Policy paper

Economic Crime and Corporate Transparency Act: identity verification and authorised corporate service providers

Updated 1 March 2024

1. What is the government doing and why?

Individuals who register and control companies or file with the Registrar will have to prove they are who they say they are by verifying their identity. This will make it much harder to register fictitious directors or beneficial owners, stopping the vast majority of fraudulent appointments from reaching the Companies House register.

In most instances, identity verification will be a simple, quick process without significantly adding to the existing requirements on business. Businesses of all sizes will benefit from greater assurance from the Companies House register when they are consulting it to research potential suppliers and partners.

This will apply to existing directors (and their equivalents), People with Significant Control. Companies already on the register will have a transition period within which to verify these identities. Identity verification requirements will also apply to all new registered company directors and People with Significant Control. IDV requirements will also apply the majority of those delivering documents to the Registrar (the exception being individuals delivering documents who are either themselves corporate service providers who have been specifically authorised by the registrar, or officers or employees of firms which are authorised corporate service providers).

2. How will identity verification work?

There will be two routes to identity verification: direct verification via Companies House, and an indirect route through an Authorised Corporate Service Provider.

If a person is verifying their identity directly with Companies House, identity verification will link a person with a primary identity document, such as a passport or driving licence. The person undergoing verification will be asked to take a photograph of their face, and present their identity document so the two can be compared electronically using likeness matching technology, and verified. If successful, the person will be notified in a matter of minutes. Alternative methods will be available for individuals, including a digitally assisted route. Support will also be available throughout the process.

Identity verification by Authorised Corporate Service Providers (ACSP)

People may use an intermediary / agent to file with the Registrar, form a new registerable entity, or verify identities of individuals affiliated with the registrable entities. These “corporate service providers” are often accountants, legal advisers, and company formation agents. Once the Act comes into force, only those corporate service providers which have been authorised by the registrar will be allowed to deliver documents to the registrar on behalf of clients. In order for a corporate service provider to be authorised by the registrar, they must be supervised under the UK Money Laundering Regulations. Although ACSPs will therefore have an existing obligation to carry out customer due diligence checks on their clients under the Money Laundering Regulations, completion of these checks will not necessarily mean that an individual has had their identity verified to the standard required for the purpose of this Act. The ACSP must demonstrate that they have verified their clients to the required standard which will be set out in secondary legislation and guidance.

The identity verification checks undertaken by ACSPs will achieve the same level of assurance of the claimed identity as those undertaken through the direct verification route.

ACSPs will be required to submit a statement to the Registrar to confirm that their identity verification checks meet the required standard. ACSPs will be required to retain records pertaining to identity verification checks. These requirements will be created by regulations made by the Secretary of State who can request further information if necessary.

More information on how the government envisages the process of identity verification working is set out in the Corporate Transparency and Register Reform White Paper.

3. Who will this apply to and when will they need to verify?

Identity verification requirements will apply to all new and existing registered company directors, People with Significant Control (PSCs) and those filing with the Registrar.

There will be a transition period for existing directors, their equivalents in other registrable entities and PSCs to verify their identity in. This transition period will provide existing directors and PSCs time to comply with the new requirements.

For new directors, identity verification must take place before an application for the formation of a company is delivered to the Registrar. If a director is being appointed to an existing company, the director must verify their identity before their appointment is notified to the Registrar.

New PSCs will have a 14-day period, after the formation of a company or after a company has notified the Registrar that they have become a PSC, within which to confirm to the Registrar that their identity is verified. For Relevant Legal Entities this period will be 28 days, and they will need to provide a name of a verified relevant officer. If PSCs are not verified after this point they will commit a criminal offence.

Anyone wishing to file documents with the Registrar will need to verify their identity before they file the document, unless they are an employee or officer of an authorised corporate service provider or subject to an identity verification exception made in secondary legislation.

In general, we expect identity verification to be a one-off requirement. Once a person is verified, they obtain a verified status. However, there may be instances where re-verification is required, for example if the Registrar has reason to doubt the validity of the identity verification, such as on suspicion of fraud. The events that will trigger the requirement to reverify will be set out in secondary legislation.

4. What will happen if individuals don’t comply?

The consequences of non-compliance with the identity verification requirements will depend on circumstances. However, an individual who was under a requirement to verify their identity with the Registrar, and failed to comply with it, could be subject to:

• criminal proceedings - which could result in a level 5 fine
• civil penalties issued by the Registrar of Companies
• incorporations/registration of a new company being rejected
• being unable to file statutory filings
• the public register being annotated to show the individual’s status as ‘unverified’

For directors, failing to verify could also result in being prohibited from acting as a director.

There will also be a new offence which applies to the director or equivalent of an ACSP, of failure to notify the Registrar of changes to their supervisory body/bodies within a period of 14 days following the change.

All existing directors and PSCs will have to comply with the new requirements within a transition period. Those that do not comply by the end of the period may face criminal sanctions or civil penalties. The companies register will also be annotated to reflect their unverified status. The civil penalty regime and the annotation of the register to show an individual’s status as ‘unverified’ will be introduced by secondary legislation under existing and new delegated powers.

5. When will this come into effect?

These reforms will come into effect after new secondary legislation and guidance are made, and system development is complete.

6. What restrictions will be imposed on the use of corporate directors?

Provisions within the Small Business, Enterprise and Enforcement Act 2015 which have not yet been commenced restrict the use of corporate directors. These provisions will be brought into force in parallel with measures within this Act along with regulations which will set out the more limited basis upon which companies will be permitted to retain or appoint corporate directors in the future.

BEIS consulted in December 2020 on “principle based” exception proposals which will form the basis of the regulations.

It will be made explicit that only corporate entities with “legal personality” will be properly appointable as corporate directors. All directors (or director equivalents) of the latter will have to be natural persons and those natural person directors must have been subject to an appropriate identity verification process. Only UK registered entities will be capable of being appointed a corporate director.

Companies with existing corporate directors will be given 12 months to comply; within that time they must either ensure their corporate director is compliant with the principles or resign them.

New companies or companies appointing a corporate director must ensure they satisfy the conditions from the date this measure comes into force