A DSC in income tax is a Digital Signature Certificate, the electronic equivalent of your handwritten signature used to authenticate returns and forms filed online with the Income Tax Department. Under the Information Technology Act, 2000, it carries the same legal weight as signing on paper. Companies, political parties, and any taxpayer whose accounts must be audited are required to use one; everyone else can choose it as an optional verification method alongside Aadhaar OTP and other electronic options.
How the Signature Actually Works
A DSC uses a pair of cryptographic keys. One private key stays with you, stored on a USB token. One public key is used by the Income Tax Department to confirm the document came from you. When you sign a return, the private key generates a unique encrypted stamp tied to the contents of that specific document. Change a single character afterwards and verification fails automatically.
That is the difference between a DSC and a simple electronic signature like a typed name or a scanned image. Section 3 of the Information Technology Act sets out the asymmetric cryptosystem and hash function behind it, and Section 5 gives the resulting signature full legal recognition wherever a handwritten signature would otherwise be required.
Who Must Use a DSC to File
The Income Tax Department makes DSC-based verification mandatory only for specific categories: companies, political parties, and any person whose accounts must be audited under the Income Tax Act.
The audit requirement under Section 44AB is what pulls most businesses and professionals into the mandatory group. The current thresholds are:
- Businesses in general: total sales, turnover, or gross receipts exceeding ₹1 crore in a financial year.
- Businesses with low cash transactions: if both cash receipts and cash payments stay at or below 5% of their respective totals, the threshold rises to ₹10 crore.
- Professionals: gross receipts exceeding ₹50 lakh in a financial year.
If you cross any of these thresholds and your accounts require a statutory audit, you need a DSC to file. For individual taxpayers and others not subject to audit, DSC is entirely optional.
If You Are Not Required to Use a DSC
If you fall outside the mandatory categories, the portal accepts several other ways to e-verify:
- Aadhaar OTP sent to the mobile number linked to your Aadhaar. This is the most common method for individual filers.
- Electronic Verification Code (EVC) generated through a pre-validated, EVC-enabled bank account.
- EVC through a pre-validated demat account.
- Net banking, which redirects you from your bank’s portal to the e-filing site.
- A printed and signed ITR-V mailed to CPC Bangalore if nothing electronic works.
One thing to watch: if you pick “e-Verify Later” while submitting the return, you cannot come back and use DSC to verify that specific filing. You will have to use one of the other electronic methods or send the physical ITR-V.
Getting a Digital Signature Certificate
Since January 2021, Class 1 and Class 2 certificates are no longer issued in India. Every new DSC is Class 3, the highest security level, which is what income tax filing requires. You buy one from a licensed Certifying Authority, a third-party organization authorized by the Controller of Certifying Authorities to verify identity and issue certificates. The list of licensed CAs is published on cca.gov.in.
Applying usually means submitting your PAN, an identity proof such as Aadhaar, and address proof. The CA verifies your documents, often with a short video verification, and then issues the certificate. The private key is written onto a physical USB token that you plug into your computer whenever you need to sign. Because the key lives on the hardware, it never sits on your machine as a copyable file.
Certificates are valid for one, two, or three years depending on what you choose at purchase. Prices vary, but a one-year Class 3 certificate generally runs between ₹1,500 and ₹5,000, with longer validity costing more. Most professionals pick two or three years to skip frequent renewals. Once it expires, you go through the same application with a CA to get a new one, though renewal tends to be faster.
Registering Your DSC on the Income Tax Portal
After you receive the token, you have to link it to your e-filing account on incometax.gov.in before it can sign anything. The portal uses a tool called the emsigner utility, which you download and install on your computer first.
- Log in to the e-filing portal with your user ID and password.
- Click your name in the top right of the Dashboard and open “My Profile.”
- Click “Register DSC” on the left of the Profile page.
- Confirm that emsigner is installed and click Continue.
- Select your certificate provider, pick the certificate, enter the token password, and click Sign.
If validation succeeds, the DSC is active for all future filings on that account and stays registered until the certificate itself expires. If you want to swap in a new certificate before expiry, the portal lets you view the current details or register a fresh one. For a company, the principal contact person registers their own DSC under their personal login.
What Happens If the Return Is Not Verified
A filed return is not a valid return until it has been verified, whether by DSC, Aadhaar OTP, EVC, or physical ITR-V. If verification does not happen in time, the Assessing Officer can treat the return as defective under Section 139(9) of the Income Tax Act.
Once flagged as defective, you get 15 days from the date of the notice to fix it. The Assessing Officer has discretion to extend that period if you apply. If the defect is not corrected within 15 days or any extension granted, the return is treated as invalid and the law treats you as though you never filed. That opens the door to late-filing penalties, the loss of any right to carry forward losses, and the other consequences of a missing return. The Assessing Officer can still condone the delay if you fix the defect before the assessment is completed, but that discretion is not something to plan around. Verifying immediately after filing, which happens in the same session with a registered DSC, is the safer habit.
Other Places the Same DSC Works
The same certificate is accepted across several government platforms, which makes the cost easier to absorb. Companies and LLPs need a DSC for annual returns and other filings with the Ministry of Corporate Affairs through the MCA21 portal, where it is mandatory for all Registrar of Companies filings. GST registration and returns, e-tendering on government procurement portals, and filings with the Reserve Bank of India or SEBI also accept or require DSC-based authentication. One Class 3 certificate covers all of them.