Navigating the ECCT Act 3: Identity verification of directors and PSCs

This article discusses one of the most significant changes to company law brought about by the Economic Crime and Corporate Transparency Act (ECCTA): mandatory identity verification for company directors and persons with significant control (PSCs). This new requirement will make identity verification integral to company formation; indeed, it will not be possible to form a company without it. Once it is in force, existing companies will have a brief grace period in which to become compliant. Here we lay out what we know about ID verification at the time of writing (after the ECCTA was passed but before any secondary legislation).

Who will be required to verify their identity, and when?

Individuals in the following roles will be required to be ID verified with Companies House:

• Company directors, new and existing
• PSCs (persons with significant control)
• Directors of relevant legal entities (RLEs)
• Members of limited liability partnerships (LLPs)
• General partners of limited partnerships
• Directors of overseas companies doing business in the UK
• Most people making filings to Companies House on behalf of a company, with the exception of authorised corporate service providers (ACSPs) (see below), who are already authorised by the Registrar. Other exceptions may be introduced in secondary legislation.

When incorporating a company, subscribers must within 14 days provide a statement to the Registrar that the directors’ identities are verified and that they are not disqualified as directors. PSCs must be ID verified within 14 days of registering. RLEs (relevant legal entities or ‘corporate PSCs’) have 28 days to report the successful ID verification of one of their officers, such as a director. Members of LLPs and general partners of limited partnerships will have to be ID verified within similar time scales.

Will shareholders have to be ID verified?

In the consultation phase before the ECCT Bill was drafted, the government intended to require ID verification for shareholders as well as directors and PSCs. However, this idea was scrapped because the government considered the intrusion into people’s private lives to be excessive for the transparency benefit it would bring. It seemed of little value to force small investors with minimal influence on companies to identify themselves when PSCs (often holding over 25% of the shares) and directors’ identities were already captured by the proposed regime. The government has published an analysis of its rationale for not introducing ID verification for shareholders.

“This new requirement will make identity verification integral to company formation; indeed, it will not be possible to form a company without it.”

Restrictions on corporate directors

The ECCTA provides that if any of a company’s directors is a corporate entity, then all of that entity’s directors must be humans (natural persons) and have their identities verified. This prevents the creation of obscure multi-level chains of corporate directors that can hide company ownership. The ‘chain’ stops at the first level of corporate directors. These measures effectively constitute the long-awaited ‘ban’ on corporate directors, with an exception for those whose directors are all natural persons.

Furthermore, only UK-registered corporate directors will be permitted. No overseas-registered entity will be allowed to be a corporate director of a UK company. This ties in with efforts to stamp out money laundering via overseas entities such as the Register of Overseas Entities (ROE).

There will be a 12-month grace period after these requirements come into force. After this, corporate directors will have to be made compliant or have their directorships terminated.

What will the process be for identity verification?

The government’s intention is for it to be a simple one-off digital process that takes a matter of minutes. Individuals with roles in multiple entities should only need to verify their identity once. This will create a digital identity account that is thereafter valid in all positions they hold. It will be developed in concert with the government’s single sign-on programme, an effort to simplify individuals’ and business’s access to government digital services.

Identity verification will be carried out either directly (digitally) with Companies House or via an ACSP (authorised corporate service provider). Both routes are equally valid in the eyes of the law.

ID verification is most likely to take the form of linking an individual with a piece of photo ID such as a passport or driving licence. This may be combined with facial recognition technology matched against government databases. The government has stated that this function will be outsourced to one or more third-party identity service providers, for which there exists a competitive marketplace. Alternative accessibility will be available for individuals who have no form of photo ID (a significant percentage of UK adults have neither a passport nor a driving licence), and for those unable to use the digital system.

“Identity verification will be carried out either directly (digitally) with Companies House or via an ACSP (authorised corporate service provider). Both routes are equally valid in the eyes of the law.”

How will ACSPs be involved in ID verification?

ACSPs are accountants, legal advisers, company formation agents, company secretarial agents and similar businesses with an existing obligation to carry out customer due diligence checks on their clients. To be registered with Companies House for the provision of identity verification services, they must:

• be ID verified themselves
• provide proof they operate under a supervisory authority for the purposes of AML (anti-money laundering) regulations.

Once approved by the Registrar, ACSPs will be authorised to conduct identity checks on directors and PSCs. They deliver proof of these checks to Companies House via verification statements, which carry an authority equal to direct verification with Companies House. The precise regulatory framework for how ACSPs operate will emerge via secondary legislation. For more on ACSPs, see our blog post What is an ACSP?

Penalties and consequences of non-compliance

There will be a transitional period for existing companies to comply with the new requirements. By the end of this period, sanctions will depend on circumstances but may include criminal proceedings, civil penalties, and the rejection of incorporations and statutory filings. There will also be the reputational damage of having the company marked as ‘unverified’ on the register.

These penalties, to be introduced by secondary legislation, will likely progress to director disqualification proceedings if nothing is done to rectify the situation. If there is a technical issue at Companies House that prevents a director or PSC from verifying their identity, this will be a valid defence against a criminal offence having been committed.

A director who continues to act as such despite not being ID verified commits an offence, as do a company and its officers who allow an unverified appointee to act. Thus identity verification becomes a collective responsibility.