Filing a GST return ends with a signature. Until it is signed, a return is only saved or submitted; the portal files it, and issues the acknowledgement reference number (ARN), only once it is signed.
What are EVC and DSC?
| EVC | DSC | |
|---|---|---|
| What it is | A one-time code from the GST portal | A digital signature certificate, usually on a USB token |
| Sent to or held by | The authorised signatory's registered mobile and email | The authorised signatory, issued in their PAN |
| Set-up | None beyond correct contact details on the registration | Buy a Class 3 certificate, register it on the portal, install the portal's signing utility (emSigner) |
| Cost | Free | Paid, renewed every one to three years |
| Who can use it | Most taxpayers, including proprietors and partnership firms | Everyone; mandatory for companies |
Who must use DSC?
A company registered under the Companies Act 2013 must sign its GST returns with a DSC (the proviso to Rule 26(1) of the CGST Rules). Relaxations during the pandemic let companies use EVC for GSTR-1 and GSTR-3B for parts of 2020 and 2021; the last one ended on 31 October 2021.
Proprietors and partnership firms can use EVC or DSC. For other forms of business, use the options the portal offers on your filing screen; where only DSC is offered, a DSC is needed.
How does EVC work?
- On the return, choose File with EVC and pick the authorised signatory.
- The portal sends a six-character code to that signatory's registered mobile number and email.
- Type the code exactly as it arrives. It can contain letters as well as digits, like K7Q2M9; a box that accepts only numbers will refuse it.
- The portal files the return and shows the ARN. A confirmation also goes by email and SMS.
The code goes to the signatory, not to whoever is filing. If an accountant or an app files for you, the signatory has to be reachable at that moment.
How does DSC work?
- Buy a Class 3 DSC in the authorised signatory's name, linked to their PAN, from a licensed certifying authority.
- Register it on the GST portal: log in, then go to My Profile and Register or Update DSC.
- Install emSigner, the portal's signing utility, on the computer you file from, and keep it running.
- On the return, choose File with DSC, select the certificate, and enter the token's PIN.
The portal's own checks: the DSC must not have expired, must be registered on the portal, and must be PAN-based.
Why does EVC fail?
- The code goes to an old number. The registered mobile belongs to someone who left, or to your accountant. Update the authorised signatory's details through a non-core amendment of your registration, which does not need an officer's approval.
- The code is typed into a numbers-only field. Use a field that accepts letters.
- Too many attempts. Wait and ask for a new code rather than retrying the old one.
Why does DSC fail?
- emSigner is not installed or not running, or the browser blocks it.
- The certificate has expired, or was renewed but the new one was never registered on the portal.
- The token's driver is missing on the computer you are using.
- The DSC belongs to someone who is not an authorised signatory on the registration.
Can an app sign for me?
No app can sign for you, and none should. An app that files GSTR-1 through the portal's API sends the return and then asks for the EVC code; the authorised signatory still receives it on their own phone and types it. That keeps the signature where the law puts it.