First convictions for identity verification offences

With the one year transition period for existing companies coming to an end in November, companies and their professional advisers must now ensure that directors and PSCs have completed the process before time runs out. Here we look at what these cases show and the actions companies need to take.

Identity verification: the essential requirements

Identity verification is a central part of the Economic Crime and Corporate Transparency Act 2023 (ECCTA), which strengthened Companies House powers to improve the accuracy of the company register and tackle the misuse of UK companies for criminal purposes.

Identity verification became a legal requirement for directors, LLP members, PSCs and certain others from 18 November 2025, intended to ensure that those who own and control businesses can be identified and held accountable.

Identity verification is usually a one-off process. The two main options for an individual to verify their identity are:

1. Directly with Companies House through a GOV.UK One Login, free of charge.
2. Through an Authorised Corporate Service Provider (ACSP)

Once successfully verified, the individual will receive a Companies House personal code. This code must then be confirmed to Companies House for each relevant role on each UK company with which the individual is involved.

Individuals appointed to a new directorship from 18 November 2025, whether for a new or existing company, must have their identity verified before they can act as a director.

New PSCs from 18 November must also verify their identity. They must either provide their personal code as part of notification to Companies House that they are now a PSC of a new or existing company or as a separate submission within 14 days.

Existing directors as at 18 November 2025 must verify their identity and provide their Companies House personal code when their company files its first confirmation statement from that date. That first confirmation statement will not be accepted by Companies House unless a correct personal code is provided for each director.

Existing PSCs as at 18 November must also verify their identity and confirm their personal code to Companies House. Personal codes for existing PSCs are not submitted as part of the confirmation statement, but instead by the standalone verification statement (VS01) form. There is a 14-day compliance window for each PSC.

What happened in these legal cases?

On 17 September 2026, the Insolvency Service announced the first successful prosecutions involving directors who had failed to comply with the new identity verification requirements. Three directors were fined following proceedings at the City of London Magistrates’ Court.

The first director prosecuted was Jill White, a director of White (Reading Properties) Limited. She continued to act as a company director, including participating in board-level decision-making and signing the company’s accounts, despite at the time not having completed identity verification.

Another director of the same company, Marc Dillon, had verified his own identity. However, he was prosecuted because he failed, despite an awareness of the legal requirements, to take reasonable steps to prevent White from continuing to act as a director while she was unverified.

In the third case, Modinat Banjo continued to act as a director of J Isogony Apparel Limited without completing the required identity verification process. She signed and delivered accounts on behalf of the company while remaining unverified.

The three directors were also prosecuted for failing to file confirmation statements within the statutory period to do so. In line with the transitional rules for companies from 18 November 2025, to be able to successfully file the confirmation statement they would first have needed to complete the identity verification process for all directors.

The three individuals were fined and ordered to pay costs and victim surcharges.

What do we learn from these identity verification enforcement cases?

Firstly, these prosecutions demonstrate that there is no ability to opt out of identity verification. Directors who continue to act without being verified risk prosecution.

Secondly, directors are shown to have a responsibility not only for their own identity verification but more broadly for ensuring that others responsible for running the company are similarly compliant. Directors cannot allow others who are unverified to continue to act for the company without taking risk of enforcement upon themselves too.

Thirdly, while the particular focus is on identity verification, the wider Companies House compliance picture has an important bearing. In each of these cases, a confirmation statement was overdue. A missed deadline such as this can be a potential trigger for investigation or further evidence of a pattern of non-compliance.

Fourthly, they point to the importance of good record-keeping of action and communication by companies and their professional advisers. In each of these cases, the directors were given several opportunities to comply but apparently failed to do so. Directors who have complied individually but sit alongside others who have failed to do so will need to evidence the reasonable steps they have taken to prevent those others from continuing to act while unverified.

While the financial penalties here were fairly small, the potential reputational impact and criminal convictions provide a stern message to company directors and their professional advisers about the consequences of non-compliance.

What does this mean for Companies House’s enforcement approach?

Under ECCTA, Companies House has gained far more expansive powers. Moving from a Register to a quasi-Regulator, it can now:

• Employ wide-ranging powers to reject, rectify and remove information from the public register;
• Analyse and share information with other government entities, including law enforcement bodies; and
• Pursue a greater range of enforcement options against companies and individuals.

The announced convictions form part of a pattern of new enforcement activity. In the first three months of the year, 360 directors were convicted for filing offences. Between January and June 2026, there were 23 directors banned from running companies for a combined 70 years for serious or persistent non-compliance with filing requirements.

In respect of identity verification specifically, Companies House has set out a staged approach to enforcement:

• Initially, this has involved informing companies and individuals about their obligations, alongside delivering guidance and reminders.
• Where identity verification requirements have not been met for an individual by the relevant deadline, Companies House may issue a default letter explaining the offence.
• There is the potential then to move to enforcement, although Companies House has stated it will take account of appropriate exceptional circumstances.

To date, Companies House has exhibited a large degree of patience, with a significant number of individuals overdue in verifying their identity and companies overdue in submitting their first confirmation statement from 18 November 2025, which requires all directors first to have been verified. As we now reach the end of the transitional year, however, it is clear that individuals and companies must either be moving towards full compliance or face enforcement. Companies and their professional advisers certainly cannot assume there will be a long grace period after the transitional year ends in November 2026.

As we start to see an increase in enforcement, the options available include:

• Restrictions on company filings or annotation of the public register
• Financial penalties
• Criminal prosecution
• Director disqualification
• Company strike off
• Referral to other government or enforcement bodies, such as the Insolvency Service
• Other specific enforcement action where appropriate

A lesson of these cases is that continuing to act as a director without completing the required identity verification is a serious offence. The company and other directors may also be in breach if an unverified individual is allowed to continue acting as a director.

What should companies do now?

If directors, PSCs or others attached your company or clients potentially still have to undertake identity verification, the time for action is now. Getting fully up to date now, including involving a professional accountant if needed, is still likely to be less expensive and time-consuming than facing an investigation and potential enforcement action.

For companies that existed before 18 November 2025, that will involve a need to:

• Identify every director, PSC and others who must have their identity verified.
• Check the relevant deadline for each role. The deadlines may be different for the same person who is both a director and PSC of a company.
• Each person needs to complete the identity verification process.
• At part of a successful identity verification, the person claims their Companies House personal code from the Registrar.
• If any of the key information for individuals on the public register is incorrect (for example, a director’s date of birth), update using the appropriate form.
• Provide the personal code to Companies House for each person. For directors and LLP members, this will be on the first confirmation statement due from 18 November 2025. For each PSC, a verification statement (form VS01) must be filed.

If you are involved in many companies, you only need to verify your identity once, but you will need to confirm your personal code to Companies House separately for each role on each company.

As demonstrated in these legal cases, directors must have controls in place to prevent unverified individuals from acting. Each director will therefore need to ensure that other directors of their company have fully completed the identity verification requirements or take appropriate steps to prevent them from acting as a director.