Cracking down on corporate secrecy: what the ECCTA means for UK businesses

The Economic Crime and Corporate Transparency Act 2023 (ECCTA) is a significant legislative package aimed at enhancing the prevention of financial crime in the UK. It builds on recent legislation aimed at making information about UK companies public and maintaining transparency around the people or entities that own and run them, while also impacting how those companies are managed. 

We explore what the key changes are, what companies should be doing now, what the potential consequences are of failing to take appropriate steps, and how likely it is that the reforms will meet their stated aims.

What are the new rules, and when will they kick in?

Some of the changes resulting from ECCTA are already in force, and other elements will be phased in over time. 

Section 43, ECCTA inserts a new section 167M into the Companies Act 2006 (CA) which will prohibit any individual acting as a director (subject to limited exemptions) unless their identity has been verified.

Other major changes introduced by ECCTA include: 

• company accounts filings becoming ‘electronic-only’, to be enacted before the end of 2026;
• certain limitations to be enacted regarding use of corporate directors of UK companies (again expected during 2026);
• the abolition of certain registers currently maintained by companies, which will be replaced with a requirement to file information at Companies House (implementation date to be confirmed);
• the ability to protect residential addresses filed with Companies House from being publicly available in certain circumstances (already in force); and
• the creation of a new criminal ‘failure to prevent fraud’ offence for large organisations, requiring reasonable fraud prevention measures to be put in place (pending further guidance).

One of the key pillars of the ECCTA reforms is identity verification (IDV), which became available on a voluntary basis on 8 April 2025, while mandatory IDV is expected to come into force in the autumn. Once mandatory, the identity of all new directors will need to be verified before an application for formation is submitted to the Registrar (where the company is a new entity) and, in the case of directors being appointed to existing companies, before the notification of appointment is submitted to the Registrar. Existing directors will have a 12-month transition period in order to enable them to verify. 

The IDV requirements will extend beyond directors. Individuals who are ‘persons with significant control’ (PSCs) (including those who are members of certain types of partnerships), as well as those individuals who are responsible for making filings with the Registrar, will also be required to verify their identity.

Additionally, advisors who file information with Companies House on behalf of their clients, and who are regulated for money laundering purposes – lawyers, accountants etc. – will need to register as ‘authorised corporate service providers’ (ACSPs) to continue making filings. ACSPs must be ‘fit and proper.’ 

What are the potential sanctions?

The purpose of IDV is to ensure transparency in relation to the individuals and entities running and owning companies in the UK. It is also designed to reduce the risk of fraudulent filings and to ensure that only authorised individuals can submit information or make changes to company records. This helps protect individuals and businesses from identity theft and fraudulent activities, which, in our experience, has been difficult to avoid or resolve in the past.  

Therefore, if there is a failure to complete mandatory IDV within the required timeframe, sanctions could include:

• Civil Penalties: The Registrar of Companies could impose fines if an individual fails to comply (exact amounts are not yet specified).
• Criminal Proceedings: This could lead to a level 5 fine (unlimited), meaning the financial penalty could be substantial depending on the circumstances. Enforcement will likely start with warnings and civil penalties, escalating to criminal or disqualification actions for persistent offenders.
• Operational Restrictions: Non-compliant individuals or entities could face rejection of new company incorporations or registrations, and statutory filings (e.g. annual accounts) might be blocked, triggering late filing penalties (currently starting at £150 and rising with delays). Registration of ACSPs may also be restricted.
• Director Disqualification: Persistent failure to comply could lead to disqualification proceedings, barring individuals from acting as directors.
• Reputational Damage: The public register could be annotated to mark the individual as “unverified,” which could harm their credibility or business relationships. We could also see external pressures, for example from banks who will not lend to unverified individuals and businesses, which could prompt compliance. 

What should companies be doing to avoid them?

Keeping on top of the compliance requirements will be key. This can be achieved through several methods, as outlined below:

Internal record keeping: 

• Maintain an up-to-date, centralised database of directors and PSCs to streamline the verification process.
• Create a verification status tracker to quickly identify compliance gaps.

Processes/compliance:

• Establish processes to ensure company officers monitor director verification status.
• Create escalation procedures for directors who fail to verify.

Training/ internal policies 

• Conduct workshops/training for the relevant directors/employees on how to complete IDV and potential personal liability risks.

Conclusion

In addition to the aforementioned reforms mentioned, there are several other aspects to ECCTA which highlight the government’s ambitions in this area. On the whole, the reforms are a welcome addition to the UK’s fight against financial crime, and signal that the UK continues to value corporate transparency. 

The UK has historically been a leader in transparency regarding company information, with details about companies’ finances, and their directors and shareholders, being public and free to access for some time. However, it has lagged behind other jurisdictions in challenging the integrity and veracity of the information filed with Companies House. 

Questions remain on how effective the new rules will be in preventing economic crime. Early signs on enforcement – issuing penalties of £58,500 since October 2024, and collecting just £1,250 – reinforce the phased approach Companies House is taking. 

The shift in role for Companies House – from permissive recipient to engaged verifier of information – is significant and will go a long way in improving transparency in connection with UK companies and their ownership structures. 

With more tools available to law enforcement to investigate economic crime and 23 new powers available to Companies House, it remains to be seen whether there will be a significant increase in enforcement action or whether ECCTA will be an effective deterrent against corporate misconduct.