What charities need to know about the Economic Crime and Corporate Transparency Act 2023

Insight

06.11.2025

Since the Economic Crime and Corporate Transparency Act 2023 (the Act) was passed, the Government has brought it into force in stages. Another raft of provisions, which are arguably the most impactful, will come into force on 18 November.

This article aims to explain how certain aspects of the Act will impact charities:

the offence of failing to prevent fraud;
identity verification for trustees and others; and
certain administrative matters.

Which charities will be affected?

The Act applies to corporate bodies, so if your charity is a trust or unincorporated association, it won't apply to you directly (though see the penultimate paragraph of the section on identity verification). It will affect charitable companies and subsidiary trading companies, but also – in some cases – other corporate charities such as charitable incorporated organisations (CIOs), Royal Charter bodies, and statutory charities. If your charity is one of these, you need to understand how the Act might apply to you.

A quick note on terminology: the directors of a charitable company are its charity trustees. Since this article is aimed primarily at charities, it uses the term 'trustees' rather than 'directors'.

Failure to prevent fraud

The failure to prevent fraud offence is designed to hold large corporate organisations to account by placing the onus on them to proactively prevent fraud. We have summarised the key takeaways below but you can read more about it in our briefing here.

The offence came into force on 1 September 2025. It applies to corporate charities that meet two of the following three criteria:

more than 250 employees;
more than £36m turnover;
more than £18m in assets. [1]

For these purposes, 'turnover' means income from providing goods and services, so it excludes donations. Because the offence applies to corporate bodies, it will be relevant to any CIOs, Royal Charter charities or statutory charities that meet the threshold criteria.

The offence captures fraudulent conduct carried out by 'associated persons', a term which includes employees, agents and subsidiaries acting for or on behalf of the charity. The fraud must be committed with the intention of (directly or indirectly) benefitting (i) the charity; or (ii) any individual or organisation to which the charity provides services. The Act contains a list of offences that constitute fraud in this context. As you'd expect, the central theme of the offences is that they involve dishonesty.

A conviction could result in an unlimited fine, regardless of whether the individual responsible is prosecuted. For charities, it will likely also cause reputational damage. In addition, it may lead to increased scrutiny from the Charity Commission or other regulators, and from funders.

The main defence for a charity is that it had reasonable fraud prevention procedures in place to keep fraud from happening. The only other potential defence is that, in all the circumstances, it was not reasonable to expect the charity to have fraud prevention procedures in place.

Last November, the Government issued guidance on the failure to prevent fraud offence which we have summarised in this article. Because the guidance consists of principles (rather than a list of rules), the steps a charity should take depend on many factors. These include: (i) taking appropriate legal advice; (ii) the risk profile of the charity and the type of work it does; (iii) the charity's geographical reach; and (iv) guidance from the Charity Commission and any other relevant body. Last November, the Charity Commission published 'Protect your charity from fraud', which links to other useful guidance.

Identity verification (IDV)

The IDV regime requires all trustees and People with Significant Control (PSCs) to complete a one-off IDV process (with re-verification only required in a limited range of circumstances, such as when evidence submitted as part of the IDV process is believed to be false, misleading or deceptive). The mandatory regime will be introduced on 18 November 2025. At that stage, it will only apply to individual trustees and PSCs. Corporate trustees and relevant legal entities (RLEs – corporate bodies that would be PSCs if they were individuals) will be required to complete IDV at a later date. Similarly, at some point in the spring/summer 2026, it will become necessary for those who file documents at Companies House on behalf of your charity to complete IDV (unless the person is filing it in their capacity as a third party agent registered as an Authorised Corporate Service Provider (ACSP)). Non-compliance could lead to financial penalties and may be a criminal offence, not just for the individual but also for the charity and every other officer in default.

IDV can be completed via one of two routes: (i) directly at Companies House or (ii) via an ACSP. Once your identity has been verified, Companies House will provide you with a unique personal IDV code which should be used across all your relevant roles. You can read more in the government guidance on completing IDV and using and managing personal codes.

Here’s a summary of what is changing:

Individual trustees appointed on or after 18 November 2025 must complete IDV before their appointment is notified to Companies House. They cannot act until they have done so;
Individuals who become a PSC on or after 18 November 2025 must complete IDV within 14 days of their appointment being notified to Companies House.
Existing individual trustees must complete IDV before the charity files its first confirmation statement after 18 November 2025. Their personal IDV codes must be provided with the confirmation statement.
Existing individual PSCs who are also trustees of the same charity broadly follow the same timing above. In their capacity as trustees, they will need to provide their personal IDV code with the charity's first confirmation statement filed after 18 November. In their PSC role, they must separately provide their personal IDV code within 14 days of the confirmation statement date.
Existing individual PSCs who are not trustees of the same charity must complete IDV by the 14th of the month in which they were born. For example if you were born in March then the deadline to complete IDV is 14 March 2026.
If an individual has a role at more than one entity (charitable or otherwise), IDV must be completed by the earliest applicable deadline.

By the end of 2026, Companies House anticipates starting compliance activity against those who have failed to complete IDV.

The trustees of unincorporated charities and CIOs will only be within scope of the IDV regime if they (or their charities) are PSCs or RLEs in relation to another company. This may be the case where a charity has one or more subsidiary trading companies.

Unfortunately, there isn't a 'one size fits all' answer to the question of whether Royal Charter charities and statutory charities fall within the IDV regime. We recommend that trustees take legal advice to find out how the rules apply to their charity.

Administration

Company registers

From 18 November 2025, companies will no longer be required to maintain registers of (i) directors and their residential addresses, (ii) secretaries and (iii) PSCs. Instead, this information must be registered and kept up to date at Companies House. This should ensure information on the central register of companies is correct and reliable.

Also from 18 November 2025, all companies, including those that have previously elected to maintain their register of members at Companies House, will have to keep a register of members at their registered office address or at a single alternative inspection location.

Filing annual accounts

From 1 April 2027, companies will need to submit their accounts to Companies House using commercial software (including dormant accounts). The current web and paper route submission will close for accounts filings (but we understand it will remain open for other statutory filings).

You can read more about the changes and other record keeping reforms on the Government's webpages.

What should you do to prepare?

Voluntary IDV is already open so companies should:

Identify when their next confirmation statement is due, so they are aware of their IDV deadlines. This is particularly relevant for larger charitable companies whose trustees may also be directors of subsidiary companies – the deadline to complete IDV will be when the first of those entities is due to file its confirmation statement after 18 November 2025.
Take proactive steps to encourage their trustees and PSCs to complete IDV before 18 November 2025. Individuals who want or need to appoint an ACSP to complete IDV should start working with their chosen ACSP as soon as possible.

Companies should also audit their statutory registers to ensure they are up to date. They should reconcile any inconsistencies before those registers migrate to Companies House.
Charities in scope of the failure to prevent fraud offence should carry out a fraud risk assessment, including reviewing their internal governance and compliance policies to ensure they reflect current risks and business practices. Charities should implement a robust fraud prevention framework.

For more information on any of the above please speak to your usual Farrer & Co contact. We will continue to monitor developments in this area.

[1] The position is slightly different if your charity has subsidiary companies. In those cases, the criteria apply to the aggregate figures for the charity and its subsidiary put together, after – in the case of assets and turnover – any intra-group transactions have been deducted.

This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.