In this latest article in our 'Understanding the Economic Crime and Corporate Transparency Act 2023 (ECCTA)' series, we focus on the new requirements for key persons associated with Companies House entities to verify their identity via a mandatory identity verification (IDV) regime.

Since March 2025, it has been possible to carry out IDV on a voluntary basis, but the new mandatory requirements are due to commence in the Autumn. We outline who needs to undertake the IDV, how it can be done, the timeframe for completing the process and the consequences for failing to comply.

Who needs to verify their identity?

Companies: The requirement to carry out IDV will apply from Autumn 2025 to individuals appointed as a director for the first time, and the company must ensure that the director does not act until the verification has been completed. Companies will need to provide the IDV credentials of existing directors when they file their next confirmation statement due after a date yet to be set in Autumn 2025.

Limited Liability Partnership (LLPs): Although the necessary secondary legislation has yet to be published, it is anticipated that LLP members will be able to verify their identity at the same time as directors. This means IDV will be compulsory for all new members of LLPs or, where a member is a corporate entity, its individual directors (or equivalents) from Autumn 2025. Again, LLPs will need to provide IDV credentials for existing members when they file their next confirmation statement due after a date yet to be set in Autumn 2025.

Limited partnerships: Any corporate general partner of a new limited partnership must appoint a registered officer whose identity has been verified by the end of 2026. The registered officer must be an individual who is one of the general partner's managing officers (a director or equivalent). Existing limited partnerships will have a transitional period of six months in which to provide the registered officer details.

Persons with significant control (PSCs): IDV will be compulsory for new PSCs of both companies and LLPs from Autumn 2025. If the PSC is a relevant legal entity (RLE), the entity will have to nominate a managing officer who is an individual and whose identity has been verified. When a company or LLP notifies Companies House of a confirmed registrable PSC or RLE, it will have the option of confirming that the identity of the PSC or relevant officer of the RLE has already been verified. If this confirmation is not given, Companies House will send a notice to the PSC or RLE, requiring them to confirm their identity (or their relevant officer's identity) has been verified within 14 days (for a PSC) or 28 days (for a relevant officer of an RLE).

Persons who carry out filing at Companies House on behalf of an entity: There is currently no requirement for individuals supplying documents to the Registrar to confirm who they are or the authority under which they act. From Spring 2026, individuals may only deliver documents on behalf of an entity (for example a company secretary on behalf of the company), if they are an officer or employee of the entity and have IDV status or they are an authorised corporate service provider (see below) or an officer/employee of an ACSP . The document they are delivering will have to be accompanied by a statement confirming verified status. The commencement date for this has not been confirmed but is expected to be Spring 2026. Note that Gowling WLG LLP will be registering as an ACSP for this purpose.

Authorised corporate service providers (ACSP): Firms and individuals may apply to Companies House to register as an ACSP , in which capacity they may carry out IDV services, as outlined below. In the case of an individual, in order to apply they must have their identity verified, and in the case of an ACSP , the person making the application on the firm's behalf must have their identity verified. These requirements have been in place since 4 March 2025.

How is identity verification carried out?

Verification by GOV.UK

Identity verification can be done either directly via the GOV.UK One Login service or using an ACSP.

The GOV.UK One Login service is a free service which allows users to prove their identity to be able to use various government services, either using the GOV.UK ID check app on their smart phone, by answering security questions online, or at a Post Office. Even if a person has previously proved their identity to access other services, it will still be necessary to create a new login and carry out IDV specifically for Companies House. The starting point for verification is on the Companies House website.

Gov.UK ID Check app: Users will need to scan a QR code which will take them to the App Store to download the app (requiring login details and password). They will be prompted to scan in their photo ID and their face. The types of photo ID which can be used for this are:

  • Biometric passport from any country
  • UK photo driving licence
  • UK biometric residence permit or residence card
  • UK Frontier Worker permit

Web browser: People who don't have the necessary photo ID may still be able to verify using bank or building society details. They will need to provide their National Insurance number and answer some security questions, such as their mobile phone contract, bank accounts, credit cards, loans or mortgages they may have. They will also need to enter details from a UK passport, UK photo driving licence or current account with a UK bank or building society.

In person at a Post Office: Certain UK Post Offices offer "in branch" verification To apply, details have to be entered from photo ID onto the GOV.UK website, and an interview generated at a specific branch. At the interview, the Post Office will scan the photo ID and take a photo. The types of photo ID which can be used for this are:

  • UK passport
  • Non-UK passport
  • UK photo driving licence
  • EU photo driving licence
  • National identity photocard from an EU country, Norway, Iceland or Liechtenstein

Verification by an ACSP

An ACSP , such as an accountant or solicitor, can also carry out IDV. This can be done from any country, but the ACSP , who must be registered with a UK Anti-Money Laundering supervisory body, must also be registered with Companies House to become authorised. The list of documents which can be used by an ACSP to verify identity is wider. It typically includes the following:

  • Biometric passport from any country
  • UK, Isle of Man, Channel Islands or EU photocard driving licence
  • EU or EEA biometric identity card
  • UK biometric residence permit or residence card.

Where individuals do not have the required document for direct verification, (for example non UK resident individuals who do not have a suitable biometric passport there) is another route which ACSP can use for which two documents must be provided from a much longer list.

What happens after identity verification has been completed?

Once IDV has been successfully undertaken, a unique identifier known as a Companies House personal code will be generated. This will appear on the screen at the end of the process if GOV.UK login was used, or will be sent by email if the verification was done via an ACSP

The code should be kept secure, in the same way an individual's unique taxpayer reference will be needed for various purposes - if you are a director of an existing company it will need to be entered on the next confirmation statement (Autumn 2025 onwards), or it will be needed if registering as a new director or PSCs.

Consequences of failure to comply with identity verification

If a person fails to verify their identity and continues to act as a director or PSC, they are committing an offence which is punishable by a fine (although the director’s appointment and any actions undertaken as a director will still be valid). A company will also commit a criminal offence if it allows a director to act while unverified.

Next steps for identity verification compliance

  • Identify everyone in the organisation who will need to have their identity verified and brief them on the requirements, in particular the need to have suitable and current identity documents available. Companies do not have a duty to ensure a PSC or RLE complies with IDV requirements but may wish to inform them of the requirements as part of their shareholder engagement.
  • Note your confirmation statement date and ensure the IDV process gets underway in plenty of time. This is particularly important for companies which have confirmation statement dates which fall in the Autumn as delays to filing the statement could result in a late filing penalty. Groups with a number of UK companies may want to compile a list of confirmation filing dates.
  • Looking ahead to Spring 2026, you may wish to consider whether there will be any employees who need to have their identities verified in order to be able to make filings on behalf of the organisation.

If you would like to discuss these changes and how they will impact your business, please contact Sharon Ayres, Caroline Williams or your usual Gowling WLG contact.

If you'd like to receive future articles in our 'Understanding