Policy paper

Factsheet: identity verification and authorised corporate service providers

Updated 26 October 2023

1. What is the government doing and why?

Individuals who register companies or file with the Registrar will have to prove they are who they say they are by verifying their identity. This will make it much harder to register fictitious directors or beneficial owners, stopping the vast majority of fraudulent appointments from reaching the Companies House register.

Identity verification will be a simple, quick process without significantly adding to the existing requirements on business. Businesses of all sizes will benefit from greater assurance from the Companies House register when they are consulting it to research potential suppliers and partners.

This will apply to existing directors, People with Significant Control, and the majority of those delivering documents to the Registrar (the exception being individuals who are either themselves corporate service providers who have been specifically authorised by the registrar, or officers or employees of firms which are authorised corporate service providers). Companies already on the register will have a transition period in which to verify these identities. Identity verification requirements will also apply to all new registered company directors and People with Significant Control.

2. How will identity verification work?

There will be two types of identity verification: direct verification via Companies House, and an indirect route through an Authorised Corporate Service Provider.

If a person is verifying their identity directly with Companies House, identity verification will link a person with a primary identity document, such as a passport or driving licence. The person undergoing verification will take a photograph or scan of their face and the identifying document. The two will be compared, using likeness matching technology, and the identity verified. If successful, the person will be notified in a matter of minutes. Alternative methods will be available for individuals without photographic ID and digitally assisted / non-digital identity verification will be available for users who cannot use the digital identity verification system.

Identity verification by Authorised Corporate Service Providers (ACSP)

People might decide to use an intermediary / agent to file with the Registrar, form a new registerable entity, or verify their identity. These “corporate service providers” are often accountants, legal advisers, and company formation agents. Following enactment of the Bill, only those corporate service providers which have been authorised by the registrar may deliver documents to the registrar on behalf of clients. In order for a corporate service provider to be issued with authorised status by the registrar, a precondition is that they must be registered with a supervisory body for anti-money laundering (AML) purposes. As such, they will have an existing obligation to carry out customer due diligence checks on their clients.

The identity verification checks undertaken by ACSPs will achieve the same level of assurance of the claimed identity as those undertaken through the direct verification route, and apply to all directors and People with Significant Control (PSCs). They will also be required to declare that they have completed all of the necessary identity verification checks when they interact with the Registrar and Companies House.

ACSPs will be required to retain records pertaining to identity verification checks; the Registrar can create new requirements on record retention and request further information if necessary.

More information on how the government envisages the process of identity verification working is set out in the Corporate Transparency and Register Reform White Paper.

3. Who will this apply to and when will they need to verify?

Identity verification requirements will apply to all new and existing registered company directors, People with Significant Control (PSCs) and anyone else filing with the Registrar.

There will be a transition period for existing directors and their equivalents, and for PSCs to verify their identity in. This transition period will provide existing directors and PSCs time to comply with the new requirements, whilst ensuring the integrity of data already on the register.

For new directors, identity verification must take place before an application for the formation of a company is delivered to the Registrar. If PSCs are not verified within a short time after the incorporation of a company, they will commit a criminal offence. Post-incorporation, a director must verify their identity as soon as possible and must do so before their appointment is notified to the Registrar by a company. Individual PSCs will have a 14-day period after registering with the Registrar in which to verify their identity. For Relevant Legal Entities this period will be 28 days. Relevant Legal Entities will need to provide the name of their verified relevant officer.

Anyone wishing to file documents with the Registrar will need to verify their identity before they do so unless they are an employee or officer of an authorised corporate service provider or subject to an identity verification exception made in secondary legislation.

In general, we expect identity verification to be a one-off requirement. Once a person is verified, they obtain a verified status. However, there may be instances where re-verification is required, for example if the Registrar has reason to doubt the validity of the identity verification, such as on suspicion of fraud. The events that will trigger the requirement to reverify will be set out in secondary legislation following Royal Assent.

4. What will happen if individuals don’t comply?

A transition period will provide existing companies with a set amount of time to comply with the new requirements. Those that do not comply by the end of the period may face criminal sanctions or civil penalties. The companies register will also be annotated to reflect their unverified status. The civil penalty regime and the annotation of the register to show an individual’s status as ‘unverified’ may be introduced by secondary legislation under existing and new delegated powers.

The consequences of non-compliance with the identity verification requirements will depend on circumstances. However, an individual who was under a requirement to verify their identity with the Registrar, and failed to comply with it, could be subject to:

  • criminal proceedings - which could result in a level 5 fine
  • civil penalties issued by the Registrar of Companies
  • incorporations/registration of a new company being rejected
  • being unable to file statutory filings
  • the public register being annotated to show the individual’s status as ‘unverified’

For directors, failing to verify could also result in being prohibited from acting as a director.

There will also be a new offence, see Sanctions fact sheet which applies to the director or equivalent of an ACSP, of failure to notify the Registrar of changes to their supervisory body/bodies within a period of 14 days following the change.

5. When will this come into effect?

These measures will require new secondary legislation and guidance, as well as system development, following Royal Assent of the Bill.

6. What restrictions will be imposed on the use of corporate directors?

The government already has powers to restrict the use of corporate directors and these will be brought into force in parallel with this Bill along with regulations which will set out the more limited basis upon which companies will be permitted to retain or appoint corporate directors in the future.

BEIS consulted in December 2020 on “principle based” exception proposals which will form the basis of the regulations.

It will be made explicit that only corporate entities with “legal personality” will be properly appointable as corporate directors. All directors of the latter will have to be natural persons and those natural person directors must, prior to the corporate director appointment, have been subject to an appropriate identity verification process.

Companies with corporate directors will be given 12 months to comply; within such time they must either ensure their corporate director is compliant with the conditions or resign them.

New companies or companies appointing a corporate director must ensure they satisfy the conditions from the date this measure comes into force.