Identity verification for the Economic Crime and Corporate Transparency Act (ECCTA)

In recent years, the United Kingdom has focused on fighting economic crimes and money laundering by introducing new requirements for companies that are registered or doing business in the UK. 

The Economic Crime (Transparency and Enforcement) Act 2022 (ECTE Act) created the Register of Overseas Entities to help oversee the purchase, sale, and transfer of property or land in the UK by foreign entities. It helps shine a light on foreign criminals who attempt to commit fraud or launder money in the UK through real estate. 

Passed in 2023, the Economic Crime and Corporate Transparency Act (ECCTA) builds on the ECTE Act by introducing a series of reforms for Companies House (the UK’s executive agency that maintains the official registry of businesses), limited partnerships, cryptoassets, and anti-money laundering (AML) powers. 

Below, we cover some of the ECCTA’s key clauses and take a closer look at its identity verification requirements.

What is the Economic Crime and Corporate Transparency Act?

The Economic Crime and Corporate Transparency Act (ECCTA) is a UK law aimed at fighting economic crimes, such as fraud and money laundering. It received royal assent on October 26, 2023, and is being rolled out in stages through 2025. 

Some of the ECCTA’s key reforms are:

• Companies House reforms: The ECCTA makes the most significant changes to Companies House since 1844, when corporate registrations were first introduced. The agency will now take a more active role in fighting crime and promoting legitimate business in the UK by acting as a gatekeeper for company registrations, collecting more robust data, including ownership, and improving the data quality in its registry. One significant change is the introduction of identity verification requirements for company directors, people with significant control (PSC), and people filing on behalf of companies. 
• Limited partnership (LP) reforms: Creates stricter registration and transparency requirements for LPs. For example, LPs will now need to have a registered office in the UK and must verify the identities of their general partners. Companies House also has new powers to close, restore, and sanction LPs. 
• Crypotasset reforms: Amends the Proceeds of Crime Act 2002 (POCA) to allow law enforcement to more easily seize cryptoassets that were associated with a crime.
• AML-related reforms: Makes it easier for businesses to share and law enforcement agencies to obtain information related to money laundering and terrorist financing for investigative purposes. 

The ECCTA also allows the government to hold large companies and partnerships liable for failing to prevent fraudulent activity by their employees and agents. These businesses could be liable even if they weren’t aware of the fraud or misconduct if they benefited from the fraud and didn’t have reasonable fraud prevention procedures in place.

Identity verification for ECCTA

The ECCTA’s identity verification requirements apply to anyone who creates, runs, owns, or controls a company in the UK. Failing to comply could be a criminal offense and result in criminal sanctions or civil penalties, including:

• A Level 5 fine (no stated limit)
• Registrar of Companies-imposed civil penalties
• Rejected filings for new incorporations and registrations
• Rejected statutory filings
• Potentially receiving an “unverified” status in the public registrar
• Directors who don’t verify their identity may be forbidden from being a director in any registered business

The identity verification requirements and penalties are forthcoming. Some details are already available about whose identities need to be verified: 

• Current directors: Existing directors, those with equivalent positions, and person(s) with significant control (referred to as PSCs in the Act) will have a transition period during which they will need to verify their identity. 
• New directors: Directors and equivalents must verify their identity before filing an application to form the business. A new director at an existing business needs to verify their identity as quickly as possible — before the company notifies the Registrar of Companies. 
• New PSCs: New PSCs of existing companies can be individuals or relevant legal entities (RLEs). Most hold more than 25% of the company’s shares, have more than 25% of the voting rights, or have the right to add or remove the majority of the board of directors. Individual PSCs will have 14 days to verify their identity after registering with the Registrar of Companies or after notifying the Registrar that they have become a PSC. RLEs will have 28 days and will be required to share the name of a verified officer in the company. 
• People acting on behalf of a company: Need to verify their identity before they can file documents with Companies House. 

Additionally, new legislation will limit the ability of companies to serve as corporate directors. All directors of such companies must be natural persons who verify their identities. Existing businesses will have 12 months to comply with these changes. 

‍

How to prepare for the ECCTA’s identity verification requirements

Secondary legislation and guidance from Companies House will provide more details about the ECCTA’s identity verification timelines, systems, requirements, reverification, and penalties. 

Once identity verification requirements start, the process will need to be completed directly with Companies House or via an authorized corporate service provider (ACSP) such as an accountant, legal adviser, or agent. The Corporate Transparency and Register Reform white paper (page 44) shows what the process might look like if you use the Companies House reporting tool.

The process is intended to be as simple and seamless as uploading a picture of an identity document and taking a selfie. 

Most individuals will likely only have to verify their identity once. Unlike some Know Your Customer (KYC) requirements, ECCTA may not require reverification if the ID expires. However, reverification could still be required in some situations, such as when fraud is suspected. 

You can also prepare for these upcoming requirements by:

• Notifying anyone who may need to verify their identity that they need to have a current photo ID.
• Creating a list of people who will likely become directors or PSCs, or will file documents on the company’s behalf in the coming year. 
• Creating processes for verifying the identity of new hires, sometimes called a Know Your Employee (KYE) process.

Persona streamlines identity verification around the world

As the ECCTA’s identity verification requirements come into effect, businesses in the UK will need reliable and efficient ways to verify identities.

Persona’s global ID verification solutions can help streamline the collection, verification, and storage of identity information. Our automated identity verifications use live guidance and auto-capture, and easily allow people to switch between devices to verify their identity in seconds using government IDs, other approved documents, and selfies.  

That’s why companies like Lime are already using Persona to comply with KYC requirements in the UK. You can get a demo today or start for free if you need to verify the identity of users, businesses, or employees.