CHAPTER ONE – WHY IDENTITY VERIFICATION IS BEING INTRODUCED (AND CONSEQUENCES FOR FAILURE TO COMPLY)

How the UK’s framework for company registration and filing has been abused

The Companies House framework has historically been abused and used to conduct a variety of economic crimes; and it was in dire need of overhaul and control.

A company could be created and registered at Companies House in a few minutes, from anywhere, by anyone who had the ability to complete the relevant form and pay the small registration fee! Once a company has been registered at Companies House, an artificial person with its own legal personality has been born (and this artificial person can then conduct business, enter contracts, borrow money etc.).

Often fraudulent activity using companies and the register at Companies House has featured one or more of the following behaviours:

creation of a company deliberately to perpetrate fraud;
using an individual’s personal details or addresses without consent; and/or
filing false information about a company to create a veneer of legitimacy.

Companies House has historically suffered problems with companies being formed for fraudulent purposes together with phoenix trading (which prevents creditors being able to claim on assets and customers unable to reclaim deposits and refunds).

Synthetic identities are also now becoming a more prevalent issue (and Chapter 7 explains this growing problem in more detail).

These historic problems stemmed from the requirement upon Companies House to accept all information filed in good faith (with no checks at all in place to confirm that the individual such as a director has consented to act, or if they were even a real person at all).

The system was also taken advantage of by using agents to form companies and to file on other peoples’ behalf without conducting any form of robust due diligence or any anti-money laundering checks. It was supremely easy (and incredibly cheap and quick) to form a company, with the person filing based anywhere in the world, with no legitimate basis for the company creation.

A recent fraudulent example of misuse was where companies were established to fraudulently claim for government support during the Covid 19 pandemic. In 2021, HMRC seized twenty-six and a half million pounds in previously claimed furlough cash from a series of four fake companies which each claimed to have dozens of employees and had similar company names.

Ensuring all directors, people with significant control (“PSCs”) and anyone presenting information to the register has an account with correct personal information, including a verified identity (and links showing all of their roles in one place) will make the legislation easier to enforce and officers traceable (as there will always be a verified natural person associated with an incorporation or filing).

Ensuring all roles are linked will have the dual benefit of enabling third parties (including consumers) to see what a director is doing and to recognise more easily when they may be dealing with fraudulent companies.

For example, if the register shows a director was linked to multiple companies with similar names that had all been wound up in quick succession, this can indicate fraudulent behaviour and allows the public to exercise caution in dealing with such companies. The corollary of this is that it can also positively help legitimate companies by showing third parties more detailed and reliable information and improving data on the public register which will go further to reassure third parties that they are genuine (as discussed in more detail below).

All the above has been reflected and supported by the enormous number of blogs, articles and announcements issued by Companies House. Andy King, Chief Executive and Registrar of Companies for England and Wales stated on 22 January 2026 that the “introduction of identity verification will make it harder to use the register to create anonymous corporate structures that enable fraud, corruption or other criminal activity. Businesses use our data to carry out due diligence, access finance and add value to their products and services. So, making that data more accurate, up-to-date and reliable will support the government’s broader mission for economic growth.”[1]

Aims for identity verification

More than seven million individuals will be required to verify their identity. As noted above, historically, anyone, based anywhere in the world, could incorporate a company and file documents at Companies House, using fictitious names or false identities.

Identity verification will address these historic crimes noted above by making it more difficult to register fictitious officers and enabling Companies House to know exactly who is filing documentation.

The Corporate Transparency and Register Reform White Paper Policy overview and response to final consultations was published in February 2022. It identified approximately half of all incorporations and filings are presented by third parties (such as solicitors, accountants and company formation agents (and that the majority are legitimate individuals and firms whose practice depends on their ability to incorporate companies and file documentation swiftly).[2]

However, it has also been recognised that offshore trust and company service providers are at high risk for being used for money laundering or terrorist financing schemes and the corresponding identity verification rules aim to ensure firms filing at Companies House comply with the new legislation (reducing these risks) whilst supporting legitimate activity.

Four objectives of ECCTA

The four objectives of the ECCTA aim to address the abusive behaviours discussed above:

Objective 1 – To ensure that any person who is required to deliver a document to the registrar does so (and that the requirements for proper delivery are complied with).

Objective 2 – To ensure that information contained in the register is accurate and that the register contains everything it ought to contain.

Objective 3 – To ensure that records kept by the registrar do not create a false or misleading impression to members of the public.

Objective 4 – To prevent companies and others from carrying out unlawful activities, or facilitating the carrying out by others of unlawful activities [3]

Identity verification forms a key part in achieving these objectives. It underpins the goal of ensuring the integrity and reliability of the information available at Companies House. It is one of the elements introduced by the ECCTA, which will improve corporate transparency and tackle economic crime. This is also backed by “A blueprint for modern digital government: A long-term vision for digital public” published in January 2025 by Department of Science, Innovation and Technology which has six priorities to transform the government for a digital era (which includes expanding GOV.UK One Login).[4]

Improving the data on the public register

Companies House in October 2025 identified that the data on the public register is a valuable resource, aiding businesses making informed decisions and supporting transparency and that it plays a key role in the UK economy. Companies House data is estimated to be worth between one billion pounds and three billion pounds a year to users.[5]

Once individuals have verified their identity, this information is publicly available and can demonstrate legitimacy and credibility to third parties (including potentially enhancing the ability for companies to avail themselves of financing and improving relationships with suppliers and creditors), together with assisting in identifying fraudulent behaviours as noted above.

For each company that an officer is appointed to, beneath the officers’ details (which lists their name, role, date of birth, nationality, date of appointment and country of residence), there is now a new entry headed “Identity verification status”. Once the officer has supplied their identity number and verification statement for that company, a green tick and entry in bold is added stating “Verification requirements complete”.

By 3 October 2025, more than two million, seven hundred thousand people had signed a petition against biometric identity cards. Whether or not these digital identity cards proceed in the future, company officers should be reassured that identity verification does not create a digital identity – the purpose of identity verification is designed to prove that people on the register at Companies House (and those filing on behalf of others) are who they say they are.

Consequences for failure to comply

Companies House have indicated that the range of actions they will take for failure to comply follows four categories.

The first is that they will inform people of their obligations (so that individuals cannot plead they were not aware of the requirements), they will then nudge and guide people to enable compliance, deal with non-compliance and address fraud and criminal activity.

For communications, Companies House are using different methods to ensure all individuals impacted are aware of the requirements to verify their identity.

Firstly, they are utilising websites together with various social media channels. They have a bespoke website that focuses on all the changes to UK company law (which is updated promptly to reflect any changes that occur). See Chapter 10: Useful Links at document C for this website. They also utilise a separate regular newsletter that provides useful and timely updates.

Practical tip:

If you are a practitioner and do not already subscribe to the Companies House newsletter, this text recommends subscribing.

Link to subscribe can be found in Chapter 10: Useful Links at document A.

You may also wish to consider following the Companies House official page on Linked In which can be a helpful source of discussion (and is also useful to see when the services may not be operating as expected).

In addition, if you utilise social media, Companies House also has an official Facebook page that also shares regular short updates and reminders.

The above are general methods to staying informed. Companies House will also contact companies directly. Prior to a confirmation statement filing deadline, the relevant company will be emailed (using the registered email address for that company) to instruct them on the fact each of the directors must be verified by the filing deadline. Any advisor should check which email address is being used by each company and that the registered emails are being received (and read!). See below for a fictional email to a company with a confirmation statement becoming shortly due.

This has been reiterated frequently in official emails from Companies House. It is vital to ensure companies have chosen the most appropriate registered email address for the company and all registered email addresses have received an official email address with this information. The official emails clearly indicate that the information is relevant to all companies registered in the UK and ask any third-party agents who receive the email on behalf of a company to forward it to all company directors of all companies they work with.

If there is any formal enforcement correspondence, a hard copy letter will be sent to the company’s service address (which, to comply with the ECCTA, must be an “appropriate address” meaning that any letter sent to such address will come to the attention of a person acting on behalf of the company). In relation to PSC infractions, non-compliance letters will be posted to the residential address of the PSC concerned.

If individuals are struggling to achieve compliance, there is a lot of support available. The emails sent out to companies usually contain links to guidance on how to comply (See Chapter 3 for a fictional example of such an email), the guidance available online is free (and there are short, helpful videos) and Companies House also help via their contact centre.

When telephoning the Companies House contact centre directly, one of the options included within the initial menu is to select “one” if you are calling in relation to identity verification (to ensure the person calling is directed promptly to the team responsible).

If there is failure to comply with identity verification, the process will begin with a default letter to the individual concerned. This is a key point that is repeated throughout this text – it is the relevant officer’s responsibility to comply and verify their own identity. The default letter will explain the offence and will also highlight that enforcement action may be taken without any further notice.

The enforcement action may include financial penalties, prosecution and referral to the Insolvency Service. Companies House will select what they deem the most appropriate, considering the nature of the non-compliance, circumstances set out in representations (see Chapter 3 below), and the seriousness of the transgression (including any previous patterns of non-compliance).

This enforcement action is directed at the individual who has failed to verify their identity (and potentially the company and its officers if they are directed by an unverified director under section 167(M) Companies Act 2006 – see Chapter 2 below). These consequences are separate to any consequences for failure to comply with the authorised corporate service provider (“ACSP”) role, which is detailed in Chapter 6 below.

Fictional extract of an email for a company with a confirmation statement due within 4 weeks

This is an official email to the registered email address of XYZ LIMITED (1098765) from Companies House. If you’re a third-party agent who has received this email on behalf of a company, please forward to the company director(s).

Your confirmation statement for XYZ LIMITED is due by X/XX/2026.

As a company director, you’re legally responsible for filing this on time – even if your company is dormant or not trading, or if you use an agent or accountant to file on your behalf.

Verify your directors before you file

UK company law now requires all company directors to verify their identity.

If you’ve already verified your identity, you do not need to do it again – but you must provide your personal code for each role you hold.

Before you file your next confirmation statement you must make sure every company director has verified their identity and got their Companies House personal code and include the personal code for each director in your company’s confirmation statement.

Your confirmation statement will be rejected if you do not complete these 2 steps.

If someone else files your confirmation statement, all directors must share their personal codes with them so they can include the details in your company’s filing.

To verify your identity and get your personal code, go to: gov.uk/guidance/verify-your-identity-for-companies-house

You can verify online using GOV.UK One Login or through an Authorised Corporate Service Provider (ACSP), such as an accountant or solicitor.

If you’ve already verified and need guidance on where to find your code, go to: gov.uk/guidance/companies-house-personal-codes-for-identity-verification#where-to-find-your-personal-code

(Further instructions are also included within these emails, together with clear details surrounding the PSCs identity verification requirements and consequences for missing the deadline, which are reiterated as a financial penalty, the fact Companies House may remove the company from the register (which could impact the company business account and credit rating) and the public register will show the confirmation statement as overdue.