Company DSC — KK Pudur Maduravoyal & Maduravoyal

Sub-section (1) of Section 3 of the Information Technology Act, 2000 provides that any subscriber may authenticate an electronic record by affixing his digital signature, and sub-section (2) prescribes that such authentication shall be effected by use of asymmetric crypto-system and hash function which envelopes and transforms the initial electronic record into another electronic record. It is to be noted that any document signed by the authorised signatory of a company on behalf of the company is treated as authenticated only where the digital signature is created in the manner so prescribed; this is the parent provision underpinning every MCA21, GSTN, ICEGATE and Income-tax filing made by the company.

Section 3A, inserted by the Information Technology (Amendment) Act, 2008, recognises electronic signatures as legally valid, provided they are reliable and notified by the Central Government in the Second Schedule. It is to be noted that the DSC issued by a Certifying Authority licensed under Section 24 satisfies the reliability test, and a Class 3 DSC issued in the name of an authorised signatory of the company carries presumption of integrity and identity for purposes of all statutory filings on behalf of the company.

Section 5 provides that where any law requires that information or any other matter shall be authenticated by affixing the signature of any person, such requirement shall, notwithstanding anything contained in such law, be deemed to be satisfied if the information or matter is authenticated by means of a digital signature affixed in such manner as may be prescribed. It is to be noted that this Section is the operative bridge between the Companies Act, the CGST Act, the Income-tax Act and the IT Act, allowing the company's authorised signatory to discharge signature requirements digitally without any separate physical attestation.

Sub-section (1) of Section 35 provides that any person may make an application to the Certifying Authority for issue of a Digital Signature Certificate. Sub-section (3) requires the Certifying Authority, while issuing such certificate, to be satisfied that the applicant holds the private key corresponding to the public key to be listed in the DSC and that such public key will be used to verify the digital signature affixed by the private key. It is to be noted that the DSC issued in the name of the company's authorised signatory must record the company's name in the organisational field to qualify as a Company DSC.

The Information Technology (Certifying Authorities) Rules, 2000 framed under Section 87 of the IT Act prescribe the standards for issue, verification and management of Digital Signature Certificates. It is to be noted that Rule 23 requires the Certifying Authority to maintain a Certification Practice Statement, Rule 24 prescribes the contents of the DSC including subscriber name and organisation, and Rule 31 prescribes class-wise assurance levels with Class 3 being the highest used for company filings requiring physical presence verification at the time of issuance.

Section 21 of the Companies Act, 2013 provides that save as otherwise provided in the Act, a document or proceeding requiring authentication by a company, or contracts made by or on behalf of a company, may be signed by any key managerial personnel or an officer or employee of the company duly authorised by the Board in this behalf. It is to be noted that read with Section 5 of the IT Act, this signature may be affixed digitally through the Class 3 Company DSC of the authorised signatory, and absence of a properly worded board authorisation is the most common cause of DSC-based filings being treated as defective.

What Company DSC means under Indian electronic-signature law

Section 21 Companies Act 2013 — authentication on behalf of the company

Section 21 of the Companies Act 2013 prescribes the manner in which a document or proceeding requiring authentication by a company shall be signed — by any key managerial personnel or an officer or employee of the company duly authorised by the Board in this behalf. The provision is the corporate-law counterpart of Section 5 IT Act and clarifies that a 'Company DSC' is, in legal substance, the DSC of an individual office-bearer authorised by the Board, not a juristic person's certificate. CCA Interoperability Guidelines 2015 reinforce this — Class 3 DSCs are issued only to natural persons, with the company's name embedded in the Organisation (O) field of the X.509 Subject when the DSC is for company use. The board authorisation typically takes the form of a Section 179 resolution mapping the office-bearer to specified filing categories.

Comparative — eIDAS, US ESIGN and DocuSign frameworks

The European Union eIDAS Regulation 910/2014 establishes three tiers of electronic signatures — simple, advanced, and qualified — with the qualified electronic signature (QES) holding the same legal effect as a handwritten signature across all Member States. The qualified trust service provider regime under eIDAS mirrors India's CCA-licensed Certifying Authority model. The US Electronic Signatures in Global and National Commerce Act 2000 (ESIGN Act) adopts a technology-neutral approach similar to Section 3A IT Act, treating any electronic record signed with intent as legally binding subject to the Uniform Electronic Transactions Act adopted by State legislatures. DocuSign and Adobe Sign operate within both frameworks. Indian Class 3 DSCs are PKI-based equivalents of eIDAS advanced electronic signatures with qualified-CA backing, and are accepted under WebTrust audit standards for cross-border transactions where mutual recognition between Indian CCA and foreign trust frameworks is established.

Statutory framework — IT Act 2000 and the 2008 Amendment

The Digital Signature Certificate regime in India is anchored in the Information Technology Act 2000, originally enacted to give legal recognition to electronic records and electronic signatures based on the Public Key Infrastructure model adopted by the UNCITRAL Model Law on Electronic Commerce 1996. Section 2(1)(p) defines digital signature as authentication of any electronic record by a subscriber by means of an electronic method or procedure in accordance with Section 3, which prescribes asymmetric crypto-system and hash function as the technical standard. Section 35 governs the issuance of Digital Signature Certificates by Certifying Authorities licensed by the Controller of Certifying Authorities under Section 17. The IT Amendment Act 2008 introduced Section 3A which expanded the recognition to 'electronic signatures' — a technology-neutral category encompassing biometric authentication (including Aadhaar e-KYC and Aadhaar e-Sign), beyond the original asymmetric-key digital signature. The combined framework treats both digital signatures under Section 3 and electronic signatures under Section 3A as valid for authentication of electronic records, subject to the Second Schedule notification by the Central Government.

Section 139D Income Tax Act — DSC for ITR-6 companies

Section 140 — verification of the return

Section 140 of the Income Tax Act 1961 prescribes the categories of persons who can verify the return of income. For a company, Section 140(c) provides that the return shall be verified by the Managing Director, or where there is no Managing Director or where for any unavoidable reason the Managing Director is not able to verify, by any director thereof. For companies wound up under the Companies Act 2013, the return is verified by the liquidator. For non-resident companies, the return is verified by an authorised representative under Section 288 holding a valid power of attorney. The Section 140 verification operates through the principal officer's Class 3 individual DSC affixed to the ITR-6 JSON or XML file at the time of upload. The DSC's PAN must match the principal officer's PAN as captured in the ITR-6 verification block.

TDS returns and DSC under Section 200

Section 200(3) of the Income Tax Act 1961 read with Rule 31A of the Income Tax Rules 1962 prescribes the quarterly TDS return (Form 24Q, 26Q, 27Q, 27EQ) filing requirement. Companies are required to file the TDS return electronically with digital signature under Rule 31A(4A). The DSC is of the principal officer of the company or, where the deductor is a branch, of the branch's authorised officer. The TDS return DSC is administered through the TIN-NSDL portal and the TRACES portal under separate sub-user authorisations, with the principal Authorised Signatory's Class 3 DSC operating as the master credential. The TDS certificate generation in Form 16 (salary TDS) and Form 16A (non-salary TDS) on the TRACES portal also requires DSC affixation by the deductor before the certificate is treated as authenticated under Section 203.

Tax-audit upload and Section 44AB DSC interplay

Section 44AB read with Rule 6G of the Income Tax Rules 1962 requires every company carrying on business or profession with turnover exceeding the threshold to get its accounts audited. The tax audit report in Form 3CB / 3CD is prepared by a Chartered Accountant in practice and uploaded to the income-tax e-filing portal under Rule 12(1)(ba). The CA's Class 3 individual DSC carrying the ICAI membership number authenticates the audit report at the upload stage. The company's principal officer then accepts the audit report on the portal using the company's principal-officer Class 3 DSC. The two-stage DSC affixation — first by the CA on upload, then by the principal officer on acceptance — embodies the dual-accountability principle that protects both the company and the auditor in the tax-administration relationship. Rejection by the principal officer triggers a re-upload by the CA with revised positions.

OPC versus Private Limited DSC requirements

OPC under Section 2(62) — single subscriber

The One Person Company introduced by Section 2(62) of the Companies Act 2013 is a Private Limited with only one person as member. The OPC is a sub-form of Private Limited and therefore inherits the full DSC requirement under Section 21 read with Rule 8 of the Registration Rules — the sole member, who is also typically the sole director under Section 152(1)'s minimum requirement, must hold a Class 3 individual DSC with the OPC's name in the Organisation field. The OPC additionally requires a Nominee designated under Section 3(1)(c) — the Nominee's identity is captured in INC-3 at incorporation but the Nominee does not require a DSC unless they later step in as sole member. The OPC governance simplification — Section 122(1) board-meeting waiver for OPCs with only one director, Section 152(1) minimum-one-director rule — does not extend any DSC waiver.

Private Limited — minimum two directors, minimum two DSCs

Section 149(1)(a) of the Companies Act 2013 prescribes a minimum of two directors for a Private Limited and Section 7(1)(c) read with Section 3(1)(b) prescribes a minimum of two subscribers. Each director and subscriber must hold a Class 3 individual DSC for the SPICe+ Part B filing — the minimum DSC count for a Private Limited at incorporation is therefore two. In practice, prudent design includes a third Class 3 DSC for the Company Secretary (where appointed under Section 203) or the Authorised Signatory for GST / EPFO / ESIC purposes designated by board resolution. The Private Limited's DSC matrix at steady state typically comprises — two Director DSCs for MCA filings, one Authorised Signatory DSC per GSTIN for GST filings, one Authorised Signatory DSC for EPFO / ESIC, one principal-officer DSC for IT filings, plus the statutory auditor's own DSC for AOC-4 / Form 3CB certification.

Section 8 company — non-profit DSC nuances

Section 8 of the Companies Act 2013 governs companies formed for promotion of commerce, art, science, sports, education, research, social welfare, religion, charity, protection of environment or any such other object, with the intention to apply profits, if any, in promoting its objects and prohibiting payment of any dividend to its members. Section 8 companies operate under a Central Government licence in INC-12 obtained from the Regional Director under Section 8(5). The DSC requirements mirror those of a Private Limited — at least two directors with Class 3 individual DSCs, plus a CA / CS / CMA in practice with Class 3 DSC certifying SPICe+ Part B. The licence under INC-12 is also affixed digitally with the RD's DSC at issuance. Subsequent compliance — Form 8 income-and-expenditure statement, Form 11 annual return — uses the directors' DSCs. The Section 12A and Section 80G registration applications under the Income Tax Act 1961 require additional DSC affixation by the principal officer.

EVC versus DSC — when is DSC mandatory and when optional

Procurement and tender filings — Class 3 DSC mandatory

Government procurement portals — the Central Public Procurement Portal (CPPP), the Government e-Marketplace (GeM), the Indian Railways e-Procurement System (IREPS), the Defence Public Sector Undertaking portals, and the various State e-Procurement systems — uniformly require Class 3 individual DSCs of the bidder's Authorised Signatory for bid submission, bid signing and Letter of Acceptance acknowledgement. The CPPP under the General Financial Rules 2017 Rule 159 mandates Class 3 DSC with the CCA-licensed CA chain. GeM Rule on Authorised User mandates Class 3 DSC with specific OID extensions for the GeM workflow. For company bidders, the DSC is of the office-bearer designated by Section 179 board resolution as the Authorised Tender Signatory. EVC is not available for any procurement portal — the higher security assurance of DSC is treated as integral to the procurement integrity framework.

Individual taxpayer — EVC as default

Electronic Verification Code (EVC) was introduced by the Central Board of Direct Taxes under Rule 12(3)(b) of the Income Tax Rules 1962 as an alternative to DSC for individuals, HUFs and certain other categories. The EVC is a ten-digit alphanumeric code generated through Aadhaar-OTP, net-banking, bank-account, demat-account or e-mail / mobile of the registered user. EVC operates as a one-time verification artifact attached to the specific filing; it does not function as a continuing credential. Individual taxpayers filing ITR-1 / ITR-2 / ITR-3 / ITR-4 typically use Aadhaar-OTP EVC. The EVC pathway is also extended to GST registration applicants who are individuals / HUFs / proprietorships under Rule 26(1)(b) of the CGST Rules. EVC is not available for companies, LLPs, foreign companies or foreign LLPs — for these, DSC is the mandatory mode under Rule 26(1)(a) CGST and Rule 12(3)(a) IT Rules.

Company filings — DSC mandatory across regulators

For companies and LLPs, DSC is mandatory and unconditional across the MCA-21, GSTN, ICEGATE, EPFO, ESIC, IT and TRACES portals. The mandatory rule flows from three concurrent statutory bases — Section 21 Companies Act 2013 (authentication on behalf of the company), Rule 26(1)(a) CGST Rules (DSC for corporate GST filings), Rule 12(3)(a) IT Rules read with Section 139D IT Act (DSC for ITR-6 companies). The mandatory rule is technology-neutral within the DSC category — Class 3 individual DSC of an authorised office-bearer suffices, with no preference among the CCA-licensed Certifying Authorities (eMudhra, Sify, CapriCorn, NSDL e-Gov, IDRBT, Verasys, Pantasign, e-Mudhra). The only flexibility is in DSC validity (one-year or two-year) and signature class (Class 3 individual versus HSM-based Document Signer Certificate for automated invoice signing).

AOC-4 rejection — Director DSC used in place of Company DSC

GSTR-9 annual return filed with expired Company DSC — Section 47 late fee

GSTR-1 DSC failure during peak filing — vendor token outage

ICEGATE customs broker DSC biennial renewal missed — IEC suspension

Other Services in KK Pudur Maduravoyal, Chennai

What KK Pudur Maduravoyal Clients Say