It is a pleasure to see you in the Chair, Mr Stringer. The registrar regulations were laid before the House in draft on 22 May 2024, and the unique identifiers regulations were laid before the House in draft on 31 October 2024. They form part of a programme to implement the Economic Crime and Corporate Transparency Act 2023.
The 2023 Act is a landmark piece of legislation that delivers the most significant reforms to Companies House in more than 180 years, in order to protect the public from fraud and deliver real benefits to the business community. There has already been much progress since the Act was passed, including the introduction of stricter rules and checks to help Companies House to cleanse the register. The two sets of regulations before us will help to implement perhaps the most important changes to the UK’s company registration framework in the Act, requiring identity verification for those setting up, running and controlling companies. The 2023 Act amended the Companies Act 2006 to establish two ways in which an individual can verify their identity: either directly with Companies House or via an authorised corporate service provider, which I will refer to as an ACSP. The providers must be supervised for anti-money laundering purposes and registered with Companies House.
I will set out specifically what the two instruments do. The draft Registrar (Identity Verification and Authorised Corporate Service Providers) Regulations 2024 set out the legal framework that underpins identity verification. The identity verification procedure will involve an individual delivering specific information to the registrar or to an ACSP, which must include their name, date of birth and any further information specified in the registrar’s rules, which are a form of tertiary legislation.
Given the technical and increasingly evolving mechanisms for identity verification, it would be inappropriate to list every single identity document that must be provided to the registrar or an ASCP, or every single step that an individual must take in the regulations. Instead, the registrar is enabled to specify the requirements in a more suitable form and adapt or tweak the detail quickly where necessary. Companies House has produced a draft version of the registrar’s rules—I hope that they are in the Committee Room for Members to see—which I hope will provide some examples of the kind of information that might be required from applicants. When the registrar or ACSP receives all the correct information from an applicant, they will grant the identity verification application if they are satisfied that the information provided is true. That is the broad legal process for identity verification.
In practice, Companies House will use the gov.uk One Login platform to deliver its identity verification service. One Login is a cross-government verification platform that enables users to have a single login and verified identity for multiple government services. An individual will create an account and can verify their identity using a range of evidence, such as a passport or driving licence, or through knowledge-based verification questions based on their credit record or banking information. The process also includes checks to ensure that the individual matches the picture on their photo ID. For most people completing the purely digital route, the process will take a matter of minutes. Individuals can also complete the process in person at a post office.
If an individual decides to verify via an ACSP, the ACSP must follow the legal procedure established in these regulations and in the registrar’s rules. Companies House will issue guidance to ACSPs to explain how the procedure should be applied in practice and what checks they must perform on the information received. That will ensure that both routes achieve the same level of assurance in identity verification. Once an ACSP verifies an applicant’s identity, it will deliver a verification statement to Companies House to confirm that it has followed the correct procedure. The verification statement will be published alongside the applicant’s appointments on the register to maximise transparency. Alongside this verification statement, ACSPs must give the registrar information about the evidence they relied on to verify an individual’s identity. That means that Companies House will not lose access to crucial identity data if someone uses an ACSP and will also be provided with an assurance that the identity checks have been completed correctly.
The regulations add other checks and balances to the ACSP regime. ACSPs will be required to maintain records relating to the identity verification for seven years from the date they determined the identity verification request. The registrar can suspend and de-authorise an ACSP if they do not consider it to be fit and proper to carry out the functions of an ACSP. Finally, the registrar can perform spot checks on ACSPs and ask them to provide information about their identity verification obligations. All those provisions combined ensure that Companies House has the tools at its disposal to ensure that the ACSP regime is as effective and robust as possible.
I now turn briefly to the second set of regulations, the draft Unique Identifiers (Application of Company Law) Regulations 2024. These are technical and apply provisions on unique identifiers contained in the Registrar (Identity Verification and Authorised Corporate Service Providers) Regulations 2024 to other entities. A key mechanism underpinning the operation of identity verification is the use of a unique identifier or personal code, which we use to identify individuals who have had their identity verified, as well as registered ACSPs.
The first set of regulations we covered will enable allocation of unique identifiers to individuals associated with companies. These regulations give the registrar the power to allocate unique identifiers to ACSPs and individuals associated with other entities, namely limited partnerships, limited liability partnerships, companies authorised to register, unregistered companies, and Scottish qualifying partnerships. Identity verification requirements will eventually apply to other entities registered at Companies House, so it is necessary that we make these regulations relating to unique identifiers to ensure these requirements can operate in practice.
Finally, I want to update the Committee on the timings of identity verification. Companies House published its outline transition plan last October, which confirmed that it aims to start requiring identity verification from autumn of this year. In a few weeks, ACSPs will be able to register and individuals will be able to voluntarily verify their identity with Companies House, giving people lots of time to complete the process before legal requirements actually start.