Digital Signature Certificate (DSC) – including DGFT DSC

Class 3 is the current active and mandatory class for all government portal submissions in India. The IT (Certifying Authorities) Rules define three classes by identity assurance level. Class 1 involved email-only verification with minimal identity assurance. Class 2 involved Aadhaar-based or similar database verification but without in-person or video verification. Class 3 involves the highest level of identity assurance — currently implemented through Aadhaar eKYC plus a live video verification with the Certifying Authority's representative. The Controller of Certifying Authorities mandated Class 3 for all MCA company and LLP filings from 1 January 2021. Class 2 DSCs that were issued before this date and have not expired in terms of their validity period are nonetheless now rejected by MCA21, which validates the DSC class at the time of filing.

Yes. For company filings on MCA21, every director who is required to sign a particular form must have their own individual Class 3 DSC. MCA21 forms are signed by specific named directors — not by a generic company-level credential. For incorporation, every proposed director must have a valid DSC before the SPICe+ form is filed. For annual filings such as AOC-4 and MGT-7, at minimum the director signing the forms (typically the Managing Director or a designated director) and the statutory auditor must each have a valid, unexpired Class 3 DSC. One director cannot use another director's DSC — the signature would identify the wrong person and the portal's DIN-to-DSC mapping would reject it.

Yes. The Certifying Authorities' video verification process is conducted remotely — by video call — and does not require physical presence in India. For NRI directors who have an Aadhaar linked to an Indian mobile number they can access abroad, the standard eKYC + video process applies. For NRI directors whose Aadhaar is linked to an inactive Indian SIM (a very common situation), the OTP delivery will fail and the standard process is not usable. In this case, Certifying Authorities have an alternative process typically using the Indian passport as the primary identity document, with notarised copies and additional steps — the exact requirements vary by CA. The crypto token is then shipped by international courier to the applicant's address. Timeline for NRI applicants is typically 10–20 working days from initiation to token delivery internationally.

An expired DSC is immediately non-functional — MCA21 validates the DSC's validity period at the time of signing, and will reject a form signed with an expired certificate with an error message indicating certificate expiry. The filing is incomplete and the deadline is not met. If this happens on or after the due date for AOC-4 or MGT-7, penalties at ₹100 per day per form begin accruing from the due date, with no statutory ceiling. The renewal process takes 3–7 working days from initiation (eKYC + video + token delivery + portal mapping). The only protection is proactive renewal before expiry — PNPC initiates renewal 30 days before expiry for all clients.

Yes — a single Class 3 DSC on a single USB token can be registered and used across all portals simultaneously. The DSC is not portal-specific at the certificate level. However, each portal has its own registration and mapping process: MCA21 requires DIN-to-DSC mapping; the GST portal requires DSC registration under the GSTIN; TRACES maps the DSC to the TAN; the DGFT portal requires DSC registration under the IEC. All of these are one-time setup steps (repeated at each renewal). PNPC performs cross-portal mapping for every DSC as part of the standard service, not as an add-on.

No — these are legally and technically distinct mechanisms. A Class 3 DSC is a hardware-backed cryptographic certificate stored on a USB token. It creates a persistent digital signature: the same certificate can sign thousands of documents over its 1–3 year validity period, each signature cryptographically tied to the specific document content and verifiable by anyone with the public key. Aadhaar eSign is an online service that uses Aadhaar OTP for one-time transaction authentication — it produces a legally valid signature for general contracts and agreements, but is not accepted by MCA21 for company forms, is not accepted by the DGFT portal, and is not used for company Income Tax returns. Aadhaar OTP portal verification (used for individual ITRs, Udyam, proprietorship GST registration) is a session authentication mechanism — not a digital signature at all. These are different tools for different purposes, and only the Class 3 hardware DSC satisfies the regulatory mandates for company-level government filings.

Both are Class 3 DSCs and use the same cryptographic infrastructure. The difference is in the identity information embedded in the certificate and the regulatory context in which they are used. A director's individual DSC identifies the person by name (and optionally organisation), and is used to sign MCA forms, ITR-6, GST filings, and DGFT applications in the director's capacity. A practising CA's DSC is an individual DSC that typically includes the CA's ICAI membership number in the certificate fields — enabling portals (particularly MCA21 and the Income Tax portal) to verify that the signatory is a registered practising CA before accepting an audit certificate or financial statement certification. A CA who is simultaneously a director of a company may hold two separate DSCs: one practitioner DSC for audit-related signings, and one director DSC for company compliance filings — using each in its appropriate context.

The USB crypto token is a hardware security device that stores your private key in a tamper-resistant chip. When you sign a document or filing, the computer sends the document hash to the token, the token computes the signature using your PIN-protected private key inside the chip, and returns the signature to the computer. The private key itself never leaves the chip. This architecture means: even if someone intercepts data between the token and the computer, they cannot extract the private key; even if someone gains access to your computer, they cannot sign anything without the physical token and the PIN. If the token is lost or stolen, the DSC must be immediately revoked by contacting the issuing Certifying Authority. Revocation takes effect immediately and prevents any future use of that certificate. A new DSC application is required — the revoked certificate cannot be restored. PNPC manages revocation and reissuance as a single coordinated process.

Only organisations licensed by the Controller of Certifying Authorities (CCA), which operates under the Ministry of Electronics and Information Technology, can issue legally valid DSCs in India. The currently active licensed CAs include eMudhra, Capricorn CA, CDAC (Centre for Development of Advanced Computing), NSDL e-Gov, and a small number of others. The current list is published on the CCA website (cca.gov.in). All licensed CAs issue equally valid DSCs — the legal standing of a DSC does not depend on which licensed CA issued it. PNPC works primarily with eMudhra and Capricorn for established video verification infrastructure and nationwide courier delivery. Offerings from unlicensed operators (sometimes seen on classified ad sites) have no legal validity.

Approximate market rates from licensed Certifying Authorities as of recent periods: 1-year validity — ₹1,200 to ₹1,500; 2-year validity — ₹1,800 to ₹2,500; 3-year validity — ₹2,200 to ₹3,000. These ranges vary by CA and may change. For a director or professional with ongoing annual filing obligations across MCA, GST, and Income Tax, a 3-year validity DSC is more cost-efficient per year and reduces the number of renewal cycles, which each require video verification and token reconfiguration — an operational disruption as well as a cost. PNPC recommends 2-year or 3-year validity for most clients. The cost is passed through to clients without markup.

DSCs must be in place before the SPICe+ form is filed on MCA21 — all proposed directors must sign SPICe+ with their individual Class 3 DSCs. The DSC process should be initiated at the very start of the incorporation engagement — on Day 1, in parallel with name clearance checks and MoA/AoA drafting. A typical DSC takes 5–8 working days from initiation to delivered and portal-mapped token. If DSC applications are delayed until after the name clearance is obtained, the resulting gap can push the SPICe+ filing out by a week or more — during which the approved name may become available to others. PNPC initiates DSC applications for all directors on Day 1, always.

Often yes. The physical USB crypto token typically has a longer useful lifespan than a single DSC validity period — usually 5–10 years for the hardware. When a DSC expires and is renewed, the Certifying Authority can in many cases load the renewed certificate onto the same token, replacing the expired certificate. This depends on: whether the same CA is used for renewal (cross-CA token reuse is not always supported), whether the token model is compatible with the CA's current certificate format, and whether the token's own firmware supports reconfiguration. PNPC confirms with the CA at renewal time whether existing token reuse is feasible. If not, a new token is issued — which is included in the renewal cost from the CA.

A DSC used for DGFT portal submissions is not a different type of certificate — it is the same Class 3 DSC. The difference is in the portal-level registration. The DGFT (Directorate General of Foreign Trade) portal has its own authentication system in which the DSC must be registered against the entity's IEC (Importer-Exporter Code). This registration is done within the DGFT portal after the DSC token is received — it is a one-time setup per IEC profile. Once registered, the DSC is used to sign and submit DGFT applications such as Advance Authorisation applications, EPCG licence applications, IEC amendments, and SION revision submissions. The IEC-holder entity's GSTIN must also be updated in the DGFT portal profile, and the profile must show the authorised signatory whose DSC is being registered.

Yes, in two respects. First, the outgoing director's DSC, while it remains technically valid until its expiry date, should no longer be used for company filings — it would represent a filing signed by someone who is no longer authorised. Second, the incoming director needs their own valid Class 3 DSC to sign future company forms. The DIR-12 form that effects the appointment and resignation of directors on MCA21 itself requires DSC signatures — from the incoming or outgoing director as applicable. After the change, the new director's DSC must be mapped to their DIN on MCA21 and portal access updated. PNPC manages the entire director change process including DSC coordination.

For GST filings by companies (not individuals or proprietors), the GST portal accepts both DSC authentication and EVC (Electronic Verification Code) authentication. EVC for companies is generated via the GST portal itself or via net banking — it does not require a hardware DSC. However, companies that prefer DSC-based authentication (for higher security assurance, or because their compliance workflow uses DSC-based signing) can register their director's Class 3 DSC on the GST portal and use it for all filings including GSTR-1, GSTR-3B, and GSTR-9. For companies that have already obtained a DSC for MCA filings, using the same DSC on the GST portal adds no marginal cost.

Yes. A Class 3 DSC can be used to digitally sign any PDF document using PDF signing software (Adobe Acrobat, eMudhra's emSigner, or similar). The signature is visible in the PDF, cryptographically verifiable, and legally valid under the Information Technology Act 2000 for contracts and agreements. This is particularly useful for signing vendor agreements, employment contracts, shareholders' agreements, and other business documents electronically — avoiding the need to print, sign, and courier physical documents. The signed PDF carries a timestamp and the signer's verified identity, providing non-repudiation (the signer cannot later deny having signed).

eMudhra's emSigner (and similar tools from other Certifying Authorities, such as Capricorn's signing tool) is a desktop application that acts as a bridge between the USB crypto token and the web browser. Most government portals — MCA21, the GST portal, the Income Tax portal — use a Java applet or a web-based signing interface that needs to communicate with the token. Modern browsers have blocked or removed Java support, so Certifying Authorities provide standalone signing applications that handle the browser-to-token communication. Installation of the CA's signing application is typically required on the computer where the DSC is being used. PNPC provides guidance on the correct version to install for each portal combination, and troubleshoots browser-token communication errors that frequently arise after browser or Windows updates.

The DSC itself — a Class 3 individual DSC — is identical in terms of certificate class and issuance process. The portal-mapping difference is: for company directors, the DSC is mapped to a DIN (Director Identification Number) on MCA21; for LLP designated partners, the DSC is mapped to a DPIN (Designated Partner Identification Number), which is the LLP equivalent of a DIN and is obtained through the same MCA process. Both DIN and DPIN map to the same MCA21 credential system. The LLP annual forms — Form 8 (statement of accounts), Form 11 (annual return) — must be signed by the designated partners' DSCs. An LLP must have at least two designated partners, both of whom need valid DSCs for all annual filings.

DIR-3 KYC is an annual MCA compliance requirement for every individual holding a Director Identification Number (DIN). It must be filed by 30 September each year for the previous financial year. The form requires the DIN holder to verify their identity and contact details with MCA — typically via OTP on their registered mobile and email. If DIR-3 KYC is not filed by the deadline, the DIN is marked 'deactivated' by MCA. A deactivated DIN means the director cannot sign any MCA form using their DSC — even a valid, unexpired Class 3 DSC cannot rescue a deactivated DIN. PNPC tracks DIR-3 KYC for all client-directors on the compliance calendar and files it before the September deadline.

Yes. Foreign nationals (non-Indian citizens) can obtain a Class 3 DSC in India for use in MCA filings as company directors. The identity verification process for foreign nationals typically uses the foreign passport as the primary identity document (since they will not have an Aadhaar). The Certifying Authority conducts video verification using the passport for identity confirmation. The applicant must have a DIN, which requires submitting an apostilled or notarised copy of their passport and address proof to MCA as part of the DIN application. The DSC is then issued using the same passport identity. PNPC coordinates the DIN and DSC processes simultaneously for foreign national directors, accounting for the additional document notarisation and apostille requirements.

The DSC is a personal credential tied to the individual, not to the company. If a company is struck off or dissolved, the director's DSC remains fully valid until its expiry date and can continue to be used for any other company or LLP where the person is a director, for their individual Income Tax filings, or for any other purpose for which the DSC was registered. The DIN of a director of a struck-off company is not automatically deactivated — DIN deactivation for this reason typically occurs only in cases of Section 164(2) disqualification following a company's failure to file returns for three consecutive years. PNPC advises clients on the distinction between company dissolution and personal DIN/DSC status.

Renewal follows the same process as initial issuance: a fresh application to the Certifying Authority, Aadhaar eKYC, and video verification. A renewed DSC has a new certificate serial number — even if the name and other details are identical — because it is a new certificate, not an extension of the old one. Whether the same physical token is reused depends on the CA and the token model: many CAs can overwrite the old certificate on the same token with the renewed one if the token is submitted or connected for remote reconfiguration. If the token is retained with the renewed certificate, the PIN setup process repeats. After renewal and token delivery (or token reconfiguration), all portals where the DSC was registered must be updated with the new certificate — MCA21 DIN mapping, GST portal, DGFT portal, TRACES — because these systems identify the DSC by its serial number, which has changed.

Yes. PNPC's Dubai office assists Indian companies with directors based in the UAE, and UAE-incorporated entities that also have Indian subsidiary directors requiring DSCs for Indian MCA filings. The DSC issuance process is the same — Indian Certifying Authority (eMudhra or Capricorn), Aadhaar eKYC or passport-based verification by video call, and international courier delivery to the UAE address. Indian MCA and Income Tax portal filings by a director physically in the UAE use the same Class 3 Indian DSC — there is no UAE equivalent for Indian regulatory portals. PNPC coordinates the international video verification scheduling and courier logistics as part of cross-border engagements.

The penalty is not for not having a DSC per se — it is for the missed filing itself. Under the Companies Act 2013, late filing of AOC-4 (financial statements) or MGT-7 (annual return) attracts additional fees of ₹100 per day per form from the day after the due date, with no statutory maximum cap. A filing delayed by 30 days due to an expired DSC would attract ₹3,000 in additional MCA fees per form — for two forms (AOC-4 + MGT-7), that is ₹6,000 for 30 days of delay. Directors can also be personally prosecuted for filing defaults under Section 137 and Section 92 of the Companies Act. The Ministry of Corporate Affairs also has a 'Active Company Tagging Identities and Verification' (ACTIVE) scheme under which companies with persistent filing defaults are marked inactive, restricting certain transactions.

A Class 3 DSC on a USB token is not locked to any specific computer. The token can be plugged into any computer that has the appropriate USB driver and signing software installed. The PIN protection ensures that only the authorised user can sign documents even if the token is plugged into someone else's machine. For directors who work on multiple computers (office desktop, home laptop, travel laptop), the DSC can be used on each — provided the driver software is installed on each machine. Cloud-based signing software from some CAs also allows token-based signing via a browser without a full desktop application installation, though compatibility varies by portal.

TRACES (TDS Reconciliation Analysis and Correction Enabling System) allows DSC-based authentication for certain functions — particularly for correction statements, lower deduction certificate requests under Section 197, and authorised representive access. For standard TDS return filing via TAN, the deductor's TAN credentials and DSC or net banking-based authentication are accepted. DSC registration on TRACES maps the DSC to the TAN holder's TRACES profile. Companies that already have a Class 3 DSC for MCA and Income Tax purposes can register the same DSC on TRACES for consistent authentication across all tax portals.

Revocation is requested directly from the issuing Certifying Authority — by submitting a revocation request form along with identity verification. Upon revocation, the CA updates the Certificate Revocation List (CRL) and the OCSP (Online Certificate Status Protocol) database, which all government portals check in real-time when a DSC is used for signing. A revoked DSC is immediately and permanently invalidated — it cannot be used for any signing and its status is publicly verifiable. Revocation is permanent; it cannot be undone. Reasons for revocation include: suspected compromise, token loss or theft, cessation of authority (former director or former employee), or voluntary revocation when a replacement is obtained.

MCA transitioned from MCA21 Version 2 to Version 3 in a phased rollout. For most users, DSC registrations and DIN mappings were migrated to the V3 system. However, where migration did not carry over the DSC mapping correctly — which some users experienced — re-registration of the DSC on V3 is required. The re-registration process is similar to the original mapping: the user logs into MCA21 V3 with their DIN credentials and registers the DSC token through the portal's DSC management section. PNPC verifies that existing client DSC mappings are active and functional on MCA21 V3 and assists with re-registration where needed.

The DSC operates at the file level — it signs the document file (PDF, XML, or the specific format required by the portal) regardless of the language of the content. A DSC can sign a document in any language. For government portal forms, the form itself is in English with specified fields, and the DSC signs the completed form file. There is no language-specific constraint on the DSC.

No. The entire Class 3 DSC process is conducted online and remotely. The identity verification is done via video call; the documents are submitted electronically; the token is delivered by courier. There is no requirement to visit the Certifying Authority's office, a government counter, or any physical location. This is by design — the digital infrastructure is intended to support fully remote and online processes. The only physical element is the USB crypto token that is delivered by courier.

End-to-end timeline for a Class 3 DSC in India, assuming all documents are in order and the applicant is available for video verification: Video verification — Day 1 or Day 2 from application. Token dispatch by CA — Day 2 or Day 3 from successful verification. Token delivery within same city or nearby — Day 4–6. Token delivery to a distant city or internationally — Day 7–15. MCA21 portal mapping after token receipt — Day 7 or Day 8 at the latest with PNPC handling. Test signature on MCA21 — Day 8. Total: 7–10 working days for domestic applicants; 15–20 working days for international. For urgent cases, PNPC requests expedited processing from the CA where available — but delivery logistics remain the limiting factor.

For a partnership firm, the DSC for DGFT submissions is typically obtained in the name of the managing or authorised partner with the firm's IEC. The DSC registration on the DGFT portal links the partner's individual Class 3 DSC to the firm's IEC profile. For a proprietorship, the proprietor's own Class 3 DSC is used, linked to their IEC. The individual DSC + IEC combination is the same approach regardless of entity type. The DGFT portal requires the IEC holder to designate an authorised signatory in the IEC profile, and that signatory's DSC must be registered against the IEC. PNPC handles the DGFT portal configuration for firms and proprietors as part of every IEC and DGFT application engagement.

A company may designate a non-director employee as an authorised signatory for specific portal filings — for instance, a CFO for GST portal submissions or a company secretary for certain MCA forms. In this case, an individual Class 3 DSC is obtained for that employee, with an organisation-type certificate that includes the company name. The supporting documentation includes a Board Resolution naming the employee as the authorised signatory for the specific purpose, and the employee's individual identity documents (Aadhaar, PAN). The DSC is then mapped to the specific portal under the company's credentials with the employee as the designated signatory. If the employee later leaves the company, their DSC should be revoked from portal access and a new signatory DSC obtained.

When a client contacts PNPC with an expired or non-functional DSC on a filing deadline, the immediate steps are: (1) Identify the root cause — expiry, PIN lock, token damage, or portal mapping issue. Not all 'DSC errors' at filing time are actually expiry — some are browser/driver/mapping issues that can be resolved in minutes. (2) If actual expiry or irreversible hardware issue: initiate emergency renewal with the CA, requesting expedited processing. (3) Assess whether the filing can be signed by another director whose DSC is valid — as a stopgap to meet the deadline while the primary signatory's DSC is being renewed. (4) If deadline cannot be met: calculate the late fee exposure and advise the client. (5) File as soon as the new DSC is available and portal-mapped.

Yes — this is a core element of PNPC's compliance management service. For every client for whom PNPC has obtained or manages a DSC, the expiry date is entered into the compliance calendar. PNPC initiates the renewal process 30 days before expiry and coordinates with the client to schedule video verification at a convenient time within that window. The 30-day advance window is specifically chosen to ensure that even if there is a scheduling delay for the video call, or a courier delay to an unusual address, the renewal is complete and the new token is portal-mapped well before the old certificate expires. Clients who manage their own DSCs independently can request that PNPC track these expiries as part of an annual compliance retainer.

No material difference. Section 8 companies (licensed under Section 8 of the Companies Act 2013 for charitable, social, or not-for-profit purposes) are companies registered with MCA and are subject to the same MCA filing requirements as other companies, including the DSC requirement for director signatures on all MCA forms. The directors of a Section 8 company need individual Class 3 DSCs for SPICe+ (with the Section 8 licence application filed alongside), and for all subsequent annual filings (AOC-4, MGT-7) and event-based forms. The only contextual difference: Section 8 companies are frequently managed by trustees or social sector professionals rather than commercial businesspersons, who may be less familiar with the DSC process — PNPC provides additional guidance in these cases.

PNPC cannot obtain a DSC on your behalf in the sense of substituting for your personal identity — the Certifying Authority's video verification process is specifically designed to confirm that the named individual, personally, is applying. No one else can undergo verification in your place. What PNPC handles on your behalf: the entire application initiation, document preparation and submission, CA coordination, video call scheduling, token delivery tracking, driver installation guidance, portal mapping, and first-use testing. Your personal involvement is limited to: being present and available for the 5–10 minute video verification call, and setting your own PIN on token receipt. Everything else is managed by PNPC.