The Economic Crime and Corporate Transparency Act 2023: Identity verification in UK companies

The Economic Crime and Corporate Transparency Act 2023 ("ECCTA") was brought in to enhance corporate transparency and to combat economic crime in the UK. ECCTA sets out new statutory objectives that the registrar of companies will seek to promote. As part of achieving those objectives, ECCTA has introduced a mandatory identity verification system for individuals involved in UK companies.

What is identity verification and who needs it?

Identity verification ensures the authenticity of individuals linked to UK companies, helping to prevent fraud and strengthen confidence in corporate structures. The following individuals must verify their identity with Companies House:

• all existing directors and persons with significant control (“PSCs”);
• all new registered company directors and PSCs; and
• those filing documents with the Registrar.

It is important to note that if a company or other legal entity is registered as a PSC (such entity being a Relevant Legal Entity (“RLE”)), the identity of a relevant officer of the RLE will need to be verified. 

Authorised Corporate Service Providers (“ACSPs”) i.e. third-party agents such as a firm of solicitors or accountants, can submit filings on behalf of clients provided they have registered themselves as such with Companies House. Directors and PSCs are also able to voluntarily verify their identity at Companies House.

How do you verify your identity with Companies House?

There are two primary routes for identity verification:

1. Direct Verification via Companies House: individuals will need to create a GOV.UK One Login account and register an account with Companies House. There are 3 methods to verify your identity directly using the GOV.UK One Login:

• GOV.UK ID Check app: individuals will submit identity documents (e.g. passport or driving licence) via the app. The individual undertaking the verification will take a photo of their face so that it can be matched electronically using facial recognition technology. If successful, verification is completed within minutes.
• Answering security questions online: individuals will need to provide a copy of a UK photo ID and answer security questions about things like their mobile phone contract, bank accounts, credit cards, loans or mortgages in order to verify their identity.
• Post Office: individuals will be asked to enter details from their photo ID used on the GOV.UK One Login and go to a Post Office that offers ‘in branch verification’ where the individual’s photo will be scanned, and a picture taken. The result will be sent to the individual via email.

2. Verification through ACSPs: as mentioned above, ACSPs are authorised by Companies House to verify an individual’s identity. ACSPs will be entities that are already regulated for anti-money laundering purposes and have an obligation to carry out their own due diligence checks on their clients. Using an ACSP will achieve the same level of compliance as direct verification. The role of an ACSP will involve conducting identity verification checks, delivering documents to Companies House, maintaining records on identity verification checks for inspection purposes and providing further information on these checks to Companies House at the Registrar’s request.

Once an individual’s identity has been successfully verified, they will be given a unique identification code (known as a Companies House personal code) that is personal to that individual. This code will be required for a number of reasons including filing confirmation statements, being appointed a director or becoming registrable as a PSC for one or more companies.

What are the consequences of not verifying your identity?

Failure to comply with identity verification requirements can lead to serious legal and financial consequences, the level of which will depend on the circumstances. An individual who has failed to comply, could be subject to:

• criminal proceedings - which could result in a level 5 fine (the maximum level);
• civil penalties issued by the Registrar of Companies;
• incorporations/registration of a new company being rejected;
• being unable to file statutory filings;
• the public register being annotated to show the individual’s status as ‘unverified’; and
• for directors, it could result in them being prohibited from acting as a director in the future.

Existing directors and PSCs are granted a transitional period to comply with the new requirements, however, failure to meet these obligations by the deadline set could result in criminal sanctions or civil penalties. The company's register will also be annotated to reflect an individual's unverified status, which could impact an individual’s reputation or standing.

Implementation timeline

The identity verification requirements will be rolled out in the following phases:

• From 8th April 2025: individual directors and PSCs can voluntarily verify their identities with Companies House.
• By Autumn 2025 (specific date to be confirmed): all new directors and PSCs will need to verify their identity when they are appointed, including on incorporation. A 12-month transition period will begin for existing directors and PSCs to verify their identity as part of the annual Confirmation Statement filing.
• By Spring 2026 (specific date to be confirmed): filing at Companies House will be restricted to verified individuals or ACSPs.
• By the end of 2026: it is expected that the transition period will have completed. Companies House will start compliance activity against those who failed to verify their identity.

Next steps

To ensure compliance, companies should:

• Educate directors and PSCs about the new requirements by reading the guidance at Companies House.
• Ask directors and PSCs to set up a GOV.UK One Login account and verify their identities early to avoid last-minute disruptions.
• Identify any group entities that are RLEs and determine which individual will be appointed as the relevant officer for each.
• Work with regulated ACSPs to streamline compliance.
• Consider any alterations required to your onboarding process for new directors.
• Review internal policies and corporate governance procedures to ensure compliance with identity verification requirements and to keep track of unique personal identification codes for directors and PSCs once obtained.

If you or your business has any corporate matters you would like advice on, including the matters raised in this article, please contact our corporate team by email on [email protected].