Identity Verification at Companies House: How ECCTA's Director ID Regime Will Reshape Britain's Corporate Register

The Economic Crime and Corporate Transparency Act 2023 (ECCTA) does many things, but Part 2 contains a provision that will touch every company director in the United Kingdom: compulsory identity verification. For the first time in the register's 180-year history, Companies House will not simply accept a director appointment at face value. It will require proof that the person exists, that they are who they say they are, and that their identity has been checked against a government-held or authorised intermediary's record.

The statutory framework sits in sections 64 to 69 of ECCTA, which insert new sections 1110A to 1110F into the Companies Act 2006. These are not aspirational clauses awaiting secondary legislation. The phased implementation began in 2025, and by the time the transitional window closes, every one of the approximately 5.4 million live directorships on the UK register will need to have been verified — either directly by Companies House, through an Authorised Corporate Service Provider (ACSP), or via a recognised overseas equivalent.

Who Must Verify, and When

The obligation falls on three categories of individual:

1. New directors appointed on or after the commencement date for their cohort must verify their identity before the appointment takes effect. No verification, no directorship.
2. Existing directors appointed before commencement must verify within a transitional period set by the Secretary of State. The current indication is 12 months from their cohort's commencement date, though the final duration is not yet fixed by statutory instrument.
3. Persons with significant control (PSCs) must also verify. This is less remarked upon but equally consequential: a PSC who has not verified cannot lawfully be recorded on the PSC register, and the company commits an offence if it knowingly records an unverified PSC.

There is a fourth category that catches the filing ecosystem: presenters. Anyone delivering a document to Companies House on behalf of a company — accountants, formation agents, solicitors — must either be an ACSP-registered individual or have verified their identity directly with the registrar. This is the statutory hook that ends the era of anonymous bulk filing.

The phased rollout follows a risk-ranked sequence. The largest entities and those in higher-risk sectors are being called forward first, with micro-entities and dormant companies at the tail end. Companies House has not published the full cohort timetable, but the direction of travel is clear: all directors must be verified within a window that the department expects to close before the end of 2027.

Three Routes to Verification

The regime offers three pathways, and the choice between them is not merely administrative. It determines cost, speed, and whether the verification can be reused across multiple appointments.

The direct route is administratively simplest but requires the individual to create and maintain a Companies House account with multi-factor authentication. The ACSP route is the intended workhorse — it mirrors the anti-money-laundering identification framework that solicitors and accountants already operate, and it allows corporate service providers to bundle verification with company formation or annual filing services. The overseas route remains a work in progress; recognising foreign digital identity schemes is technically non-trivial and politically sensitive, particularly post-Brexit.

The Scale of the Exercise

As of May 2026, the Companies House register holds approximately 5.5 million active companies. The total stock of live directorships — counting each company-director relationship — stands at roughly 5.4 million. Some individuals hold a single directorship; others hold dozens. The Insolvency Service's director disqualification data suggests that around 4.1 million unique individuals occupy those 5.4 million directorships.

The verification exercise must therefore process at least 4.1 million individual identity checks, plus the PSC population, which overlaps partially but adds perhaps 500,000 unique individuals who are PSCs but not directors. The total universe is in the region of 4.5 to 5 million people.

To put that in context: HM Passport Office processed approximately 7 million passport applications in 2025. Companies House is effectively being asked to run a passport-scale identity verification programme on top of its existing filing operations, without the decades of identity-checking institutional muscle that HMPO possesses.

What Happens to Non-Compliant Directorships

The Act is blunt about consequences. Where a director has not verified within the prescribed period, the registrar must annotate the register to show the individual as unverified. The company commits an offence if it continues to list an unverified individual as a director after the deadline. The director themselves commits an offence if they continue to act while unverified.

The statutory penalties are calibrated to hurt: on summary conviction, a fine up to the statutory maximum (unlimited in England and Wales since the 2015 sentencing reforms); on indictment, up to two years' imprisonment. The Act also gives the Secretary of State power to direct the compulsory striking-off of companies that fail to replace unverified directors, though this is framed as a backstop rather than a first resort.

The more immediate commercial consequence may be subtler. Banks, lenders, and trade creditors are already building the verification flag into their onboarding and monitoring systems. An "unverified director" annotation on the public register will function as a de facto credit-rating downgrade long before any criminal sanction bites.

The Filing Ecosystem Shift

Perhaps the most under-examined consequence of the identity verification regime is the structural change it imposes on the company formation and filing market. Currently, a significant volume of Companies House filings are submitted by unregulated formation agents who operate on thin margins and high volume. The ACSP regime requires those agents to either obtain AML supervision (registering with HMRC, the FCA, or a professional body supervisor) or cease filing.

This is not accidental. The white paper that preceded ECCTA was explicit that the anonymity of the filing chain was itself a vector for economic crime. By requiring every presenter to be either directly verified or ACSP-registered, the Act squeezes the unregulated formation market from both ends. Companies House has indicated it expects the number of regular presenters to contract by perhaps 30–40% as unregulated agents exit or merge into supervised practices.

How the UK Compares

The UK is not the first jurisdiction to require director identity verification, but its approach has distinctive features that make direct comparison instructive.

The UK's approach sits at the stricter end of the spectrum — broader in scope than New Zealand's, with higher criminal penalties than India's, and unique in extending identity verification not just to directors and PSCs but to everyone who files. The ACSP requirement has no direct parallel in Singapore or New Zealand, where the emphasis is on verifying the director rather than regulating the filing chain.

What the Data Will Eventually Reveal

Once the verification exercise is materially complete — likely by late 2027 or early 2028 — the register will yield data that has never existed in the UK: a definitive count of how many unique individuals actually control British companies, how many directorships the average director holds, and — critically — how many directorships listed on the pre-ECCTA register were held by individuals who could not or would not verify.

The last of these numbers is the one that matters most. The pre-ECCTA register accepted director details on trust. A formation agent could list any name, any date of birth, any correspondence address, and Companies House had no statutory power to query it. The verification regime exposes the gap between the register as it appeared and the register as it actually was. How wide that gap turns out to be will determine whether ECCTA's identity provisions are remembered as a regulatory triumph or as a costly exercise in confirming what was already largely true.