DSC and DIN for Directors: What They Are, What They Cost, How Long They Last

Every director of an Indian company carries two identity items, and founders mix them up constantly. The DIN is who you are on the MCA's records. The DSC is how you sign. One lasts for life. The other expires. In the identity layer of a private limited company, getting these two sorted first is what keeps the rest of the incorporation moving.

Here is the short version. A Director Identification Number (DIN) is a unique eight-digit number the Central Government allots under Section 153 of the Companies Act, 2013. A Digital Signature Certificate (DSC) is a Class 3 certificate issued by a Certifying Authority licensed under the Information Technology Act, 2000. You need both before a single incorporation form can be signed.

DIN and DSC are not the same thing

Think of it this way: the DIN is your name written on the boardroom door, and the DSC is the key that lets you sign on the company's behalf once you walk in. The name stays on the door for life. Keys wear out and get replaced.

The DIN identifies you. It sits in the MCA's master data, follows you from company to company, and must be quoted in returns, applications and documents that refer to you as a director. The DSC proves a signature. When a form is filed on the MCA portal, the DSC is what makes the electronic signature on it legally yours — Section 5 of the Information Technology Act, 2000 gives that signature the same standing as ink on paper.

A practising CA, CS or advocate who certifies your forms needs a DSC too, but no DIN — the DIN belongs only to directors. Your DSC, on the other hand, is personal to you and works across every company where you are a director.

What a DIN is, and how long it lasts

Section 153 says every individual who intends to be appointed as a director must apply to the Central Government for a DIN. Section 154 requires the Government to allot it within one month of the application. In practice, a DIN sought inside an incorporation arrives with the incorporation approval itself, and a clean standalone application usually clears in a few working days.

The number is allotted once, for life. It does not expire, it is never renewed, and it is never transferred to anyone else. Section 155 is blunt about the other side of that bargain: a person who holds a DIN must not apply for, obtain or possess another one. Holding two DINs is a contravention, and Section 159 sets the penalty at up to ₹50,000, with a further penalty of up to ₹500 for each day after the first that the default continues.

If your personal details change — a new address, a corrected name spelling — you do not take a fresh DIN. You intimate the change in Form DIR-6 and the same number carries on.

The two routes to a DIN: SPICe+ and DIR-3

Route one is SPICe+. When you incorporate a new company, the SPICe+ form (INC-32) allots DINs to up to three proposed directors as part of the incorporation itself. There is no separate DIN application and no separate DIN fee. If a proposed director already holds a DIN, you quote the existing number instead of applying again — the form expects that.

The three-director limit catches larger founding teams. A fourth director who does not yet hold a DIN cannot be allotted one inside your SPICe+. That person needs a DIN in hand before the form goes in.

Route two is Form DIR-3. This is the standalone application, used when an existing company appoints a director who has no DIN, and for that fourth founding director. The government fee is ₹500 per application under the Companies (Registration Offices and Fees) Rules, 2014. The application is signed with the applicant's DSC and verified by a director of the company the person is joining, which is why you cannot sensibly apply for a DIN in the abstract, with no company in view.

The paper set is light: PAN for an Indian applicant (passport for a foreign national), address proof, a photograph, and the board resolution of the appointing company for a DIR-3 filing. Most rejections I see at this stage are silly ones — a name spelled one way on the PAN and another way on the address proof. Match the spellings before you file. Our documents checklist for private limited company registration shows the exact set founders are asked for.

When a DIN ends: surrender and deactivation

A lifetime number still needs an exit door, and Rule 11 of the Companies (Appointment and Qualification of Directors) Rules, 2014 provides it. A DIN is surrendered in Form DIR-5, with a fee of ₹1,000, on limited grounds: the number is a duplicate; it was obtained wrongfully or by fraud; the holder has been declared of unsound mind by a court; the holder has been adjudged insolvent; the holder has died (a relative files, with the death certificate); or the holder has never been appointed a director anywhere and the DIN has never been used for any filing. On approval, the DIN is deactivated and cannot be used again.

Read the last ground carefully before you reach for it. A director who has actually served on a board cannot simply hand the number back because he has resigned. Resignation ends the appointment, not the DIN. The number stays with you, dormant, in case you join another board years later. The guide to adding a director through DIR-12 covers how appointments and exits are recorded once the DIN exists.

Deactivation has a second, involuntary face. If you miss your DIR-3 KYC, the MCA marks the DIN deactivated for non-compliance. That is not surrender — the number is yours and revivable — but while it sits deactivated you cannot be appointed anywhere and filings signed against it stall. Reactivation means filing the KYC and paying ₹5,000.

DIR-3 KYC is now once in three years, not annual

This is the point older articles still get wrong, so let me state it plainly. DIR-3 KYC used to be an annual ritual, due every 30 September. It is not annual any more.

The Companies (Appointment and Qualification of Directors) Amendment Rules, 2025, notified as G.S.R. 943(E) and in force from 31 March 2026, substituted Rule 12A. Every person who holds a DIN as on 31 March of a financial year now files the KYC intimation in Form DIR-3 KYC Web once in every three consecutive financial years, on or before 30 June of the year that follows the third year. Filed on time, the government fee is nil.

What does that mean for your diary? If you completed your KYC in the cycle up to financial year 2025-26, your next routine filing falls due by 30 June 2028. A DIN first allotted during financial year 2025-26 runs on its own clock and first falls due by 30 June 2029. There is no routine KYC due in 2026 or 2027 for a director who was compliant — anyone who tells you to file it this September is working from a dead rule.

One duty did not relax. If your mobile number, email address or residential address changes, you update it through DIR-3 KYC Web within 30 days of the change. That update keeps you reachable for MCA notices; it does not restart your three-year clock.

What a DSC is, and why it is Class 3

A DSC is issued by a Certifying Authority licensed by the Controller of Certifying Authorities under the Information Technology Act, 2000. You buy it from the authority or its registration partners — never from the MCA, which only consumes the signature.

Founders still ask for a Class 2 DSC because old checklists mention it. Stop asking. The Controller of Certifying Authorities discontinued Class 2 certificates with effect from 1 January 2021, and every certificate issued since then for MCA work is Class 3 — the highest assurance class, issued after Aadhaar-based eKYC and video verification of the applicant. A Class 2 certificate issued before that date simply lived out its validity and was replaced by a Class 3 at the end of it.

For MCA filings you need the signing type. A combo certificate, which pairs signing with encryption, is what e-tender and some trade portals ask for; a director who only files with the MCA does not need to pay for the combo.

Token, paperless and validity: how a DSC actually reaches you

The certificate itself lives on a FIPS-compliant USB crypto token — a small hardware device that holds your private key and asks for its PIN each time you sign. MCA filings expect the certificate on a token, so budget for one if you do not already own a compatible token. Paperless, in DSC advertisements, describes the application, not the storage: Aadhaar eKYC, an online form and a short video verification, with no paper file moving anywhere. If you already hold a token, most authorities will download a fresh certificate onto it and charge you only for the certificate.

Validity is your choice at purchase: one, two or three years. Two years is the term most directors take. When the period ends, the certificate is not renewed in place — the authority issues a fresh certificate after fresh verification, and you register the new DSC against your DIN on the MCA portal before you file again. An expired DSC signs nothing, and the MCA does not extend a filing deadline because a signature lapsed. Check the expiry date a month ahead.

What DIN and DSC cost

Let us separate the government fee from the market price, because quotes often blur the two.

The DSC figures are market ranges across licensed Certifying Authorities and their partners, not a government tariff — the certificate carries 18% GST, and same-day or assisted issuance costs more than the bare paperless route. A combo (sign and encrypt) certificate costs more than the signing-only figures above. Treat any quote far outside these bands as a question to ask, not a bargain to grab.

So for a two-director company, the identity layer is genuinely cheap: no DIN fee inside SPICe+, and roughly ₹2,100–₹4,300 in DSC costs if both directors take two-year signing certificates and one of them needs a token. The expensive version of this step is the delayed version — a lapsed DSC discovered on filing day, or a DIR-3 run-around for a fourth director nobody planned for.

The order I ask founders to follow

Get the DSCs first, for every proposed director and for the professional who will certify the forms. Quote existing DINs where they exist; let SPICe+ allot the rest, and run DIR-3 early for anyone beyond the third director. Verify each DIN's status on the MCA portal before Part B is prepared — an old deactivated DIN surfaces at the worst moment — and diary the DSC expiry dates and the June 2028 KYC date the day the company is born.

If you would rather not run this chain yourself, our private limited company registration service lines up the DSCs, DINs and the SPICe+ filing as one sequence, with the expiry dates diarised from day one. Bring us the PAN and address proof of each director, spelled the same way on both, and the identity layer stops being the reason your incorporation waits.