If your company was incorporated more than a few years ago, the Companies House you remember no longer exists. The Economic Crime and Corporate Transparency Act 2023 — ECCTA — is the largest reform of the UK companies register since it was created in 1844, and it is being rolled out in stages right now. Some duties already apply to every company. The biggest one, mandatory identity verification, must be completed during a transition period ending 18 November 2026 — and your own due date is probably earlier. This post explains what ECCTA is, what has already changed, and what you and your board need to do before the deadline.

What is ECCTA and why does it exist?

ECCTA received royal assent in October 2023 in response to the UK’s persistent economic crime problem. For 180 years, Companies House operated largely as a passive filing cabinet: it recorded what companies told it, with no power to question whether any of it was true. That made the UK register a favourite tool for fraudsters, from fake directors to shell companies with fictional addresses.

ECCTA turns Companies House into an active gatekeeper. The registrar now has power to query, reject and remove information, share data with law enforcement, and — critically — require the people behind companies to prove who they are.

What has already changed

Several duties have applied to every UK company since March 2024:

• Registered office: PO boxes are no longer acceptable. Every company needs an "appropriate address" where documents can be delivered and acknowledged.
• Registered email address: every company must maintain a registered email address that Companies House uses for communications.
• Lawful purpose statement: companies must confirm on incorporation, and annually on the confirmation statement, that their activities are lawful.
• Company names: tighter rules prevent names that mislead or suggest criminal purpose.

Separately, since September 2025 large organisations are exposed to the new "failure to prevent fraud" corporate offence — a reminder that ECCTA’s reach extends beyond the register itself into fraud governance.

Identity verification: your deadline is closer than you think

The centrepiece of ECCTA is identity verification (IDV). Since 18 November 2025, every new director and person with significant control (PSC) must verify their identity with Companies House, and members of LLPs are in scope too. Existing directors and PSCs must verify during a 12-month transition period that ends on 18 November 2026 — but your personal due date is almost certainly earlier than that.

For directors, the due date is the company’s next confirmation statement: you must provide your Companies House personal code as part of that filing. PSCs must provide theirs within a 14-day window — starting the day after the company’s confirmation statement date if they are also a director, or in the first 14 days of their birth month if they are not. In other words, 18 November 2026 is the backstop; your real deadline is set by your confirmation statement date.

Missing your due date is an offence. Companies House consequences include financial penalties, being unable to make any filings for your company, and being unable to start a new company. Verification is also expected to extend to anyone who files documents at Companies House, from no earlier than November 2026.

There are two routes to verify. Individuals can do it themselves through GOV.UK One Login using a biometric passport or driving licence, or in person at a participating Post Office. Alternatively, an Authorised Corporate Service Provider (ACSP) — a registered, supervised agent such as First CoSec — can carry out the verification and confirm it directly to Companies House, handling the process end to end.

What is still to come

ECCTA’s rollout continues beyond the IDV deadline. From 1 April 2028, all accounts must be filed by commercial software in iXBRL format — the web and paper routes close for accounts. Small and micro-entity companies will need to file a profit and loss account (with an option to keep it off the public register), and abridged accounts are being abolished. Boards should treat ECCTA not as a single deadline but as a multi-year change programme in how their company interacts with the register.

What your board should do now

• Audit your register entries: check every director and PSC against Companies House records and identify who still needs to verify.
• Check your confirmation statement date: that, not 18 November 2026, sets your real deadline — and verify well ahead of it, particularly for directors overseas or without UK photo ID.
• Check the basics: confirm your registered office and registered email address meet the new requirements.
• Assign ownership: someone — a company secretary, in-house or outsourced — should own ECCTA compliance across all group entities.

How First CoSec can help

First CoSec is a registered ACSP, which means we can verify your directors and PSCs directly with Companies House — no One Login, no Post Office queue — and manage the surrounding filings, registers and board approvals as part of a broader company secretarial service. If you would like a no-obligation review of where your company stands against the November 2026 deadline, contact us at enquiry@firstcosec.co.uk.