New UK director ID rules spark concerns over fraud risk

The launch of the UK's mandatory identity verification rules for company directors, persons with significant control (PSCs), and limited liability partnership (LLP) members has raised concerns among corporate governance and financial crime specialists about low compliance rates and the risks of system exploitation during the phased rollout.

Compliance rates

With an estimated seven million individuals and entities required to verify their identities with Companies House under the new regime, only about one million had done so as of last month. This leaves less than 15% compliant as the regulations take effect.

"Despite the mandatory identity verification regime kicking off on Tuesday, only one million of the estimated seven million directors, PSCs and LLP members have verified their identities with Companies House. That's less than 15%, and with deadlines fast approaching for many, it's a real concern," said Meg Ogunsola, Global Director of Entity Management Solutions, Vistra.

Ogunsola drew attention to the potential for significant backlogs if uptake does not improve. Companies House has indicated it will maintain a strict stance on compliance, regardless of technical challenges or administrative delays.

"If people don't get moving, we could see significant backlogs. Companies House has already made it clear there'll be no leniency, even if there are tech issues or delays. At this rate, many will be at risk of fines, blocked filings or being struck off the register entirely," said Ogunsola.

Another important issue highlighted is the lack of awareness within many businesses regarding their PSCs. Ogunsola noted the widespread absence of accurate ownership records, which poses additional risk as Companies House increases scrutiny of company filings.

"What's even more worrying is that over half of UK companies don't actually know who their PSCs are. Companies House is taking no exception to inaccurate documentation, so this isn't the moment for complacency. Acting now means avoiding a last-minute scramble, steering clear of penalties, and demonstrating to regulators and stakeholders that your business takes governance seriously," said Ogunsola.

Fraud risk

Specialists in financial crime prevention identify the slow rollout and technical setbacks as weaknesses which could provide opportunities for abuse by criminal groups, particularly during the 12-month transitional period.

"The UK has shown it can act decisively against criminal networks through sanctions and enforcement targeting international gangs, which is welcome. But when it comes to domestic corporate fraud and verification, much more needs to be done. Identity checks for company directors are a vital reform, but the slow uptake and technical failures show a deeper problem," said Silvija Krupena, Director of the Financial Intelligence Unit, RedCompass Labs.

Krupena warned that criminals may take advantage of the malfunctioning or incomplete verification to set up shell companies or register fake directors, challenging the effectiveness of the new reforms.

"Criminal groups can and will exploit weaknesses in the system, from fake directors to shell companies, and when platforms like One Login break down, legitimate businesses pay the price while fraudsters slip through the cracks.

These checks are essential, but they must work seamlessly. Stronger controls and a smoother process are needed if the UK is serious about shutting down the corporate structures that enable money laundering and financial crime," said Krupena.

Banking impact

Banks face an operational burden as the identity verification process unfolds. The need to validate Companies House data increases compliance workloads at a time when they are already under pressure to combat economic crime.

Jonathan Frost, Director of Global Advisory for EMEA at BioCatch, said the phased timeline for compliance means that banks will continue to shoulder the costs and risks associated with unreliable corporate records.

"The 12-month phased rollout for mandatory identity verification leaves a clear window for criminals to abuse. With 6 million companies and officers still to be verified, it seems likely that banks will continue to shoulder a disproportionate burden, investing vast sums into double-checking Companies House data.

This will distract from their efforts to tackle economic crime, and depending on how effective Companies House's processes prove to be, there could be worse to come. If ineffective, banks will need to treat each company with a degree of scepticism that the ECCTA provisions were supposed to remove.

Companies House should focus on using the same technology as banks, excluding bad actors from the register by tracking behaviours and devices. This will enable them to detect suspicious activity, whilst also streamlining the process for genuine directors," said Frost.