Multinational companies with UK entities are approaching the end of a 12-month identity-verification transition at Companies House, the UK’s corporate registry, with a large gap between confidence and completed work. Although 84% of directors surveyed by Vistra said their organisation was prepared, only 9% reported that every relevant director and person with significant control (PSC) had completed verification.

Beneath the headline deadline sits a more complicated timetable. Identity verification is part of the Economic Crime and Corporate Transparency Act 2023 (ECCTA). Mandatory verification began on 18 November 2025, opening a 12-month transition for existing directors and PSCs. Each individual has a due date tied to their role and circumstances, and some deadlines have already passed. Companies House says the start date opened a phased process in which companies were told what to do and when. 

A missed due date can quickly become a finance and governance problem. It can prevent a company from filing its confirmation statement and make it unlawful for an unverified director to continue acting. Inaccurate director or ownership data can also complicate bank know-your-customer reviews, mandate changes and financing documentation.

Confidence runs ahead of completion

Only 26% of respondents said their business had checked that Companies House records for directors and PSCs were accurate. Even fewer had identified everyone who needed verification, at 20%, while 22% had obtained and recorded the necessary Companies House personal codes.

Practical progress therefore appears patchier than the 84% preparedness figure suggests. The results are also difficult to reconcile with respondents’ estimate that 61% of relevant people had completed verification. Decentralised activity may explain part of the mismatch: an overseas director could have verified independently even though the group has not recorded the code or linked it to every UK role. If the business cannot evidence that completion centrally, it may discover the gap only when a filing is due.

Among the 50 UK-based directors, 86% described their organisations as prepared, yet none said every relevant director and PSC had finished. Their estimated average completion rate was 60%, and only 14% said their organisation had passed the three-quarter mark.

Regional results produced an even wider contrast in the US cohort, where 94% claimed preparedness while the average completion level was 55%, the lowest of the markets reported. EU respondents recorded the highest average completion at 73%, and 34% said everyone in scope had finished. APAC had the lowest stated preparedness at 72%. Vistra did not disclose the number of respondents in each regional group, so those comparisons are best treated as directional.

One identity, several due dates

The regime covers directors and PSCs, with Companies House estimating before launch that six million to seven million people would need to verify by mid-November 2026. Individuals can complete the check free through GOV.UK One Login or use an Authorised Corporate Service Provider, such as an accountant or solicitor. Successful verification produces a personal code. 

Directors must supply that code with the company’s next confirmation statement. A director serving several companies has to provide it for each company, while an overseas company must confirm that all directors are verified by the anniversary of its UK establishment’s registration. Companies House says a confirmation statement cannot be filed without the personal codes of all directors. 

PSCs follow a separate timetable. Someone who is both a director and a PSC of the same company must provide the code separately for each role, with the PSC submission due during a 14-day period beginning after the confirmation statement date. A PSC who is not also a director generally has a 14-day window at the start of their birth month, while a person becoming a PSC after 18 November 2025 has 14 days from being added to the register. 

Companies House treats verification and connection to the register as two steps. First, the individual passes the identity check and receives a personal code. The code and a verification statement must then be supplied to connect that verified identity to the relevant company role. A group can therefore have directors who have proved who they are while their UK appointments remain incomplete on the register. 

Across a multinational structure, that distinction turns a short personal check into a larger coordination exercise. The individual may verify once, but the business still needs an accurate list of appointments, the right code, evidence that it has been linked to each role and a calendar of due dates.

Cross-border structures slow the work

More than three-quarters of respondents (76%) said directors and PSCs based outside the UK had added complexity. The proportion reached 88% among Middle East respondents, the highest regional result. Coordinating people across jurisdictions and time zones was the most common barrier, cited by 27% of those with overseas individuals in scope.

Documentation and information handling followed closely. Differences in identity documents were cited by 24%, as were concerns about data protection or sharing personal information. Companies House accepts biometric passports from any country through its online route, but multinational groups still have to communicate the process, resolve failed checks and decide how personal codes will be stored and shared securely. 

Entity records present a second problem. Some 30% found discrepancies between Companies House and their internal data. Missing supporting documents, out-of-date director details and incorrect or incomplete PSC and ownership information were each reported by 29%. Respondents could encounter several issues, and only 1% said their review uncovered none.

Faulty entity data rarely stays confined to the statutory register. Banks routinely request the same legal names, directorships and ownership chains during onboarding, periodic KYC reviews and changes to account authorities. Corrections made under deadline pressure can draw treasury, legal and company secretarial staff into the same remediation work.

Vistra’s global head of entity management, Meg Ogunsola, said: “There is a clear gap between how prepared businesses feel and how much of the practical work has actually been completed. For multinationals, this challenge is magnified by having directors, PSCs and corporate information spread across multiple jurisdictions. These reforms are an important step towards improving corporate transparency, but they are also creating additional work for businesses. The findings show why having accurate entity data, clear ownership of the process and visibility over individual verification requirements is so important. As the transition period nears its end, businesses should be clear on who still needs to verify, their individual due dates and whether the information supporting that process is accurate and complete.”

Enforcement is already under way

September brought the first Insolvency Service convictions for identity-verification offences. Two directors were prosecuted after continuing to act while unverified. A third had completed their own verification but was convicted after failing to take reasonable steps to stop an unverified fellow director from continuing to act. The cases also involved overdue confirmation statements. 

The third conviction shows that responsibility extends beyond completing one’s own check. A company may break the law if it allows an unverified director to act, and another director can face action if they know about the position and fail to address it. In the other cases, unverified directors participated in board-level decisions or signed and delivered company accounts.

Non-compliance can lead to criminal proceedings, civil penalties, an inability to make statutory filings and a public annotation showing an individual as unverified. A director may also be prohibited from acting. The three September fines ranged from £80 to £307 before costs and victim surcharges. A blocked confirmation statement or a director unable to act may cause more disruption than the fine itself. 

Wider ECCTA work is already consuming staff time. Two-thirds of Vistra’s respondents said recent transparency, identity-verification and corporate-liability requirements had added at least ten working hours a month. The average was 13.9 hours, equivalent to almost 21 eight-hour days a year. UK respondents reported 17.3 additional hours a month, or nearly 26 working days annually. Those figures cover the wider package of reforms and cannot be attributed solely to identity verification.

By late October, the percentage marked complete tells only part of the story. Companies need a role-by-role record showing every UK entity, each director and PSC, their individual due dates, whether verification has succeeded and whether the personal code has been connected to the register. Vistra’s figures suggest many groups are still missing parts of that basic record.

Preparedness now needs to be measured by completed, linked codes and filing-ready data. A broad declaration of readiness says little about whether the next confirmation statement can actually be filed or whether every director can continue acting lawfully.

Vistra, which provides entity-management services, commissioned Censuswide to question 300 directors at multinational organisations with a UK presence between 3 and 16 September 2026, including 50 UK-based respondents. Across the full sample, directors estimated that an average 61% of the people requiring verification had completed it. The findings are self-reported and were not independently audited, but they show how much work may remain behind corporate assurances of readiness.