Tips and pitfalls: ID verification for existing directors

Croner..

All directors and people with significant control (PSCs) need to verify their identity with Companies House before the transition period ends. Meg Ogunsola, global head of entity management at Vistra, explains the process and potential risk areas.

Company directors must act now ahead of the end of the identity verification transition period in November to fix gaps in their records and ensure their entity governance can withstand tougher enforcement.

Directors are facing growing scrutiny from Companies House over filings, identity verification and corporate governance. The era of Companies House as a passive registrar has well and truly ended. Between January and June 2026, it disqualified 23 directors for persistent or serious non-compliance with filing requirements for a combined 70 years, fining them a total of £17,810, and prosecuted hundreds more.

The fight against corporate crime and fraud has seen Companies House undergo its biggest shake-up since its formation, with the Economic Crime and Corporate Transparency Act 2023 (ECCTA) giving it new powers to issue financial penalties and disqualify people and firms from the register.

Under the ECCTA, large organisations that meet at least two of three thresholds of more than 250 employees, annual turnover of more than £36m, or total assets of more than £18m, can be held liable when an associated person commits fraud intending to benefit the organisation. The Crime and Policing Act 2026 has also expanded liability to all criminal offences committed by senior managers.

Furthermore, all directors and people with significant control (PSCs) must now file documents verifying their identities by November 2026, while presenters and third-party agents must do so by November 2027. Further reforms are set to be introduced in 2028 mandating digital filing of accounts and requiring small and micro companies to file profit and loss accounts and balance sheets.

But the significance of Companies House’s active gatekeeping goes beyond the prospect of penalties. It also exposes weaknesses in governance, entity data and compliance processes, particularly for companies with several entities and fragmented workflows.

As enforcement grows, businesses should use this as a catalyst to get their records in order, improve data integrity and establish clear accountability for keeping that information accurate.

Non-compliance carries criminal weight

Since 18 November 2025, identity verification has been mandatory for new directors, PSCs and limited liability partnership (LLP) members.

Existing directors and PSCs were given a transition period of up to one year, with the deadline for directors dependent on their next confirmation statement, and within 14 days of the first day of their birth month for PSCs.

Despite directors having been able to verify their identity since April 2025, just under 4m of the more than 7m affected had done so by June duringh the transition period.

Companies House has been active in cleaning up the register. Since March 2024, it has removed more than 151,000 registered office addresses and seized millions in suspected criminal proceeds.

Failing to complete mandatory identity verification can lead to civil and criminal penalties, including unlimited fines and even imprisonment where false or misleading information is provided.

Companies also face severe operational consequences, from being unable to complete statutory filings to having new incorporations or registrations rejected. Directors can also face disqualification, while the public register may display them as ‘unverified’.

All of this can have a significant impact on the reputation of both directors and their companies. With the end of the transition period fast approaching, recent enforcement activity should serve as a clear warning that Companies House expects businesses and directors need to meet their obligations.

The practical barriers to verification

However, directors may struggle to verify their identity not because of a lack of intent, but due to weak organisational processes.

Outdated director records, incorrectly identified or missing PSCs, inconsistencies across group entities, fragmented ownership records, unclear responsibility for filings and poor audit trails can all undermine a company’s ability to contact the relevant people and ensure they complete verification on time.

In that sense, identity verification is more than a compliance exercise, acting as an early indication of whether a business truly has accurate records, clear accountability, and effective oversight across its corporate structure.

For example, less than half (43%) of UK directors surveyed by Vistra believed they had correctly identified their PSCs, demonstrating how difficult it can be to establish who the right people are.

This challenge is exacerbated for larger, complex businesses where directors, PSCs, legal teams and entity records may be spread across multiple jurisdictions, systems and time zones. This makes it harder to maintain a single, accurate view of who controls each entity and who is responsible for keeping its records up to date.

Even where overseas directors are aware of their responsibilities, they can face more limited routes to verification. Companies House’s direct verification route does not support non-biometric documents, there is no built-in multilingual interface for people whose first language is not English, and overseas directors cannot complete the process in person in the same way UK-based directors can at Post Offices.

What good governance looks like

With the clock ticking, companies should use this as an opportunity to strengthen their internal governance structures and ensure company secretaries, legal teams or entity management functions have clearly defined ownership of compliance.

They should map every UK entity and each accountable director and PSC across the group, and review filing information for inaccuracies or inconsistencies. Checking the verification status and individual due dates of each person, and alerting those who have not yet verified well in advance, will give them sufficient time to complete the process rather than leaving it until the final day.

However, verification should not be treated as a one-off activity. Organisations may still face governance risks if they lack processes for new appointments, ownership changes, corporate restructurings, ongoing monitoring and filings, particularly with upcoming account filing changes in 2028.

This means establishing a consistent approach across jurisdictions and ensuring changes made locally are reflected in a centralised entity record. Clear escalation routes and defined ownership can help prevent information becoming fragmented across teams and systems.

Where appropriate, particularly for complex structures or difficult PSC determinations, specialist external support can help reduce administrative strain and create a defensible audit trail.

Companies House’s tougher stance should be an incentive for businesses to ensure they are operationally ready for greater scrutiny and ongoing regulatory change. In an era of tougher enforcement, that ability to demonstrate control over your entities will separate those that treat governance as a compliance exercise from those building stronger, more transparent and more resilient entity governance for the years ahead.

About the author

Meg Ogunsola, global head of entity management at Vistra