Digital Signature (DSC) Services

Class 3 DSC is mandatory for all filings on the MCA21 V3 portal, including incorporation forms such as SPICe+, and annual filings such as AOC-4 and MGT-7A. This requirement flows from the Information Technology Act 2000 read with the Companies (Registration Offices and Fees) Rules 2014. A Class 2 DSC is no longer accepted by the Controller of Certifying Authorities (CCA) as the CCA discontinued Class 2 issuance from January 1, 2021. The DSC must be issued by a licensed Certifying Authority under Section 24 of the IT Act 2000 and registered on the MCA21 portal before any e-form can be digitally signed.

A Class 3 DSC is typically issued with a validity of one or two years from the date of issuance, as permitted by the Certifying Authority under the Information Technology (Certifying Authorities) Rules 2000. Renewal must be initiated before the existing certificate expires, because an expired DSC cannot be used to sign any e-form on MCA21, the Income Tax e-filing portal, or the GST portal. The renewal process requires fresh identity and address verification with the Certifying Authority, though some CAs offer paperless Aadhaar-based e-KYC renewal under the IT (CA) Rules. We track DSC expiry dates for all authorised signatories and initiate renewal at least 30 days in advance to avoid filing disruptions.

Yes, an NRI director can obtain a Class 3 DSC from any CCA-licensed Certifying Authority in India, but the documentation requirements differ from resident applicants. Acceptable identity proof includes a valid passport, and the documents must be attested by the Indian Embassy or Consulate in the country of residence, or apostilled as applicable under the Hague Apostille Convention where the country is a signatory. The verification process is governed by the Information Technology (Certifying Authorities) Rules 2000, Schedule I, which lists acceptable identity and address proof categories. Physical presence in India is not mandatory if the CA supports video-based verification or Embassy attestation.

The same Class 3 DSC can be registered and used across multiple government portals — MCA21, the Income Tax e-filing portal (www.incometax.gov.in), and the GST portal (www.gst.gov.in) — provided the PAN of the authorised signatory matches across portals. Under Rule 26 of the CGST Rules 2017, a company must mandatorily use a DSC for filing on the GST portal if the applicant is a company incorporated under the Companies Act 2013. The DSC must be registered separately on each portal, and the USB token containing the private key must be accessible at the time of signing. Individual proprietors and partners may use Aadhaar-based e-Sign as an alternative under the same Rule 26.

Yes, a compromised or lost DSC must be revoked immediately by submitting a revocation request to the issuing Certifying Authority under Section 38 of the Information Technology Act 2000, which empowers CAs to suspend or revoke certificates. Once revoked, the certificate is listed on the CA's Certificate Revocation List (CRL), and no portal will accept signatures made with it. The subscriber is legally responsible for all actions taken with the DSC until revocation is confirmed, so prompt action is critical. After revocation, a fresh DSC must be procured with new key generation; the old private key from the lost token cannot be reissued.