In practice: ECCTA 2023 - implications for finance transactions

·       Since 18 November 2025, all newly appointed individual directors of UK companies, as well as all new individual LLP members or people with significant control (PSCs) of newly incorporated UK companies or LLPs, have been required to complete identity verification (IDV).

·       Existing individual directors or LLP members must complete IDV by the date their company's next annual confirmation statement is due at Companies House after 18 November 2025—and in any event, before the end of the 12-month transition period.

·       Existing PSCs of UK companies and LLPs will also need to complete IDV checks within the transition year. However, the timetable for compliance for PSCs is more complex.

·       The key takeaway here is that we are currently in a transition year, during which millions of individuals are required to satisfy the IDV hurdle.

In order to comply with IDV, an individual must supply compliant contact details and supporting identity documentary evidence directly to Companies House, or they can instruct an Authorised Corporate Service Provider (ACSP) who can complete their IDV on their behalf. Successful applicants are issued by Companies House with an 11 digit "unique identifier" number (UID), also known as a "Personal Code", confirming that they have completed their IDV.  Individuals will have only one UID, which is personal to them and which will apply across all their directorships (and, if applicable, in their role as an LLP member or as a PSC). Note that there is a separate service for filing a PSC's UID at Companies House, so an individual who is both a director and a PSC will need to notify Companies House of their UID in both capacities to be compliant.

Even when an individual has completed IDV, the UID number issued by Companies House may not, on its own, prove sufficient evidence of compliance. This is because the UID is personal to the individual and is not intended to be shared with third parties. The UID is not shown on the public register, hence third parties are unable to carry out any independent cross-checks at Companies House. A lender will have more comfort if the UID is accompanied by confirmation from the relevant individual (e.g. as part of a director certificate) that they have successfully completed IDV and been issued with a UID by Companies House.

It is possible that, in some circumstances, Companies House records may not provide the full picture. For example, we have encountered situations where, if some, but not all, of a company's directors or PSCs have completed IDV and the company's annual confirmation statement date after 18 November 2025 has not yet passed, there is no confirmation on the register regarding the IDV status of those individuals. Confirmation of IDV status will only appear in Companies House records once the company has successfully filed its confirmation statement, and since a company can only file its confirmation statement if all of its directors have completed IDV, this creates a scenario where, if only some directors have complied, the records will show that none have completed IDV, regardless of the actual position. This creates an "invisibility problem", where director signatories to core finance documents may have completed IDV, but there is no conclusive way to verify this on the public record.

Another IDV roadblock arises where an individual does not have the right combination of documents to meet the IDV threshold. We are aware of anecdotal evidence of individuals, for instance directors based overseas without biometric passports (or in some cases without any form of passport), who have recently changed their name or do not have a UK home address, who are struggling to or in some cases are unable to comply with the IDV hurdle.

Searches at Companies House may indicate whether all current directors of the relevant company have completed their IDV. However, given that this search alone cannot be relied on, best practice is for this to be supported by a statement in a director's certificate, to the effect that all directors have completed IDV and been issued with a UID. Arguably such a statement is necessary in all circumstances, given the unreliability of the public record. However, it will be particularly desirable where the register states that the company (as a whole) is not IDV compliant.  

Guidance issued by the Law Society in February 2026 outlines the steps that legal advisers may consider taking when notifying Companies House that an individual's identity has been verified. This includes asking an individual for their UID and the name used to complete IDV, together with online cross checks. Although this guidance applies in different circumstances, it may offer lenders pointers as to the sort of checks that would be both advisable and achievable.

Borrowers should be aware that law firms may also be examining the new IDV hurdles through the lens of their anti-money laundering (AML) reporting obligations. This could provide boards with further incentive to ensure that IDV does not prove to be a sticking point on lending transactions.

As explored above, if a director is not IDV compliant and nevertheless proceeds to execute transaction documents, this is a criminal offence. If a law firm knows or suspects, or has reasonable grounds for knowing or suspecting, money laundering, the firm has to submit a Suspicious Activity Report to the National Crime Agency (NCA). There is an argument that a director who acts when not IDV-compliant and continues to earn salary and benefits could be said to receive proceeds of crime. The fact that Companies House should already have this information would not, of itself, stop the firm having to file a report. Some firms may therefore conclude that IDV non-compliance could warrant an internal escalation of the matter for review by the Money Laundering Reporting Officer, as this provides a statutory defence to the offence of failure to report. Nevertheless, it is unlikely firms would conclude there is sufficient evidence of a suspicion of money laundering so as to trigger an NCA reporting requirement; this might require evidence of a director actively seeking to evade the IDV requirements, rather than simply failing to comply due to oversight or technical issues.

ECCTA introduces new rules relating to delivery of documents to Companies House. In time, core filings will have to be made via "presenters" or ACSPs, who have been authorised to make filings at Companies House and have completed IDV. Many law firms have registered as an ACSP for filing purposes. Companies House recently postponed the proposed Spring 2026 due date for making IDV of presenters a compulsory part of filing (including MR01 charge registration filings) until no earlier than November 2026, so exact timings for this change (and the logistical details) remain uncertain.

In a bid to boost corporate transparency by clearing the register of incorrect information, ECCTA gives Companies House extensive new powers and greater scope to correct errors or erroneous filings. This could in time lead to more filings being rejected or lead to previous filings being questioned.

Compliance with the "people with significant control" (PSC) regime is an important point for secured lenders, as a lack of information regarding to the identity of a company's PSC can, in extreme cases, have implications for the efficient enforcement of share security. ECCTA has changed the PSC regime by providing that, since 18 November 2025, PSC information of "in scope entities" (which includes most UK companies and LLPs) is maintained solely on the public register at Companies House (s790LA to s790LL CA 2006). Prior to that date, entities had to place this information in their "PSC Register", which could either be hosted "in house" or online at Companies House.

The main practical implication for loan finance transactions is to consider the appropriate scope of conditions precedent. As yet, there is no market consensus on revised CP wording and the Loan Market Association has not updated its templates. Hence there are many live transactions which require, as a CP, a copy of a formal "PSC Register" – a concept which no longer exists.

Existing PSCs of UK companies will need to complete the IDV checks outlined above; the timetable for compliance by PSCs is more complex, depending on when they became a PSC and whether they are also directors. Criminal penalties could result from non-compliance, once section 790LT (Offence of failing to comply with sections 790LM to 790LR) CA 2006 is fully in force. However, Companies House have indicated that it will not initially impose penalties for non-compliance. Crucially however, there are no adverse consequences for lenders of an individual PSC not fulfilling this requirement. The risks here are not the same as for a director who fails to complete IDV; liability rests with the PSC (or potentially the company, if it has not notified the PSC).

There are potential scenarios (such as the perfection of a legal mortgage or an appropriation of shares on enforcement) where a secured lender could become a "relevant legal entity" (RLE) for the purposes of the PSC regime. Lenders are at pains to avoid this eventuality. Note that, under the new IDV rules, such cases would require relevant officers of the RLE to be subject to IDV.

Significant uncertainties remain around key aspects of ECCTA and IDV that lenders should be aware of. While we have already touched on the ACSP regime for filing information at Companies House, further guidance is awaited on how this will operate in practice. Another unresolved area is the application of the IDV regime to those who file documents with Companies House, to limited partnerships, corporate directors of companies, corporate members of LLPs and officers of corporate PSCs. We await guidance and a clearer timeline on when the IDV regime will be extended to these groups. Finally, it will be interesting to see whether the current "light touch" approach to non-compliance persists, or if Companies House will begin to enforce its new powers more vigorously over time.