Director KYC (DIR-3 KYC): The Complete Annual Guide

Every individual who holds a Director Identification Number — a DIN — must verify their particulars with the Ministry of Corporate Affairs every year. The obligation attaches to the DIN, not to any directorship: if a DIN was allotted to you on or before March 31, you file the KYC for that year by September 30, even if you sit on no board today, even if the DIN has never been used, and even if the company you once directed has closed.

This catches people who do not think of themselves as 'directors': a designated partner in an LLP (DPINs are covered), a founder who incorporated something in 2019 that never took off, a professional who took a DIN for a client engagement. If MCA ever allotted you the number and it is in approved status, the annual clock runs.

The requirement exists because of a data problem the ministry set out to fix in 2018: lakhs of DINs with dead phone numbers, stale addresses and untraceable holders, discovered during the crackdown on shell companies. Annual KYC keeps a live, verified contact channel between the regulator and every person empowered to sign for a company — which is why the personal mobile and personal email, verified by OTP, are the heart of the filing rather than an afterthought.

First-time filers — DIN holders who have never completed KYC — file the full e-form DIR-3 KYC. It carries your personal particulars (PAN, name as per PAN, address, personal mobile and personal email), is verified by OTPs delivered to that mobile and email, must be signed with your own digital signature certificate, and is certified by a practising CA, CS or CMA. Foreign nationals include passport details, with documents apostilled or notarised as applicable.

Repeat filers whose particulars are unchanged use DIR-3 KYC-WEB — a lighter, no-fee verification on the MCA portal that re-confirms the same mobile and email by OTP. It takes minutes when done on time.

If any particular has changed — mobile, email, address, name — the web route will not do. A changed mobile or email requires filing the full e-form again; other particulars (address, name) are corrected through DIR-6 before or alongside the KYC. The commonest failure here is a director whose old number is dead: they cannot receive the OTP, cannot use the web route, and discover this on September 29.

Keep five things ready: your PAN (the name must match the income-tax database), Aadhaar, your current personal mobile and personal email (official company emails are a bad idea — they die when you leave), and your DSC with validity beyond the filing date. First-time filers also need the certifying professional lined up.

The OTP mechanics deserve respect: the portal sends OTPs to the mobile and email entered, they expire quickly, and repeated failures lock the attempt. File in one sitting with both devices at hand. NRIs and foreign directors should note that the mobile must be able to receive the OTP — an Indian number that no longer exists in your pocket does not qualify.

There is no filing fee when you file within the window. The entire cost of punctual compliance is fifteen minutes of attention once a year.

One practical nuance on certification: the full e-form must be certified by a practising professional, which means first-time filers and changed-particulars filers should engage that professional before the deadline week — September certifications are a seasonal crunch, and a form bounced for a certification defect on September 30 lands in the ₹5,000 zone through no fault of the particulars themselves.

On October 1, every DIN without completed KYC is marked 'Deactivated due to non-filing of DIR-3 KYC'. Reactivation is mechanical but not free: file the pending KYC with a ₹5,000 fee and the DIN switches back on. There is no adjudication discretion to waive it.

The real damage is what a deactivated DIN blocks. The director cannot sign any MCA e-form — so the company's AOC-4, MGT-7, ADT-1 and event filings stall if the signing director is deactivated, and those forms then accrue their own ₹100-per-day fees while everyone waits. In a two-director company where both miss KYC, the company is effectively paralysed at the registrar until someone pays and files. Banks and diligence teams also read DIN status directly off the MCA master data — 'deactivated' next to a promoter's name is a needless red flag in a funding or loan file.

A deactivated DIN also does not excuse the obligation: the KYC remains due, the fee compounds nothing but the delay does, and repeated neglect sits badly alongside the separate disqualification regime under Section 164(2) for companies that stop filing altogether.

Treat DIR-3 KYC like a birthday that costs ₹5,000 to forget. Put a recurring September 1 reminder against every DIN in the family — founders routinely forget the spouse-director or the parent-director on the original board. Verify in the first week of September; the portal slows markedly near the deadline.

Keep the KYC identity durable: a personal email you will hold for decades, a mobile number you actually carry, and a DSC renewed before it lapses (DSCs run two-to-three-year validities — expiry in late September is a classic trap). When numbers or emails change, file the full form promptly rather than waiting for the season.

For companies, add DIN status to the standard annual-compliance checklist reviewed before AGM season: every director's KYC done, every DSC valid, every DIN active. It is a two-minute check on the MCA master-data page that protects the entire October filing calendar downstream — and it costs nothing except the discipline of actually looking.