DSC USB Tokens Are Moving to FIPS 140-3 (September 2026)

If you use a Digital Signature Certificate, an important hardware change is on the way. Following a directive from the Controller of Certifying Authorities (CCA), the USB tokens that store DSCs are moving from the older FIPS 140-2 standard to the newer, more secure FIPS 140-3 — with a firm deadline. Here is what it means for you.

What is FIPS 140-3?

FIPS 140 is the international security standard for the cryptographic hardware that holds your digital signature key — in other words, your USB token. FIPS 140-3 is the latest version, replacing FIPS 140-2. It brings stricter security testing, stronger tamper resistance and tighter cryptographic controls, so the private key inside your token is even harder to extract or misuse.

What is changing — and the deadline

The CCA has directed that from 21 September 2026, Certifying Authorities must stop issuing Digital Signature Certificates on FIPS 140-2 tokens. After that date:

• Every fresh DSC download must go onto a FIPS 140-3 compliant token.
• Every renewal must also use a FIPS 140-3 token.
• New issuance on older FIPS 140-2 tokens will stop.

Will my existing DSC stop working?

No — good news. If your DSC is already downloaded onto a FIPS 140-2 token before the deadline, it keeps working normally until the certificate expires. You do not have to replace anything mid-validity. The change applies to new issuance and renewals after 21 September 2026 — at that point you will need a FIPS 140-3 token to download or renew a certificate.

Who needs to pay attention

• Companies, LLPs and directors filing on MCA
• CAs, Company Secretaries, tax consultants and accountants
• Government contractors and e-tender / GeM bidders
• Importers/exporters filing on DGFT
• Businesses running bulk Document Signer / e-invoicing
• DSC resellers, distributors and partners — you will be supplying the new tokens

What it means for DSC partners & resellers

If you sell DSCs, plan your token stock now. From the deadline, every new certificate you issue will need a FIPS 140-3 token. Order compliant tokens early, update your pricing (FIPS 140-3 tokens are expected to cost a little more due to the upgraded hardware), and tell your customers in advance so renewals stay smooth. Many Certifying Authorities are also expected to publish exchange or buy-back policies for old stock.

What to do now — quick checklist

• Getting a fresh DSC near the deadline? Ask for a FIPS 140-3 token to be safe.
• Renewing after 21 Sept 2026? You will need a FIPS 140-3 token — budget for it.
• Have a valid DSC on an old token? No action needed until it expires.
• A reseller or partner? Stock FIPS 140-3 tokens and update your price list.

Details above follow the CCA advisory on the FIPS 140-3 transition; exact dates, pricing and exchange policies may be updated by the CCA and individual Certifying Authorities.

Frequently asked questions