Using a Digital Signature Certificate (DSC) for Statutory Filings: What Indian Employers Need to Know in 2025

A Digital Signature Certificate (DSC) is the legal equivalent of a hand-written signature for electronic filings, recognised under the Information Technology Act, 2000. For most Indian employers it is now an everyday tool — required across EPFO, MCA, Income Tax, GST and several state portals.

Class 2 is gone; Class 3 is the standard

Historically DSCs came in Class 2 and Class 3. Following the office of the Controller of Certifying Authorities (CCA) guidelines, Class 2 certificates were discontinued and Class 3 became the single standard for statutory and tendering use. If you still reference “Class 2” in an internal policy, update it: new issuance is Class 3.

What a DSC signs

• EPFO — employer KYC approval, transfer/withdrawal attestation, and authorised submissions.
• MCA — company filings (forms, annual returns) by directors and authorised signatories.
• Income Tax & TDS — return verification for entities required to e-verify by DSC.
• GST — return and registration signing for companies and LLPs.

Tokens, validity and custody

A DSC is issued on a secure cryptographic USB token (FIPS-compliant) by a licensed Certifying Authority, after identity verification. Certificates are typically valid for one to three years and must be renewed before expiry to avoid filing disruption. Treat the token like a signing seal:

• Map each token to a named, authorised signatory.
• Track expiry centrally — an expired DSC discovered on a due date is an avoidable miss.
• Control physical custody and PIN access; never share tokens informally.

DSC in the approval chain

The DSC step works best as the final, deliberate approval in a Maker–Checker–DSC chain — the conscious act that says “reviewed, verified, authorised.” Embedding signing into a structured workflow, rather than treating it as a stray administrative task, both strengthens control and produces a clean record of who signed what and when.