Companies House ID Verification: What KYB Teams Need to Know

Companies House identity verification confirms that a director or person with significant control (PSC) is who they say they are. But it doesn’t meet your own customer due diligence (CDD) obligations, and the Money Laundering Regulations (MLRs) don’t let you rely on the register alone. While an unverified director doesn’t automatically trigger enhanced due diligence (EDD), it can still be a risk signal, though, and your risk assessment should decide how much weight it carries.

Since 18 November 2025, new directors and PSCs have had to verify before they’re appointed. Existing ones must verify by their company’s next confirmation statement, and the transition period ends on 17 November 2026. The first prosecutions came in September 2026. For KYB teams, the open question is what an unverified name on the register should change about onboarding.

What does verification tell you?

That a person is who they say they are. Directors and PSCs verify through GOV.UK One Login, in person at a Post Office, or through an Authorised Corporate Service Provider (ACSP) such as an accountant or solicitor. Once they have done it, the register shows them as verified with a green tick. 

It tells you nothing apart from their compliance with the ECCTA. Verification doesn’t confirm that the person controls the company or where their money comes from.

Companies House itself says its checks are different from customer due diligence (CDD). And regulation 28(9) of the Money Laundering Regulations 2017 (MLRs) bars you from relying solely on the register to verify a beneficial owner.

What happens if an individual isn’t verified?

Three things.

1. The company can’t file its confirmation statement. Companies House says it “will not accept your company’s confirmation statement until all directors have verified their identity.”

2. People commit offences. Under section 167M of the Companies Act 2006, it is an offence to act as a director while unverified, and an offence for the company to let them. Every officer in default is liable, which is how a verified director ended up in court.

3. Enforcement escalates. Companies House can issue financial penalties of up to £10,000, annotate the public register, or refer cases to the Insolvency Service. A conviction can lead to disqualification. 

The first has a curious knock-on effect. 

If a company doesn’t file its confirmation statement, it risks a penalty and, eventually, being struck off. Once a company is dissolved, everything it owned passes to the Crown as bona vacantia. Credit balances are property, so the bank can no longer pay them out on the former directors’ instructions. The company can be restored to the register, but restoration doesn’t undo anything the Crown has already disposed of.

Left alone long enough, one unverified director can put a customer’s money in the Crown’s hands. 

Enforcement has already started. On 16 September 2026, three directors were fined at City of London Magistrates’ Court in the first prosecutions for identity verification offences. While one of them had, in fact, verified his identity, he was still fined for failing to stop an unverified colleague from acting as a director.

What happens if an obliged entity onboards an unverified individual? 

Legally, nothing. The MLRs don’t forbid it. Regulation 33(1) lists the cases where enhanced due diligence (EDD) is mandatory, and verification status isn’t one of them. Nor are disqualification, prosecution or conviction. 

That doesn’t mean you should onboard them without thinking it through. There are two reasons why.

You’ll be relying on stale data

If a director hasn’t verified, Companies House won’t accept the company’s confirmation statement. That’s the annual filing in which a company confirms its details on the register are correct.

Once it can’t be filed, the company’s record stops being updated. The longer the director stays unverified, the further the register drifts from the truth. If you onboard the company, that out-of-date record is what you’ll be checking against.

Worse still is the uncertainty. An overdue confirmation statement could mean:

• a director who hasn’t got round to verifying.

• a company in administrative difficulty.

• a dormant or abandoned company.

• a company deliberately avoiding scrutiny.

The register won’t tell you which. So, someone on your team must find out, which means chasing the customer, delaying onboarding and, in some cases, filing discrepancy reports. Many cases will turn out to be harmless, but you won’t know which ones until someone has checked.

So how do you tell the difference? That’s where your risk assessment comes in.

It can be a risk signal, depending on the circumstances

Onboarding a customer with an unverified director isn’t an offence for you. But the director is committing one every time they act for the company. And, according to Gemma Marjoribanks, Practice Support Specialist at the Institute of Chartered Accountants of Scotland, a client’s failure to verify “should be considered as part of the risk profile of the client”.

The MLRs leave that judgement to you. Regulation 33(1) makes EDD mandatory in any case your own risk assessment identifies as high risk, and “in any other case which by its nature can present a higher risk of money laundering or terrorist financing”.

A director who verified a week late is one thing, but a director who is months past their deadline and still running the company is another, and it’s reasonable to treat that as a higher risk, particularly in the context of other risk signals that the MLRs list: nominee usage, opaque ownership structures, high-risk jurisdictions.

Don’t wait for Companies House to act first, either. The first prosecutions only came in September 2026, ten months after the rules took effect.

How does this work in practice? A view from the regulator

The Financial Conduct Authority hasn’t addressed the issue directly. But its Financial Crime Guide sets out the kind of due diligence it expects.

One example of poor practice it gives is a firm that “disregards allegations of the customer’s or beneficial owner’s criminal activity from reputable sources repeated over a sustained period of time.” Companies House is the UK’s official company register. If it shows a director has been overdue for months and is still in post, ignoring that starts to look like the poor practice the FCA describes.

The FCA also lists, as an example of EDD, “carrying out searches on a corporate customer’s directors or other individuals exercising control to understand whether their business or integrity affects the level of risk associated with the business relationship.” A director’s failure to meet a basic legal duty is the kind of thing those searches should pick up.

Good due diligence should therefore take verification into account, in proportion to the risk. On its own, an overdue director may mean little. Combined with nominee shareholders or an opaque ownership structure, it means a lot more. Nominee shareholders are already a risk factor listed in the MLRs.

Get verified data from source, in real time.

Kyckr pulls data and documents in real time from Companies House and official company registers in 100 other countries. Either by API or our online portal, Kyckr lets you access the world’s company registers, all in one place and in one format.