Companies House has taken the first major step towards mandatory identity verification for directors/people of significant control (PSCs) and anyone filing on behalf of a company with the release of the voluntary identity verification (IDV).
However, while IDV will create an extra layer of protection against cybercriminals or “bad actors” abusing the system, concerns have been raised on AccountingWEB that the new reforms could still be open to potential abuse from criminals funnelling through fake IDs.
Voluntary IDV goes live
The voluntary period of IDV was rolled out on 8 April and comes weeks after Companies House launched the registration process for authorised corporate service providers (ACSP).
The new service is driven by the need for individuals to verify their identity directly with Companies House through the gov.uk One Login or via their ACSP – a third-party representative such as an accountant.
This is the first step in Companies House’s efforts to tackle the misuse of the companies register, culminating in mandatory identity verification from autumn 2025, where more than six million directors will need to comply.
The introduction of IDV is one of the key changes coming into force under the Economic Crime and Corporate Transparency Act 2023, which has given Companies House enhanced powers to stamp down on economic crime.
Companies House chief executive Louise Smyth hailed IDV as being crucial in “improving the quality and reliability of our data and tackling misuse of the companies register”. She has encouraged directors and PSCs to take advantage of this voluntary period before it becomes mandatory later this year.
Accountants on AccountingWEB’s Any Answers forum are already getting to grips with verification. Paul Benney called the process “surprisingly straightforward”. After going through the gov.uk One Login, he then took a photo of a passport, where he lay a phone on top of the passport for the near field communication (NFC) reader to access the chip. He said the whole process took 10 minutes in total. “Although there may be some challenges with the ACSP process, this one worked fine for me.”
According to Companies House, more than 1,000 ACSPs have registered to date.
Verifying an identity
David Winch, the director of MLRO Support and a regular on the pages of AccountingWEB’s Any Answers forum, also volunteered himself as a guinea pig and registered as an ACSP three weeks ago. Up until this week, ACSPs couldn’t do anything. But with the launch of the voluntary period of IDV, they’re now able to verify a client or an individual.
Speaking to AccountingWEB, Winch recounted his experience of verifying the identity of David Winch. Although Winch was able to verify the identity of “David Winch” using ID technology through FirmCheck, he expressed concern that, on visiting the Companies House website, “as far as I can see, there isn’t actually any test that I have actually done that”.
Winch said: “Having verified the ID of David Winch I looked at the Companies House record of MLRO Support Ltd, expecting to see some acknowledgement that David Winch’s ID had been verified – but there is no sign of that yet.”
He said that this will not be visible online until mandatory ID verification comes into force, expected to be autumn 2025.
Winch also explained how he had to state to Companies House that he had used ID verification technology to ID “David Winch”. “They are relying on my integrity and my understanding of IDV to confirm that I have genuinely verified the ID of David Winch to an acceptable standard,” he said, raising concerns that this could be open to abuse by bad actors.
“It seems to me that there is a very wide scope for abuse of this system – or possibly accidental abuse if an accountant is under the impression that verifying their client’s ID for money laundering regulations is effectively sufficient, despite not being up to Companies House’s standards.
“Another accountant might 'sign off' on that statement without properly understanding what Companies House standard requires, or (worse) knowingly 'sign off' on that, whilst knowingly failing to meet that standard - and Companies House would never know (because they do not check). So it makes a mockery of the whole thing.”
Companies House responds
In response, a Companies House spokesperson said:“ACSPs will be expected to verify individuals to the same standard as those verifying directly with Companies House. Firms will not be able to register as an ACSP unless they are supervised under UK Anti-Money Laundering regulations, and the registrar will not accept applications if the applicant is not fit and proper.
“From then on, the ACSP must be supervised under UK Anti-Money Laundering regulations at all times, and Companies House and the supervisors will regularly share intelligence and changes to an ACSP’s supervisory status. Companies House can suspend or deauthorise an ACSP if we think it is no longer fit and proper to perform these functions.
“ACSPs will be required to keep records relating to identity verification checks they complete and respond to Companies House spot checks. Failure to comply will be a criminal offence.”
Companies House has providedguidanceto support ACSPs
Road to mandation
The latest release from Companies House is one of the first steps in the process of what is an extensive set of reforms. The next key date in Companies House’s calendar will be in the autumn/winter when identity verification becomes compulsory before you’re able to file a confirmation statement for around six million directors.
The PSCs then must identify themselves within 14 days after the filing of the confirmation statement. Winch highlighted that this could also be “prone to lapses”.
“If you’ve got PSCs who are not directors, they’re supposed to file their ID within 14 days after the confirmation statement, but what’s going to happen if they don’t? It seems to me the answer is nothing much.”
Then from the spring/summer next year, IDV becomes mandatory for anyone wanting to file on behalf of a company. Therefore, accountants who file on behalf of a client will have to become an ACSP come spring 2026. From the autumn/winter of 2026, the transition period ends and Companies House will enforce compliance with IDV.
For accountants trying out the system, Winch advised them to check that the Companies House record for their client directors and PSCs shows precisely the same name as their passport or driving licence. So if the client’s name is Philip, do they spell their name with one L or two Ls?
“If the name is not precisely what’s on the passport or driving licence, I presume Companies House will put hurdles in your way when you try to verify that person’s ID with a misspelled name,” he said.
Drive to tackle fraud
The implementation of IDV comes as Companies House has new enhanced powers to tackle fraud and improve corporate transparency, particularly the abuse of directors’ IDs.
“In a time where economic crime has become too common, it is imperative that we bring in measures to prevent identities being stolen online and today marks a significant milestone in our plans to require identity verification for those setting up and runningcompanieson theCompaniesHouseregister later this year," commented the minister for employment rights, Justin Madders MP.
However, Winch reflected on a question he was asked during a panel at the Festival of Accounting & Bookkeeping in March on whether IDV will stamp out fraud and his one-word answer was “no”.
“Now having seen how ACSPs could be abused, I’m even more of the opinion that the answer to the question is no. Anybody can get themselves registered for AML purposes with HMRC and say they’re an accountant, fill in some forms and then get registered as an ACSP and wave through all sorts of bad actors as company directors.
“Presumably it will be for Companies House to be reactive and to realise that this particular ACSP is pushing through bad actors and suspend their ACSP status but by then the damage may have been done.”
Winch said the situation reminds him of the Proceeds of Crime Act of 2002, which prevented bad actors from laundering money unless they notified the National Crime Agency. “As we know, money laundering hasn’t come to an end. The IDV measures will make it more difficult for the bad actors to abuse the registrar. But I’m sure it won’t take them very long to work out ways to do what they shouldn’t be doing and to get away with it for a time.”
