If you have heard that the UK now requires identity verification for company directors and want to know whether the rules apply to you, the answer turns on three things. Do you hold a director or PSC role at a UK company, when was that role created or notified, and have you already gone through the verification step. The regime is new in form (the Economic Crime and Corporate Transparency Act 2023 is the underlying statute), narrow in concept (it is a one-off identity check per natural person, not per company), and broad in scope (every UK company in the country is in scope). This page is the entry-level walkthrough.

"Identity verification in the UK" is the headline name for the statutory requirement that natural persons holding director or PSC (Person with Significant Control) roles at UK companies prove their identity to Companies House (via GOV.UK One Login) or to an Authorised Corporate Service Provider (an ACSP, broadly an AML-supervised accountant or company-secretarial firm registered as an ACSP with Companies House). The verification produces a unique personal code that the individual quotes on subsequent filings. The underlying documents are not made public. The legal requirement applies to newly appointed directors and PSCs from 18 November 2025; existing directors and PSCs have a twelve-month transition window to action it through their next confirmation statement.

What Is Identity Verification in the UK in One Paragraph?

Identity verification, in the UK corporate context, is a one-off statutory check that a natural person who holds a director or PSC role at a UK company is who they say they are. The check is required by sections 64 (PSC verification) and 65 (procedure) of the Economic Crime and Corporate Transparency Act 2023, with parallel director-side provisions at ECCTA sections 40 to 45. The individual proves identity by submitting a biometric document (typically a passport) plus a liveness check, either through the free GOV.UK One Login route operated by the Cabinet Office, or through an Authorised Corporate Service Provider operating under ECCTA s.66. The output is a Companies House personal code issued under ECCTA s.68, which is private to the individual and is quoted on future filings as evidence of the verified status. ECCTA s.69 ring-fences the underlying identity documents from public inspection.

Who Has to Verify?

The regime applies to natural persons holding any of three kinds of relationship with a UK company:

Directors. Every individual on the board of a UK company, whether executive, non-executive, founder, or family-member appointee, is in scope. UK residence is irrelevant; an overseas director of a UK company is in scope. The regime covers UK private limited companies, public limited companies, limited liability partnerships (with adjustments), and limited partnerships (under the parallel ECCTA Part 2 LP reforms).

Persons with Significant Control. A PSC is, broadly, any individual who owns more than 25 percent of shares, holds more than 25 percent of voting rights, has the right to appoint or remove a majority of the board, or exercises significant influence or control over the company. The PSC test under Companies Act 2006 Sch 1A includes a look-through rule for trustees and intermediate corporate ownership. Every PSC of a UK company is in scope.

Filers and corporate officers (later commencement). A later commencement phase will bring the persons who file documents at Companies House on a company's behalf into scope, alongside corporate officer scenarios (where a corporate body sits on a board). That phase commences no earlier than November 2026.

For a landlord with multiple BTL SPVs, the practical headline is per-person, not per-company. A founder who is a director of three buy-to-let SPVs and a director of one family investment company verifies once and the same personal code covers all four entities. A parent and spouse holding equal shares across the portfolio verify twice (once each) and each code covers all of their roles.

When Did Identity Verification Become Mandatory?

The commencement chain has three stages.

Voluntary opening, 8 April 2025. Companies House opened the One Login verification route on a voluntary basis from 8 April 2025. Individuals who completed their verification during the voluntary window had a personal code in hand before the legal requirement kicked in.

Legal requirement for new appointments, 18 November 2025. From 18 November 2025, identity verification is a legal precondition to being appointed as a director or notified as a PSC of a UK company. A new appointment or notification on or after that date will be refused by Companies House unless the individual has already verified and has a personal code.

Transition window for existing roles, through approximately November 2026. Directors and PSCs in office on 18 November 2025 are not retrospectively forced to verify on that date. Each company's existing roles must be verified by the next confirmation statement that falls within the twelve-month transition window. A company whose confirmation statement falls in March 2026 verifies its existing roles by that filing; a company whose confirmation statement falls in October 2026 verifies its existing roles by that filing. The effective end of the transition window is around November 2026; companies that have not actioned their existing roles by the second confirmation statement after 18 November 2025 are in non-compliance.

The exact transition mechanics, including any extensions or transitional reliefs announced by Companies House, are published on the official campaign page at changestoukcompanylaw.campaign.gov.uk. Verify the current state of the rollout against that page before relying on the headline dates in any third-party article (including this one): commencement detail can move.

How Do I Verify, and What Are the Two Routes?

There are two routes to identity verification. Both produce the same Companies House personal code; the choice between them depends on logistics, not on the legal weight of the result.

Route 1: GOV.UK One Login. The individual downloads the GOV.UK One Login app to a smartphone, scans a biometric document (in-date passport is cleanest; UK photo driving licence, UK BRP, and UK Frontier Worker permit are also accepted), and completes a liveness check (a short video to confirm the person matches the document). Companies House cross-checks against the document issuer's records and issues the personal code, typically within minutes. The route is free.

Route 2: Authorised Corporate Service Provider (ACSP) under ECCTA s.66. An ACSP is an AML-supervised firm (under MLR 2017, supervised by HMRC, ICAEW, ACCA, ICAS, CIOT, the SRA, or a comparable AML supervisor) that has registered with Companies House as an ACSP. The ACSP completes the verification on behalf of the individual, using the AML-compliant KYC checks the firm already operates for client onboarding. The route is preferred where the family accountant or solicitor already holds the individual's ID documents under MLR 2017, which removes the need to repeat the document upload. The route may involve a fee depending on the ACSP's commercial terms.

For a landlord portfolio, the ACSP route via the family accountant is usually the operationally easier choice. The accountant already holds AML-compliant KYC for each director, the verification can be run for the entire family in one batch, and the personal codes flow straight into the firm's filing workflow for confirmation statements.

What Documents Are Accepted?

The canonical accepted-documents list is published on the gov.uk verify-your-identity-for-Companies-House guidance page. The list moves over time as Companies House adds support for new biometric documents; verify at the point of action.

The cleanest document is an in-date biometric passport (any issuing country). The biometric chip allows the One Login app to read the data directly and the liveness check completes in minutes. UK photo driving licences (full or provisional) and UK biometric residence permits are also accepted via One Login. Where the individual has only a paper-only document, an expired passport, or a non-biometric foreign document, the One Login route may not complete, and the individual typically falls back on the ACSP route where the ACSP can run a non-standard verification.

For overseas directors, the One Login app supports passports from most issuing countries with biometric chips. Where the home-country passport is not supported, the ACSP route can be used with the ACSP completing the verification in the overseas director's country.

What Is a Companies House Personal Code?

The Companies House personal code is the unique identifier issued to each verified individual under ECCTA s.68. The code is a numeric string private to the individual, who quotes it on subsequent Companies House filings (confirmation statement, IN01 incorporation, AP01 director appointment, PSC01 PSC notification, CH01 change of director particulars, and similar) to evidence verified status.

One person equals one code. The same code covers every UK directorship and PSC role that the person holds, present and future. A director appointed to a fifth UK company in 2027 quotes the personal code already on file; no re-verification is required. The code does not expire and is not re-issued unless the underlying identity changes (a name change supported by a deed poll, for example).

The code itself is treated as confidential under ECCTA s.69. It does not appear on the public register; only the fact that the person has been verified appears, attached to their director or PSC entry on the relevant filings.

What Happens if I Do Not Verify?

From 18 November 2025, acting as a director or PSC of a UK company without being verified by the applicable deadline is a criminal offence under ECCTA. The sanctions cluster has three components.

Criminal fines. The company and the individual are both potentially liable for fines. The fine architecture follows the Companies Act civil penalties regime, with maximum fines stepped by the seriousness and persistence of the breach.

Filing refusal. Companies House will reject any filing that names an unverified person in a director or PSC role. The practical consequence is paralysis of routine compliance: confirmation statements cannot be filed, director changes cannot be notified, charges cannot be registered (where a director signature is required on the form), and accounts cannot be filed where the director-confirmation step would name an unverified person.

Disqualification exposure. Persistent non-compliance feeds into the disqualification regime under the Company Directors Disqualification Act 1986. Repeated refusal to verify, alongside other compliance failures, can lead to the Insolvency Service seeking a disqualification order against the individual.

Want this checked against your specific situation?

Drop your email and a one-line summary. We reply within 24 hours, no phone call needed.

What About Overseas Directors of UK Companies?

The verification requirement attaches to the role, not the location. An overseas director of a UK company must verify, regardless of where they live. Most overseas directors verify through One Login using their home-country biometric passport; the app supports passports issued by the vast majority of countries with biometric chips, no UK visit required.

Where the home-country passport is not supported, or where the director prefers an adviser-managed route, the ACSP route can be used. An ACSP can verify a director located overseas by running the AML-compliant KYC remotely (video call plus document review) and lodging the verification with Companies House. The route is well-trodden for US-based directors of UK property-investment companies; our US-based directors page covers the angle in detail.

What About Authorised Corporate Service Providers (ACSPs)?

An ACSP is a firm authorised under ECCTA s.66 to provide identity verification services to Companies House. To become an ACSP, a firm must be supervised under MLR 2017 by an approved AML supervisor (HMRC, ICAEW, ACCA, ICAS, CIOT, the SRA, the Bar Council, or a comparable supervisor for the relevant profession) and must register separately with Companies House as an ACSP.

Most established UK accountants, company-secretarial firms, and law firms are already AML-supervised, so the ACSP registration is procedural rather than substantive. From a landlord's perspective, the practical question is whether your accountant has registered as an ACSP and is offering verification as part of the service. Ask. If the answer is yes, the ACSP route is usually the easier path: the firm already holds your AML-compliant KYC, the verification can be run for the whole family in one batch, and the personal codes flow straight into the confirmation-statement workflow.

Is Verified Identity Data Made Public?

Mostly no. ECCTA s.69 (Identity verification: material unavailable for public inspection) ring-fences the underlying identity documents and biometric data submitted during verification: passport scans, driving-licence images, biometric data, and the personal code itself are not published on the public register.

What is published is the fact that the person has been verified, attached to their director or PSC entry. A user searching Companies House for a director or PSC sees "identity verified" against the name; the user does not see the passport, the address used during verification, or the personal code. This was a deliberate design point during ECCTA passage to balance the policy goal (a register of corporate control with verified identity, hardened against fraud) against the privacy concern that publishing identity documents on a free public database would expose directors to identity theft and harassment.

What Else Changed Under ECCTA?

Identity verification is one of several parallel reforms ECCTA introduced. Others include:

  • Registered email address. Every UK company must hold a registered email address with Companies House and must keep it current. The email is not published publicly; it is used by Companies House to send statutory communications direct to the company.
  • Lawful purposes statement. On every confirmation statement filing, the company confirms that its future activities will be lawful. The confirmation is a recurring obligation, not a one-off.
  • Abolition of locally held PSC and director registers. The previous duty to maintain a separate company-level PSC register and director register at the registered office has been abolished. The central register at Companies House is now the only register.
  • New statutory role for the Registrar. The Registrar of Companies has new active integrity objectives (s.1 ECCTA) and powers to refuse filings, query inconsistent information, and intervene where the register integrity is at risk.
  • Changes to the Register of Overseas Entities (RoE). The ECTEA 2022 RoE regime has been substantially tightened by ECCTA, with sharper sanctions for non-compliance.

Our Companies House confirmation statement changes page covers the 4 March 2024 confirmation statement reforms in detail. Our other Companies House cluster pages cover the registered email, lawful purposes statement, and Registrar powers.

Authorities Cited