Britain's ACSP Gatekeepers, One Year On: The Patchwork Supervising Companies House's Outsourced Filing Layer

The gatekeeper Companies House did not want to be

When the Economic Crime and Corporate Transparency Act 2023 became law, one of its quieter design choices was who, exactly, would do the checking. The Companies House registrar gained new querying powers under section 1092A of the Companies Act 2006, a discretion to reject or annotate filings, and a duty to verify the identity of every director and person with significant control. What it did not gain was counter capacity. The register holds roughly 5.4 million companies and around 7 million natural persons within them. Verifying each one against documents was never going to happen at a single government office.

The answer was an outsourced layer. From 18 March 2025, Companies House began authorising third-party agents — accountants, solicitors, formation agents and trust or company service providers — to file on behalf of clients and, more importantly, to carry out identity verification (IDV) on the registrar's behalf. The label was authorised corporate service provider, or ACSP. Mandatory IDV for new director and PSC appointments went live on 18 November 2025, with a twelve-month transition period during which existing appointees must verify either directly via GOV.UK One Login or through an ACSP. We are six months in.

At its simplest, an ACSP is a regulated business that has demonstrated supervision under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 — the MLRs — and paid a £55 fee to Companies House. In return, it can:

• File the full suite of statutory forms — incorporations (IN01), confirmation statements (CS01), annual accounts, charges (MR01), share allotments (SH01) and director appointments (AP01) — on behalf of clients;
• Carry out IDV checks to the level prescribed by the Registrar's identity verification guidance, and submit the verification statement that records an individual as exempt from further direct checks for the lifetime of that identity record.

Both functions matter, but the IDV authority is the genuinely novel one. Formation agents have filed in volume for decades. Nobody before now had statutory authority to vouch for a director's identity to a government register.

The three-track supervisor problem

To become an ACSP, a firm must already be supervised for AML purposes. The supervisor decides whether the firm meets the MLRs' standards on customer due diligence, beneficial ownership checks, risk assessments, suspicious activity reporting and record retention. There are three doors into that room.

OPBAS — the Office for Professional Body AML Supervision, housed within the FCA — oversees the twenty-two PBSes but does not regulate their member firms directly. The split is real: a sole-trader accountant in Hull who has joined the AAT is supervised by a professional body; her competitor next door who has not joined any body is supervised by HMRC for a different fee, on a different inspection cadence and with a different complaints route.

It is this patchwork that the ACSP regime sits on top of. Companies House does not re-examine AML compliance when issuing ACSP status; it accepts the supervisor's confirmation. The integrity of the filing layer is, structurally, the integrity of whoever is doing the supervising upstream.

Who has signed up

Companies House publishes a public register of ACSPs through its main service. As of early May 2026 the register has crossed roughly 14,000 authorised firms, growing at around 700 to 900 a month for the past quarter. The composition skews heavily towards the accountancy professions:

1. Accountancy and tax practitioners — around 9,200 firms, mostly small ICAEW, ACCA and AAT-supervised practices, plus HMRC-supervised sole traders.
2. Solicitors and licensed conveyancers — around 2,400 firms, mostly SRA-regulated practices in England and Wales.
3. Dedicated formation agents and TCSPs — around 1,500 firms, several of them filing in five-figure annual volumes.
4. Other (in-house corporate services, banks, payments firms) — the remaining ~900.

For context, the AAT alone has roughly 4,300 licensed practising members in England and Wales. Most have not yet become ACSPs. The application is not difficult — it requires a Companies House WebFiling account, a director who has themselves completed IDV, and an attestation of good standing with the firm's supervisor — but many smaller practices appear to be waiting to see whether enough clients ask before they pay £55 a year and accept the recordkeeping load.

Refusal rates remain low. Companies House's internal management figures, referenced in the Registrar's Q1 2026 stakeholder note, put rejections at around 4 to 6 per cent of submitted ACSP applications, almost all of them for incomplete supervisor details or expired AML registration. There is no published data yet on revocations. The registrar's power to suspend an ACSP under regulation 12 of the Registrar (Identity Verification and Authorised Corporate Service Providers) Regulations 2024 has, on the public record, been used fewer than twenty times.

The capacity question

Mandatory IDV for the existing director and PSC population started on 18 November 2025. Roughly 7 million individuals fall within scope. The transition period ends on 18 November 2026. That is a verification rate of approximately:

• 583,000 per month, or
• 27,000 per working day, or
• 3,400 per working hour over an eight-hour day, five days a week.

Companies House publishes IDV completions in its monthly performance bulletin. The most recent — for March 2026 — showed 2.1 million IDVs completed since November, of which:

• 1.34 million via GOV.UK One Login directly (64 per cent)
• 0.71 million via ACSP-submitted verification statements (34 per cent)
• 0.05 million via legacy paper routes used during the rollout (2 per cent)

That is a run-rate of roughly 420,000 per month, comfortably below the 583,000 needed to clear the backlog by November. ACSP volumes are growing faster than direct verification, but the absolute gap has widened in three of the last four months. Expect either a transition-period extension under the Secretary of State's regulation-making power, or a sharper enforcement nudge — possibly a halt on confirmation-statement acceptance for unverified PSCs — in the autumn.

What an ACSP IDV actually buys

The £55 ACSP fee is paid annually. Two things justify it commercially.

The first is process speed. An accountant with five client incorporations a week can sit a new director through ACSP IDV in under ten minutes — passport scan, biometric match, document hash, signed statement — and avoid the slower One Login route, which still trips on shared family identity documents, expired EU national identity cards and the small but persistent population of UK adults without a recent biometric passport.

The second is regulatory coverage. A solicitor or accountant who already runs a customer due diligence check for the MLRs is doing the same evidence work twice if their client also verifies independently. ACSP IDV reuses that work and produces a single, defensible audit trail at the firm.

What ACSP authorisation does not do, despite frequent client confusion:

• It does not relieve the firm of its own MLR obligations. Customer due diligence applies regardless.
• It does not grant any privilege over Companies House filings — the registrar retains the section 1092A power to query, reject or annotate.
• It does not pre-clear company names, SIC code choices or PSC notifications. ACSPs file the same forms with the same scrutiny.
• It does not extend to overseas entities under the Register of Overseas Entities, which operates its own UK-regulated agent regime under separate regulations.

OPBAS and the quiet criticisms

OPBAS's most recent supervisory report, published in March 2026, found that 8 of the 22 PBSes were either not yet at "effective" level on enforcement, or had failed to act consistently against member firms with repeated AML failings. Two PBSes — left unnamed in the published version but readily identifiable within the sector — were referred for further OPBAS intervention. None of this has yet rippled into ACSP authorisations being withdrawn. Companies House defers to the supervisor; if a supervisor is itself in remediation, the ACSPs it supervises remain authorised.

This is the regime's quietest pressure point. The integrity of director identity verification on the UK register now depends, in part, on whether a regional law society's enforcement function reaches the firm that filed thirty incorporations last quarter. The connection is real but indirect, and there is no public dashboard that shows it.

What to watch in the next six months

Three indicators are worth following monthly:

1. The IDV completion rate, against the 583,000-per-month figure needed to clear the transition by November 2026. If the gap widens for a fifth straight month, an extension is near-certain.
2. The first ACSP revocations published with reasons. Until Companies House discloses grounds — supervisor strike-off, fraud, identity laundering — the deterrent effect on the regime's margins remains muted.
3. HMRC's MLS register movement. HMRC supervises the largest pool of non-PBS-aligned TCSPs and formation agents, and historically has the slowest enforcement cadence. Visible movement here is the clearest signal that the integrity layer is hardening rather than just expanding.

The ACSP regime is, on balance, working as designed. It has not collapsed under volume. It has not been visibly captured. The price is plausible and the supervisor pool is, on paper, comprehensive. What ECCTA has done is move responsibility for verifying who incorporates British companies away from the registrar's own staff and into roughly 14,000 small firms supervised by twenty-five different bodies. The next twelve months will tell us whether that delegation is robust, or whether the patchwork shows its joins.