Companies House Identity Verification: First Prosecutions Put Directors’ Compliance Responsibilities into Focus

The first prosecutions for breaches of the new Companies House identity verification requirements have provided an early indication of how the strengthened UK corporate transparency regime may operate in practice.

On 16 September 2026, three company directors were convicted at the City of London Magistrates’ Court in cases brought by the Insolvency Service. Two directors had continued to act without completing the required identity verification, while another had verified his own identity but failed to take reasonable steps to prevent an unverified fellow director from continuing to act.

The cases are significant beyond the fines imposed. They demonstrate that identity verification is now an active compliance obligation rather than simply an administrative change to the Companies House filing process. Directors and companies need to understand not only when verification is required, but also how the requirements interact with appointments, confirmation statements, people with significant control and the wider responsibility for maintaining accurate corporate records.

Why has identity verification been introduced?

Identity verification forms part of the reforms introduced by the Economic Crime and Corporate Transparency Act 2023 (ECCTA).

The reforms significantly expand the role and powers of Companies House. One of their central objectives is to improve confidence in the information held on the companies register and make it more difficult for UK corporate structures to be established or operated using false or stolen identities.

Mandatory identity verification took effect from 18 November 2025.

From that date, individuals becoming directors have generally been required to verify their identity and provide the relevant Companies House personal code as part of the incorporation or appointment process.

For existing directors, the regime has been introduced through a 12-month transition period. An existing director is required to provide their personal code as part of the company’s next confirmation statement during the transition.

The requirements also extend to people with significant control (PSCs), although the process and relevant compliance window differ according to the individual’s circumstances.

Verification is more than a filing formality

One of the important features of the new regime is that the obligation does not end with obtaining a Companies House personal code.

The legislation prohibits an individual from acting as a director unless their identity has been verified. It also places a corresponding obligation on the company to ensure that an individual does not act as a director while unverified.

This distinction was demonstrated clearly by the first prosecutions.

In one case, a director continued participating in board-level decision-making and signed company accounts while her identity remained unverified. In another, a director signed and delivered company accounts on behalf of the company before completing the required verification.

The third conviction is particularly relevant to boards. The director concerned had completed his own identity verification, but was prosecuted for failing to take reasonable steps to prevent another individual from continuing to act as a director while unverified.

The compliance question for a company is therefore wider than whether each individual director knows about the requirement. Companies should have processes capable of identifying whether the individuals acting as directors have satisfied the applicable verification requirements.

What are the consequences of non-compliance?

Under the Companies Act 2006 provisions introduced by ECCTA, an individual who acts as a director without the required verification commits an offence.

The company must also ensure that an individual does not act as a director unless that individual’s identity has been verified. Where the company fails to comply, the company and every officer who is in default may commit an offence.

Companies House guidance also makes clear that PSCs may commit an offence if they continue in that capacity after the relevant deadline without satisfying the applicable identity verification requirements.

The first cases show that these provisions are capable of leading to criminal enforcement.

The three directors prosecuted in September received financial penalties and were ordered to pay costs and victim surcharges. The circumstances also show that subsequent verification does not necessarily eliminate the consequences of earlier non-compliance: the directors who had initially failed to verify subsequently completed verification, but the prosecutions proceeded.

There is, however, an important legal distinction. The legislation expressly provides that acting while unverified does not, by itself, invalidate the director’s corporate acts. The statutory consequence is instead the potential commission of an offence.

That distinction may matter where companies are reviewing decisions or documents involving a director who was later discovered to have been unverified.

Directors and PSCs should distinguish their respective obligations

The verification process is not identical for every role.

An existing director is required to provide their Companies House personal code in connection with the company’s confirmation statement. A director of several companies must provide the code in respect of each company.

PSCs operate under a different timetable. They generally have a 14-day period in which to provide their personal code, with the timing determined by factors including whether they were already registered before 18 November 2025 and whether they are also a director of the same company.

An individual who is both a director and a PSC of the same company must comply separately in each capacity. Providing the personal code for the director role through the confirmation statement does not, by itself, complete the PSC requirement.

This is an area where companies with more complicated ownership and governance structures should take particular care. A single individual may have obligations associated with several companies and more than one capacity.

Verification and the wider Companies House compliance framework

Identity verification should not be considered in isolation from the broader Companies House reforms.

The September prosecutions also involved failures by the relevant companies to file confirmation statements within the statutory period. That combination illustrates how weaknesses in routine corporate administration can expose companies and directors to several compliance issues simultaneously.

For boards and finance teams, the practical challenge is therefore one of corporate record management as much as identity verification.

Director appointments and resignations, PSC information, confirmation statement dates and other statutory records should be monitored as part of a coherent compliance process.

This is particularly important for groups, companies with overseas directors, businesses undergoing changes in ownership or management, and organisations where responsibility for Companies House filings is divided between internal teams and external advisers.

Practical considerations for companies and directors

Companies should consider reviewing their current position before the relevant filing or verification deadline arises.

A sensible review may include:

• confirming that each current director has completed identity verification;
• establishing the verification position of each PSC; and
• checking that the personal codes have been provided through the correct Companies House process.

Companies should also consider whether their procedures for appointing new directors prevent an individual from beginning to act before the verification requirements have been satisfied.

For individuals holding multiple appointments, maintaining a clear record of the entities for which the personal code has been submitted can help reduce the risk of assuming that verification for one company automatically satisfies the requirements for another.

Corporate groups may require additional coordination. The underlying identity verification belongs to the individual, but compliance must still be addressed in relation to each relevant company and role.

The first prosecutions also reinforce the importance of keeping confirmation statement and other statutory filing deadlines under review. Identity verification is increasingly integrated into the broader corporate filing framework, meaning that deficiencies in company secretarial processes can have consequences beyond a late administrative filing.

A broader change in corporate compliance

The identity verification regime forms part of a wider shift in the role of Companies House from a largely passive recipient of information towards a registrar with stronger powers to scrutinise information and support enforcement.

For directors, this increases the importance of treating Companies House information and filings as substantive corporate compliance matters.

The first prosecutions do not mean that every administrative error will result in court proceedings. In the cases announced by the Insolvency Service, the individuals had been given multiple opportunities to comply before enforcement action was taken. Nevertheless, the proceedings demonstrate that the new requirements have legal consequences and that continued non-compliance can progress beyond reminders and filing difficulties.

Businesses should therefore understand who is responsible for monitoring director and PSC verification, how those requirements interact with confirmation statements and appointments, and whether their corporate records accurately reflect their current governance and ownership arrangements.

This article is intended as general information only and does not constitute legal, accounting or other professional advice. The application of Companies House requirements will depend on the circumstances of the company and the individuals concerned. Specific advice should be obtained where appropriate.