Get ready for the identity verification regime under ECCTA

Under the Economic Crime and Corporate Transparency Act 2023 (ECCTA), Companies House is introducing a new identity verification regime that affects almost every UK corporate entity. While the goal is to make corporate structures more transparent, the administrative impact on businesses could be significant.

If you’re a director, partner, persons with significant control (PSCs), or someone who files with Companies House, these changes apply to you.

According to Companies House, around 7 million people are expected to be impacted by this significant change.

Who must verify their identity?

The following individuals will be required to verify their identity under the new regime:

• Directors of UK Companies
• Members of UK Limited Liability Partnerships (LLPs)
• General Partners of UK Limited Partnerships (LPs)
• Persons with Significant Control (PSCs)
• Individuals filing information with Companies House.

It is important to note that the regime will apply to both existing and new appointees.

Timeline and implementation

From autumn 2025, identity verification will become mandatory for all new incorporations, appointments of directors, members, partners and PSCs. And from then, existing directors, members, partners and PSCs will have just 12 months to verify as well, likely triggered through an event, such as the annual confirmation statement.

For law firms in particular, where there can be large numbers of members across various LLP or LP structures, it is worth flagging that all members will be required to verify their identity. This has the potential to create a significant administrative burden and is a process that will require careful forward planning, particularly in the context of renewals, retirements, and new joiners.

Failure to comply

Failure to comply could result in:

• Companies House not accepting filings, including incorporation or changes to the register.
• Financial penalties for companies and individuals.
• Directors (and equivalents) being disqualified from holding office.
• Imprisonment (if someone a person knowingly submits misleading, false, or deceptive documents or statements to Companies House).

How to verify identity?

1. Direct verification via Companies House

Individuals can use the Companies House digital portal, which includes:

• Uploading a valid photo ID (passport, UK driving licence)
• Taking a real-time photo (selfie)
• Automatic biometric matching of the photo with the ID.

The Companies House route offers three options. Each option permits slightly different documents to be provided as evidence of identity:

• Option 1 – GOV.UK One Login Check app: permitted documents include biometric passport, UK photocard driving licence and UK biometric residence card or permit.
• Option 2 – GOV.UK One Login web service: permitted documents include UK passport, UK photocard driving licence and UK bank account with national insurance number.
• Option 3 – Face to face service (at a selected post office): permitted documents include biometric passport, non-biometric passport from selected countries and UK or EU photocard driving licence. However, this service is only available to those with a UK home address. 

2. Verification via an ACSP

Individuals may also verify their identity through a registered ACSP. The ACSP must be supervised under UK anti-money laundering (AML) regulations and authorised by the Registrar.

This may be a more convenient route for overseas/non UK resident individuals and clients dealing with multiple filings or complex corporate structures.

Powers and capabilities of ACSPs

Upon registration, an ACSP can:

• Verify identities of individuals required to do so under ECCTA (e.g. directors, PSCs, members).
• Submit documents and filings (such as incorporations, changes to officers or PSCs) directly to Companies House on behalf of clients.
• Declare compliance with ECCTA’s identity verification standards in their submissions.

This enables Companies House to trust that filings made through an ACSP come from a verified and regulated source.

Ongoing responsibilities of registered ACSPs

Once registered, ACSPs are subject to several important obligations. These include:

• Verification standards: ACSPs must carry out identity verification in line with ECCTA-specific standards, which may include biometric checks, document authenticity validation, and use of traceable digital tools. Standard AML/KYC checks alone are not sufficient. Firms will also need to consider implementing internal procedures to manage their obligations as an ACSP, including staff training, internal compliance reviews, and secure client data handling.
  
• Record-keeping: All verification checks must be securely recorded and stored for inspection or audit, typically for at least five years.

• Notifications: ACSPs must notify Companies House within 14 days of any change to their AML supervisory body or other material changes in their operations or compliance framework.

• Use of digital credentials: All filings and verifications must be made through the ACSP’s dedicated Companies House digital account using its unique identity number, ensuring traceability and accountability.

We urge organisations and individuals to consider their obligations and begin the process to verify identities. If you have any questions about the information in this article, please contact us or your usual Fox Williams adviser.