One of the key elements of the new Economic Crime and Corporate Transparency Act (ECCTA) is identity verification (IDV). Under new provisions, IDV for directors (and equivalents such as LLP members), people with significant control (PSCs) and anyone filing at Companies House on behalf of a company is becoming mandatory.
IDV for directors and PSCs launched on 8 April 2025. This is currently voluntary, but mandatory IDV will be required from 18 November 2025. The verification process is designed to deter people trying to incorporate and use companies for illegal purposes, and to give people using the register greater confidence that directors and PSCs of companies are who they say they are.
There are two routes for directors and PSCs to meet IDV requirements. Most people will do it directly through Companies House using its One Login system. But verification can also be done via third party providers, including accountants.
- If your firm wishes to provide IDV services to clients, you need to be registered as an Authorised Corporate Service Provider (ACSP).
- If you want to carry out IDV checks on your clients and submit that information to Companies House, you will need to register.
Meeting the standard
Once registered as an ACSP, you will be expected to verify individuals to the same standard as those verifying directly through the Companies House service. To support the process, Companies House has produced comprehensive guidance on how to meet the verification standard and comply with your legal responsibilities as an ACSP.
The steps laid out in the guidance are minimum checks, and you must complete every step to verify someone’s identity. Checks can be carried out remotely or in person. You can also use commercial identity verification providers or platforms but, in this case, you are still responsible for deciding whether the required information provided by the person being verified is genuine.
“There are, of course, very strict procedures around how ACSPs must verify individuals,” explains Sandy Price, AML Manager at ICAEW. You must follow the prescribed steps, and there is a list of the various documents that can be used as evidence of identity, which depend to some extent on how you will be checking documents submitted as evidence.
One option is to use ID Validation Technology (IDVT) to confirm that the required document, such as a passport or driving licence, is legitimate. This technology reads the cryptographic features of the document.
Alternatively, firms can verify the individual documents manually. If the documents are being checked by a person, however, that person must be trained in detecting false documents by a specialist training provider. According to the Companies House guidance, this could be any organisation that follows the Home Office best practice guide. Neither Companies House nor ICAEW holds a list of approved providers for IDV training, but you can search online for appropriate organisations.
ACSPs and IDV services
As of 10 June, Companies House had processed around 70-80,000 IDVs through One Login and over 2,000 via an ASCP. “Our analysis shows that One Login can handle about 96 to 97% of all people on the register,” says Mark Buckley, Senior Implementation Lead at Companies House. “So, it has the capability to do the majority of what Companies House needs. But there are still people that One Login can't process.” Examples include politically exposed persons, people on sanctions lists, and people without the documents required to use One Login (such as biometric passports or UK photo driving licences).
“This is where the ACSP community can step in,” suggests Mark. “One Login is quite a standard process, whereas ACSPs have a really big toolbox at their disposal. Our guidance gives an extensive list of all of the things available to an ACSP to be able to verify someone's identity if they don't present with the gold standard microchipped passport,” he explains. “There are a lot of documents in our guidance that can be used, but you need to assure yourself that you've had enough information to ensure a person is identity verified, because ultimately the risk is yours.”
“It is quite risky identity verifying people,” he adds, “which is why you shouldn't undertake it lightly.” And if you get it wrong, the consequences for your business could be serious. “If you fail to comply with the required standard, Companies House can remove you from the ACSP register, which means you will not be able to file on clients’ behalf at Companies House in future, or provide the IDV service,” emphasises Sandy. “Furthermore, if you lose your status as an ACSP, any individuals that you have verified will have that verification removed from the register, and they’ll need to get it done again by a new ACSP. This means the repercussions of not verifying appropriately could have a significant impact, including reputational damage. So, think long and hard before taking on that responsibility.”
Recognising AML risks
"ICAEW doesn't have an AML supervisory remit over work to file documents on behalf of clients or IDV; it’s policed and enforced by Companies House” explains Michelle Giddings, Head of AML, within Professional Standards ICAEW. "Having said that, our firms do need to recognise the engagement risks associated with ACSP work and in particular IDV” Michelle stresses. “Directors can verify their own identity directly at Companies House and, for many individuals, it will be easy enough to do it themselves, so you always need to ask yourself why an individual has come to you to verify their identity, because there's a risk that those who don't want to reveal their identity might try to exploit ACSPs.”
“Clearly, if you've had a client for a number of years, and you know them, then this risk will be significantly lower,” she adds. “But if an individual walks in off the street and asks you to verify their identity, you have to think quite carefully about the risk of professionally enabling that individual to obscure who they really are.”
“It’s also important to understand that the Companies House IDV is not the same as the risk-based approach to client due diligence under the MLRs,” adds Michelle. “So, you must follow all the steps in the Companies House guidance to meet the standard required.”
“Verification under the MLRs is risk-based,” explains Sandy, “which means there’s no prescriptive requirement as to how you choose to verify your client; it’s dependent on the element of risk you have assessed when you take them on board. There are all sorts of different ways you can verify, based on the risks you want to mitigate.”
“The Companies House IDV,” she emphasises, “takes a prescribed step-by-step approach, which is because it’s simply aimed at verifying a person is who they say they are, rather than managing the broader risk of that person being involved in money laundering.”
“Another point to note,” says Sandy, “is that you need to keep records for seven years under the Companies House requirements. And that’s above and beyond the length of time one would normally keep records for AML purposes.”
Think carefully
If you already have the necessary IDVT, expertise and skills in house, providing IDV services may be something that can add value to your firm and clients. But if you need to purchase equipment and train up staff to the required levels, you should weigh the costs and risks involved in offering IDV services against the potential benefits.
“You also need to recognise that getting IDV wrong really matters,” stresses Michelle. “You could lose your ACSP status in its entirety, which means you won't even be able to file for your clients. So, we advise thinking carefully about the pros and cons.”
Advising clients
Whether you choose to provide IDV services or not, you’ll need to advise clients on what IDV means for them and how they can complete it themselves. To support this, Companies House has produced detailed guidance for directors and PSCs, including how to verify their identity through different channels, including online through One Login, via an ACSP and in person at a Post Office.
If you’re a limited company or limited liability partnership, you will also need to verify identities for directors and PSCs for your own practice. And, if you want to register as an ACSP, you’ll need to verify your identity before you can use the online registration service. “One way of supporting clients might be to go through the One Login process yourself, and see how it works in practice, so you can then advise what your own experience was like,” suggests Michelle.
At ICAEW, we’ll be continuing to highlight relevant updates from Companies House, as well as supporting our firms with further guidance material on key issues. You can watch our recent webinar on demand to hear more from Mark, Sandy and Michelle. And look out for our upcoming AMLbites videos, which will cover topics such as ACSP registration, and IDV requirements and challenges.
Resources
- Watch ICAEW’s webinar, Companies House update: ACSPs and the Economic Crime and Corporate Transparency Act
- Visit the Companies House campaign webpage, which contains links to further guidance, blogs and updates
- Read our previous article on the background to the ECCTA changes and the ACSP registration process