DSC vs Aadhaar eSign: Which to Use for Indian Company Filings

You're about to file the annual return for your private limited company, and the MCA portal throws an error. The signature didn't validate. Or maybe your CA asks whether you have a DSC ready, and you're wondering why your Aadhaar eSign isn't enough when it worked fine for your income tax return last year. This confusion costs founders real time, and sometimes a rejected filing that has to be redone before a deadline.

The short version: DSC vs Aadhaar eSign for company filings is not a matter of preference. The portal and the form decide for you. Some filings demand a Class 3 Digital Signature Certificate by law. Others happily accept an Aadhaar-based OTP signature. Get this wrong and you waste days. Let's sort out exactly when each applies across MCA, GST, and ITR.

What is the actual difference between a DSC and Aadhaar eSign?

Both are legally valid electronic signatures under the Information Technology Act, 2000. But they work differently and serve different trust levels.

A Digital Signature Certificate (DSC) is a cryptographic certificate issued by a licensed Certifying Authority such as eMudhra, Sify, or Capricorn. It's tied to a person, stored on a physical USB token (a FIPS-compliant crypto device), and used to sign documents from your computer. For company work you almost always need a Class 3 DSC, which involves video verification and document checks. A DSC is valid for one, two, or three years and then needs renewal. Typical cost runs from around ₹800 to ₹2,500 for the certificate plus the token.

Aadhaar eSign is an OTP-based signature. You authenticate using your Aadhaar number and the OTP sent to your linked mobile, and the system generates a one-time signature certificate on the spot. There's no token, no renewal, nothing to carry. It's fast and free in most contexts, but it carries a lower assurance level than a Class 3 DSC, which is precisely why some regulators won't accept it for high-stakes filings.

Think of it this way. Aadhaar eSign is convenient and good enough for individual, lower-risk submissions. A DSC is the heavyweight credential demanded when a regulator wants strong, non-repudiable proof that a specific authorised person signed.

When is a DSC mandatory for MCA / ROC company filings?

This is where most of the confusion lives. For anything filed with the Ministry of Corporate Affairs (MCA), through the MCA21 V3 portal, a Class 3 DSC is mandatory. Aadhaar eSign is not accepted for company and LLP statutory filings. No exceptions worth planning around.

You will need a DSC for, among others:

• Company incorporation forms (SPICe+, AGILE-PRO-S, eMOA, eAOA)
• Annual filings such as AOC-4 (financial statements) and MGT-7 / MGT-7A (annual return)
• Director appointments and resignations (DIR-12)
• DIN-related forms and DIR-3 KYC
• Charge creation and modification (CHG-1)
• LLP forms (FiLLiP, Form 8, Form 11)
• Changes to registered office, share capital, and most other event-based filings

Every director and the company secretary or CA certifying the form needs their own DSC. So if you're a two-director startup in Pune incorporating now, you need two Class 3 DSCs before you even start, plus one for the professional certifying the forms.

If you're still deciding on your entity type before any of this matters, our breakdown of private limited vs LLP vs OPC is worth a read first, because the structure changes which forms you'll face.

A common rejection trap

The MCA system validates that the DSC is registered against that person's role on the portal. A brand-new DSC that hasn't been associated with the director's DIN, or one that has expired mid-process, throws a signature error. Register the DSC on MCA before you sign, and check the validity date. An expiring DSC is the single most avoidable cause of a failed annual filing.

Can I use Aadhaar eSign for income tax (ITR) filings?

Yes, and for most individuals and many businesses this is the easier route. On the Income Tax e-filing portal you can verify and sign returns using Aadhaar OTP, net banking EVC, or a DSC. For salaried individuals, proprietors, and many small businesses, Aadhaar OTP-based e-verification is perfectly valid and instant.

However, a DSC becomes mandatory for ITR in specific cases:

• Companies filing their income tax return
• Taxpayers whose accounts require a tax audit under Section 44AB
• Political parties and certain other entities specified by the IT rules

So a private limited company files its ITR with the authorised signatory's DSC, while the same person filing their personal ITR can simply use Aadhaar OTP. Two different rules, same individual. That mismatch is exactly what trips founders up.

If your startup is also chasing the income tax holiday, plan your signing setup alongside the paperwork. Our guide on the 3-year tax exemption under Section 80-IAC covers what DPIIT-recognised startups can claim.

Does GST registration and return filing need a DSC or Aadhaar eSign?

GST is the most nuanced of the three, because it actually depends on your entity type.

• Companies and LLPs: A DSC is mandatory for GST registration and for filing returns. Aadhaar eSign / EVC is not an accepted substitute for these entities.
• Proprietorships, partnerships, and individuals: You can use EVC (Aadhaar-based OTP) to verify GST registration applications and returns. A DSC is optional, not required.

So if you run a sole proprietorship selling on marketplaces from Jaipur, you can complete GST registration and file your GSTR-1 and GSTR-3B using only Aadhaar OTP. Convert that same business into a private limited company, and you'll now need a DSC for every GST submission.

Worth noting: GST registration also requires Aadhaar authentication as a separate step from signing, regardless of which signature method you use. And if you're expanding operations and adding a GSTIN in another state, the same entity rules carry over. We walk through that in our post on multi-state GST registration and adding a second GSTIN.

DSC vs Aadhaar eSign for company filings: the quick decision table

Here's the cheat sheet to keep next to your filing checklist:

• MCA / ROC (any company or LLP form): Class 3 DSC. Always.
• ITR for a company or tax-audit case: DSC required.
• ITR for individuals and small businesses (no audit): Aadhaar OTP is fine.
• GST for companies and LLPs: DSC required.
• GST for proprietors and partnerships: Aadhaar EVC is fine; DSC optional.
• Signing PDFs, vendor agreements, internal approvals: Aadhaar eSign usually sufficient unless a counterparty insists on a DSC.

The pattern is easy to remember once you see it: incorporated entities lean DSC, individuals and unincorporated businesses lean Aadhaar eSign. The MCA portal is the strictest of the lot.

How do I set up a DSC the right way and avoid rejected filings?

If you've concluded you need a DSC, here's the order of operations that prevents most headaches:

1. Get a Class 3 DSC from a licensed Certifying Authority. You'll need PAN, Aadhaar, a photo, and a short video verification. Two-year validity is the usual sweet spot for cost versus renewal hassle.
2. Install the token drivers and signing utility (such as emBridge or the CA's equivalent) on the machine you'll file from. Java and browser settings often need adjusting.
3. Register the DSC on the relevant portal. For MCA, associate it with the director's DIN and role. For GST, register it under the authorised signatory profile. For income tax, register it under the e-filing DSC management menu.
4. Test a small action before deadline day. Sign one low-stakes form to confirm the certificate validates.
5. Track expiry dates. Set a reminder 30 days before any DSC expires, and re-register the renewed certificate.

The most expensive mistake we see isn't picking the wrong signature type. It's discovering an expired or unregistered DSC at 11 pm on the filing deadline.

Many founders running lean teams from co-working spaces use a virtual office address for GST and company registration to keep their registered office documentation clean while sorting out the signing infrastructure. It's a small thing that keeps your filings consistent.

Where eDarpan fits in

We're a technology company based in Dwarka, New Delhi, and a lot of our compliance and infrastructure work starts exactly here, with founders untangling which signature their next filing needs. Through our services and IT consulting, we help teams set up DSC tokens correctly, register them across MCA, GST, and income tax portals, and put renewal reminders in place so a deadline never gets blown by an expired certificate.

If your operations are growing, we can also support the wider stack around your filings, from Google Workspace and Microsoft 365 licensing for secure document handling to client communication tools like the WhatsApp Business API. Talk to our team if you want a clean, audit-ready signing setup from the start.

Frequently asked questions

Can one DSC be used by multiple directors of a company?

No. A DSC is issued to a specific individual and legally represents that person's signature. Each director and authorised signatory needs their own Class 3 DSC. Sharing a token isn't just risky, it defeats the purpose of non-repudiation that the certificate provides.

Is Aadhaar eSign legally valid for signing business contracts?

Yes. Aadhaar eSign is a recognised electronic signature under the IT Act and is valid for most commercial contracts. That said, if a counterparty, lender, or government tender specifically requires a Class 3 DSC, you'll need to comply with their requirement regardless of the law's baseline acceptance.

What happens if my DSC expires in the middle of a filing?

The portal will reject the signature, and you'll have to renew or reissue the certificate and re-register it before completing the filing. To avoid this, always check the validity date before starting any time-sensitive submission, and renew at least a few weeks ahead of expiry.

Do startups recognised under Startup India get any relaxation on DSC requirements?

No. Startup India recognition brings tax and compliance benefits but does not change electronic signature rules. A recognised private limited company still needs a Class 3 DSC for MCA and most GST and ITR filings. You can read what recognition actually delivers in our guide to Startup India recognition benefits.

Can I file GST as a company using Aadhaar OTP instead of buying a DSC?

No. For companies and LLPs, the GST portal mandates a DSC for registration and returns. Aadhaar-based EVC is only available to proprietorships, partnerships, and individuals. If you've incorporated, budget for a DSC as part of your compliance setup.

The bottom line

Resolving the DSC vs Aadhaar eSign for company filings question comes down to one rule of thumb: incorporated entities almost always need a Class 3 DSC, while individuals and unincorporated businesses can usually rely on Aadhaar eSign. MCA gives you no choice at all. GST and ITR depend on your structure and whether an audit applies. Set up the right credential early, register it on each portal, and keep an eye on expiry, and you'll stop seeing those last-minute signature errors. If you'd rather hand the setup to someone who does this every week, eDarpan is here to help.

Image credit: Business. by kevin dooley via flickr (BY 2.0), sourced through Openverse.