> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/documentation/regulatory-framework.md).

# Regulatory Framework

eSign in India operates under a layered legal and technical framework administered by the Controller of Certifying Authorities (CCA).

## Legal basis

* **Information Technology Act, 2000** — Section 3A and the Second Schedule recognise "e-authentication technique using Aadhaar or other e-KYC services" as an electronic signature.
* **Electronic Signature or Electronic Authentication Technique and Procedure Rules, 2015** — prescribe the procedure for eSign.
* **Gazette notifications** issued by MeitY/CCA notifying eSign and subsequent amendments.

## CCA documents that govern eSign

| Document                                                 | Purpose                                                                                                                                                                                                                |
| -------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| e-Authentication Guidelines for eSign (v1.9, 09.09.2026) | Security, key generation, consent, audit and evidence requirements for ESPs and CAs. v1.8 added infrastructure requirements for external eSign services; v1.9 revised Section 10 and Annexure I on Remote Key Storage. |
| eSign API Specification 2.1 (07.02.2023)                 | Online Aadhaar eKYC based eSign. Added face authentication.                                                                                                                                                            |
| eSign API Specification 3.3 (09.12.2020)                 | CA eKYC account based eSign (asynchronous).                                                                                                                                                                            |
| eSign Remote API Specification 1.1                       | Remote Key Storage enrolment and signing.                                                                                                                                                                              |
| On-boarding Guidelines for ASPs                          | Process and obligations for Application Service Providers.                                                                                                                                                             |
| Sample ASP–ESP Agreement                                 | Contractual template between ASP and ESP.                                                                                                                                                                              |
| Subscriber Agreement                                     | Terms accepted by the eSign user.                                                                                                                                                                                      |
| ESP Empanelment Guidelines                               | Criteria for CAs to operate as ESPs.                                                                                                                                                                                   |

## Key obligations at a glance

| Requirement           | Rule                                                                                                               |
| --------------------- | ------------------------------------------------------------------------------------------------------------------ |
| Key generation        | In the ESP's HSM (FIPS 140-3 Level 3), separate from the CA's DSC-issuing HSM.                                     |
| One-time keys         | Unique per user; destroyed immediately after one-time use.                                                         |
| Certificate validity  | One-time eKYC class DSC ≤ 30 minutes.                                                                              |
| Consent               | Explicit electronic consent for eKYC, certificate issuance and signing. The `sc="Y"` flag is mandatory.            |
| What leaves the ASP   | Only the document hash and a document description; never the document.                                             |
| ASP request integrity | Every request XML is signed by the ASP; every response is signed by the ESP.                                       |
| Evidence              | Form C, audit logs and transaction records retained for at least 7 years.                                          |
| Audit                 | Monthly IS audit sampling of 10% of events (max 5,000); annual CA compliance audit.                                |
| Capacity              | ESP infrastructure must handle at least 1,000 external eSign transactions per minute with redundancy and failover. |

{% hint style="warning" %}
ASPs are responsible for obtaining user consent, showing the user what they are signing, protecting their ASP signing key, and storing `txn`/`resCode` for audit. These obligations are part of the ASP–ESP agreement.
{% endhint %}