Vadapalani-Koyambedu Road Company DSC — Chennai South

Sub-section (1) of Section 3 of the Information Technology Act, 2000 provides that any subscriber may authenticate an electronic record by affixing his digital signature, and sub-section (2) prescribes that such authentication shall be effected by use of asymmetric crypto-system and hash function which envelopes and transforms the initial electronic record into another electronic record. It is to be noted that any document signed by the authorised signatory of a company on behalf of the company is treated as authenticated only where the digital signature is created in the manner so prescribed; this is the parent provision underpinning every MCA21, GSTN, ICEGATE and Income-tax filing made by the company.

Section 3A, inserted by the Information Technology (Amendment) Act, 2008, recognises electronic signatures as legally valid, provided they are reliable and notified by the Central Government in the Second Schedule. It is to be noted that the DSC issued by a Certifying Authority licensed under Section 24 satisfies the reliability test, and a Class 3 DSC issued in the name of an authorised signatory of the company carries presumption of integrity and identity for purposes of all statutory filings on behalf of the company.

Section 5 provides that where any law requires that information or any other matter shall be authenticated by affixing the signature of any person, such requirement shall, notwithstanding anything contained in such law, be deemed to be satisfied if the information or matter is authenticated by means of a digital signature affixed in such manner as may be prescribed. It is to be noted that this Section is the operative bridge between the Companies Act, the CGST Act, the Income-tax Act and the IT Act, allowing the company's authorised signatory to discharge signature requirements digitally without any separate physical attestation.

Sub-section (1) of Section 35 provides that any person may make an application to the Certifying Authority for issue of a Digital Signature Certificate. Sub-section (3) requires the Certifying Authority, while issuing such certificate, to be satisfied that the applicant holds the private key corresponding to the public key to be listed in the DSC and that such public key will be used to verify the digital signature affixed by the private key. It is to be noted that the DSC issued in the name of the company's authorised signatory must record the company's name in the organisational field to qualify as a Company DSC.

The Information Technology (Certifying Authorities) Rules, 2000 framed under Section 87 of the IT Act prescribe the standards for issue, verification and management of Digital Signature Certificates. It is to be noted that Rule 23 requires the Certifying Authority to maintain a Certification Practice Statement, Rule 24 prescribes the contents of the DSC including subscriber name and organisation, and Rule 31 prescribes class-wise assurance levels with Class 3 being the highest used for company filings requiring physical presence verification at the time of issuance.

Section 21 of the Companies Act, 2013 provides that save as otherwise provided in the Act, a document or proceeding requiring authentication by a company, or contracts made by or on behalf of a company, may be signed by any key managerial personnel or an officer or employee of the company duly authorised by the Board in this behalf. It is to be noted that read with Section 5 of the IT Act, this signature may be affixed digitally through the Class 3 Company DSC of the authorised signatory, and absence of a properly worded board authorisation is the most common cause of DSC-based filings being treated as defective.

What Company DSC means under Indian electronic-signature law

Statutory framework — IT Act 2000 and the 2008 Amendment

The Digital Signature Certificate regime in India is anchored in the Information Technology Act 2000, originally enacted to give legal recognition to electronic records and electronic signatures based on the Public Key Infrastructure model adopted by the UNCITRAL Model Law on Electronic Commerce 1996. Section 2(1)(p) defines digital signature as authentication of any electronic record by a subscriber by means of an electronic method or procedure in accordance with Section 3, which prescribes asymmetric crypto-system and hash function as the technical standard. Section 35 governs the issuance of Digital Signature Certificates by Certifying Authorities licensed by the Controller of Certifying Authorities under Section 17. The IT Amendment Act 2008 introduced Section 3A which expanded the recognition to 'electronic signatures' — a technology-neutral category encompassing biometric authentication (including Aadhaar e-KYC and Aadhaar e-Sign), beyond the original asymmetric-key digital signature. The combined framework treats both digital signatures under Section 3 and electronic signatures under Section 3A as valid for authentication of electronic records, subject to the Second Schedule notification by the Central Government.

Section 5 — legal recognition equivalence

Section 5 of the IT Act 2000 establishes the legal-recognition equivalence rule — where any law provides that information or any other matter shall be authenticated by affixing the signature, then such requirement shall be deemed to have been satisfied if such information or matter is authenticated by means of a digital signature affixed in the manner prescribed by the Central Government. This equivalence rule is the foundation for all subsequent regulator-specific frameworks — MCA-21 under the Companies Act 2013, GSTN under the CGST Act 2017, ICEGATE under the Customs Act 1962 and the Income Tax e-filing portal under the Income Tax Act 1961 all derive their DSC-acceptance mandates from Section 5. The Supreme Court in Trimex International FZE Ltd v Vedanta Aluminium Ltd [2010 3 SCC 1] confirmed that Section 5's recognition extends to commercial contracts authenticated electronically, validating company-DSC-signed agreements as enforceable instruments under the Indian Contract Act 1872.

Section 21 Companies Act 2013 — authentication on behalf of the company

Section 21 of the Companies Act 2013 prescribes the manner in which a document or proceeding requiring authentication by a company shall be signed — by any key managerial personnel or an officer or employee of the company duly authorised by the Board in this behalf. The provision is the corporate-law counterpart of Section 5 IT Act and clarifies that a 'Company DSC' is, in legal substance, the DSC of an individual office-bearer authorised by the Board, not a juristic person's certificate. CCA Interoperability Guidelines 2015 reinforce this — Class 3 DSCs are issued only to natural persons, with the company's name embedded in the Organisation (O) field of the X.509 Subject when the DSC is for company use. The board authorisation typically takes the form of a Section 179 resolution mapping the office-bearer to specified filing categories.

DSC issuance — process, documents and validity

Renewal, revocation and lost-token replacement

DSCs are issued for a fixed validity period — one year or two years — and must be renewed before expiry to ensure continuity of filings. The renewal process is typically lighter than fresh issuance — existing KYC is preserved and only the certificate is re-issued against the same or a new token. Renewal applications are best initiated 45 days before expiry to allow for portal re-registration under Rule 8 of the MCA-21 Registration Rules and the equivalent re-registration on GSTN, IT and EPFO portals. DSC revocation under Section 38 of the IT Act 2000 read with Rule 31 of the IT (CCA) Rules 2000 is initiated by the subscriber on suspicion of compromise, or by the CA on detection of fraud, or by court order. Revoked DSCs are added to the Certificate Revocation List (CRL) maintained by the CA and consulted by relying portals in real time. Lost-token replacement requires a fresh KYC verification — the existing DSC must be revoked first and a new DSC issued, with the new token replacing the lost one.

CCA-licensed Certifying Authorities

The Controller of Certifying Authorities licensed under Section 17 of the IT Act 2000 currently administers a panel of seven CCA-licensed Certifying Authorities for DSC issuance — eMudhra, Sify Communications, CapriCorn Identity Services, NSDL e-Governance, IDRBT, Verasys (formerly Code Solutions) and Pantasign. Each CA operates under the CCA's CP/CPS (Certificate Policy / Certification Practice Statement) framework and the Interoperability Guidelines 2015. The CAs offer a uniform product set — Class 3 individual DSC with one-year or two-year validity, Document Signer Certificate (HSM-based) for automated workflows, and Encryption Certificate for confidentiality use cases. Pricing is broadly comparable — ₹1,500 to ₹3,000 for one-year Class 3 individual DSC and ₹2,500 to ₹5,000 for two-year Class 3 individual DSC, varying by CA and reseller channel. The applicant has free choice among CAs subject to the destination portal's compatibility matrix.

KYC documents and Aadhaar e-KYC

The DSC issuance process under CCA Guidelines requires the applicant to furnish PAN (mandatory), Aadhaar (preferred via Aadhaar offline e-KYC XML), passport-size photograph, address proof (Aadhaar, voter ID, passport, driving licence, utility bill not older than two months, or bank statement), e-mail (for verification OTP), and mobile (for verification OTP). For organisational DSCs (Class 3 with company in Organisation field), the additional documents are — Certificate of Incorporation / Registration of the organisation, PAN of the organisation, board resolution under Section 179 authorising the applicant as the signatory, GST registration certificate (where applicable), and Authorisation Letter on the organisation's letterhead. The KYC verification is conducted through video-KYC by the CA's verifier under CCA Notification on Video-KYC for DSC dated 7 August 2020, valid throughout India.

Comparative — eIDAS, US ESIGN and Indian DSC

Singapore Electronic Transactions Act and the Asian frameworks

Singapore's Electronic Transactions Act 2010 (revised 2021) adopts a two-tier framework similar to eIDAS — electronic signatures with general legal recognition under Section 8, and secure electronic signatures under Section 17 with the same legal effect as a handwritten signature. The secure electronic signature must be uniquely linked to the signatory, capable of identifying them, created under their sole control, and linked to the record such that subsequent changes are detectable — language closely tracking the eIDAS advanced electronic signature definition. Singapore's National Authentication Framework operates through National Certification Authority (NCA) accredited certifying authorities. Other ASEAN jurisdictions — Malaysia (Digital Signature Act 1997), Indonesia (Electronic Information and Transactions Law 2008), the Philippines (E-Commerce Act 2000) — operate broadly similar PKI-based frameworks. India's IT Act 2000 was an early mover in the Asian context and continues to be one of the more rigorous PKI-based frameworks, with mandatory CCA licensing and audit of Certifying Authorities under Rule 33 of the IT (CCA) Rules 2000.

Cross-border recognition and trust frameworks

Cross-border recognition of electronic signatures and DSCs remains a work in progress globally. The WebTrust for Certification Authorities audit framework (operated by AICPA and CPA Canada) provides one assurance pathway — CAs that hold WebTrust audits are accepted by major browser vendors and document-management platforms across jurisdictions. Indian CCA-licensed CAs that hold WebTrust audits (eMudhra, Sify and select others) accordingly enjoy de facto cross-border recognition for routine document signing. For formal regulatory acceptance, however, jurisdictional reciprocity arrangements are required — as between EU Member States under eIDAS, between Schengen states under historical arrangements, or under bilateral mutual recognition agreements. India has not yet entered formal MRAs with the EU or US for DSC recognition; cross-border filings to foreign regulators typically rely on the foreign regulator's own signature framework. Indian DSCs are usable for Indian-portal filings by foreign-resident directors, with the DSC issued in India to the foreign individual after apostilled / consularised KYC.

EU eIDAS Regulation 910/2014

The EU eIDAS Regulation 910/2014 (electronic Identification, Authentication and Trust Services) establishes a harmonised framework for electronic signatures across all EU Member States. Three signature tiers are recognised — simple electronic signature (any data in electronic form attached to other electronic data for authentication, including scanned signatures), advanced electronic signature (uniquely linked to the signatory, capable of identifying the signatory, created using means under the signatory's sole control, and linked to the data such that any change is detectable), and qualified electronic signature (an advanced signature created by a qualified signature creation device and based on a qualified certificate issued by a qualified trust service provider). The QES under Article 25(2) has the equivalent legal effect of a handwritten signature across all Member States. The QES framework is operationally similar to India's Class 3 individual DSC with CCA-licensed CA chain — both rely on PKI, both require strict identity verification, both produce non-repudiable signatures. Mutual recognition between Indian CCA and EU qualified trust providers is not yet formalised but is the subject of intermittent diplomatic exchange under the India-EU Trade and Technology Council.

Director DSC versus Company-Authorised-Signatory DSC

Section 152 read with Section 21 — director authentication

A Director DSC derives its authority from the director's position under Section 152 of the Companies Act 2013 and the deemed authentication mandate under Section 21. Where the company law or rules require a director's signature on a document — INC-22 (registered office change), DIR-12 (director appointment / cessation), MGT-14 (special resolution filing), AOC-4 (financial statements filing), MGT-7 (annual return filing) — the Director DSC is the prescribed mode. The CCA template for Director DSC populates the X.509 Subject with the director's name in Common Name (CN), the company in Organisation (O), the directorship designation in Title (T) where the CA supports it, and the director's PAN in serial number (SN). The DIN of the director is often included in the OU (Organisational Unit) field. MCA-21's signature-verification module reads these fields to validate that the DSC belongs to a director on record.

Section 179 — Authorised Signatory authentication

Section 179 of the Companies Act 2013 read with Schedule III empowers the Board to exercise all powers and to do all such acts and things, as the company is authorised to exercise and do, subject to the Act, MOA, AOA and shareholders' approval where required. The Board can delegate specified powers to committees, directors, key managerial personnel or any officer of the company. An 'Authorised Signatory' is the office-bearer designated under such a Section 179 delegation for specified filing or signing categories — typically the GST Authorised Signatory under Rule 26 CGST Rules, the EPFO / ESIC Authorised Signatory under the respective scheme rules, the IEC Authorised Signatory under the Foreign Trade Policy, and the IT Authorised Signatory under Section 140 of the Income Tax Act 1961. The Authorised Signatory DSC is a Class 3 individual DSC carrying the company name in the Organisation field, accompanied by the certified copy of the Section 179 board resolution when filed at the portal level.

Class 2 versus Class 3 — CCA's class-based hierarchy

The CCA Interoperability Guidelines historically prescribed three classes of DSCs — Class 1 (low-assurance, identity verified against e-mail database), Class 2 (medium-assurance, identity verified against trusted database such as PAN), and Class 3 (high-assurance, identity verified by physical presence or video-KYC). With effect from 1 January 2021, CCA discontinued Class 2 DSCs through the CCA Notification dated 27 November 2020, mandating Class 3 as the only category for new issuance for individuals and organisations. Class 2 DSCs issued prior to the cut-off continue to be valid until expiry. All MCA-21, GSTN, EPFO, ESIC, IT and ICEGATE filings now require Class 3 DSCs. Class 3 DSCs are issued for one-year or two-year validity periods, with the two-year validity attracting a marginally higher fee. The Class 3 issuance process includes video-KYC, mobile-OTP, e-mail verification, PAN database match, and Aadhaar offline e-KYC.

AOC-4 rejection — Director DSC used in place of Company DSC

GSTR-9 annual return filed with expired Company DSC — Section 47 late fee

GSTR-1 DSC failure during peak filing — vendor token outage

STK-2 strike-off application rejected — Company DSC mapped to dormant signatory

Other Services in Vadapalani-Koyambedu Road, Chennai

What Vadapalani-Koyambedu Road Clients Say