Compliance Guide: Transition to FIPS 140-3 Compliant DSC Tokens
Updated: Sep 21
Digital Signature Certificates (DSCs) are essential in India for various online services. These include income tax filing, GST, MCA filings, tenders, e-procurement, and DGFT. A significant change is coming regarding the DSC USB token requirement from 22 September 2026.
According to the Controller of Certifying Authorities (CCA), new DSCs will require FIPS 140-3 compliant USB tokens starting on 22 September 2026. Users, businesses, professionals, and DSC partners should plan their token requirements in advance.
What Is Changing in DSC Tokens?
Until 21 September 2026, new DSCs can still be downloaded on existing FIPS 140-2 compliant tokens.
From 22 September 2026, new DSCs will not be downloadable on FIPS 140-2 tokens. Instead, a FIPS 140-3 compliant token will be necessary.
Key Changes at a Glance
Date | DSC Token Requirement |
Up to 21 September 2026 | FIPS 140-2 tokens can be used for new DSC downloads |
From 22 September 2026 | New DSCs require FIPS 140-3 compliant tokens |
Existing DSC on FIPS 140-2 token | Continues to remain valid until its expiry |
DSC renewal after 22 September 2026 | FIPS 140-3 compliant token required |
What Is FIPS 140-3?
FIPS 140-3 is a security standard for cryptographic modules. A compliant USB token ensures a secure environment for storing and using the private key associated with a Digital Signature Certificate. The transition from FIPS 140-2 to FIPS 140-3 aligns with newer security requirements for cryptographic devices.
Will My Existing DSC Stop Working?
No. Existing DSCs downloaded on FIPS 140-2 compliant tokens will not be automatically cancelled. They can continue to be used until their validity expires, subject to the applicable requirements of the concerned portal or service. However, when you need to download a new DSC or renew a DSC after 21 September 2026, a FIPS 140-3 compliant token will be required.
Can I Continue Using My FIPS 140-2 Token?
Yes, you can continue using your FIPS 140-2 token for existing DSCs during the DSC's validity period. However, FIPS 140-2 tokens should not be purchased with the expectation that they can be used for downloading new DSCs after 21 September 2026. If you regularly process DSCs, it is advisable to switch to FIPS 140-3 compliant tokens before the deadline.
Why Should You Buy a FIPS 140-3 Token in Advance?
The transition may increase demand for compliant tokens among various professionals. This includes Chartered Accountants (CAs), Company Secretaries (CSs), Tax Consultants, GST Practitioners, Tender Consultants, businesses, DSC resellers, and government e-tendering users. Purchasing a compliant token in advance can help avoid last-minute procurement issues and interruptions in DSC processing.
FIPS 140-3 DSC Tokens Available from e-Secure
e-Secure provides genuine FIPS 140-3 compliant DSC USB tokens suitable for the upcoming DSC token requirements. Options currently promoted by e-Secure include HYP 2003, mToken, and Innait Precision tokens. Whether you need a single token or multiple tokens for your DSC business, choosing a compliant token now can help you prepare for the upcoming transition.
Important Point for DSC Partners
DSC partners and resellers should review their existing token inventory before 21 September 2026. If your stock mainly consists of FIPS 140-2 tokens, consider planning your FIPS 140-3 token inventory in advance. This is particularly crucial for partners who process a large number of DSC applications every month. Also, ensure that your DSC download utility/software is updated to support FIPS 140-3 compliant tokens before attempting to download DSCs on the new tokens.
FIPS 140-2 vs FIPS 140-3 Tokens
Feature | FIPS 140-2 Token | FIPS 140-3 Token |
Existing DSC usage | Yes, subject to DSC validity | Yes |
New DSC download after 21 Sept 2026 | No | Yes |
Suitable for new DSC requirements | Limited after deadline | Yes |
Recommended for new purchases | No | Yes |
Frequently Asked Questions
1. When will the new DSC token requirement start?
The new requirement will apply from 22 September 2026.
2. Can I download a new DSC on a FIPS 140-2 token before 21 September 2026?
Yes, new DSCs can be downloaded on existing FIPS 140-2 compliant tokens until 21 September 2026.
3. What happens to my existing DSC stored on a FIPS 140-2 token?
An existing DSC remains usable until it expires, subject to applicable requirements.
4. Do I need to buy a new token for DSC renewal?
Yes, for a new or renewed DSC downloaded after 21 September 2026, a FIPS 140-3 compliant token will be required.
5. Should I buy a FIPS 140-2 token now?
If you are purchasing a token for future DSC downloads, a FIPS 140-3 compliant token is the better choice due to the upcoming requirement.
6. Which FIPS 140-3 tokens are available?
FIPS 140-3 compliant options such as HYP 2003, mToken, and Innait Precision are available through e-Secure, subject to current stock and availability. Currently, FIPS 140-3 Verified Watchdata Proxkey Tokens are not launched by the Company.
Conclusion
The transition to FIPS 140-3 compliant DSC tokens from 21 September 2026 is crucial for DSC users and partners. If you frequently apply for or process Digital Signature Certificates, it is recommended to move to a FIPS 140-3 compliant USB token before the deadline. This will help ensure that your DSC downloads and renewal activities are not affected by the transition.
Need a FIPS 140-3 compliant DSC token? Buy genuine FIPS 140-3 certified tokens with express delivery from e-Secure at esecuredsc.com.