Identity verification at Companies House is now a legal requirement for company directors and people with significant control, and the 12-month transition period that began in November 2025 is close to its end. This article explains who must verify, how, and what the first prosecutions have shown.
What changed on 18 November 2025?
According to GOV.UK, identity verification became a legal requirement on 18 November 2025. The official guidance is careful to say that this date “is not a deadline”: it marks the start of a 12-month transition period, giving companies time to make sure every director and person with significant control (PSC) has verified by their individual due date.
The rule sits within the Economic Crime and Corporate Transparency Act 2023. Its aim is to make the register of companies more reliable by tying each role on it to a verified real person, as part of wider changes to what companies must file and disclose.
Who has to verify, and by when?
The announcement from Companies House set out different timings for different people:
| Person | When they must verify |
|---|---|
| New director | Before being appointed to an existing company, or before incorporating one |
| Existing director | When filing the company’s next confirmation statement during the transition |
| Existing PSC | Within the 12-month transition, with an individual window of 14 days linked to their status |
| Limited partnerships, corporate directors, corporate LLP members | Later; no date given in the announcement |
Companies House estimated that 6 to 7 million individuals need to verify by mid-November 2026. Directors and PSCs can check the register for their own verification due dates.
Acting as a director without being verified, once the director duties begin to apply, is an offence. Verification is not optional, and the Insolvency Service has said there is no opt-out.
How does a director actually verify?
There are two routes, according to GOV.UK.
Online through GOV.UK One Login
This route is free. It requires one of the following kinds of photo ID:
- a biometric passport from any country;
- a UK photo driving licence, full or provisional;
- a UK biometric residence permit;
- a UK biometric residence card; or
- a UK Frontier Worker permit.
The person also needs their current address, the year they moved there and a GOV.UK One Login account.
Through an authorised professional
An Authorised Corporate Service Provider (ACSP) can verify identity on a person’s behalf. These are accountants, solicitors or other professionals supervised for anti-money-laundering purposes and registered with Companies House. The person has to provide suitable identity documents.
Once verified, an individual receives a personal code. From 18 November 2025 they need that code, plus a verification statement, for each company role they hold.
What if the photo ID has expired?
GOV.UK’s updated guidance, last revised on 30 April 2026, sets out different tolerances:
- expired passports cannot be used;
- a DVLA-issued driving licence can be used if it expired within the last 90 days;
- a residence permit, residence card or Frontier Worker permit can be used if it expired within the last 18 months.
Expired documents cannot be used for the alternative routes, which are to verify with bank or building society details and a National Insurance number, or in person at the Post Office after entering photo ID details online.
What did the first prosecutions show?
On 17 September 2026 the Insolvency Service announced its first convictions for identity verification offences. Three directors were fined at City of London Magistrates’ Court on 16 September.
- One director acted as a director while unverified, including in board decisions and signing accounts. She verified about nine months after the deadline, shortly before court, and was also convicted over a late confirmation statement.
- A second director had verified his own identity but failed to take reasonable steps to stop the first from acting unverified, despite knowing the requirement.
- A third director signed and delivered accounts while unverified, verified around 28 May 2026, and was also convicted of failing to file a confirmation statement on time.
The money involved was modest. The amounts reported were:
| Defendant | Fine | Costs | Victim surcharge | Total |
|---|---|---|---|---|
| Director 1 | £166 | £85 | £66 | £317 |
| Director 2 | £307 | £85 | £123 | £515 |
| Director 3 | £80 | £85 | £32 | £197 |
The totals are illustrative arithmetic from the reported figures: £166 + £85 + £66 = £317; £307 + £85 + £123 = £515; and £80 + £85 + £32 = £197.
Why do small fines still matter?
Three points stand out beyond the sums.
First, the second conviction shows that a director who has personally verified can still be exposed if they know a colleague has not and take no reasonable steps to stop that person acting. Responsibility is shared across the board.
Second, the cases involved ordinary small companies, and the unverified director’s activity was routine: signing accounts and taking part in decisions. Acts that look administrative are the ones that trigger the offence.
Third, a conviction is a public record. For a business that relies on lenders, suppliers or investors reading the register, an offence tied to late filings is not a trivial matter, even if the fine is. Readers who follow how to read a company’s financial story will know that governance signals, such as timely filing, form part of the picture.
How should a board approach the end of the transition?
Companies House has said it will take a proportionate approach to enforcement and will help companies comply. Its 2026 to 2027 business plan, according to GOV.UK, aims for all companies to have met identity verification requirements linked to their confirmation statement, or to be on an appropriate pathway to compliance or enforcement action, by the end of the financial year.
In practical terms, the governance questions are straightforward:
- Does the company hold a current list of every director and PSC, with each person’s verification status?
- Is anyone acting as a director who has not yet verified?
- Is the confirmation statement timetable aligned with verification, since existing directors confirm at that point?
- Are the roles that arrive later, such as corporate directors, being tracked?
The GOV.UK guidance also warns against letting others use, selling or giving away an identity, because the person could be legally responsible for debts or other liabilities taken out in their name. That warning is a reminder that the register’s reliability protects individuals as well as the public.
For a business-side view of the same rules, see how director identity verification works for businesses.
What is the difference between the confirmation statement and verification?
The two are often confused. A confirmation statement is the company’s annual check that the information held on the register is correct. Identity verification is about the individual: it establishes that the named director or PSC is a real person who has proved who they are. For existing directors the two meet, because the GOV.UK guidance says they confirm verification when they file the next confirmation statement. A company that files late therefore risks two problems at once, as two of the convicted directors found, since each was also convicted over a confirmation statement that was late or missing.
Verification as routine company housekeeping
Identity verification is now part of the ordinary rhythm of company administration, alongside accounts and confirmation statements. The 18 November 2025 start date opened a 12-month window, and the first fines show that acting without verification can lead to prosecution, even where the penalty is small. Directors and PSCs who have not yet verified can do so free online or through an authorised professional, and boards can reduce risk by keeping a simple record of who has completed the step.
This article is general information, not personalised financial or legal advice; rules, dates and rates change.
Sources: GOV.UK; Companies House; Insolvency Service
