An email from Companies House asking you to verify your identity is almost certainly real, but it is also exactly the email a scammer would forge. So the two questions to settle, in order, are whether yours is genuine and what it actually requires of you. On the first: Companies House has been emailing directors and PSCs systematically during the transition window for identity verification under ECCTA 2023, so a real notice is the likeliest explanation, but impersonation scams have piggybacked on the campaign and the authentication checks matter. On the second: you verify your identity once at Companies House, via the free GOV.UK One Login route or via an Authorised Corporate Service Provider, then quote the resulting personal code on your company's next confirmation statement. That is the whole job.

Free interactive tool

Free Incorporation and company structures tool

See the real cost and saving of incorporating

Our interactive tool is built for a larger screen. Tell us your numbers and a specialist will send your figure and the next sensible step, with no obligation.

Step 1 of 2, about you

Step 1 of 2, about you

Is This Email Genuine? How to Authenticate a Companies House Communication

The fastest way to assess a Companies House email is to run the five standard authenticity tests.

Sender domain. Legitimate Companies House emails come from a gov.uk domain, typically @companieshouse.gov.uk or @notifications.service.gov.uk. Hover over the sender name (in most email clients) to reveal the actual email address. A sender domain that is gov.uk-adjacent but not actually gov.uk (a hyphenated lookalike, an unrelated TLD, or a free-mail service) is a red flag.

Specific company reference. A genuine email will reference your specific company by name and Companies House number, and may reference your role (director, PSC, or both) within that company. A vague "Dear sir or madam, please verify your identity for your business" with no company-specific details is a red flag.

No payment request, no password ask. Companies House does not collect verification fees by emailed payment link. The GOV.UK One Login route is free. Any email demanding direct payment through a link, asking for password or banking details, or insisting on urgent payment to avoid a fine, is a phishing attempt.

Link destinations. Hover over any link before clicking to reveal the true URL. Genuine Companies House links go to gov.uk addresses (typically gov.uk, companieshouse.gov.uk, or signin.account.gov.uk). A link that purports to go to Companies House but resolves to a non-gov.uk address is a red flag.

Cross-reference the campaign page. The Companies House campaign page at changestoukcompanylaw.campaign.gov.uk tracks the official rollout state at any given moment. If your email matches what the campaign page is currently communicating (commencement state, transition-window guidance, document acceptance), it is probably genuine. If your email contradicts the campaign page (a different deadline, an unexpected requirement, an unusual payment ask), it is probably not.

If you remain uncertain, contact Companies House directly via the published telephone number on the official site, never via a phone number supplied in the email itself. Report suspected impersonation scams to Action Fraud and follow the NCSC suspicious-email guidance for additional security-hygiene steps.

What Does the Email Actually Require?

A genuine identity-verification email from Companies House does five things. It tells you about the obligation under ECCTA 2023 to verify your identity as a director, a PSC, or both. It names your specific company and your role in it. It states your deadline, anchored to your company's next confirmation statement falling within the transition window if your role already existed, or immediately for a new appointment. It points you to the GOV.UK One Login route or an Authorised Corporate Service Provider under ECCTA s.66. And it gives you your company's confirmation statement filing date for reference.

What it asks you to do: complete the verification, obtain your Companies House personal code (issued under ECCTA s.68), and make sure that code is recorded on your company's next confirmation statement. The One Login route costs you nothing. The code it produces is private to you and covers every UK directorship and PSC role you hold, so you never re-issue it company by company.

How Fast Do I Need to Act?

Your deadline depends on when your role started and your company's filing cycle.

Newly appointed director or PSC (appointed on or after 18 November 2025). You have to verify before the appointment can be lodged at Companies House. The filing simply will not accept an unverified person, so verification happens as part of the appointment, not afterwards. If you have been told you are joining a UK company board, verify your identity now.

Existing director or PSC (in office before 18 November 2025). You have to verify by your company's next confirmation statement falling within the twelve-month transition window, which began 18 November 2025 and ends around November 2026. Each company you sit on has its own confirmation-statement date, and that date sets your deadline. If the confirmation statement is filed late, you still have to be verified by that filing date.

Do not wait until the confirmation-statement deadline. If you hold a biometric passport, the One Login app takes you ten to thirty minutes, longer only if your documents need extra review. Volume at Companies House climbs as the transition window closes, so verifying early keeps you clear of any system-load delay.

What If I Ignore the Email?

Ignoring a genuine identity-verification email is not a safe option. Three consequences follow if you do nothing.

Criminal liability for acting unverified. Carrying on as a director or PSC of a UK company without being verified by your deadline is a criminal offence under the ECCTA 2023 framework. The maximum fines escalate with persistence, and while the enforcement case-law is still building, the early-rollout pattern is that Companies House is taking the regime seriously.

Companies House filing refusal. While you are named in a director or PSC role unverified, Companies House will refuse your company's filings. Compliance grinds to a halt: you cannot file the confirmation statement, you cannot notify appointments, change-of-particulars filings are rejected. The knock-on effects reach your lenders (a company that cannot file its confirmation statement looks bad on a search), your insurers, and any supplier running due diligence on you.

Disqualification exposure. Repeated non-compliance with the ECCTA framework, alongside other compliance failures, can feed into disqualification proceedings under the Company Directors Disqualification Act 1986. The Insolvency Service enforces disqualification, and the threshold is unfitness to manage a UK company.

The cumulative cost of ignoring verification is far higher than the cost of doing it. It takes you minutes; skipping it can cost you years.

See the real cost and saving of incorporating

Skip the spreadsheet. Tell us about your situation and a specialist will review your position and the next sensible step, with no obligation.

Step 1 of 2, about you

Step 1 of 2, about you

How Does the Verification Process Actually Work?

Verification runs in five steps.

Step 1: Gather your identity document. An in-date biometric passport (any country) is the cleanest route. A UK photo driving licence, UK biometric residence permit, and UK Frontier Worker permit are also accepted via the One Login app. Check the current accepted-documents list on the gov.uk verify-your-identity guidance page before you start.

Step 2: Choose your route. Either the free GOV.UK One Login self-service route (download the app, scan your document, complete a liveness check), or the Authorised Corporate Service Provider route through your accountant or company-secretarial firm, which completes verification using the AML-compliant KYC it already holds on you, usually for a small fee.

Step 3: Complete the verification. On One Login, if you hold a biometric passport this takes you ten to thirty minutes. The app reads your document, runs a liveness check through your phone camera, and submits the verification to Companies House. On the ACSP route, the firm files it for you using its own client-onboarding documentation.

Step 4: Receive your personal code. Companies House issues you a unique personal identification code under ECCTA s.68. It is private to you and does not appear on the public register under ECCTA s.69. You quote it on later Companies House filings as proof you are verified.

Step 5: Update every UK directorship and PSC role. Your code covers every company in which you hold a director or PSC position. At each company's next relevant filing (confirmation statement, appointment notification, change of particulars), the code goes on the record against your name. Your accountant or company-secretarial agent usually runs this filing flow for you.

For the full operational walkthrough with the landlord-LtdCo angle, see our ECCTA identity verification operational page, and for the wider framework our complete guide to identity verification in the UK.

One Login or ACSP: Which Route Suits My Situation?

This is an operational choice, not a legal one: both routes produce the same Companies House personal code.

GOV.UK One Login suits you if: you hold a valid biometric document (an in-date passport especially); you are happy installing and using a smartphone app; you already have an active GOV.UK One Login account from tax or other services; you do not have a settled relationship with an accountant who could handle the verification for you.

An ACSP suits you if: your accountant or company-secretarial firm has already registered with Companies House as an ACSP; that firm already holds your AML-compliant KYC documentation under MLR 2017; you hold several directorships across different entities and want them handled together; you do not have a biometric document the One Login app supports; or you simply prefer an adviser-managed process. ACSP fees typically run in the £20 to £100 range per individual, and if you run a multi-SPV portfolio the convenience usually outweighs the cost.

What If My Role on the Companies House Register Is Wrong?

Companies House emails from the register state at a recent snapshot date. If it lists you as a director or PSC of a company you have resigned from, or where your PSC interest has changed, the email is reflecting an out-of-date entry. That is a register-accuracy problem, and you need to fix it separately from the verification question.

So: log in to Companies House through the official portal, review the current entry for the company, and file the right correction (TM01 for a director resignation, CH01 for a change of director particulars, or PSC07 for cessation of a PSC notification). If the company has fallen behind on its statutory filings, chase the company first; if it will not respond, you can notify Companies House of your resignation yourself.

Do not verify your identity for a role you no longer hold. Correct the register first, then verify (or not, depending on which roles you actually keep).

What Other ECCTA Reforms Should I Expect?

Identity verification is one of several Companies House reforms ECCTA introduced. The others: a registered email address for every UK company (not published publicly, used by Companies House for statutory communications); a lawful purposes statement on every confirmation statement; the abolition of locally-held PSC and director registers, with everything consolidated at the central Companies House register; new active integrity objectives and powers for the Registrar (ECCTA s.1); the Authorised Corporate Service Provider regime under ECCTA s.66; and a substantial tightening of the Register of Overseas Entities (RoE) framework. They run in parallel, and your email may mention some of them alongside the identity-verification ask. Our Companies House confirmation statement changes page covers the confirmation-statement reforms in detail.

Authorities Cited