FAQs: Understanding the Economic Crime and Corporate Transparency Act 2023 (ECCTA)

ECCTA is a new UK legislation designed to strengthen corporate transparency and combat economic crime. It introduces new requirements for verifying the identity of company directors (including shadow directors), Persons with Significant Control (PSCs), members of LLPs, registrable beneficial owners, and anyone filing information at Companies House on behalf of themselves, a company or an LLP, to enhance accountability and prevent financial misconduct.

Businesses must comply with the enhanced identity verification (IDV) processes, ensuring that directors, PSCs (including where Relevant Legal Entities are listed), members of LLPs and presenters to Companies House are properly verified.

New offences under the ECCTA also require higher standards of compliance on businesses, especially in relation to updating controls around financial crime.

Companies must also maintain accurate and up-to-date records and file necessary disclosures with Companies House.

The legislation applies to all UK-based legal entities, and any global entity with a UK nexus,  and includes the following people within those entities:

• All new and existing company directors.
• People with significant control of a company (PSCs).
• Partners of LLPs.
• Registrable beneficial owners.
• Anyone who files information on behalf of a company.
• Third-party service providers managing company administration.

All UK registered companies need to comply with the new requirements as set out in the ECCTA. This includes any global entity with a UK nexus. In order to be compliant, companies must:

• Ensure that the identities of directors of companies, as well as the identities of PSCs, including where Relevant Legal Entities of companies are listed, individuals within limited liability partnerships and limited partnerships are registered by submitting IDV documentation to Companies House.
• Ensure corporate structures are transparent and legally compliant.
• Keep statutory records up to date and provide accurate ownership disclosures.

• Submission of government-issued photo identification (e.g., passport, driving licence).
• Proof of residential address (e.g., utility bill, bank statement) dated within three months.
• Digital or in-person identity verification.
• Accurate declaration of PSCs and company ownership structures.
• Ongoing monitoring and updates to Companies House as required.

During the IDV process Companies House may share personal data with third parties, including credit agencies. By using an ACSP you can minimise such data sharing and also reduce the administrative burden on the individuals undergoing the IDV.  

Failure to comply with the ECCTA regulations may result in:

• Financial penalties for companies and individuals.
• Restrictions on company operations.
• Possible criminal liability for directors and officers.
• Reputational damage and increased regulatory scrutiny.

• Assess the impact of ECCTA on your company and the disruption of non-compliance.
• Engage with an Authorised Corporate Service Provider (ASCP) to facilitate compliance.
• Gather and verify the necessary IDV documentation without delay.
• Submit required disclosures to Companies House at earliest opportunity. 

An ACSP, such as Vistra, can assist businesses by:

• Managing the IDV process efficiently
• Ensuring full compliance with regulatory requirements.
• Offering company secretarial support and legal review of PSCs.
• Reducing the administrative burden on businesses.

The new, mandatory identity verification requirements became mandatory on 18 November 2025.

On incorporation, it will be necessary to confirm in the Companies House application form that the proposed officers of the new company have been verified. It will not be possible to incorporate a new company without this confirmation.

Post-incorporation, new directors will have to verify before their appointment is notified to Companies House (which must happen within 14 days of appointment). 

This identity verification will happen as part of a company’s annual confirmation statement filing, meaning that all existing directors will be required to file evidence of their identity being verified at the same time as filing the company’s first confirmation statement during that period.

From 18 November every PSC must file a notification with Companies House confirming that their ID has been verified and supply their unique personal code. This notification is separate from the company's Confirmation Statement and must be done using a new electronic-only method which became available on 18 November 2025. 

Companies are responsible for ensuring that their PSCs are aware of the IDV requirements, but the PSC is personally responsible for completing the verification.  

• PSCs who are also a director must submit their unique personal code separately for each role within 14 days of the entity’s Confirmation Statement date.
• PSCs who are not directors must submit their unique personal code within 14 days of the first day of their birth month, based on the information held by Companies House. 

For overseas companies: 

• Directors must verify their identity before the UK establishment is registered.
• Existing overseas companies with a UK establishment: directors must verify their identity before the first anniversary of the establishment opening after 18 November 2025. 

All new and existing PSCs will need to verify their identity and maintain that verified status as long as they are registered at Companies House. Where the registrable PSC is a Relevant Legal Entity (RLE), the entity will have to nominate a managing officer who is an individual and whose identity has been verified.

Ensuring that companies hold and maintain accurate PSC or RLE information is essential. If in any doubt, advice should be sought as to the requirements under the PSC regime.

When the provisions of the ECCTA come into force, new PSCs and RLEs will be able to be registered without having had their identities verified in advance. However, any new PSC must become verified and confirm that status to the registrar within 14 days of receipt of a notice from the registrar. RLEs will have 28 days from receipt of the notice to comply.

There will be a transition period during which existing PSCs and RLEs will have time to verify their identity. Companies that do not comply by the end of that period may face criminal sanctions or civil penalties. 

Companies House confirmed that individuals would be able to voluntarily verify their identity from 8 April 2025. Mandatory verification for new PSCs and RLEs was then introduced on 18 November 2025, which also marked the beginning of the 12-month transition phase for existing PSCs and RLEs.

Where a company has a PSC that is a corporate, known as Relevant Legal Entity (RLE), the IDV rules will be introduced at a later date, which is yet to be confirmed by Companies House. When the IDV regime will apply, a RLE must nominate an officer (who must be an individual), whom will be required to complete the IDV for themselves.  

Regarding corporate directors, the ECCTA introduces new restrictions on who can serve as a corporate director. These rules are expected to come in at a later, unconfirmed date. They are expected to require that: 

• Only a UK corporate entity can be appointed as corporate director
• All directors of a corporate director must be individuals, who have had their own identity verified.

If you’re not able to successfully have your identity verified then you will not be able to become a Director, PSC etc. 

From 27^th January 2025, individuals have been able to apply to Companies House to suppress a residential address that has been used as a company’s registered office address on historical documents. 

As a continuation of these suppression powers, it will be possible to have an individual’s occupation suppressed from June 2025. Moving forward, Companies House will also move to stop collecting occupations entirely from autumn 2025, so this information may cease to appear on public record too.

Should you require assistance with suppressing information please speak to Vistra Corporate Law.

A “large organisation” is guilty of an offence relating to the Failure to Prevent Fraud if a person who is associated with the body commits a fraud offence intending to benefit (whether directly or indirectly) the relevant body, or any person to whom, or to whose subsidiary undertaking, the associate provides services on behalf of the relevant body. There is a defence if the relevant body had in place reasonable prevention procedures.

Large organisations who do not have reasonable prevention procedures in place (or where it is not reasonable to expect such procedures).

A large organisation is defined as:

• Does the company receive more than £36 million in annual revenue?
• Does the company have more than £18 million in total balance sheet assets?
• Does the company have more than 250 employees? 

Organisations should familiarise themselves with the rules around Failure to Prevent Fraud and look to put in place reasonable prevention procedures. 

The ECCTA aims to simplify and streamline the filing options for small companies, which will no longer have the option to prepare and file abridged accounts. Instead, small companies will be required to file both their profit and loss account and their directors’ report (thereby removing the option of filing what is usually known as the “filleted accounts”).

Micro-entities will be required to file their profit and loss account too, but not their directors’ report.

Although the profit and loss accounts are required to be filed under the ECCTA, the legislation does also include a regulatory power that enables these profit and loss accounts, or parts of them, to not be made available for public inspection. However, how this particular provision is to be applied and in what circumstances is yet to be formally advised.

Where companies are exempt from audit, the ECCTA requires the statement by the directors regarding the audit exemption to identify the exemption being taken and include confirmation that the company qualifies to take it.

This statement applies to all companies claiming exemption from audit, including dormant companies. 

The ECCTA White Paper proposed that a requirement be introduced whereby companies must submit digitally tagged accounts in iXBRL format. This has not yet been implemented and will be focussed upon during the secondary stages of the ECCTA legislation (presumed to be late 2025 / early 2026)

If you have any further questions the please contact us at [email protected] and we’ll be able to support you through the ECCTA requirements.