Changes in DSC USB Tokens from 21 September 2026 – FIPS 140-3

Compliance Guide

Digital Signature Certificates (DSCs) are widely used in India for income tax filing, GST, MCA filings, tenders, e-procurement, DGFT, and other online services. An important change is coming to the DSC USB token requirement from 21 September 2026.

As per the guidelines of the Controller of Certifying Authorities (CCA), new DSCs will require FIPS 140-3 compliant USB tokens from 21 September 2026. Users, businesses, professionals, and DSC partners should therefore plan their token requirements in advance.

What Is Changing in DSC Tokens?

Until 20 September 2026, new DSCs can continue to be downloaded on existing FIPS 140-2 compliant tokens.

From 21 September 2026 onwards, new DSCs cannot be downloaded on FIPS 140-2 tokens and will require a FIPS 140-3 compliant token.

Key Changes at a Glance

Date	DSC Token Requirement
Up to 20 September 2026	FIPS 140-2 tokens can be used for new DSC downloads
From 21 September 2026	New DSCs require FIPS 140-3 compliant tokens
Existing DSC on FIPS 140-2 token	Continues to remain valid until its expiry
DSC renewal after 21 September 2026	FIPS 140-3 compliant token required

What Is FIPS 140-3?

FIPS 140-3 is a security standard for cryptographic modules. A compliant USB token provides a secure environment for storing and using the private key associated with a Digital Signature Certificate.

The move from FIPS 140-2 to FIPS 140-3 is part of the transition toward newer security requirements for cryptographic devices.

Will My Existing DSC Stop Working?

No.

Existing DSCs already downloaded on FIPS 140-2 compliant tokens are not automatically cancelled because of this change. They can continue to be used until their validity expires, subject to the applicable requirements of the concerned portal or service.

However, when you need to download a new DSC or renew a DSC after 21 September 2026, a FIPS 140-3 compliant token will be required.

Can I Continue Using My FIPS 140-2 Token?

Yes, for existing DSCs already stored on the token, the token can continue to be used for the applicable purpose during the DSC's validity period.

However, FIPS 140-2 tokens should not be purchased with the expectation that they can be used for downloading new DSCs after 20 September 2026.

If you regularly process DSCs, it is advisable to switch to FIPS 140-3 compliant tokens before the deadline.

Why Should You Buy a FIPS 140-3 Token in Advance?

The transition may increase demand for compliant tokens among:

• Chartered Accountants (CAs)

• Company Secretaries (CSs)

• Tax Consultants

• GST Practitioners

• Tender Consultants

• Businesses and Companies

• DSC Resellers and Partners

• Government e-Tendering Users

• Professionals using multiple DSCs

Purchasing a compliant token in advance can help avoid last-minute procurement issues and interruptions in DSC processing.

FIPS 140-3 DSC Tokens Available from e-Secure

e-Secure provides genuine FIPS 140-3 compliant DSC USB tokens suitable for the upcoming DSC token requirements.

FIPS 140-3 token options currently promoted by e-Secure include HYP 2003, mToken and Innait Precision tokens.

Whether you need a single token or multiple tokens for your DSC business, choosing a compliant token now can help you prepare for the upcoming transition.

Important Point for DSC Partners

DSC partners and resellers should review their existing token inventory before 21 September 2026.

If your stock mainly consists of FIPS 140-2 tokens, consider planning your FIPS 140-3 token inventory in advance. This is particularly important for partners who process a large number of DSC applications every month.

Also ensure that your DSC download utility/software is updated to support FIPS 140-3 compliant tokens before attempting to download DSCs on the new tokens.

FIPS 140-2 vs FIPS 140-3 Tokens

Feature	FIPS 140-2 Token	FIPS 140-3 Token
Existing DSC usage	Yes, subject to DSC validity	Yes
New DSC download after 20 Sept 2026	No	Yes
Suitable for new DSC requirements	Limited after deadline	Yes
Recommended for new purchases	No	Yes
Future-ready	Limited	Yes

Frequently Asked Questions

1. When will the new DSC token requirement start?

The new requirement will apply from 21 September 2026.

2. Can I download a new DSC on a FIPS 140-2 token before 21 September 2026?

Yes, as per the stated transition timeline, new DSCs can be downloaded on existing FIPS 140-2 compliant tokens up to 20 September 2026.

3. What happens to my existing DSC stored on a FIPS 140-2 token?

An existing DSC is not affected merely because the token is FIPS 140-2. It can remain usable until the DSC expires, subject to applicable requirements.

4. Do I need to buy a new token for DSC renewal?

For a new/renewed DSC downloaded after 21 September 2026, a FIPS 140-3 compliant token will be required.

5. Should I buy a FIPS 140-2 token now?

If you are purchasing a token for future DSC downloads, a FIPS 140-3 compliant token is the better choice in view of the upcoming requirement.

6. Which FIPS 140-3 tokens are available?

FIPS 140-3 compliant options such as HYP 2003, mToken and Innait Precision are available through e-Secure, subject to current stock and availability. Currently FIPS 140-3 Vertified Watchdata Proxkey Tokens are not launched by the Company.

Conclusion

The transition to FIPS 140-3 compliant DSC tokens from 21 September 2026 is an important change for DSC users and partners across India.

If you frequently apply for or process Digital Signature Certificates, it is recommended to move to a FIPS 140-3 compliant USB token before the deadline. This will help ensure that your DSC downloads and renewal activities are not affected by the transition.

Need a FIPS 140-3 compliant DSC token?

Buy genuine FIPS 140-3 certified tokens with express delivery from e-Secure at esecuredsc.com.