ECCTA: further developments in the identity verification regime

Insight

06.11.2025

Since our last briefing in April 2025 (Identity verification for directors and PSCs is now live), there have been various developments in the Economic Crime and Corporate Transparency Act 2023 (ECCTA) implementation timetable. ECCTA introduces significant reforms to UK company law aimed at tackling economic crime and improving corporate transparency. The changes affect all UK companies, particularly directors and persons with significant control (PSCs) and some of the more fundamental reforms are coming into force later this year.

In this briefing, we cover the headline developments over the last quarter and provide some guidance on what companies, directors and PSCs should be doing now to get their housekeeping in order in advance of the mandatory changes coming in November 2025.

1. Identity Verification (IDV)

The IDV regime requires all directors, PSCs and LLP members and those in equivalent roles to complete a one-off IDV process (with re-verification only required in a very limited range of circumstances (for example suspected fraud)). This is a mandatory regime and will be introduced on 18 November 2025 for all new individual directors and individual PSCs, with staggered implementation for existing individuals in that capacity/role.

Whilst the regime will eventually extend to all in those roles, the commencement of the mandatory regime on 18 November will only apply to individual directors, PSCs and LLP members. Corporate directors, relevant legal entities (corporates that are PSCs) and corporate LLP members will be required to complete IDV at a later date. Non-compliance could lead to financial penalties and may be a criminal offence, not just for the individual themselves but also the company or LLP and every other officer in default.

Here’s a summary of what is changing:

New individual directors and individual LLP members (appointed/admitted on or after 18 November 2025) must verify their ID before their appointment admission is notified to Companies House. They cannot act until they have completed IDV.
New individual PSCs (become a PSC on or after 18 November 2025) must verify their ID within 14 days of their appointment being notified to Companies House.
Existing individual directors and individual LLP members must verify their ID before the next confirmation statement is filed after 18 November 2025. Their personal IDV codes must be provided with the confirmation statement.
Existing individual PSCs who are also directors of the same company broadly follow the same timing as above. They must provide their personal IDV code via a separate service within 14 days of the confirmation statement date as it is not included in a PSC capacity with the confirmation statement.
Existing individual PSCs who are not directors of the same company must verify their ID by the 14th of the month of their birth month (for example if you were born in March then the deadline to complete IDV is 14 March 2026).

If an individual has a role at more than one entity, IDV must be completed by the earliest applicable deadline. If an individual takes on a new directorship, is appointed a member of a different LLP or becomes a PSC of another entity on or after 18 November 2025 then they may need to complete IDV earlier as they should align with the 'new' appointment deadlines.

As explained in our previous briefings, IDV can be completed via one of two routes (i) directly at Companies House or (ii) using a third party agent known as an Authorised Corporate Service Provider (ACSP). You can read more in the government guidance on completing IDV and using and managing personal codes.

By the end of 2026, Companies House anticipates starting compliance activity against those who have failed to complete IDV.

2. Overseas and unregistered companies

Companies incorporated outside of the UK are required to register at Companies House if they open a UK establishment. Regulations published recently will also bring directors of those registered overseas companies in scope of the IDV regime. We understand that existing directors must complete IDV before the first anniversary of the opening of the UK establishment after 18 November 2025.

Similarly, companies not formed under the Companies Act 2006, such as by Royal Charter or by private Acts of Parliament, will also be in scope of the IDV regime and it will apply to directors and PSCs in the same way as companies and LLPs.

3. Company record keeping

From 13 October 2025, access to Companies House WebFiling accounts will be via GOV.UK One Login (One Login) and you will not be able to access WebFiling without connecting your existing account to a One Login account. Companies House has clarified that you will still be able to file a charge (mortgage) document without connecting your WebFiling account to your One Login account. You can find out more about this change and how to process your WebFiling activities through the One Login service in the recent Government announcement.

From 18 November 2025, companies will no longer be required to hold registers of (i) directors and their residential addresses, (ii) secretaries and (iii) PSCs. Instead, this information must be registered and kept up to date at Companies House. This should ensure information on the central register of companies is correct and reliable.

Also from 18 November 2025, companies that have previously elected to maintain their register of members at Companies House instead of internally/locally (private companies have been able to do this since 30 June 2016), will no longer be able to do so. Instead, they will have to maintain a register of members at their registered office address or single alternative inspection location.

From 1 April 2027:

All companies will need to submit their accounts using commercial software (including dormant accounts). The current web and paper route submission to Companies House will close for accounts filings (but we understand it will remain open for other statutory filings).
Small companies will have to file annual accounts (including profit and loss and balance sheet), a directors’ report and, unless exempt, an auditors' report.
Micro companies will have to file annual accounts (including profit and loss and balance sheet) and, unless exempt, an auditors' report but the directors’ report will be optional.
Companies will no longer be able to prepare and file 'abridged' accounts.

You can read more about these changes and other record keeping reforms on the Government's webpages.

4. Companies House Powers

The Companies House Business Plan for 2025/2026 discusses how Companies House will look to use its enhanced powers gained under ECCTA, including (i) querying information and asking questions before accepting a filing, (ii) changing a company's registered office address if it is not 'appropriate'; (iii) sharing more information across law enforcement agencies and regulatory bodies; and (iv) striking a company off the register if it was formed on a false basis.

5. Suppressing personal information on the public register

The range of circumstances in which an individual can apply to hide personal information from the public register has been widened. Individuals can now apply to suppress information including:

signatures;
business occupations;
the day of date of birth; and
residential addresses (although you cannot apply to remove this from the public domain if it is also a registered office address of an active company or where the address forms part of a company name)

6. The 'Failure to Prevent Fraud' offence

On 1 September 2025, the failure to prevent fraud offence came into force. This offence applies to large organisations meeting two of the three criteria.

More than 250 employees
More than £36m turnover
More than £18m in assets

The offence is triggered if a person who is associated with an organisation, and acting as such, commits a fraud intending to benefit the organisation or anyone for whom the associate provides services. Organisations that are found to be engaging in such practices could be prosecuted and potentially liable for unlimited fines. The main defence for large organisations is that it had reasonable fraud prevention procedures in place to prevent the fraud from happening in the first place. You can read more about the offence and what your organisation must do in our briefing here.

What Should You Do Now?

Voluntary IDV is now open so companies should be:
- identifying when their next confirmation statement is due so they are aware of their IDV deadlines. This is particularly relevant for larger organisations where directors may hold office across a number of group companies, as the deadline to complete IDV will be when the first of those companies is due to file its confirmation statement after 18 November 2025; and
- taking proactive steps to encourage their directors and PSCs to complete IDV in advance of the mandatory regime coming into force on 18 November 2025. Individuals wanting or needing to appoint an ACSP to complete IDV should start working with their chosen ACSP to ensure the process is completed in a timely fashion.
Companies should also be auditing their statutory registers to ensure they are up to date and should reconcile any inconsistencies in advance of those registers migrating to Companies House.
Anyone submitting filings on behalf of a company using the WebFiling services (with the exception of charge (mortgage) documents) should create a One Login account before 13 October 2025.
Organisations in scope of the failure to prevent fraud offence should carry out a fraud risk assessment, including reviewing their internal governance and compliance policies to ensure they reflect current risks and business practices. Companies should implement a robust fraud prevention framework.

For more information on any of the above please speak to your usual Farrer & Co contact. We will continue to monitor developments in this area.

This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.