ECCTA: Companies House ID Verification Rules 2026

The Economic Crime and Corporate Transparency Act (ECCTA) requires every UK company director and person with significant control (PSC) to verify their identity with Companies House. Verification became mandatory for new appointments on 18 November 2025, and all existing directors and PSCs must verify by 18 November 2026\.

That second deadline is the one that matters right now. The 12-month transition period for the UK's roughly 7 million existing directors and PSCs ends this November, and Companies House has said it intends to take enforcement action against non-compliance from the end of 2026. This guide covers who must verify, every confirmed deadline, the penalties, how Authorised Corporate Service Providers (ACSPs) work, and what the regime means if you onboard or monitor UK companies at scale.

What is ECCTA?

The Economic Crime and Corporate Transparency Act 2023 is UK legislation, given royal assent in October 2023, that overhauls Companies House from a passive registry into an active gatekeeper. It gives the registrar powers to query, reject, and remove information, and it introduces the identity verification regime that is the subject of this page.

ECCTA is broader than identity checks. It also created the "failure to prevent fraud" corporate offence for large organisations, in force since 1 September 2025, tightened rules on registered office addresses, and is progressively restricting who can file documents at Companies House. But identity verification is the piece with the hardest deadlines and the widest reach: it touches every UK company, every director, and every individual PSC.

The policy logic is simple. For over 180 years, anyone could register a UK company under any name with no proof of identity, which made UK shell companies a staple of international money-laundering schemes. Verification ties every director and controller on the register to a real, checked human being.

Who must verify their identity under ECCTA

Identity verification applies to four groups, on different timelines:

1. New directors: must verify before their appointment can be registered. Mandatory since 18 November 2025\.
2. New PSCs (people with significant control, broadly individuals holding more than 25% of shares or voting rights, or exercising significant influence). Mandatory since 18 November 2025\.
3. Existing directors and PSCs: those in post before 18 November 2025 verify during a 12-month transition. Directors verify by the date their company's next annual confirmation statement falls due; all existing directors and PSCs must be verified by 18 November 2026.
4. People filing documents at Companies House ("presenters") and third-party agents: mandatory verification for this group was pushed back from spring 2026 to late 2026, so anyone delivering filings will soon need verified status or ACSP registration too.

The same rules apply to members of LLPs, and to the "relevant officers" of corporate entities that sit in director or PSC positions. Residence and nationality are irrelevant: an overseas director of a UK company must verify just like a UK-resident one.

Once verified, an individual receives a Companies House personal code, a unique identifier they use to link their verified identity to each directorship or PSC position. Verification is a one-time exercise, not per-company.

ECCTA 2026 deadlines table

All dates below are confirmed against primary sources as of August 2026\.

If you run compliance for a portfolio of entities, the practical takeaway is that the confirmation statement date, not 18 November, is each company's real deadline during the transition.

How verification works: GOV.UK One Login vs ACSP

There are two routes to verified status:

Route 1: Directly with Companies House via GOV.UK One Login. The individual proves their identity using government-issued documents such as a passport or driving licence, typically combined with a biometric selfie check through the GOV.UK app, or in person at a Post Office if digital routes fail. It is free.

Route 2: Through an Authorised Corporate Service Provider (ACSP). Accountants, solicitors, and company formation agents that are supervised for anti-money laundering in the UK can register as ACSPs and verify clients' identities on Companies House's behalf. This is the route most professional firms use for clients who are overseas, time-poor, or managing many appointments at once.

Either route produces the same outcome: verified status and a personal code. Checks carried out by ACSPs must meet the same level of assurance as verification done directly with Companies House.

How ACSPs work

An ACSP is not a light-touch role. To register, a firm must be supervised by a UK AML supervisor (such as the FCA, HMRC, or a professional body), and the registration is made by a senior person in the business. Once authorised, the ACSP can:

• Verify the identity of directors, PSCs, and members to the Companies House standard
• File documents at Companies House on behalf of clients
• Form companies for clients

In exchange, ACSPs take on real obligations. They must confirm to Companies House that each verification met the required standard, keep records of the checks they performed, and remain AML-supervised; Companies House can suspend or deauthorise providers that fall short. Companies House has published guidance on using third-party providers to verify, and firms should expect the registrar to scrutinise ACSP-performed checks, since agents are historically where abuse of the register concentrated.

For accountancy and legal firms, this creates a new operational question: how do you run document-plus-biometric identity checks on hundreds of clients to a government evidential standard without building a honeypot of passport scans? Identity verification tooling matters here. Zyphe is a privacy-first, decentralized identity verification and compliance platform that runs document and biometric checks without storing personal data in a central vendor database. Identity data is sharded across decentralized storage with encryption keys held by the user, while audit trails are preserved for compliance teams. For ACSP-style workflows, that means you can evidence that a check was done to standard via KYC software and decentralized PII storage without warehousing the underlying documents yourself.

Penalties for non-compliance

Failing to verify on time is a criminal offence under ECCTA, and liability can attach to the individual, the company, and its officers. The confirmed consequences include:

During the transition year, Companies House has said it will not prosecute existing directors for late verification while the 12-month window runs. That forbearance ends with the transition: enforcement action is expected from the end of 2026. Any UK entity in your customer base with unverified officers after 18 November 2026 is carrying a live regulatory defect.

What ECCTA means for KYB and onboarding teams

If you verify UK businesses as customers, as a bank, fintech, marketplace, or payments firm, ECCTA changes your evidence base in three useful ways and adds one new risk signal.

1\. The register becomes more trustworthy, not trustworthy enough. Verified directors and PSCs make Companies House data materially better. But verification confirms a person exists and matches their documents; it does not confirm ownership percentages are accurate or that the PSC list is complete. Your KYB software still needs to corroborate registry data against documents and independent sources rather than accept it at face value.

2\. Unverified status is a red flag you can act on. From late 2026, a company whose directors remain unverified is either inattentive or avoiding scrutiny. Register annotations for unverified officers should feed your risk scoring the same way a missed confirmation statement does. Continuous UBO screening that re-checks officer and ownership data catches these changes between periodic reviews, rather than at the next refresh.

3\. UBO discovery still has to go beyond the PSC register. The PSC regime's 25% threshold means real controllers can sit below the disclosure line or behind layered entities. Mapping ultimate beneficial owners through multi-layer structures remains your job, not the registrar's. ECCTA narrows the gap between the register and reality but does not close it.

4\. Expect identity evidence requests to rise. As presenters and agents come into scope in late 2026, more UK counterparties will ask your platform to evidence who was verified, when, and to what standard. Zyphe's KYB workflows produce audit trails designed for exactly this, and because verification data is not pooled in a central vendor database, an evidence request does not require exposing a store of customer documents. Zyphe reports that its architecture reduces data-breach risk by around 90% compared with centralized vendors. For a broader look at evaluating tooling against requirements like ECCTA, see our KYB software guide for 2026 and our walkthrough of KYB onboarding flows.

ECCTA's deadlines are fixed; how much manual work they generate for your team is not. Book a Zyphe demo to see how privacy-first KYB verification and UBO screening keep your UK counterparty checks current without building a database of other people's passports.