Do You Need Digital Signature Certificate (DSC) – including DGFT DSC? A Practical Starting Point
A Digital Signature Certificate is the legal equivalent of your wet-ink signature for every government filing in India — MCA company filings, GST portal submissions, Income Tax returns for companies and audit cases, DGFT export applications, and e-tender submissions. Without a valid DSC (MCA asks for Class II or above; in practice, certifying authorities now issue Class 3), a company cannot file its annual returns, a director cannot be appointed, a contract cannot be submitted on the government procurement portal, and a CA cannot certify an audit. PNPC Global obtains and renews DSCs for directors, partners, authorised signatories, and practising CAs as part of every incorporation and compliance engagement — because the DSC is not a standalone requirement, it is the signature infrastructure that makes every other compliance filing legally valid.
What This Actually Covers
A Digital Signature Certificate (DSC) is an electronic document issued by a government-licensed Certifying Authority (CA) under the Information Technology Act 2000 and the IT (Certifying Authorities) Rules 2000. It contains the holder's identity information, their public key, and the digital signature of the issuing Certifying Authority — creating a cryptographically verifiable proof that a specific, authenticated individual signed a specific document at a specific time. The legal basis for DSC-based signatures in India is the IT Act 2000 and the rules made under it, which set up a framework of licensed Certifying Authorities operating under the Controller of Certifying Authorities (CCA), an office under the Ministry of Electronics and Information Technology (MeitY).
For the full scope, current process and what PNPC includes, see the dedicated Digital Signature Certificate (DSC) – including DGFT DSC service page.
When You'd Need This
- Company incorporation: SPICe+ filing on MCA21 requires a valid DSC from all proposed directors; without it, the form cannot be submitted
- LLP incorporation and annual filings: FiLLiP, Form 3, Form 8, Form 11 — signed by the designated partner's DSC; both designated partners must have valid DSCs
- GST filings by companies: Rule 26 of the CGST Rules says a registered person registered under the Companies Act, 2013 must furnish documents and applications verified through DSC. The Board has notified EVC as an alternative for some returns from time to time, so check what the portal accepts for the specific filing
- Income Tax returns and audit reports: ITR-6 (companies), tax audit reports and transfer pricing audit reports (audit-threshold and international/specified-transaction provisions under the Income Tax Act), Form 3CA-3CD — signed by director and tax auditor DSCs respectively
How to get a DSC, step by step
- Choose a licensed Certifying Authority. MCA states that DSCs are issued by the authorities the CCA has licensed, and applicants are free to pick any of them; prices differ because the market sets them. Avoid anyone who is not on the CCA's list.
- Apply with proof of identity. You can apply with original documents and self-attested copies, or, where the authority offers it, through Aadhaar eKYC, in which case supporting documents are not needed. Your name should match across PAN, Aadhaar and any organisation records.
- Complete the verification. Depending on the authority this is an eKYC step with video verification. It is done remotely, without visiting an office.
- Receive the token and set the PIN. The private key sits on a hardware token, so signing needs the token and its PIN together.
- Register it on each portal. MCA21 links the certificate to your DIN. The GST portal links it to the GSTIN, and the DGFT portal to the IEC. The same certificate can be registered on several portals, but each registration is a separate step and is repeated after renewal.
- Renew before expiry. MCA notes that DSCs are typically issued with one-year or two-year validity and are renewable. A signature is judged as at the time it was affixed, so an expired certificate mainly blocks new filings, not old ones.
Mistakes that hold up filings
- Using someone else's DSC. MCA warns that it is illegal to use a digital signature issued to anyone other than yourself. Keep tokens with the person named on them, and issue authorisations instead of sharing PINs.
- Finding the expiry on the due date. Track expiry dates for every director and signatory, and renew weeks ahead, because a filing signed with an expired certificate is rejected.
- Assuming a valid DSC fixes a DIN problem. Director KYC is now filed on Form DIR-3 KYC Web once every third consecutive financial year, by 30 June, and within 30 days of a change to a director's mobile number, email or address. If the KYC is missed, the DIN can be affected, and the certificate cannot cure that. Confirm the current position on the MCA portal.
- Skipping the portal registration. A certificate that is issued but not mapped to your DIN, GSTIN or IEC will be rejected when you try to sign.
- Not testing before a deadline. Browser and operating-system updates regularly break the signer application. Do a test signature a few days before a deadline, not on the evening of it.
- Delaying revocation of a lost token. If a token is lost or its PIN is compromised, ask the issuing authority to revoke the certificate straight away; revocation cannot be reversed.
DSC, eSign and Aadhaar OTP are not the same thing
Aadhaar OTP on a portal login proves who you are for that session. Aadhaar-based eSign is an online service for signing individual documents. A DSC is a certificate on a hardware token that signs filings and can be reused for many signatures during its validity. MCA requires company and LLP filings to be made using digital signatures by the authorised person, so check what the specific portal accepts before you swap one for another. For director changes, see the note on appointment and resignation of directors; for the wider calendar of due dates, the compliance calendar guide; and for DGFT-specific filings, DGFT advisory.
What This Doesn't Cover
- Udyam MSME registration: uses Aadhaar-based authentication, so a DSC is not what that registration flow asks for
- Individual Income Tax return filing (ITR-1, ITR-2, ITR-4 for individuals) where e-verification via Aadhaar OTP, net banking, or bank account is sufficient: DSC is one permitted option but not mandatory
- GST registration for individuals and sole proprietors using Aadhaar OTP authentication: DSC is an alternative for those who prefer it, not a requirement in these cases
Quick Answers
What is a Class 3 DSC, and what happened to Class 1 and Class 2?
The CCA groups certificates into classes by how identity is checked and where the key is stored. Class 1 can keep the key in software; Class 2 and Class 3 require a hardware cryptographic device (FIPS 140-2 level 2), and Class 3 adds the option of a physical or video verification. The CCA also lets a Certifying Authority opt out of issuing any class, so what you are offered depends on the authority. MCA's own requirement is a Class II or higher signing certificate for MCA21 filings, and in practice you will now be issued a Class 3 certificate. If MCA21 rejects a certificate you already hold, check three things before assuming the class is the problem: the expiry date, whether it is registered against the right DIN, and whether the token driver or signer application is working. If a filing really is refused because of the class, ask the certifying authority that issued it whether it can be replaced.
Does every director of a company need their own separate DSC?
Yes. For company filings on MCA21, every director who is required to sign a particular form must have their own valid DSC (MCA accepts Class II or above; new certificates are issued as Class 3). MCA21 forms are signed by specific named directors — not by a generic company-level credential. For incorporation, every proposed director must have a valid DSC before the SPICe+ form is filed. For annual filings such as AOC-4 and MGT-7, at minimum the director signing the forms (typically the Managing Director or a designated director) and the statutory auditor must each have a valid, unexpired DSC. One director cannot use another director's DSC — the signature would identify the wrong person and the portal's DIN-to-DSC mapping would reject it.
Can an NRI director get a Class 3 DSC without visiting India?
Yes. The Certifying Authorities' video verification process is conducted remotely — by video call — and does not require physical presence in India. For NRI directors who have an Aadhaar linked to an Indian mobile number they can access abroad, the standard eKYC + video process applies. For NRI directors whose Aadhaar is linked to an inactive Indian SIM (a very common situation), the OTP delivery will fail and the standard process is not usable. In this case, Certifying Authorities have an alternative process typically using the Indian passport as the primary identity document, with notarised copies and additional steps — the exact requirements vary by CA. The crypto token is then shipped by international courier to the applicant's address. How long it takes depends on the Certifying Authority and the courier to the country concerned, so ask for a delivery estimate before you plan a filing around it.
Where PNPC Fits In
Speak directly with a PNPC Chartered Accountant — your DSC is the signature infrastructure behind every filing your business will make in India; getting it right from Day 1, and keeping it renewed and portal-mapped without gaps, means your compliance deadlines are never held up by a missing, expired, or mis-configured token.
PNPC Global has advised Chennai, Bangalore and Hyderabad businesses since 1986. Explore the full Registrations & Licences practice for related services, or go straight to the Digital Signature Certificate (DSC) – including DGFT DSC page for specifics.
Specific rates, fees, thresholds and deadlines are set by the relevant authority and change over time — this article deliberately does not quote figures that could go stale. Confirm current numbers directly with PNPC or the official source before you act.