 crore to ₹125 crore.
Incident impact: Estimated at ₹20–25 crore revenue and ₹10–12 crore PAT, largely in H2.
EBITDA margin: Management expects to maintain approximately 25%.
Capex: About ₹23 crore incremental planned capex for the year.
DPDP: Targeting 40–50 clients in the first year; typical deal sizes cited at ₹40–50 lakh, rising to ₹1–2 crore for larger entities.

Qualitative signals

Management expects the TLS-incident impact to last roughly two quarters, then normalize.
It expects greater DPDP traction next year and more PQC activity as migration deadlines approach.
Enterprise platforms and new market entries remain the main growth priorities.
Conventional Trust Services may remain flat to 8–10% growth; eSign is expected to provide stronger growth.
Management says it has no other major acquisition payments planned in the next six months.

5. Standout Statements

“We now expect our revenue to be about 800 crores and PAT to be around 125 crores.”
“Given the limited returns from TLS relative to our overall business, we have decided to exit the sale of publicly trusted TLS certificates.”
“The impact has not been as pronounced as it might have been … and it is slowly settling down.”
“The only affected customer is this university federation in the US.”
The university federation’s decision to continue with eMudhra’s product while sourcing TLS elsewhere is a positive retention signal, though it does not resolve broader reputation uncertainty.
The estimated revenue impact is materially larger than the stated TLS revenue base, indicating the risk includes foregone deals and customer hesitation, not just the exited product line.

6. Red Flags / Positive Signals

Red flags
– FY27 guidance was cut despite strong H1 growth; the projected reduction is concentrated in H2.
– Management acknowledges some customer delays and lost deals, while also characterizing reputational risk as minimal. These statements suggest uncertainty around the true spillover.
– Trust Services remains structurally subdued, with conventional business growth limited.
– Cash conversion weakened as creditors declined, even though receivable days were said to be stable.

Positive signals
– H1 revenue and PAT grew 23.4% and 27%, respectively, with year-on-year margin expansion.
– Enterprise solutions grew 36%; the directly affected US customer is continuing with the product.
– Management cited one DPDP win, one PQC order and multiple active proofs of concept.
– Planned exit removes a low-growth, high-compliance-burden TLS activity.

7. Historical Comparison & Consistency Analysis

Source limitation: Only the Q2 FY26 transcript and current Q2 FY27 transcript were provided. The second- and third-last transcripts were marked “Transcript Not Available,” so they cannot be reliably labeled or analyzed.

a. Quarter-by-Quarter Tone Evolution

Q2 FY26 — November 5, 2025
– Dominant tone: Optimistic, with clear caveats.
– Major themes this quarter:
– Product growth expected to offset stagnant US services and slower Trust Services.
– Cryptas integration and cross-selling expected to support growth.
– US product pipeline, new data-center readiness and market localization emphasized.
– Management expected FY26 revenue of ₹675–700 crore and PAT margin of 15.5–16%.
– Tone shift vs previous quarter: N/A (baseline; earlier transcript unavailable).

Q2 FY27 — November 5, 2026
– Dominant tone: Cautious.
– Major themes this quarter:
– Strong enterprise-platform and international growth.
– TLS security incident, customer reassurance and exit from public TLS.
– FY27 guidance reduction and H2 impact.
– DPDP, PQC and private PKI as future growth opportunities.
– Tone shift vs previous quarter: More Cautious.
– What changed:
– The prior call focused on scaling US product sales and converting pipeline; the current call is dominated by incident containment and revised forecasts.
– Prior management framed a stronger second half as a path to guidance; current management cut its full-year outlook and expects the incident to weigh on H2.
– The earlier call discussed visa constraints and service growth; current commentary gives more weight to security reputation, regulatory timelines and product-led diversification.

Trajectory Summary: The available comparison shows a shift from growth-led optimism in Q2 FY26 to a more cautious Q2 FY27 after a specific security incident. Product-led growth remains the central strategic narrative, but near-term confidence has weakened and guidance has been reduced.

b. Tracking Past Commitments vs Outcomes

Q2 FY26 FY26 revenue outlook of ₹675–700 crore
Expected: FY26 revenue within that range.
What happened: The current call does not provide FY26 actual revenue, so achievement cannot be verified from the supplied transcript.
Flag: Not verifiable.
Cryptas expected to turn profitable over the next two quarters
Expected: Profitability following integration.
What happened: Current management says cross-selling is improving its margin profile and gives a quarterly revenue run rate, but does not clearly confirm that Cryptas has reached profitability.
Flag: ⏳ Not confirmed / potentially delayed.
New product enhancements expected to launch around March/April
Expected: Launches or integration by that timeframe, as discussed in Q2 FY26.
What happened: The current call does not confirm whether those launches occurred. It describes ongoing product investment and capex for data privacy, AI and identity verification.
Flag: ❌ Not mentioned again; delivery cannot be confirmed.
Trust Services expected to rise from about ₹100 crore to ₹120–130 crore in FY26
Expected: Higher annual revenue, supported by eSign growth.
What happened: The current call describes conventional Trust Services as limited-growth and cites strong eSign volumes, but gives no actual FY26 segment revenue.
Flag: Not verifiable.

c. Narrative Shifts

From US expansion to incident containment: The prior call emphasized the US data center, localization and sales pipeline; this call focuses on TLS exit and reputational exposure in the US and parts of the Middle East.
More explicit product selectivity: Management now openly describes TLS as declining, low-return and costly to maintain, rather than treating it as an expansion opportunity.
Emerging themes: DPDP and PQC have moved from product development and market positioning toward cited wins, deal targets and conversion timelines.
Continuing theme: Product-led growth remains the proposed offset to slower services and conventional Trust Services.

d. Consistency & Credibility Signals

Overall credibility: Medium.
– Management was direct about the incident, appointed an external reviewer, disclosed the guidance reduction and committed to exiting the affected business.
– However, it simultaneously described the broader business impact as minimal while forecasting a reduction substantially larger than the stated TLS revenue contribution. The explanation—lost prospects, delays and reputation spillover—is plausible but not yet quantified in detail.
– Historical commitments on Cryptas profitability, product launches and Trust Services revenue are not clearly reconciled in the current call, limiting assessment of follow-through.

e. Evolution of Key Themes

Enterprise/product demand — Improving: Enterprise solutions grew 36%; focus remains on international expansion and cross-selling.
US opportunity — Deteriorating near term / uncertain longer term: Prior localization and pipeline optimism is now tempered by reputational impact and withdrawn TLS deals; private PKI remains a stated opportunity.
Trust Services — Stable to weak: Token-related disruption and limited conventional growth persist; eSign is the brighter component.
Margins — Stable target, weaker earnings outlook: Management still targets ~25% EBITDA margins, but has cut PAT guidance because of the incident.
Security risk — Newly elevated: A specific certificate-control failure is now a central operating and credibility issue; review outcomes are pending.

f. Additional Insights

The incident exposes a tension in the diversification narrative: management says no single market or business line is dominant, yet a small TLS activity has prompted a material reduction to company-wide guidance. This suggests the financial exposure is less about TLS revenue itself and more about the uncertain effect on new business conversion and reputation. The planned exit may reduce future operational risk, but the expected recovery after two quarters remains management’s estimate, not yet a demonstrated outcome.

eMudhra Cuts FY27 Guidance After TLS Security Incident