Corporate Bitesize: ECCTA – Identification Verification

The Economic Crime and Corporate Transparency Act 2023 (ECCTA) has introduced a new identity verification (IDV) regime which requires individuals holding certain positions within organisations and/or making filings with Companies House to have their identities verified. 

Voluntary IDV started on 8 April 2025 and the legal requirement to do so will come into force in autumn 2025. 

Who does it apply to?

Those who will need to verify their identity include:

• a new or existing director of a UK registered company;
• a new or existing person with significant control (PSC);
• a new or existing member of a UK registered limited liability partnership (LLP);
• a new or existing general partner (GP) of a limited partnership (LP);
• a managing officer who is the equivalent of a director;
• a relevant officer of a PSC that is a Registrable Legal Entity (RLE);
• a director of an overseas company required to register a UK establishment at Companies House; or
• someone who makes Companies House filings for a company – for example, a company secretary or an Authorised Corporate Service Provider (ACSP), also known as a Companies House authorised agent.

When will IDV be required?

New directors, PSCs, and members of LLPs: from autumn 2025 (date yet to be announced), these persons will need to have their identity verified as part of the relevant organisation’s incorporation or their appointment to an existing organisation.

Existing directors, PSCs, and members of LLPs: from the same autumn date as above, these persons will need to have their identity verified before the relevant organisation submits its annual confirmation statement. Therefore, if an organisation’s confirmation statement is due before the autumn 2025 date, all relevant persons will not need to verify their identities until the 2026 confirmation statement is due. But if an organisation’s confirmation statement is due after the autumn 2025 date (even if by just one week), all relevant persons will need to verify their identities before that date. Companies House has indicated that directors of overseas companies and general partners of limited partnerships will also need to start having their identities verified from autumn.

Other listed persons: Companies House currently anticipates that the IDV requirement for anyone who files documents at Companies House will come into force in Spring 2026. 

How does an individual go about getting their identification verified?

There are three ways that individuals can verify their identity – these are:

1. Online via GOV.UK One Login. This method is free of charge, and you will need documents such as a biometric passport or driving licence etc.
2. In person at a Post Office. This method is free of charge and the individual will need a type of photo identification. The individual will first need to enter some details on GOV.UK One Login then go to a Post Office that offers ‘in branch verification’ where they can prove their identity using photo identification.
3. Using an ACSP. Individuals can use an ACSP to have their identity verified for a fee.

In addition, every individual having their identity verified must have a valid email and residential address.

What if the PSC or director is an organisation?

All registrable PSCs who are legal entities, i.e. RLEs, will be required to nominate a “relevant officer” who is an individual and whose identity has been verified in the same way as described above. 

Corporate directors are expected to be abolished under ECCTA in the near future. However, once in force, there will be an exception to this rule whereby a corporate entity registered in the UK will be able to be a director of a UK company provided that:

1. the corporate entity has a legal personality;
2. each of the corporate entity’s directors is a natural person; and
3. each of the corporate entity’s directors has had their identity verified.

What do individuals need to do once they’ve completed their IDV?

Once an individual or an organisation has had their identity verified, Companies House will issue a personal code as evidence of their IDV. From autumn 2025, individuals will be required by Companies House to submit this personal code every time that they, for example:

• file a confirmation statement;
• are appointed as a director or managing officer;
• become a PSC;
• are appointed as a member of an LLP; or
• are appointed as a GP of an LP.

How many times will an individual need to verify their identity?

IDV is expected to be required by a single individual on one occasion only.

However, certain situations may require IDV to be repeated, for example, where a person changes their name following marriage or divorce.

What happens if individuals do not comply?

A director will commit a criminal offence (as will the relevant organisation and, in certain cases, the other officers) where they:

1. fail to verify their identity within the relevant timeframe; and
2. continue to act as a director.

Directors who commit this offence will be at risk of a fine and, where appropriate, may also be disqualified as a director. The incorporation of a new company may be rejected by Companies House and, in serious cases, criminal proceedings may be initiated. Individuals will also likely be prohibited from submitting future filings with Companies House if they have not complied with the requirements. 

A PSC will be committing a criminal offence if they do not comply and are at risk of a fine.

It has not yet been confirmed whether such offences will also apply to LLP members and other personnel who are required to complete IDV but it should be assumed that they will.

What should organisations do now?

Organisations should review their group’s structure and identify all the persons within each organisation (i.e. their PSCs, directors, members, etc.) that will be affected by the new IDV regime. They should also pinpoint the expected compliance deadlines (which will usually be the date of filing of the next confirmation statement following autumn 2025). 

It is also important to consider whether any of the group’s companies or partnerships are RLEs and to decide who the “relevant officer” is for each. 

Organisations should consider ensuring that all of the relevant individuals verify their identities voluntarily now or at least starting the process to ensure that future compliance deadlines are not missed.

For further advice on IDV offences and whether your organisation could be affected, please contact HFW.

Michael Popp, Trainee Solicitor, assisted in the preparation of this briefing.