Key Points
- The UK's Economic Crime and Corporate Transparency Act 2023 ("ECCTA") introduces key reforms to improve corporate transparency, prevent the abuse of UK corporate structures and tackle economic crime. The ECCTA amends the Companies Act 2006 and other laws, with its implementation being phased in over time.
- A major reform is the introduction of the identity verification regime ("IDV"), requiring individuals who register or control companies to verify their identity to ensure that a verified person is linked to every entity registrable with Companies House, improving traceability of company ownership and control.
- IDV will apply to: (i) directors (irrespective of their nationality or where they are resident); (ii) limited liability partnership members and nominated directors of corporate general partners of limited partnerships; (iii) registrable persons with significant control ("PSCs"); (iv) authorised corporate service providers; (v) relevant officers of registrable relevant legal entities ("RLEs"); and (vi) persons filing documents at Companies House on behalf of a company (such as a company secretary).
- There are effectively two ways for an individual to verify
their identity:
- Direct: Verify directly with Companies House free of charge using UK One Login, which will then direct the individual to verify their identity online either via the mobile phone app route or web browser route. The other alternative for a person living in the UK is to verify their identity at a designated Post Office, though this will take more time.
- Indirect: Verify through an Authorised Corporate Service Provider ("ACSP"), who will verify on the individual's behalf. ACSPs are individuals or organisations that are registered with a UK anti-money laundering ("AML") supervisory body, such as company formation agents, solicitors, accountants, chartered secretaries, and governance professionals.
- Voluntary verification began on 8 April 2025, but verification is expected to become mandatory for new appointments from Autumn 2025 and for existing appointments from Spring 2026.
- Non-compliance could result in criminal and civil penalties, rejection of new company incorporations, and/or ineligibility to make statutory filings.
- Once an individual's identity is verified, they will be issued with a unique identifier number (known as a Companies House personal code) which can be used to connect their verified identity to Companies House's records. All of their roles on the register (e.g. as a director or PSC) can be linked together using this code, so individuals only need to verify their identity once, even if they have multiple directorships or PSC positions. IDV will also need to be confirmed on certain filings with Companies House (e.g. director appointment filings).
Background
On 26 October 2023, the ECCTA became law, overhauling key aspects of the UK's legal framework on corporate and economic crime. The changes introduced by the ECCTA are being implemented in stages, with certain provisions of the ECCTA already being in force.
The ECCTA aims to combat the use of UK business and finance for criminal activities. As such, and amongst other things, it gives Companies House new enforcement powers, enhances corporate transparency requirements, gives law enforcement new powers to seize cryptoassets and enables businesses in the financial sector to share information more effectively with a view to preventing and detecting economic crime.
Companies House
Building on the Economic Crime (Transparency and Enforcement) Act 2022, which provides for the creation and maintenance of a register of beneficial owners of overseas entities that own property in the UK, the ECCTA introduces new powers for Companies House and gives it enhanced investigative and enforcement powers. Heralded as the most significant reform of Companies House since its creation, the UK government aims to transform Companies House from a passive administrator into an active corporate gatekeeper through a series of reforms, such as:
- implementing identity verification requirements for individuals who register or control companies;
- broadening the role and powers of Companies House to act as a more proactive gatekeeper for company formation and ensure more reliable data;
- enhancing the accuracy of information on the register;
- equipping Companies House with stronger investigation and enforcement powers, and increasing its ability to share data with other organisations; and
- strengthen the protection of personal information on the register to safeguard individuals from fraud.
Identity verification regime
A key component of the ECCTA is the IDV, which requires individuals who register or control companies to verify their identity. This is to ensure that a verified person is linked to every entity registrable with Companies House, improving traceability of company ownership and control.
Who is required to verify their identity?
IDV will apply to:
- directors (irrespective of their nationality or where they are resident);
- limited liability partnership members and nominated directors of corporate general partners or limited partnerships;
- registrable PSCs;
- relevant officers of RLEs;
- ACSPs; and
- persons filing documents at Companies House on behalf of a company.
When does IDV need to be undertaken?
Companies House has produced a timeline of the implementation of the identification verification regime which indicates that:
- Existing directors and PSCs can voluntarily verify their identity with Companies House free of charge starting from 8 April 2025.
- From Autumn 2025 onwards, the incorporation of new UK companies will require compulsory IDV for all initial directors and PSCs. Completion of the incorporation process will be impossible without the verified identity of each initial director.
- From Autumn 2025, newly appointed directors and newly notified PSCs of UK companies will also need to undergo compulsory IDV. Directors will be prohibited from acting until their identity is verified, and confirmation of this verification must be included in their appointment notice to Companies House.
- Once compulsory IDV takes effect, there will be a 12-month transition for existing UK company directors and PSCs to verify their identities. The timing of verification for existing directors will be tied to the submission of a company's next confirmation statement once this transitional period begins. All existing directors and PSCs are expected to have completed IDV by Autumn 2026.
- In future, the submission of filings on behalf of companies will be restricted to individuals within the company whose identities have been verified or by an ACSP (as explained below) acting on their behalf. These restrictions are not anticipated to be implemented prior to Spring 2026.
Companies House has also advised that from Autumn 2025, (i) existing directors will need to provide their Companies House personal code as part of the company's next confirmation statement filing and (ii) PSCs will need to provide their Companies House personal code for their role as a PSC.
How will an individual's identity be verified?
There are effectively two possible routes available for an individual to verify their identity, as explained in Companies House Guidance:
- Direct: Verify directly with Companies House free of charge using GOV.UK One Login, which will then direct the individual to verify their identity online either via the mobile phone app route or web browser route. The individual will need to provide personal details and identity documents like a biometric passport, UK photo driving licence, or UK biometric residence permit. UK residents can also verify their identity at a designated Post Office, though it will take longer.
- Indirect: Verify through an ACSP, who will verify on the individual's behalf. Individuals must verify their identity to the same standard required for direct verification with Companies House. ACSPs are individuals or organisations that undertake anti-money laundering (AML) supervised activity, such as company formation agents, solicitors, accountants, chartered secretaries, and governance professionals.
What happens when individuals verify?
Once an individual's identity is verified, they will be issued with a unique identifier number (known as a Companies House personal code) which can be used to connect their verified identity to Companies House's records. All of their roles on the register (e.g. as a director or PSC) can be linked together using this code, so individuals only need to verify their identity once, even if they have multiple directorships or PSC positions. IDV will also need to be confirmed on certain filings with Companies House (e.g. director appointment filings).
What happens if individuals do not verify?
Individuals will not be able to:
- make any filings with Companies House;
- start a new company or entity; and/or
- register as an ACSP (also known as a Companies House authorised agent).
If a director or PSC does not verify their identity after it becomes a mandatory requirement, they will be committing an offence and may face criminal sanctions or civil penalties.
In the case of a director, if they continue to act as a director without verifying their identity, they will be committing an offence and could be disqualified from acting as a director, while the company and all of its directors may also be committing an offence. The Companies House register will also be annotated to reflect the director's unverified status.
What do I need to do next?
- Determine whether you need your identity verified.
- If you are a company director, consider which other individuals will need IDV for their involvement in the company (including PSCs and relevant officers of RLEs).
- If your identity needs to be verified, set up a GOV.UK One Login.
- From 8 April 2025, have your identity verified through Companies House or an ACSP.
Conclusion
ECCTA is a landmark law aimed at holding corporations accountable for fraud and economic crime, promoting better fraud prevention practices, and providing law enforcement with stronger tools to investigate, freeze, and recover criminal proceeds. These changes impact not only UK companies but also international groups with UK operations. The law is expected to increase the number and success rate of corporate investigations, though its actual impact on enforcement remains to be seen. Ultimately, ECCTA seeks to deter corporate misconduct and encourage early self-reporting and cooperation.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
