The Economic Crime and Corporate Transparency Act 2023 (ECCTA) makes identity verification compulsory for every UK company director and person with significant control (PSC) — a fundamental shift that began on 18 November 2025 and is being phased in over a 12-month transition ending 17 November 2026. Around 6 to 7 million individuals must verify their identity, either free through GOV.UK One Login or via an Authorised Corporate Service Provider (ACSP). Miss it and you cannot file your confirmation statement, your company risks being struck off, and failing to verify is a criminal offence.
This guide explains exactly what is changing, who must act, by when, and how. It is general information, not legal advice; always check current Companies House guidance.
What ECCTA 2023 is — and why it matters
ECCTA is the UK's landmark law for tackling economic crime and improving corporate transparency. Its central aim for company law is simple: make the companies register reliable. Historically, anyone could be listed as a director or PSC without proving their identity, which made the register a soft target for fraud, money laundering, and fake appointments. ECCTA closes that gap and gives Companies House new powers to query, challenge, reject, and remove information rather than simply accept whatever is filed.
The headline change: mandatory identity verification
The central reform is identity verification (IDV). For the first time, directors and PSCs must prove who they are before they can be listed and before they can file. The next two sections set out who must verify and how.
Who must verify
Identity verification is a one-off requirement, with re-verification needed only in limited cases, for all company directors, both new and existing; all registrable PSCs, the people with significant control; members of LLPs and equivalent roles; and anyone who files documents at Companies House, since filing agents will need to be registered ACSPs.
If you sit in one of these roles at more than one entity, you verify once and your single verified identity covers all your roles.
The two ways to verify — and the personal code
There are two routes. The first is directly with Companies House via GOV.UK One Login — free, and usually completed in minutes online. It uses the GOV.UK One Login ID Check app: digital facial verification plus a photo of an approved ID, such as a biometric passport or UK driving licence, and a photo of your face. The second is through an Authorised Corporate Service Provider (ACSP) — an agent such as a company formation agent, solicitor, accountant, chartered secretary, or governance professional, that is registered with Companies House and supervised under the UK's anti-money-laundering regime.
Once verified, you receive a unique Companies House personal code that links your verified identity to your roles on the register. You quote this code when confirming verification for a directorship or PSC role.
The timeline: key dates
The rollout is phased across 2025 and 2026.
| Date | What happens |
|---|
| 8 April 2025 | Voluntary IDV opened — individuals could verify early via GOV.UK One Login or an ACSP. |
|---|
| 18 November 2025 | IDV became mandatory for new incorporations and new director/PSC appointments. The 12-month transition for existing individuals began. |
|---|
| 18 Nov 2025 to 17 Nov 2026 | Transition period. Existing directors verify by their company's confirmation statement date; existing PSCs who are not directors verify by the 14th of their birth month. |
|---|
| By mid-November 2026 | Companies House estimates 6 to 7 million individuals will have needed to verify. |
|---|
| Later (2026 to 2027) | IDV extends to corporate directors, corporate LLP members, officers of corporate PSCs, and limited partnerships. |
|---|
If you take on a new directorship or PSC role on or after 18 November 2025, you may need to verify earlier, aligned to the new-appointment rules.
The other ECCTA changes already in force
IDV is the headline, but ECCTA brought several other changes you should know. Since 4 March 2024, companies must maintain an appropriate registered office address — a PO box alone is no longer acceptable — provide a registered email address, and confirm on incorporation and at each confirmation statement that their intended activities are lawful.
From 18 November 2025, companies no longer keep their own register of directors, register of directors' residential addresses, register of secretaries, or PSC register; that information is now held centrally at Companies House, though companies still keep a register of members. Companies House also gained stronger powers to scrutinise and reject filings, and fees have risen. And third parties submitting filings will need to be registered ACSPs, with software-only account filing also being phased in.
What happens if you don't verify
This is a legal mandate, not an administrative nicety. Failing to verify can mean blocked filings — you cannot file your confirmation statement (the CS01), and a company that fails to file risks being struck off the register. It can also mean rejected incorporations and appointments, and ineligibility to make statutory filings. And it can bring criminal and civil penalties — failing to verify is an offence that can lead to a fine or a criminal record, and acting as a director without verifying is itself an offence.
What this means for verifying a UK company
For anyone who relies on the register — doing due diligence on a supplier, partner, or counterparty — ECCTA is good news. With directors' and PSCs' identities verified and linked to a personal code, the Companies House record becomes far more trustworthy, and fraudulent or fictitious appointments become much harder. It is the UK equivalent of the at-source company-registry checks we describe for verifying a Nigerian CAC certificate: confirm the company and its officers against the official register rather than trusting a document at face value.
Where verifiable issuance fits — and where it doesn't
ECCTA reflects a wider truth: trust is moving to verify-at-source. The government is verifying the identity of the people behind a company so the register can be relied upon. The same principle applies to the documents a company issues — contracts, certificates, corporate resolutions, statements, and letters that counterparties later have to trust, and that today carry no built-in way to verify them.
That is where VerifyDoc.ai fits: it lets your company issue documents that each carry a QR-backed Certificate of Authenticity and a proof page, so any recipient can confirm a document is genuine and unaltered in seconds — and you can e-sign them with a verification trail.
Read this carefully: VerifyDoc.ai is not an Authorised Corporate Service Provider, is not a Companies House identity-verification provider, and cannot perform or replace ECCTA identity verification. To verify your identity for Companies House, you must use GOV.UK One Login or a registered ACSP. VerifyDoc.ai's role is limited to making the documents your company issues independently verifiable — a complement to ECCTA's trusted-register goal, not a substitute for IDV. See how it works.
A checklist for directors and companies
Map who is in scope — every director, registrable PSC, and LLP member. Choose your route — GOV.UK One Login, which is free, or an ACSP. Verify early; do not wait for your deadline, because bottlenecks build near confirmation-statement dates. Record your personal code and use it to confirm verification for each role.
Diarise the deadline — the confirmation-statement date for directors, and the 14th of the birth month for non-director PSCs. Check your registered office and email meet the appropriate standard, and that your lawful-purpose statement is in order. Use a registered ACSP if a third party files on your behalf. And take advice for group structures, overseas directors, or complex PSC arrangements.
Make the documents your company issues verifiable
ECCTA verifies the people behind your company. VerifyDoc.ai lets you make the documents your company issues — contracts, certificates, corporate letters — carry a QR-backed Certificate of Authenticity any counterparty can scan to confirm they are genuine and unaltered. Start free or see how it works.
Related reading: How to verify a CAC Certificate of Incorporation (Nigeria) and UK GDPR and verifiable documents: an issuer's guide.
This article is for general information and does not constitute legal advice. ECCTA implementation is phased and dates and details may change; always confirm current requirements with Companies House and take professional advice on your circumstances.
