Companies House, the UK repository for business filings, will soon require firms and individuals to validate their identity. The process is expected to roll out over a 12 month period, commencing on November 18, 2025.
Going forward, there will be legal requirements for directors and people with significant control (PSCs) of companies to verify their identities. This includes:
- New directors will need to verify their identity to incorporate a company or be appointed to an existing company
- Existing directors will need to confirm they have verified their identity at the same time as they file their next annual confirmation statement, during a 12-month transition period
- existing PSCs will need to verify their identity in line with an appointed day within 12 months of the commencement of mandatory identity verification on 18 November
Companies House estimates there will be six to seven million individuals who will need to prove who they are.
Individuals will be able to verify their identity through GOV.UK One Login, or through an Authorised Corporate Service Provider (ACSP).
Companies House CEO Louise Smyth CBE says this will improve the quality and reliability of their data, noting that over 300,000 individuals have completed the process.
Jonathan Frost, Director of Global Advisory for EMEA at BioCatch, said the announcement is a vital step forward for corporate transparency. At the same time, Frost sees the 12-month rollout as leaving a window of opportunity for criminals to abuse the extended time to validate identities.
“Banks invest vast sums into double-checking Companies House data, distracting from their efforts to tackle economic crime. The National Economic Crime Centre has also highlighted this issue in its recent Public Private Threat Update, which warned that the abuse of companies creates a significant money laundering risk,” says Frost. “Companies House must act swiftly to introduce robust controls to close this window of vulnerability and prevent serving as a gateway for fraudulent filings that undermine the integrity of bank due diligence and facilitate economic crime. Like banks, the agency should focus on behavioural insights, monitoring device use, behavioural patterns, and anomalies across the lifecycle of a company, to detect suspicious activity without adding friction for genuine users.”
