Important Update — 29 September 2026
The FIPS 140-3 transition date of 21 September 2026 has now passed.
Under the Controller of Certifying Authorities (CCA) migration advisory, Certifying Authorities were required to stop ordinary DSC issuance in FIPS 140-2 cryptographic modules by 21 September 2026, subject to specified exceptions.
Existing DSCs already downloaded into FIPS 140-2 modules on or before 21 September 2026 do not automatically stop working. They can continue until the DSC expires. However, those older modules generally can no longer be used for an ordinary DSC renewal or fresh DSC download after the cutoff.
This article was originally published in April 2026, before the transition took effect. For the complete current position on old tokens, renewals, FIPS 140-3 hardware and portal signing utilities, read our updated guide:
FIPS 140-3 DSC Token Rules Are Now Live: What Changes After 21 September 2026?
India’s digital signature ecosystem is about to undergo one of its most important security upgrades in years.
If you use a DSC for MCA filings, GST, income tax, tenders, or company compliance — this change will directly affect you.
From September 2026 onward, DSC USB tokens are expected to transition toward FIPS 140-3 compliance, replacing older-generation security hardware.
This isn’t just a technical upgrade.
👉 It will impact how you buy, renew, and manage your Digital Signature Certificates.
Let’s break it down in a clear, practical way.
What Is FIPS 140-3 (Simple Explanation)
FIPS 140-3 is the latest global security standard for cryptographic devices issued by the National Institute of Standards and Technology.
It replaces the older FIPS 140-2, which has been used in DSC tokens for years.
What does it actually improve?
- Stronger encryption validation
- Better protection against physical tampering
- Advanced resistance to hacking attempts
- Stricter testing and certification of USB tokens
👉 In simple terms:
Your DSC becomes harder to misuse, clone, or compromise. FIPS 140-3 introduces updated security requirements for the cryptographic module that protects the private key used by your DSC.
Why India Is Moving Toward FIPS 140-3
This transition is part of a broader push toward stronger digital security and global compliance.
India’s DSC ecosystem is regulated by the Controller of Certifying Authorities, and the shift aligns with:
- Increasing cyber threats targeting digital identity
- Growth in online compliance systems (MCA, GST, Income Tax)
- Need for globally accepted security standards
As digital transactions grow, security standards must evolve too.
What Will Change in September 2026
Here’s what businesses and DSC users should expect:
1. New DSC Tokens Will Be Upgraded
All new DSC issuances will gradually move toward FIPS 140-3 compliant USB tokens.
2. Older Tokens Will Slowly Phase Out
Tokens based on FIPS 140-2:
- Will continue working for now
- But may become outdated over time
- Could face reduced support in the future
3. Renewals May Force Migration
When you renew your DSC, you may:
- Automatically receive a new-generation token
- Need to upgrade your existing hardware
Real Impact on Businesses (What Most Articles Don’t Tell You)
This change affects more than just technology.
🔴 Cost Impact
FIPS 140-3 tokens are more secure → more expensive to manufacture →
👉 Token prices may increase gradually
🟡 Availability Risk
During the transition:
- Old tokens may go out of stock
- New tokens may have limited supply initially
🟢 Operational Impact
Some users may face:
- Driver compatibility issues
- Software/middleware updates
- IT support requirements
👉 Businesses relying heavily on DSCs must plan ahead.
Who Will Be Most Affected
High Impact Users:
- CA firms and tax professionals
- Companies filing MCA/GST regularly
- Tender and government contractors
Medium Impact:
- Businesses using DSC occasionally
Low Impact:
- Individual users with long validity DSC (for now)
FIPS 140-2 vs FIPS 140-3 — Key Difference
| Feature | FIPS 140-2 | FIPS 140-3 |
|---|---|---|
| Security Level | Standard | Advanced |
| Testing | Less strict | More rigorous |
| Tamper Protection | Basic | Enhanced |
| Future Compliance | Limited | Long-term |
👉 FIPS 140-3 is not optional in the long run — it’s the future standard.
What You Should Do Right Now
Don’t wait for the transition to hit you.
✔ If Your DSC Is Expiring Soon
Upgrade early to avoid last-minute issues.
✔ If You Manage Multiple DSCs
Start planning:
- Bulk renewal strategy
- Token lifecycle tracking
- Vendor alignment
✔ If You’re Buying New DSC
Choose providers already preparing for next-gen tokens.
Smart Opportunity for Businesses
While many will react late, smart businesses can benefit:
- Avoid compliance disruption
- Ensure smooth operations
- Offer better service (if you resell DSCs)
👉 Early adopters will have an advantage.
EverSign’s Perspective
At EverSign, we are already preparing for this transition.
Our focus is simple:
- Provide future-ready DSC solutions
- Ensure smooth migration for customers
- Help businesses stay compliant without disruption
Final Thoughts
The move to FIPS 140-3 marks a major shift in DSC security standards.
It’s not urgent today — but it will be unavoidable tomorrow.
👉 The best strategy is simple:
Prepare early, upgrade smartly, and avoid last-minute risks.
Need Help with DSC Upgrade?
Whether you need:
- New DSC issuance
- Renewal guidance
- Bulk DSC solutions
👉 Visit eversign.in and stay ahead of the transition.
