DIR-3 KYC is due by 30 September every year ā here is the difference between web and e-form, documents, step-by-step process and penalty implications.
Director's DIR-3 KYC Web/E-Form Guide
Every person holding a Director Identification Number (DIN) that was marked Active as of 31 March 2026 must complete DIR-3 KYC by 30 September 2026 ā the annual window for FY 2026-27. The Ministry of Corporate Affairs (MCA) offers two distinct paths: a quick web-based confirmation for repeat filers with no data changes, and a full DSC-signed e-form for first-timers or anyone whose KYC particulars have changed. Miss the deadline and your DIN is deactivated overnight, locking you out of every MCA e-form signature until you pay a ā¹5,000 penalty and refile. This guide walks you through which path to take, what documents to keep ready, how to file step by step, what happens if you miss the cut-off, and the exact mistakes that cause rejections.
Why DIR-3 KYC Exists and Who Must File
The DIR-3 KYC requirement was introduced under Rule 12A of the Companies (Appointment and Qualification of Directors) Rules, 2014, to allow the MCA to maintain an accurate, verified database of directors. Before this rule, a DIN, once allotted, was never re-verified ā creating scope for shell companies, inactive DINs, and identity mismatches that audit trails could not catch.
Who must file: Any individual who holds a DIN with the status "Approved" or "Active" as on 31 March of the preceding financial year. For the current filing cycle (FY 2026-27), the reference date is 31 March 2026. This includes:
- Working executive directors and independent directors of companies registered under the Companies Act 2013
- Designated partners of Limited Liability Partnerships (LLPs) who hold a DIN (as opposed to an LLP Identification Number)
- Directors who have resigned from all companies but whose DIN has not been surrendered
- Foreign nationals holding a DIN for Indian company directorships
Who does NOT need to file: Directors whose DIN status is already "Deactivated", "Surrendered", or "Cancelled" ā though if the deactivation was caused by a prior missed filing, you still need to file with the penalty to reactivate.
DIR-3 KYC Web vs DIR-3 KYC E-Form: Choosing the Right Path
Getting this choice wrong is the single most avoidable error in the entire process. The MCA V3 portal presents both options, but eligibility is strictly defined.
DIR-3 KYC Web (One-OTP Confirmation)
Use this path only if all of the following are true:
- You filed DIR-3 KYC (either web or e-form) in the immediately preceding financial year (FY 2025-26)
- Your name, father's name, date of birth, PAN, Aadhaar number, permanent address, mobile number, and email address are all identical to what the MCA system already holds
- Your DSC details have not changed
The web flow is a 5-minute confirmation, not a re-submission of documents. The system pulls your existing verified data, you authenticate via OTP on your registered mobile and email, and the filing is recorded. There is no professional certification required, no document upload, and no DSC affixation.
DIR-3 KYC E-Form (Full Submission)
Use the e-form if any one of the following applies:
- You are filing DIR-3 KYC for the first time after DIN allotment
- You changed your mobile number, email, or address since the last filing
- There is a name correction or PAN-Aadhaar mismatch that needs to be updated
- Your certifying professional needs to update professional certification details
- The system throws an error on the web path because the underlying data does not match
The e-form requires a Class 3 DSC from the director, a certification DSC from a practising CA, CS, or CMA, and supporting KYC documents.
Documents You Need for the DIR-3 KYC E-Form
Prepare these before you open the MCA V3 portal ā mid-session document searches cause OTP timeouts and session drops.
Identity proof (mandatory):
- PAN card ā compulsory for Indian nationals; the PAN number must match the DIN application exactly
- Passport ā compulsory for foreign nationals; recommended for Indian nationals travelling or with a foreign address component
Address proof:
- Aadhaar card (preferred ā links biometric identity)
- Voter ID, driving licence, or utility bill (electricity, gas, water, telephone) not older than two months from the date of filing
- Bank statement not older than two months, on bank letterhead or downloaded from net banking with official formatting
Contact details:
- A personal mobile number actively linked to your Aadhaar ā this is the number that receives Aadhaar OTP, not a company landline or assistant's number
- A personal email address you can access in real time during the session
DSC requirements:
- Class 3 DSC of the director, registered against the DIN on MCA V3
- Class 3 DSC of the certifying professional (CA/CS/CMA in practice), registered on the MCA portal
Document format: All attachments in PDF, under 2 MB per file. Scan in greyscale at 150ā200 DPI; colour scans of Aadhaar cards often exceed the size limit.
Step-by-Step: Filing DIR-3 KYC Web (Repeat Filers, No Changes)
- Open the MCA V3 portal at mca.gov.in and log in with your DIN-linked registered user ID and password.
- Navigate to MCA Services ā DIN Services ā DIR-3 KYC Web.
- The system displays your current KYC data on screen. Review each field carefully ā name spelling, address pin code, mobile, email.
- If every field is correct, click "I confirm".
- Enter the OTP received on your registered mobile number, then enter the OTP received on your registered email address.
- The system generates a Service Request Number (SRN) and marks your DIN KYC as complete for FY 2026-27.
- Download and save the SRN acknowledgement ā this is your proof of filing.
Total time: under 10 minutes. The entire bottleneck is OTP delivery, which can take 2-3 minutes on congested portal days closer to 30 September.
Step-by-Step: Filing DIR-3 KYC E-Form (First-Timers and Change Cases)
Allow 30-45 minutes for your first e-form filing. If DSC or document issues arise, allow more.
- Log in to MCA V3 at mca.gov.in using your registered user ID and password.
- Go to MCA Services ā DIN Services ā DIR-3 KYC and select "E-Form DIR-3 KYC".
- Enter your DIN in the designated field. The system auto-populates name, father's name, and date of birth from the DIN master. Cross-check these against your PAN card immediately ā any discrepancy must be resolved before proceeding (see Common Mistakes section).
- Fill in your nationality, permanent address, and present address (both required even if identical). Include pin code, state, country.
- Enter your personal mobile number and click "Send OTP". Enter the OTP within the session timer. Repeat for email address.
- Enter your PAN number and Aadhaar number. The portal validates Aadhaar in real time against the UIDAI database.
- Upload documents: PAN (mandatory), address proof (mandatory), passport if applicable. Each file must be under 2 MB.
- Affix your DSC: Select your registered DSC from the token, confirm the pin, and sign the form.
- Certifying professional DSC: Share the SRN or the partially completed form with your CA/CS/CMA. They open the form under their own registered login, review and certify, then affix their DSC.
- Click Submit. The portal issues a final SRN with timestamp.
- Download the SRN acknowledgement. Check the DIN status on MCA V3 within 24-48 hours ā it should update to "KYC Done" for FY 2026-27.
One critical timing note: Steps 8 and 9 (both DSC affixations) must happen in the same form session or after saving the draft. If the director's DSC token is not physically present during the session, save a draft and resume ā do not submit an unsigned form.
Penalty for Missing the DIR-3 KYC Deadline: The Real Numbers
The MCA's penalty mechanism is binary and immediate. There is no grace period, no condonation fee, and no advance notice email from the MCA.
What happens at midnight on 30 September:
- Any DIN for which DIR-3 KYC was not marked complete by the portal switches status to "Deactivated due to non-filing of DIR-3 KYC".
- This status update runs automatically across the entire DIN database.
Reactivation cost: A flat ā¹5,000 penalty paid at the time of filing DIR-3 KYC after the deadline. There is no sliding scale ā whether you miss by one day or six months, the fee is ā¹5,000.
Operational consequences of deactivation:
- You cannot digitally sign any MCA e-form ā AOC-4 (financial statements), MGT-7 (annual return), MGT-14 (board resolutions), DIR-12 (director changes), CHG-1 (charge creation), INC-22A (active company form) ā all stall if you are a required signatory.
- If you are the sole director of a One Person Company (OPC) or the only authorised signatory for a private limited company, the company's entire annual filing can be blocked.
- Other companies where you hold a directorship are also affected ā your deactivated DIN cannot be used to authorise filings for any of them.
Worked Example: The Cost of a 45-Day Delay
Scenario: You are a director in two private limited companies. Both have their annual filing due in October. You miss the 30 September KYC deadline by 45 days ā you only refile on 14 November.
| Item | Amount |
|---|---|
| DIR-3 KYC late penalty | ā¹5,000 |
| AOC-4 additional late fee (Company A, 45 days @ ā¹100/day) | ā¹4,500 |
| MGT-7A additional late fee (Company A, 45 days @ ā¹100/day) | ā¹4,500 |
| AOC-4 additional late fee (Company B, 45 days @ ā¹100/day) | ā¹4,500 |
| MGT-7A additional late fee (Company B, 45 days @ ā¹100/day) | ā¹4,500 |
| Total avoidable outflow | ā¹23,000 |
This is a conservative estimate ā it excludes professional fees for late filings and does not account for the additional complication if either company had a charge registration or a resolution filing that also got delayed.
The DIR-3 KYC penalty itself is ā¹5,000. But the cascading late fees across every stalled MCA filing can multiply that figure four to six times within weeks.
Pitfalls to Avoid: Common Mistakes That Cause Rejections and Delays
These are the patterns that come up repeatedly in practice. Address them before opening the portal.
1. Aadhaar Not Linked to an Active Mobile Number
The DIR-3 KYC portal requires real-time Aadhaar OTP verification. If your Aadhaar is not linked to any mobile number, or if the linked number is an old SIM you have surrendered, the filing will stall at the verification step. Fix this at an Aadhaar enrolment centre or a designated post office ā UIDAI does not allow online mobile number updates without biometric authentication. Allow 7-10 working days for the link to activate after the enrolment.
Practical implication for FY 2026-27: If your mobile number changed after the last filing, address the Aadhaar link update by early September at the latest. Do not attempt this the week of the deadline.
2. Name Mismatch Between PAN and DIN Records
The name on the DIN master is pulled from the original DIN application. If it differs from the name on your PAN card ā even by a spelling variant, an initial instead of a full name, or the order of given name and surname ā the portal validation will flag it. Resolution requires a name correction application to the MCA (using the DSC-signed process on the DIN Services menu), which takes time. Do not wait until September to discover a mismatch that has existed since DIN allotment.
3. DSC Expired or Not Registered on MCA V3
Class 3 DSC tokens are typically issued with a 1-year or 2-year validity. Many directors and professionals treat DSC renewal as an afterthought and discover expiry mid-filing. Additionally, even a valid DSC must be pre-registered against your DIN on the MCA V3 portal before it can be used in DIR-3 KYC. A DSC issued in a slightly different name variant (e.g., "Rajesh Kumar" vs "Rajesh K") against the DIN will also be rejected.
Fix: Audit your DSC expiry date in the first week of August. Register any renewed DSC on MCA V3 immediately after renewal ā do not wait until the actual filing date.
4. Certifying Professional Not Available or Their DSC Expired
The e-form requires the certifying CA, CS, or CMA to affix their DSC in the same portal session or on the saved draft. If the director files on 28 September and the professional is travelling on 29 September, or their DSC has lapsed, the submission fails. Build in at least 5 working days of buffer for the professional certification step.
5. Uploading Documents Beyond the 2 MB Size Limit
High-resolution scans of Aadhaar and PAN, especially in colour, routinely exceed 5-10 MB. The portal rejects these silently in some cases ā the upload appears to complete, but the attachment is not recorded. Always compress PDFs and verify file size before uploading. Adobe Acrobat's online compressor, iLovePDF, or any greyscale PDF tool works.
6. Using a Company Email Instead of a Personal Email
The mobile and email on the DIR-3 KYC must belong personally to the director, not to the company. Company domains change ā people resign, domains lapse, IT admins revoke access. If your company email is what you registered last year and you have since changed jobs, the OTP delivery will fail. Use a permanent personal email (Gmail, Outlook) and update it in the e-form.
DSC Management: The Compliance Layer Most Directors Underestimate
The Digital Signature Certificate is the single most operationally fragile piece of the DIR-3 KYC process. Here is a structured approach to managing it year-round:
Check DSC validity in the first week of August every year. Open your DSC token's management software (e.g., ePass Token Manager, Safenet Authentication Client) and confirm the certificate expiry date. Calendar a reminder 90 days before expiry.
Renew DSCs through a licensed Certifying Authority (CA) ā eMudhra, Sify, NSDL, or others on the CCA India list. Ensure the renewed DSC is in exactly the same name as your DIN-linked PAN.
Register the renewed DSC on MCA V3 immediately after receiving it. Navigate to MCA V3 ā My Profile ā Register/Update DSC. Do not assume the old registered DSC carries over.
Keep DSC tokens in a physically secure place. A forgotten or misplaced USB token in September, when vendors are busy and replacements take 3-5 working days, is a guaranteed late penalty.
For professionals certifying the e-form: Confirm with your CA/CS/CMA that their professional DSC (Class 3) is active and registered on MCA V3 before scheduling the certification session. Their DSC registration is separate from the director's.
The September Rush: How to File Efficiently When Everyone Is Filing
The MCA V3 portal experiences significant congestion in the last two weeks of September. Page load failures, session timeouts, and OTP delivery delays are common. Practical strategies:
- File before 15 September if all your data is stable. There is no benefit to waiting ā the form for FY 2026-27 is available from 1 April 2026.
- File on weekday mornings between 9 AM and 11 AM IST ā portal load is lower before peak business hours.
- If the web path throws an error saying your data could not be verified, do not attempt the web path more than twice. Switch to the e-form path immediately.
- If you get an OTP timeout, use the "Resend OTP" option once. If it fails again, clear browser cache, use a different browser (Chrome or Edge on a Windows machine are most stable with DSC plugins), and restart the session.
- Screenshot every step ā the SRN acknowledgement page, the OTP confirmation page, and the final submission screen. MCA support requests require these screenshots.
Key Takeaways
- Deadline: 30 September every year. For FY 2026-27, that is 30 September 2026. File by 15 September to avoid portal congestion.
- Web path vs e-form: Web path if no data changes and you filed last year. E-form for first-timers or any data update ā it requires DSC and professional certification.
- Penalty: ā¹5,000 flat for late filing, plus cascading late fees on every MCA form you are unable to sign while your DIN is deactivated ā easily ā¹15,000āā¹25,000+ in a two-company scenario.
- Aadhaar-mobile link must be active and accessible in real time. Verify this by early September; allow 7-10 days if an update is needed.
- DSC health check every August ā verify validity, renew early, register the renewed token on MCA V3 before filing day.
- Name mismatches between PAN and DIN records must be resolved well in advance of the deadline; MCA corrections take time.
- A 5-minute annual task (web path) or a 30-minute once-in-several-years task (e-form) protects the integrity of every other compliance filing you authorise as a director.
