Q4 2025-Q1 2026 Companies House and ECCTA reforms: fraud prevention, identity verification, and enhanced powers

Overview

The Economic Crime and Corporate Transparency Act 2023 is being implemented in phases, with three significant commencements between September 2025 and January 2026. These changes represent the most substantial reforms to UK company law and corporate transparency in a generation.

On 1 September 2025, Section 199 ECCTA introduced the new corporate criminal offence of failure to prevent fraud for large organisations. This follows the same "failure to prevent" model as the Bribery Act 2010, making organisations criminally liable unless they can prove reasonable fraud prevention procedures were in place.

From 18 November 2025, mandatory identity verification came into force for all company directors and persons with significant control (PSCs). New directors and PSCs must verify before their appointment can be registered, whilst existing directors and PSCs have a 12-month transition period (ending 18 November 2026) to complete verification.

On 26 January 2026, Commencement Order No. 7 brought further ECCTA provisions into force, expanding identity verification duties to authorised corporate service providers (ACSPs) and granting Companies House new powers to query, refuse, or remove filings that appear false, misleading, or incomplete. Civil penalties of up to £10,000 and criminal offences now apply for inaccurate filings.

Together, these changes shift Companies House from a passive register that accepted filings at face value to an active gatekeeper with enforcement powers, whilst creating new criminal liability for large organisations whose associated persons commit fraud.

1 September 2025: Failure to prevent fraud offence

Section 199 of ECCTA introduced a new corporate criminal offence of failure to prevent fraud. Large organisations are liable where an associated person (employee, agent, subsidiary, or other person performing services for the organisation) commits a specified fraud offence intending to benefit the organisation.

Who is caught: Organisations meeting at least two of the following three conditions are in scope: more than 250 employees, more than £36 million turnover, or more than £18 million total assets. This includes companies, partnerships, and other bodies corporate, whether incorporated in the UK or operating here.

The defence: The only defence is proving the organisation had reasonable fraud prevention procedures in place at the time of the offence. The Home Office published statutory guidance setting out six principles these procedures should follow: top-level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication and training, and monitoring and review.

These six principles mirror the "adequate procedures" framework under the Bribery Act 2010. Organisations with existing anti-bribery compliance programmes should extend them to cover fraud prevention.

Key actions: Conduct a fraud risk assessment identifying where fraud risks arise across operations, supply chain, and associated persons. Develop or update fraud prevention policies documented in line with the six Home Office principles. Train staff on fraud risks and establish confidential whistleblowing arrangements. Document everything — risk assessments, policies, training records, and due diligence — to evidence the defence if needed.

18 November 2025: Mandatory identity verification for directors and PSCs

From 18 November 2025, all company directors and persons with significant control (PSCs) must verify their identity with Companies House. This applies to approximately 7 million individuals.

New appointments: Any person appointed as a director or registered as a PSC from 18 November 2025 onwards must verify their identity before their appointment can be registered. New company incorporations require each director's Companies House personal identification code in the filing — without it, Companies House will not register the company.

Existing directors and PSCs: Those already registered before 18 November 2025 have a 12-month transition period ending 18 November 2026 to complete verification. The deadline depends on your circumstances:

• PSC who is also a director: Verify within 14 days after your next confirmation statement due date
• PSC who is not a director: Verify within 14 days from the first day of your birth month (based on the birth month shown on the Companies House register)

You can request up to two 14-day extensions through the online service, but must request these before your original deadline expires.

Verification methods: Verification can be done directly via the Companies House online service (GOV.UK Verify or Government Gateway) or through an Authorised Corporate Service Provider (ACSP) such as a formation agent, accountant, or solicitor.

Penalties for non-compliance: Civil penalties of up to £10,000, criminal fines of up to £5,000, potential director disqualification, and Companies House striking the company off the register. No prosecutions will be brought during the first 12 months of the transition period (until 18 November 2026).

26 January 2026: Expanded Companies House powers and ACSP duties

The seventh commencement order under ECCTA took effect on 26 January 2026, bringing further transparency and enforcement provisions into force.

Extended identity verification: Authorised corporate service providers (ACSPs) — including company formation agents, accountants, and solicitors who file on behalf of clients — must now verify the identity of the individuals they act for. The categories of persons who must verify their identity have also been broadened beyond the initial November 2025 rollout.

Companies House query and removal powers: Companies House now has expanded powers to query, refuse, or remove filings that appear false, misleading, or incomplete. Previously, the Registrar had very limited ability to reject documents — most filings were accepted on face value with only basic administrative checks.

The Registrar can now:

• Refuse to register a document if it appears false or misleading
• Remove information from the register that should not be there
• Annotate the register with warnings where information is disputed or under investigation
• Require companies to resolve inconsistencies in their registered information

If Companies House queries a filing, the company must respond promptly with supporting evidence. Failure to respond or resolve inconsistencies can result in penalties.

New penalties: Civil penalties of up to £10,000 apply for delivering false or misleading information to the Registrar. For the most serious cases — including deliberate fraud or persistent non-compliance — criminal offences apply, with potential imprisonment. These penalties apply to anyone who delivers a document to Companies House, not just company directors.