The main difference between Class 2 and Class 3 DSC lies in verification and security. Class 2 uses PAN and Aadhaar database checks for moderate security. Class 3 requires Aadhaar e-KYC, document checks, and mandatory video verification.
After receiving a Class 3 DSC, link it to your PAN or DIN on the relevant MCA, GST, or Income Tax portal. Without this step, the portal may reject your DSC.
Note: The Controller of Certifying Authorities discontinued Class 2 in January 2021. Class 3 is now the only DSC class issued in India.
Key Takeaways
- The CCA discontinued Class 2 DSC on 1 January 2021. Class 3 is now the only active DSC class issued in India.
- Class 3 DSC requires strict Aadhaar e-KYC, document checks, and mandatory video verification, and supports both routine and high-security transactions.
- The CCA’s Identity Verification Guidelines Version 2.5 (February 2026) refined the verification process for Class 3 DSCs, a change this guide’s earlier version didn’t reflect.
- New DSC tokens must be FIPS 140-3 certified starting 21 September 2026, an imminent compliance deadline for anyone applying soon.
- The IT Act, 2000 legally recognizes Class 3 DSC. You must use it for MCA, GST, Income Tax, DGFT, ICEGATE, and e-tendering filings.
- Existing Class 2 certificates remained valid until their original expiry. You cannot renew them today.
What are the Different Classes of DSCs?
Digital Signature Certificates (DSCs) are classified based on identity verification and security levels. The Controller of Certifying Authorities (CCA) sets these standards.
India previously had three DSC classes. However, the CCA phased out Class 1 and Class 2 in January 2021. Class 3 is now the standard DSC for most government and business transactions.
1. Class 1 DSC: It verified basic details such as name and email. It offered the lowest security level. The CCA discontinued it in January 2021.
2. Class 2 DSC: Class 2 DSC verified individuals and businesses using PAN, Aadhaar, and other government documents. It provided moderate security for routine compliance tasks.
3. Class 3 DSC: Class 3 DSC uses strict identity verification, including Aadhaar e-KYC, document checks, and mandatory video verification. It provides the highest security level. It supports e-tendering, MCA filings, GST, income tax submissions, and other secure transactions.
Note: The CCA’s Identity Verification Guidelines Version 2.5, issued in February 2026, updated Class 3 verification requirements. A FIPS 140-3 certification requirement for new tokens will also take effect on 21 September 2026. Applicants should confirm the latest requirements with their Certifying Authority.
Key Differences Between Class 2 and Class 3 DSCs
Class 2 and Class 3 DSCs served different security needs, verification levels, and use cases historically. The CCA discontinued Class 2, so you cannot use it for new filings. The table below shows what each class offered while active:
| Feature | Class 2 DSC (Discontinued) | Class 3 DSC (Current Standard) |
|---|---|---|
| Purpose / Use Cases | Previously used for basic and moderate-risk filings such as ITR, MCA, GST, PF, ESIC, and trademark filing | Currently required for all filings, from routine compliance to high-security and high-value transactions, including e-tendering, e-procurement, DGFT, ICEGATE, MCA, GST, and audits |
| Verification / KYC | Database-based verification using PAN, Aadhaar, and OTP; occasional video verification | Strict verification with Aadhaar e-KYC, document checks, and mandatory video verification, refined under CCA Guidelines Version 2.5 (Feb 2026) |
| Security Level / Encryption | Moderate encryption, suitable for low-risk portals | Highest encryption, suitable for both low- and high-risk portals |
| Storage / Token | USB token or software-based storage | USB token or hardware-based secure storage; new tokens must be FIPS 140-3 certified from 21 September 2026 |
| Accepted Portals | Was accepted on MCA, Income Tax, GST, PF, ESIC, and trademark portals before discontinuation | All government and high-security portals, including e-tendering, e-auctions, ICEGATE, and DGFT |
| Cost | Was lower cost, affordable for routine compliance | Higher cost due to advanced security and strict verification |
| Validity & Renewal | Usually 1–2 years; cannot be renewed after expiry (discontinued since 1 Jan 2021) | 1–3 years; renewable before expiry; currently the only class issued |
| Legal Validity / Implications | Legally valid when issued, but phased out; cannot be used after expiry | Legally recognized under the IT Act, 2000; ensures enforceable signatures for all secure digital transactions |
| User Base | Was used by individuals and organizations performing routine compliance | Individuals, organizations, vendors, professionals, and anyone accessing secure online systems |
| Risk / Misuse | Higher risk due to moderate verification | Very low risk due to strict verification and identity checks |
Note: Class 2’s “Purpose” and “Accepted Portals” describe its historical use before January 2021, not a current option.
Which Digital Signature Certificate Do You Need Today?
The CCA discontinued Class 2 DSCs, making Class 3 DSC the standard for digital authentication in India. Your requirements depend on your role and the tasks you handle.
1. For Individuals
If you file Income Tax returns, GST forms, or MCA, PF, or ESIC filings, you need a Class 3 DSC. It provides secure authentication and legal validity for digital signatures. You need it to access these portals and submit official documents online.
2. For Businesses
Businesses involved in e-tendering, e-procurement, or online bidding must use a Class 3 DSC. It provides the security required for high-value transactions and government portals. Businesses also use Class 3 signatures for filings and contracts.
3. For Professionals
Chartered accountants, company secretaries, tax consultants, and other professionals need a Class 3 DSC. It helps them file client returns, manage MCA documents, and handle secure business approvals. It also reduces the risk of rejection on official platforms.
