Companies House identity verification for directors abroad

These notes are dated October 2026, and the newest document in my file on Companies House identity verification is a court result rather than a guidance page. Three directors were fined in London on 16 September.

A joint press release from the Insolvency Service and Companies House calls these the first prosecutions the Insolvency Service has brought for identity verification offences, and it names both companies involved. The largest single fine was £307, before costs and surcharge.

The bill matters less here than the rule behind it.

That rule sits in section 167M of the Companies Act 2006, a section inserted by the Economic Crime and Corporate Transparency Act 2023 and fully in force since November 2025. Its first subsection reads: “An individual must not act as a director of a company unless the individual’s identity is verified”.

That sentence turned an identity check into a condition of filing. A new director cannot be appointed without it, a new company cannot be incorporated without it, and an existing company cannot file its next confirmation statement until every director has done it.

Living outside the UK, a director faces four practical questions behind the law: which route works from abroad, which documents it accepts, where the resulting code goes and what happens when the code is missing. I read the statute and guidance side by side.

One step should come before all of them. A director abroad should look up the verification due date shown against their name on the public register, and plan back from that date.

Who needs Companies House identity verification, and by when?

Every individual director needs it, along with people treated as directors, every person with significant control and every agent registering as an authorised corporate service provider. Members, general partners and managing officers count as director equivalents.

The timing depends on when the role began, and Companies House set out the split in a press release in August 2025. For people already in office, that release says “existing directors will need to confirm they have verified their identity at the same time as they file their next annual confirmation statement”.

Appointments made since 18 November 2025 follow a different rule. A new director supplies the personal code in the appointment filing, or in the incorporation filing when the company is new.

So the transition year is not one deadline for everyone. Each director's real due date follows the company's own confirmation statement date, and the campaign site stresses that the start of the transition was never a deadline in itself.

Several appointments multiply the filings, though not the check itself. The guidance on timing warns that “If you are a director of more than one company, you will need to do this for each company.”

A director who is also a person with significant control of the same company supplies the code twice, once per role, and the second filing runs on its own fourteen-day window through a separate service. I would give it a separate line in the calendar.

Corporate directors are still outside the rule for now. Limited partnerships, corporate members of LLPs and officers of corporate PSCs are also listed for a later start.

The public register itself now shows each due date. The press release said directors could check the dates for all their roles there from November 2025, and I would open that entry before any other document on a company.

How does director ID verification work through GOV.UK One Login?

Director ID verification with GOV.UK One Login is the free, direct route, and for a director abroad it depends mostly on the photo document in hand. The press release puts it in one line: “Identity verification through GOV.UK One Login is free and can be completed quickly online.”

A biometric passport from any country is accepted. A UK photo driving licence also works, as do three UK residence documents: the biometric residence permit, the biometric residence card and the Frontier Worker permit.

The service also asks for the current home address, the year the director moved in and a personal GOV.UK One Login account, and that last requirement catches directors who share one mailbox. The service page ties the verified identity to the account and adds a blunt rule: “An email address can only be used once to verify an identity.”

Two directors on one company inbox need two addresses.

Expiry rules differ from one document to the next. An expired passport cannot be used in the One Login app at all, while a DVLA licence still counts for ninety days after expiry and the residence documents for up to eighteen months.

I went looking for a fallback for people outside the UK and found less than I expected, because the bank details check and the in-person Post Office check are offered to people who live in the UK. Even the Post Office route runs on a clock.

Guidance updated in September 2026 allows three weeks from booking the appointment to finish, or the whole process starts again from the beginning.

On speed, the press release gives an average completion time of 2.4 minutes for the GOV.UK ID Checking App, measured between March and June 2025. An average is not a promise for every passport.

What does an ACSP identity check involve for a director abroad?

An ACSP identity check is the second route, built for people anywhere in the world. ACSP stands for authorised corporate service provider: an agent such as an accountant or solicitor, registered with Companies House and supervised for anti-money laundering purposes.

The guidance on verifying is direct about geography: “You can do this from any country, but your agent must register with Companies House to become authorised.” The agent also needs a UK anti-money laundering supervisor.

Cost is where the direct route and the agent route part company. One Login is free, while the same guidance says agents may charge a fee, and I have not found an official page that gives a standard price for the service.

These checks follow a published Companies House standard. An agent first collects the full name, any former names, date of birth, home address, a year of address history and an email address, and only then turns to the documents.

Documents are checked under one of two options. With document validation technology one photographic document is enough, but when a person checks the papers, remotely or face to face, two documents are needed.

One rule in that standard is written for non-residents: “If the person you’re verifying does not live in the UK, they must provide at least one government issued document.”

Agents carry a record duty under the same standard. Copies of the documents stay on file for seven years from the date of the check, and failed attempts must be recorded too.

Finding the right agent takes more care than it seems. Companies House publishes a list, and its guidance on using an ACSP admits a limit: “The agents on this list have requested to have their details published, so it may not include all ACSPs.” An existing accountant may be registered without appearing there.

After the check the code arrives by email, usually within a few hours, and once the director connects it to the company record the register shows the agent's name and its supervisors.

What is the Companies House personal code and where is it used?

Either route ends with the same thing, a personal code. The guidance describes an eleven-character code issued once the check succeeds, and it adds a line I would print for any new director: “The code is personal to you, not your company or a company you work for.”

The enforcement policy splits verification into a check and a statement. A successful check produces the code, and an identity verification statement then carries it to Companies House.

That policy points to section 1110A of the Companies Act 2006 for the legal meaning of a verified identity, so I checked the section while I had the statute open. It accepts a registrar's check or an agent's statement.

Existing directors put the code into the company's next confirmation statement. New directors put it into the appointment filing or the incorporation application, and one code covers every appointment a person holds, so a director of three companies quotes the same code three times.

I noted two snags in the personal code guidance. When the code is used, Companies House may ask for the date of birth, and a mismatch with its records blocks the connection until the date is corrected through WebFiling.

Security is the other snag in that guidance. A shared or compromised code can be replaced on request.

Since July 2026, the guidance says, codes from One Login checks are also sent by email, and agents' clients receive theirs by email too, with a recommendation to save the code to a Companies House account.

What happens to a filing when a director is not verified?

A company with an unverified director cannot complete its confirmation statement. The guidance on verifying puts it in one sentence: “Your company will be unable to file its confirmation statement unless all its directors are verified.”

New companies meet the block even earlier. Verification has been a compulsory part of incorporation and new appointments since November 2025, so an application without the codes does not put a director on the register at all.

Companies House also plans to mark the register itself. Its guidance says a note will in future appear against the name of anyone who does not verify, and that person will be unable to join a board, register a company or become an agent.

The campaign site goes further than the guidance does. It says an unverified person will not be able to make any filings for the company or start a new one, although the guidance pages still use the future tense for the same restrictions. So I read the campaign wording as the end state.

One clause in section 167M limits the damage to outsiders. Its sixth subsection says the offences are the only consequence, “so that, for example, a contravention does not in any way affect the validity of an individual’s acts as a director”.

As I read it, contracts signed by an unverified director still stand, and the risk sits with the director and the company rather than the counterparty.

What penalties can an unverified director and company face?

Acting as a director without verification is a criminal offence for the director, and section 167M makes the company and every officer in default liable when the company lets an unverified person act. The guidance on verifying restates the director's side of it: “If you continue to act as a director after the deadline without complying with all verification requirements, you will be committing an offence.”

The September cases show the second half of that rule at work. One of the convicted directors had verified his own identity.

He was prosecuted for failing to stop an unverified co-director from acting, and both were also convicted over their company's failure to file a confirmation statement on time. Daniel Hart, a senior criminal lawyer at the Insolvency Service, said in the release that “directors have responsibilities not only for their own compliance but also for ensuring unverified individuals do not continue acting as directors”.

Section 167M sets a fine on summary conviction. In England and Wales it states no level, while Scotland and Northern Ireland cap it at level 5 with a daily default fine for continued breach.

Court is not the only route for Companies House. Its enforcement policy, updated in December 2025, names prosecution, referral to the Insolvency Service and financial penalties as the main tools, and it spreads the breach across the whole board.

The policy puts it this way: “If an individual director or equivalent breaches identity verification requirements, the whole company is also breaching requirements.”

A separate penalty policy, updated in March 2026, publishes a fixed table running from £250 for a first minor offence to £2,000 for a fourth very serious one. No penalty follows if the required action is taken within 28 days of the warning notice.

A representation is the one narrow safety valve. Where circumstances were exceptional and tied to the due date, such as a serious IT failure, Companies House may pause enforcement, usually for up to two months, and its decision is final.

Formal letters about identity verification normally go to the company's service address, the enforcement policy says. A company run from abroad therefore needs someone at that address who reads the post.

What do the official pages leave unclear?

I am not sure anyone outside Companies House can yet say when people who file will need to verify, because two official pages give different answers. In January 2026 the chief executive, Andy King, wrote on the Companies House blog that this stage would begin no earlier than November 2026, with plenty of notice.

The campaign site now says November 2027. Its wording is the later one, and it promises at least six months of notice before people who file must verify.

Progress on verification is the second gap in the record. The latest quarterly table I could read shows 55.33% of director appointments verified at the end of June 2026, against about a third at the end of March.

Those figures count appointments, not people. The notes to the table say the two may not match, since one person can hold appointments in several companies, and I have not seen a figure for the quarter to September.

Money is the third gap, and the least documented. The general penalty table exists, but none of the Companies House identity verification pages I read says which band a missed verification falls into.

Each company's position also turns on facts the public pages cannot see: its confirmation statement date, which officers hold two roles, and whether a director's documents fit the One Login list. An accountant or solicitor who knows the company can confirm those points.

That check belongs before any filing goes in.

What should a director abroad do before the transition ends?

My view after a week with these documents is that Companies House identity verification belongs in the filing calendar, not in a pile of administration to clear later. The confirmation statement will not wait for it.

Outside the UK, the route comes down to the passport. A biometric passport opens the free One Login app, and without one the realistic path is an ACSP identity check, at whatever fee the chosen agent charges for it.

Companies House has promised a proportionate approach, and the September fines were modest. Its policy is still clear about the end point: a director who wants to keep acting lawfully has to verify, whichever route the passport allows.

Verification for people who file is the next change in line. What still bothers me is the penalty band, because a director reading only the identity verification pages cannot tell what a missed verification would actually cost the company or the director personally.