Digital Signatures for Electronic Invoices: A Comprehensive Guide
This guide explores the role of Digital Signature Certificates (DSC) within India's Goods and Services Tax (GST) e-invoicing framework. It outlines the phased implementation of e-invoicing based on turnover, explains what DSCs are, and details their application for authenticating electronic invoices. The article also provides a step-by-step process for attaching a digital signature to an e-invoice, ensuring compliance with regulatory requirements.
The electronic invoicing (e-invoicing) system in India has seen a phased implementation. Initially introduced on October 1, 2020, for businesses with an aggregate turnover exceeding INR 500 crore, its applicability has since expanded. It later covered entities with turnovers over INR 100 crore, then over INR 50 crore. As of April 1, 2022, it became mandatory for taxpayers whose aggregate turnover surpassed INR 20 crore in any financial year from 2017-18 onwards. Currently, from October 1, 2022, it applies to taxpayers with an annual turnover exceeding INR 10 crore. Furthermore, effective August 1, 2023, the system also includes taxpayers with an annual turnover between INR 5 crore and INR 10 crore. Recent updates regarding e-invoicing compliance include:
- May 10, 2023: The Central Board of Indirect Taxes and Customs (CBIC) announced the sixth phase of e-invoicing, extending its mandate to taxpayers with an annual turnover greater than INR 5 crore from any financial year starting 2017-18, effective August 1, 2023.
- May 6, 2023: The GST Network postponed the 7-day time limit for reporting older e-invoices on Invoice Registration Portals (IRPs) by three months, with a new implementation date yet to be declared.
- April 13, 2023: An advisory was issued by GSTN on April 12 and 13, 2023, mandating taxpayers with an annual turnover of INR 100 crore or more to report tax invoices and credit/debit notes to the IRP within seven days of their issuance, effective May 1, 2023.
This article examines the requirements for digital signatures on e-invoices and how to fulfill these obligations.
Understanding Digital Signature Certificates (DSCs)
A Digital Signature Certificate (DSC) serves as an electronic method for authenticating documents, acting as a legally valid substitute for a physical, handwritten signature. For a DSC to be recognized as valid, its creation must adhere to the stipulations outlined in the Information Technology Act, 2000.
Role of DSCs Before the E-Invoicing System
Prior to the e-invoicing framework, the Central Goods and Services Tax (CGST) Rules mandated that all invoices, including credit and debit notes, be physically signed by an authorized representative of the issuing entity. However, these rules also permitted the use of a digital signature by such an individual, provided it complied with the Information Technology Act, 2000.
DSC Application within the E-Invoicing System
Under the current e-invoicing system, suppliers are required to upload the JSON format of their invoices to the Invoice Registration Portal (IRP). While reporting invoices, this JSON must conform to specific mandatory and optional parameters. A digital signature is categorized as an optional parameter. The IRP is responsible for generating the Invoice Reference Number (IRN) – a unique hash – and subsequently digitally signing the valid JSON using its private key. Any alteration to the signed JSON would invalidate the e-invoice and render the digital signature ineffective. Once the IRP has digitally signed an e-invoice, it becomes a legally valid document for the seller's business operations. The IRP further transmits this digitally signed e-invoice to the GST Network (GSTN) and the e-way bill system.
DSC Requirements and Applicability
As previously stated, uploading the invoice JSON to the IRP makes the digital signature an optional element. After validating the invoice, the IRP digitally signs the JSON and generates a QR code. When the supplier issues a printed invoice copy to the recipient, it must prominently display the QR Code, the supplier's digital signature, and the IRN generated by the IRP. Both the QR code and the supplier's digital signature are distinct requirements and must be presented separately, not interchangeably.
Steps to Attach a Digital Signature to an E-Invoice
To successfully attach a digital signature to an e-invoice, ensure that the necessary software for reading DSCs is installed and that the 'emSigner' tool, available from the GST portal, is running. Here are the steps:
- Generate Invoice JSON and Log In: Create the invoice in the prescribed JSON format using various tools such as offline utilities or mobile applications. Afterward, log in to the IRP and attach the generated JSON file.
- Initiate DSC Verification: Locate and click the 'Verify using DSC' button. A dialog box will then appear, listing the available digital signatures.
- Select and Sign: Choose the correct Digital Signature from the list and click 'Sign'. It is crucial to ensure that the selected DSC belongs to the Authorized Signatory registered on the GST portal. You may be prompted to enter the password associated with the DSC.
- Confirm Success: A confirmation message will indicate the successful attachment of the Digital Signature Certificate. Click 'OK' or 'Proceed' to finalize the process.