The PSC Register at Ten: A Decade of Significant Control, Disclosed and Disclaimed

The People with Significant Control regime turned ten this month. Section 790A of the Companies Act 2006, inserted by the Small Business, Enterprise and Employment Act 2015, took effect on 6 April 2016 and gave the United Kingdom one of the world's first publicly searchable registers of corporate beneficial ownership. A decade in, the register has logged tens of millions of entries, yet the original case for it — that sunlight on ownership would deter shell-company misuse — sits in an awkward middle ground. It worked enough to expose the gaps; it did not work nearly well enough to close them.

ECCTA — the Economic Crime and Corporate Transparency Act 2023 — is now putting that to the test. Identity verification, address-suppression rules and a tightening of the exemption regime are reshaping how ownership is declared from this year onward. Below: what the first decade actually produced, where it strained, and how the next phase compares with overseas equivalents.

What the regime requires, in two paragraphs

A person with significant control is anyone who meets one or more of five statutory conditions in respect of a UK company or LLP: holding more than 25% of the shares; controlling more than 25% of the voting rights; the right to appoint or remove a majority of the board; the right to exercise, or actually exercising, "significant influence or control"; or holding the equivalent rights through a trust or firm without legal personality. Those tests live in Schedule 1A of the Companies Act 2006.

Registrable persons must be confirmed to Companies House and updated within 14 days of a change becoming known, and within a further 14 days when filed with the Registrar. The data — name, month and year of birth, nationality, country of usual residence, the nature and date the control arose — is published on the public register. The full date of birth, previously visible, has been redacted by default for live filings since October 2018.

What ten years has produced

A few hard figures, drawn from Companies House Statistical Releases, the Bulk Data Product and successive National Audit Office reports:

1. Around 5.3 million UK companies were on the register at the start of 2026, every one of which is required to maintain a PSC statement.
2. More than 11 million PSC entries have been logged across the decade, including superseded entries — the average live company has amended its PSC information at least twice since incorporation.
3. Roughly 9% of live companies carry a "no PSC identified" or "PSC information not yet provided" statement at any one time, a share that has barely moved since 2019 despite repeated guidance pushes.
4. Approximately 400,000 PSC entries were filed by individuals declaring themselves resident outside the United Kingdom in the most recent reporting year, with around 180 jurisdictions represented.
5. Fewer than 12,000 corrections per year are forced through the register's section-790Q objection route — the mechanism by which a registered PSC can challenge an inaccurate filing — even though academic studies of the bulk data routinely identify percentage-point-scale anomaly rates.

Those last two lines tell the central story. The register captures volume. It struggles with veracity, and it struggles with enforcement at scale.

The five soft spots a decade exposed

The PSC regime has been studied by Transparency International UK, the Financial Action Task Force, Global Witness and the Organised Crime and Corruption Reporting Project, among others. Their analyses of the bulk data converge on five recurring weaknesses.

1. The "no PSC" statement

A company may declare that it has no person with significant control, or that it has been unable to identify one. Until ECCTA, Companies House had no power to interrogate that declaration on its face — the filing was treated as accepted. Studies have repeatedly identified clusters of "no PSC" companies whose shareholdings, when traced through their own filed accounts and confirmation statements, would have produced an obvious 25% holder.

2. Self-declared significant influence or control

Condition (iv) — significant influence or control without a quantifiable shareholding — is the most enforcement-resistant. Statutory guidance under section 790E sets out indicia, but the ultimate test is qualitative. A nominee structure that disclaims any 25% threshold and does not vote can, in practice, route around the regime entirely.

3. Stacked corporate PSCs and broken chains

Where a UK company is controlled by another UK company, the parent appears as a Relevant Legal Entity (RLE). That preserves the chain on paper, but a PSC search must be repeated against the RLE to reach the natural person at the top. In long chains involving non-UK entities, the chain frequently broke before reaching anyone identifiable — until the Register of Overseas Entities arrived in 2022 to plug the offshore segment.

4. Identity assurance

Until ECCTA's identity-verification regime began phasing in during 2025, anyone could submit a PSC declaration for a company. The Registrar's role was reception, not gatekeeping. Companies House's own 2018 analysis of suspicious filings identified PSCs declared in the names of fictional characters, deceased individuals and serving public officials with no plausible connection to the companies concerned.

5. The 14-day update window in practice

The 14-day rule is rarely tested. Late updates produce no automatic penalty in most cases, and the historical record on the public register is silent on how long an outdated PSC statement persisted before correction. Auditors and reporting accountants relying on PSC searches in due-diligence work have generally treated the data as a starting point, not a finishing one.

How the UK compares with the major peer regimes

Ten years on, the UK is no longer the only public beneficial-ownership register in operation, and it is no longer the strictest. The table below contrasts the four regimes most often used as international comparators.

The instructive point is that the UK's combination of fully public access plus self-declared filings was once distinctive and is now isolated. The Court of Justice of the European Union's judgment in WM and Sovim v Luxembourg Business Registers (November 2022) effectively closed open EU registers to general public access. The US Corporate Transparency Act ran into constitutional challenge in the Eleventh Circuit, and a March 2025 Treasury rule narrowed BOI reporting to foreign reporting companies. The UK alone retains an open public regime — and is now bolting on the verification layer the others largely started with.

ECCTA's three-part repair job

The 2023 Act is being implemented in tranches across 2024–2026. Three of those tranches matter directly for the PSC register.

Identity verification. From 18 November 2025, identity verification became a statutory pre-condition to acting as a director or as a registrable PSC. Existing PSCs have a 12-month transition window — running to mid-November 2026 — to verify directly with Companies House or via an Authorised Corporate Service Provider (ACSP). After that window closes, continuing to act as an unverified PSC is a criminal offence under sections 1110A–1110F as inserted by ECCTA.

Address protection by default. Residential addresses given on PSC filings are now suppressed from the public version of the register and from the Bulk Data Product, with a controlled-access route for law enforcement and certain regulated parties. The change responds, in part, to evidence that the open register had been used to identify PSCs of small companies in domestic-abuse contexts.

Power to query, reject and remove. The Registrar now has, for the first time, a statutory power to query filings that appear inconsistent with information already on the register or with other publicly available data. That is the structural change. The PSC register is no longer a passive bulletin board: a "no PSC" declaration that contradicts a companion accounts filing can now be rejected, and the company put to proof.

The verdict at year ten

The PSC register's first decade produced a large, machine-readable, free-to-access dataset that has materially improved corporate due diligence in the United Kingdom and given investigative journalists, NGOs and counterparties a tool that did not previously exist. It has also produced a register populated by self-declaration, lightly policed, with a stubborn residual rate of "no PSC" statements that may or may not be true. Both observations can be correct at the same time.

ECCTA does not, by itself, transform the register into a verified system. It introduces the verification layer the regime should arguably have started with in 2016. Whether the next decade produces materially cleaner data depends on three variables that are not yet observable: whether ACSP capacity is sufficient to handle the verification queue without bottlenecks (the early evidence is that it is strained), whether the Registrar's new query power is exercised with consistency rather than at the margins, and whether section 790R prosecutions — historically rare — are pursued at volume.

For now, treat the register as it was always best treated: a useful starting point, not a primary source. After November 2026, when the verification transition closes, that judgement deserves to be revisited.