Digest (periodic roundup)

Q4 2025-Q1 2026 Companies House and ECCTA reforms: fraud prevention, identity verification, and enhanced powers

Between September 2025 and January 2026, three major Economic Crime and Corporate Transparency Act 2023 (ECCTA) provisions came into force, fundamentally reshaping corporate compliance. Large organisations became liable for failure to prevent fraud from 1 September 2025, all directors and PSCs must now verify their identity with Companies House from 18 November 2025, and from 26 January 2026 Companies House gained expanded powers to query, refuse, or remove false or misleading filings. This digest summarises what changed, who is affected, and what companies must do to comply.

Change event: Failure to prevent fraud offence under ECCTA in effect from 1 September 2025 Effective 1 September 2025

Overview

The Economic Crime and Corporate Transparency Act 2023 is being implemented in phases, with three significant commencements between September 2025 and January 2026. These changes represent the most substantial reforms to UK company law and corporate transparency in a generation.

On 1 September 2025, Section 199 ECCTA introduced the new corporate criminal offence of failure to prevent fraud for large organisations. This follows the same "failure to prevent" model as the Bribery Act 2010, making organisations criminally liable unless they can prove reasonable fraud prevention procedures were in place.

From 18 November 2025, mandatory identity verification came into force for all company directors and persons with significant control (PSCs). New directors and PSCs must verify before their appointment can be registered, whilst existing directors and PSCs have a 12-month transition period (ending 18 November 2026) to complete verification.

On 26 January 2026, Commencement Order No. 7 brought further ECCTA provisions into force, expanding identity verification duties to authorised corporate service providers (ACSPs) and granting Companies House new powers to query, refuse, or remove filings that appear false, misleading, or incomplete. Civil penalties of up to £10,000 and criminal offences now apply for inaccurate filings.

Together, these changes shift Companies House from a passive register that accepted filings at face value to an active gatekeeper with enforcement powers, whilst creating new criminal liability for large organisations whose associated persons commit fraud.

Changes covered
3 regulatory changes
Period
September 2025-January 2026
1 September 2025
Failure to prevent fraud offence for large organisations (Section 199 ECCTA)
18 November 2025
Mandatory identity verification for all new directors and PSCs
18 November 2026
Deadline for existing directors/PSCs to complete identity verification
26 January 2026
Companies House query/refusal powers and ACSP identity verification duties

1 September 2025: Failure to prevent fraud offence

Section 199 of ECCTA introduced a new corporate criminal offence of failure to prevent fraud. Large organisations are liable where an associated person (employee, agent, subsidiary, or other person performing services for the organisation) commits a specified fraud offence intending to benefit the organisation.

Who is caught: Organisations meeting at least two of the following three conditions are in scope: more than 250 employees, more than £36 million turnover, or more than £18 million total assets. This includes companies, partnerships, and other bodies corporate, whether incorporated in the UK or operating here.

The defence: The only defence is proving the organisation had reasonable fraud prevention procedures in place at the time of the offence. The Home Office published statutory guidance setting out six principles these procedures should follow: top-level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication and training, and monitoring and review.

These six principles mirror the "adequate procedures" framework under the Bribery Act 2010. Organisations with existing anti-bribery compliance programmes should extend them to cover fraud prevention.

Key actions: Conduct a fraud risk assessment identifying where fraud risks arise across operations, supply chain, and associated persons. Develop or update fraud prevention policies documented in line with the six Home Office principles. Train staff on fraud risks and establish confidential whistleblowing arrangements. Document everything — risk assessments, policies, training records, and due diligence — to evidence the defence if needed.

18 November 2025: Mandatory identity verification for directors and PSCs

From 18 November 2025, all company directors and persons with significant control (PSCs) must verify their identity with Companies House. This applies to approximately 7 million individuals.

New appointments: Any person appointed as a director or registered as a PSC from 18 November 2025 onwards must verify their identity before their appointment can be registered. New company incorporations require each director's Companies House personal identification code in the filing — without it, Companies House will not register the company.

Existing directors and PSCs: Those already registered before 18 November 2025 have a 12-month transition period ending 18 November 2026 to complete verification. The deadline depends on your circumstances:

  • PSC who is also a director: Verify within 14 days after your next confirmation statement due date
  • PSC who is not a director: Verify within 14 days from the first day of your birth month (based on the birth month shown on the Companies House register)

You can request up to two 14-day extensions through the online service, but must request these before your original deadline expires.

Verification methods: Verification can be done directly via the Companies House online service (GOV.UK Verify or Government Gateway) or through an Authorised Corporate Service Provider (ACSP) such as a formation agent, accountant, or solicitor.

Penalties for non-compliance: Civil penalties of up to £10,000, criminal fines of up to £5,000, potential director disqualification, and Companies House striking the company off the register. No prosecutions will be brought during the first 12 months of the transition period (until 18 November 2026).

26 January 2026: Expanded Companies House powers and ACSP duties

The seventh commencement order under ECCTA took effect on 26 January 2026, bringing further transparency and enforcement provisions into force.

Extended identity verification: Authorised corporate service providers (ACSPs) — including company formation agents, accountants, and solicitors who file on behalf of clients — must now verify the identity of the individuals they act for. The categories of persons who must verify their identity have also been broadened beyond the initial November 2025 rollout.

Companies House query and removal powers: Companies House now has expanded powers to query, refuse, or remove filings that appear false, misleading, or incomplete. Previously, the Registrar had very limited ability to reject documents — most filings were accepted on face value with only basic administrative checks.

The Registrar can now:

  • Refuse to register a document if it appears false or misleading
  • Remove information from the register that should not be there
  • Annotate the register with warnings where information is disputed or under investigation
  • Require companies to resolve inconsistencies in their registered information

If Companies House queries a filing, the company must respond promptly with supporting evidence. Failure to respond or resolve inconsistencies can result in penalties.

New penalties: Civil penalties of up to £10,000 apply for delivering false or misleading information to the Registrar. For the most serious cases — including deliberate fraud or persistent non-compliance — criminal offences apply, with potential imprisonment. These penalties apply to anyone who delivers a document to Companies House, not just company directors.

❗ Combined action checklist

Companies and directors should take the following actions:

  • Large organisations (fraud offence): Conduct a fraud risk assessment covering operations, supply chain, and associated persons. Review existing anti-bribery and anti-money laundering procedures and extend to cover fraud prevention. Develop or update fraud prevention policies following the six Home Office principles. Train employees and agents on fraud risks and reporting channels. Establish confidential whistleblowing arrangements. Document all risk assessments, policies, training, and due diligence.
  • Directors and PSCs (identity verification): Check whether you have already verified your identity with Companies House. If not, verify before your deadline (confirmation statement due date for director-PSCs, or birth month for PSC-only individuals). New directors and PSCs must verify before appointment can be registered. Obtain your Companies House personal identification code for use in filings.
  • All companies (filing accuracy): Review your registered information at Companies House for accuracy and completeness. Check that director appointments, PSC entries, registered office address, and accounts are all up to date and consistent. Improve internal controls to ensure all documents submitted to Companies House are accurate before filing. If you use an accountant, solicitor, or formation agent, confirm they are registered as an ACSP and have identity verification procedures in place.
  • Respond to queries promptly: If Companies House queries a filing, respond with supporting evidence without delay to avoid penalties. Keep records of all filings and the basis for information submitted.

⚠️ Penalties and enforcement

The three ECCTA changes carry significant penalties for non-compliance:

  • Failure to prevent fraud (from 1 September 2025): Unlimited fine for the organisation. Individual directors or officers who consent to, connive in, or are negligent about the fraud can also face personal criminal prosecution. Sentencing considers the seriousness of fraud, gain to the organisation, harm caused, and cooperation with investigation.
  • Identity verification failures (from 18 November 2025): Civil penalties up to £10,000 for failure to verify. Criminal fines up to £5,000. Potential director disqualification. Companies House can strike the company off the register. No prosecutions during first 12 months of transition (until 18 November 2026), but penalties will apply after that grace period.
  • False or misleading filings (from 26 January 2026): Civil penalties up to £10,000 for inaccurate filings. Criminal prosecution including potential imprisonment for deliberate fraud or persistent non-compliance. Directors, PSCs, and filing agents can all be held liable. Companies House can refuse to register documents and annotate the register with warnings.

These penalties apply cumulatively — a company that fails to prevent fraud, has directors who have not verified identity, and submits inaccurate filings faces enforcement risk across all three areas.

ℹ️ UK-wide application

These ECCTA provisions apply UK-wide to all companies registered at Companies House, including companies in Scotland, Wales, Northern Ireland, and England. Companies House operates across all four UK nations.

The failure to prevent fraud offence applies to large organisations whether incorporated in the UK or operating here. The identity verification and filing accuracy requirements apply to all UK-registered companies regardless of where they conduct business.

Related updates