Digital Signature Certificate (DSC) – including DGFT DSC

Class 3 is the current active and mandatory class for all government portal submissions in India — MCA, GST, Income Tax, DGFT, and e-procurement. Earlier classes (Class 1 and Class 2) were used for lower-assurance purposes but have been discontinued for most regulatory filings. The Controller of Certifying Authorities (CCA) mandated Class 3 DSCs for all company and LLP MCA filings from 1 January 2021. If you have an older Class 2 DSC that has expired, it will need to be replaced with a Class 3 — not renewed in the old class.

For company filings, every director who needs to sign a form must have their own individual DSC. MCA21 forms are signed by specific directors — not by a generic company DSC. Typically, for annual filing purposes (AOC-4, MGT-7, ITR-6), the signing director plus the statutory auditor must each have a valid, unexpired Class 3 DSC. During incorporation, all proposed directors must complete DSC video verification. One director cannot use another director's DSC.

Yes. The Aadhaar eKYC and video verification process is done remotely by video call with the Certifying Authority. For NRI directors who do not have an Aadhaar or whose Aadhaar is not linked to an accessible Indian mobile number, Certifying Authorities have an alternative process using Indian passport and notarised documents — the specific requirements vary by CA. The crypto token is then couriered to the applicant's address, including internationally. PNPC coordinates this process for all NRI directors.

An expired DSC is immediately non-functional — the MCA21 system will reject it with an error. If discovered at an MCA deadline, you are looking at a late filing penalty (₹100/day, no cap) while the renewal is processed. Renewal takes 3–5 working days from initiation to token delivery. PNPC tracks DSC expiry dates for all clients and initiates renewal 30 days before expiry — ensuring there is always a valid DSC available for every deadline.

Yes. A single Class 3 DSC can be registered on multiple government portals — MCA21, GST portal, Income Tax e-filing, DGFT, and e-procurement portals — and used for signing on each. The DSC is not portal-specific. However, each portal has its own DSC registration process — the DSC must be mapped to your DIN on MCA21, your GSTIN on the GST portal, and so on. PNPC handles this cross-portal mapping after token delivery.

No — these are distinct mechanisms. A DSC is a hardware-backed, privately held cryptographic certificate stored on a USB token. It creates a legally valid digital signature that binds your verified identity to a specific document. Aadhaar eSign is an online signing service that uses Aadhaar OTP for one-time transaction authentication. OTP-based portal verification confirms your identity for a session. Only the DSC creates a legally valid signature under the IT Act for company filings on MCA21 — Aadhaar OTP is not accepted by MCA21 for most director-signed forms.

A director's DSC is an individual Class 3 DSC that identifies the director by name and optionally by organisation. It is used to sign company forms, returns, and declarations on MCA21 and other portals. A practising CA's DSC is also a Class 3 DSC but may include the CA's ICAI membership number and 'practicing CA' designation — required for certifying audit reports and financial statements under Income Tax and MCA rules. The technical mechanism is the same; the embedded identity information and the regulatory contexts in which they are used differ.

The USB crypto token (e-Pass or equivalent) stores your private key in a tamper-resistant hardware chip. When you sign a document, the token generates the signature locally — your private key never leaves the device, even when connected to a computer. It is PIN-protected against unauthorised use. If the token is lost or stolen, the DSC must be immediately revoked by contacting the issuing Certifying Authority. A new DSC application and token are required. Revocation is permanent — it cannot be undone — but it prevents the lost token from being misused to sign documents fraudulently.

Only organisations licensed by the Controller of Certifying Authorities (CCA) under the IT Act can issue DSCs in India. The currently active licensed CAs include eMudhra, Capricorn CA, CDAC, NSDL e-Gov, and a few others. PNPC works primarily with eMudhra and Capricorn, both of which have established video verification infrastructure and nationwide courier delivery. The choice of CA does not affect the DSC's legal validity — all are equally accepted by all government portals.

Approximate market rates: ₹1,200–₹1,500 for 1-year validity; ₹1,800–₹2,500 for 2-year validity; ₹2,200–₹3,000 for 3-year validity. Prices vary slightly by Certifying Authority. These are the direct CA charges, passed through to the client. Longer validity is more cost-efficient per year and involves fewer renewal processes. PNPC recommends 2-year or 3-year validity for directors and professionals with ongoing filing obligations.

DSCs should be arranged before the SPICe+ incorporation form is filed — both directors must sign the SPICe+ form with their individual Class 3 DSCs. The DSC process should start at least 7–10 working days before the planned SPICe+ submission to allow for video verification and token delivery. PNPC initiates DSC applications for all directors on Day 1 of the incorporation engagement, in parallel with name clearance and MoA drafting — ensuring no delay in the SPICe+ filing.

The USB crypto token itself has a lifespan longer than the DSC validity period — the physical device is typically functional for 5–10 years or more. When a DSC expires, the same token can often be reconfigured with a renewed DSC by the Certifying Authority. However, if the token is lost, damaged, or incompatible with a new CA's system, a new token is issued with the renewed certificate. PNPC clarifies this with the issuing CA at renewal time — retaining the same token where possible saves cost.