Digital Signature Certificate (DSC): complete guide for 2026

A Digital Signature Certificate (DSC) is the mandatory electronic equivalent of a handwritten signature for all statutory filings, government portal submissions, and regulatory compliance in India. Without a valid, active DSC, a company director cannot sign a single form on the MCA V3 portal, a taxpayer cannot file certain income tax returns, and a business cannot submit bids on government e-tender platforms.

In 2026, the DSC landscape in India has undergone significant changes. Class 3 is now the only class of DSC issued for business use, cloud-based DSC is widely accepted across government portals, and video-based KYC has replaced in-person verification for most applicants. The move to FIPS 140-3 certified tokens is also in progress, with compliance mandatory for new tokens after September 21, 2026.

This guide covers what a DSC is, the legal framework governing it, the types available and which one to choose, the documents required, the step-by-step application process, costs, USB token versus cloud DSC, and how to register on the MCA V3 portal.

Before obtaining your DSC, read the complete guide to company registration in India – a Class III DSC is mandatory before you can file the SPICe+ incorporation form.

What is a Digital Signature Certificate?

A DSC is a secure digital key issued by a government-licensed Certifying Authority (CA) that authenticates the identity of the certificate holder when they sign documents electronically. It is based on Public Key Infrastructure (PKI) technology, which cryptographically binds the holder’s identity to a unique public and private key pair.

Under Section 3 of the Information Technology Act, 2000, a document signed with a valid DSC issued by a CCA-licensed Certifying Authority has the same legal standing as a document signed with a physical handwritten signature. Digitally signed documents are admissible as evidence in Indian courts under the IT Act and the Indian Evidence Act, 1872.

The Controller of Certifying Authorities (CCA) under the Ministry of Electronics and Information Technology (MeitY) is the apex regulatory body overseeing the issuance, management, and revocation of DSCs in India. Only CAs licensed by the CCA under Section 21 of the IT Act, 2000 may issue legally valid DSCs.

Legal framework

The legal framework governing DSCs spans several statutes:

• IT Act, 2000: Section 3 defines digital signatures and their legal validity. Section 21 governs CA licensing. Section 35 covers DSC issuance. Section 73 covers fraudulent use.
• Companies Act, 2013: mandates DSC for all MCA V3 filings including SPICe+, AOC-4, MGT-7, and all e-forms.
• Income Tax Act, 1961: mandates DSC for electronic verification of company, LLP, and trust tax returns and audit reports.
• CGST Act, 2017: requires DSC for GST registrations, returns, and refund applications where Aadhaar authentication is not used.
• Customs Act, 1962 and Foreign Trade Act, 1992: mandate DSC for ICEGATE customs filings and DGFT export-import licence applications.

Types of DSC in 2026

As of 2026, Class 1 and Class 2 DSCs have been phased out. Class 3 is the only class issued for business, professional, and regulatory use. Within Class 3, there are two variants.

Class 3 Signing DSC

Used for signing documents, forms, and returns on government portals. This is the standard DSC for MCA V3 filings, Income Tax returns, GST filings, and most e-government applications. It requires identity proof through Aadhaar-based eKYC or video-based KYC before the CA issues the certificate.

Class 3 Signing and Encryption DSC (Combo DSC)

Provides both document signing and message encryption capabilities. Required for government e-procurement and e-tender portals including the Central Public Procurement Portal (CPPP), Government e-Marketplace (GeM), Indian Railway e-Procurement System (IREPS), MSTC, and most state e-procurement portals. Also required for ICEGATE customs filings involving encrypted data exchange.

Who needs a DSC?

• Every director of a Private Limited Company, Public Limited Company, or OPC before incorporation through SPICe+ or before appointment through Form DIR-12.
• Every Designated Partner of an LLP for FiLLiP filing and subsequent LLP forms.
• Company Secretaries, Chartered Accountants, and Cost Accountants in practice who certify MCA forms such as DIR-3 and DIR-3 KYC.
• Authorised signatories for GST registrations, returns, and refund applications.
• Individuals filing Income Tax returns as companies, LLPs, or trusts where DSC-based verification is required.
• Professionals and businesses participating in government e-tenders on CPPP, GeM, or state portals.
• Importers and exporters filing on the ICEGATE customs portal and DGFT portal.

Documents required for DSC application

For Indian nationals

• PAN card: mandatory. The name on PAN must exactly match the name on all other documents.
• Aadhaar card: used for eKYC (OTP-based identity verification) or as address proof. The Aadhaar-linked mobile number must be active.
• Passport-size photograph: recent, colour, white or light background, JPEG format.
• Email address and mobile number: these become the registered contact for the DSC and all CA communications.

For organisations (company, LLP, trust)

All documents above for the individual authorised signatory, plus: Organisation PAN card, Certificate of Incorporation or Registration Certificate, and a Board Resolution or Authorisation Letter naming the individual as the authorised signatory.

For NRIs and foreign nationals

• Passport: mandatory, must be valid.
• Address proof from home country (bank statement, utility bill, or government-issued ID), notarised by a Notary Public in the home country and apostilled by the competent authority (or authenticated by the Indian Embassy if the country is not a Hague Convention signatory).
• Video KYC with the CA’s authorised representative, as in-person verification is typically not possible for foreign-based applicants.

Licensed Certifying Authorities in India (2026)

The CCA at cca.gov.in maintains the updated list of all licensed CAs. The most widely used for business DSC in 2026 are:

• eMudhra: one of the largest CAs in India with WebTrust accreditation. Fully online, paperless DSC issuance via the eMudhra app.
• Sify Technologies: longstanding CA for corporate and individual users with both online and assisted issuance.
• Capricorn Identity Services: widely used for company and organisational DSC applications.
• NSDL e-Governance Infrastructure: offers DSC for income tax and MCA applications.
• XtraTrust: popular for volume DSC procurement and e-tender specific applications.

All of the above are CCA-licensed and legally valid for all government portal filings in India.

Step-by-step DSC application process (2026)

Step 1: choose a licensed CA. Visit cca.gov.in to verify the current list of licensed CAs. Most now offer a fully online, paperless process completed in 1 to 3 working days.

Step 2: select DSC type and validity. Choose Class 3 Signing DSC for MCA, GST, and Income Tax filings. Choose Class 3 Combo for e-tender and GeM participation. DSCs are available with validity of 1, 2, or 3 years. Most users opt for 2-year validity.

Step 3: fill the online application form. Enter full legal name (exactly as on PAN), date of birth, email address, mobile number, PAN number, and Aadhaar number for Indian nationals.

Step 4: upload documents. Upload scanned copies of PAN, Aadhaar or address proof, and photograph in the specified formats.

Step 5: complete video KYC. Video KYC is mandatory under CCA guidelines from 2026. The applicant records a short video holding their original PAN and Aadhaar and states the purpose of the DSC application. The CA’s authorised representative reviews the video to verify identity.

Step 6: pay the application fee. Payment is made online. Fees include the certificate cost and, for USB token DSC, the cost of the FIPS-certified crypto token.

Step 7: download DSC. For token-based DSC, the CA couriers the FIPS-certified USB token to the applicant’s address for new applications, or issues a download link for renewals to an existing token. For cloud DSC, the certificate is provisioned to the CA’s cloud signing platform.

Cost of a DSC in India (2026)

DSC type	Approximate cost (2-year validity)
Class 3 Signing DSC with USB token	Rs. 800 to Rs. 2,500 (incl. 18% GST)
Class 3 Combo DSC with USB token	Rs. 1,300 to Rs. 3,500
Cloud-based DSC (paperless)	Rs. 200 to Rs. 500 lower than token-based
Renewal without new token	Rs. 700 to Rs. 1,800

USB token vs cloud DSC

USB token DSC

The DSC is stored on a FIPS-certified cryptographic USB token such as HYP2003 (formerly ePass Auto 2003) or WatchData ProxKey. Multiple DSCs can be stored on one token. The token must be physically connected to the computer when signing. emSigner middleware must be installed on the computer for certain portals.

From September 21, 2026, only FIPS 140-3 certified tokens will be issued with new DSC applications. Older FIPS 140-2 tokens continue to work for existing certificates until expiry.

Cloud DSC

The DSC is stored on the CA’s secure cloud infrastructure and accessed via OTP on the applicant’s registered mobile number. No physical token is required. Documents can be signed from any device with internet access. The MCA V3 portal, GST portal, and DGFT portal all support cloud DSC signing. For high-security government tender portals, a USB token may still be required.

Cloud DSC is increasingly preferred by directors, professionals, and compliance officers who file from multiple devices or locations.

Registering a DSC on the MCA V3 portal

After obtaining a DSC, it must be registered on the MCA V3 portal before it can be used to sign any MCA form. Log in to mca.gov.in, navigate to the DSC Registration section under MCA Services, select Associate DSC, choose the role (Director, Professional, or Authorised Representative), and select the correct DSC. Only Class 3 DSC is accepted on the MCA V3 portal.

Also read the GST registration guide – companies and LLPs must use a DSC to sign their GST registration applications, making an active, registered DSC essential before the GST filing step.

DSC renewal

A DSC must be renewed before its expiry date. An expired DSC cannot be used on any government portal. Most CAs send renewal reminders 30 days before expiry. The renewal process follows the same steps as the initial application. The renewed certificate must be re-registered on the MCA V3 portal after renewal. Renewal can be done with the same CA or with a different CA.

How Virtual Offices support DSC-related compliance

Every MCA form signed with a DSC must originate from a company with a valid, verifiable registered office. A deactivated registered office or an address that fails ROC verification creates compliance gaps that affect the legal validity of DSC-signed filings.

myHQ Virtual Offices in Bangalore and across 40+ cities in India provide verified, MCA-compliant registered office addresses, backed by 150+ partner spaces, 50+ Virtual Office Experts, and 10,000+ clients served. When a company’s registered office is maintained through myHQ, all MCA correspondence, ROC notices, and compliance communications are received, forwarded, and managed professionally. This ensures the company’s registered office remains active and verifiable, preserving the integrity of all DSC-signed filings made by the company’s directors.

With digital KYC and agreement, the fastest document turnaround time in the industry, flexible contract tenures, and comprehensive help and support, the registered office documentation supporting all DSC-based filings remains current at all times.

Read the guide to virtual place of business registration to understand how a virtual address supports your complete MCA and GST compliance setup.

Frequently asked questions

What is the difference between a DSC and an e-Sign?

A DSC is a certificate stored on a USB token or cloud, issued after full KYC verification by a licensed CA. It is required for all high-security government filings. An e-Sign is an Aadhaar-based OTP signature service accepted only for lower-risk transactions. For MCA company incorporation, annual filings, and all ROC forms, DSC is required.

Which certifying authority should I choose for a DSC in India?

All CCA-licensed CAs issue legally identical DSCs accepted across all government portals. Choose based on price, turnaround time, and customer support. eMudhra, Capricorn, Sify, and XtraTrust are among the most widely used in 2026.

Can one USB token store multiple DSCs?

Yes. A single FIPS-certified USB token such as HYP2003 or WatchData ProxKey can store multiple DSCs. A Company Secretary or CA managing DSCs for multiple clients can store several certificates on a single token.

Is a new USB token required for DSC renewal?

Not if the existing token is functional and FIPS-certified. The renewed certificate is downloaded to the existing token. A new token is required only if the old token is damaged, lost, or if upgrading to the FIPS 140-3 standard after September 21, 2026.

What happens if a DSC expires mid-filing?

If the DSC expires between starting and completing a form, the signing step will fail. Renew the DSC before re-attempting. File all pending forms at least 30 days before the DSC expiry date to avoid this scenario.

Can a director use the same DSC for multiple companies?

Yes. A DSC is issued to an individual, not to a specific company. The same DSC can be used to sign MCA forms for all companies and LLPs in which the individual serves as a director or designated partner, provided the DSC is registered on the MCA portal under the correct DIN.

What is a Digital Signature Certificate (DSC) and why is it required?

A Digital Signature Certificate (DSC) is a government-recognized electronic signature issued by a licensed Certifying Authority under the Information Technology Act, 2000. It is required for MCA company filings, GST registrations, income tax returns, LLP filings, government e-tenders, and other regulatory submissions. A valid Digital Signature Certificate (DSC) provides legal authenticity, security, and non-repudiation for electronic documents and transactions.