Registrar (Identity Verification and Authorised Corporate Service Providers) Regulations 2024

Considered in Grand Committee

15:45:00

Moved by

That the Grand Committee do consider the Registrar (Identity Verification and Authorised Corporate Service Providers) Regulations 2024.

My Lords, these regulations were laid before the House on 22 May 2024. I shall speak also to the Unique Identifiers (Application of Company Law) Regulations 2024, which were laid before the House on 31 October 2024. These regulations form part of a programme to implement the Economic Crime and Corporate Transparency Act 2023, which I will refer to as the 2023 Act. The 2023 Act is a landmark piece of legislation which delivers the most significant reforms to Companies House in more than 180 years to protect the public from fraud and deliver real benefits to the business community. There has already been much progress since the 2023 Act was passed, including the introduction of stricter rules and checks to help Companies House cleanse the register. The two sets of regulations we are debating today will help to implement perhaps the most important change to the UK’s company registration framework in the 2023 Act: requiring identity verification for those setting up, running and controlling companies. Through amendments to the Companies Act 2006, the 2023 Act establishes two ways in which an individual can verify their identity, either directly with Companies House or via an authorised corporate service provider—ACSP. These providers must be supervised for anti-money laundering purposes and be registered with Companies House. I will set out specifically what the two instruments will do. The Registrar (Identity Verification and Authorised Corporate Service Providers) Regulations 2024 set up the legal framework that underpins identity verification. The identity-verification procedure involves an individual delivering specific information to the registrar or to an ACSP. This must include their name and date of birth and any other further information specified in the registrar’s rules, which are a form of tertiary legislation. Given the technical and increasingly evolving mechanisms for identity verification, it would be inappropriate to list in these regulations every single identity document that must be provided to the registrar or ACSP or every single step an individual must take. Instead, the registrar is enabled to specify the requirements in a more suitable format and to adapt or tweak the detail quickly where necessary. Companies House has published a draft version of the registrar’s rules, which have been shared with Members today. I hope they provide a useful example of what evidence and steps might be required from applicants. When the registrar or ACSP receives all the correct information from an applicant, they will grant the identify verification application if they are satisfied that the information provided is true. That is the broad legal process for identity verification. In practice, Companies House will use the GOV.UK One Login platform to deliver the identity-verification service. One Login is a cross-departmental verification platform, enabling users to have a single login and verified identity for multiple government services. An individual will create an account and can verify their identity using a range of evidence, such as a passport or driving licence, or through knowledge-based verification questions based on their credit record or banking information. The process also includes checks to make sure that the individual matches the picture on their photo ID. For most people completing the purely digital route, the process will take a matter of minutes. Individuals can also complete the process in person at a post office. If an individual decides to verify via an ACSP, the ACSP must follow the legal procedure established in these regulations and in the registrar’s rules. Companies House will issue guidance to ACSPs to explain how the procedure should be applied in practice and what checks they must perform on the information received. This will ensure that both routes achieve the same level of assurance in identity verification. Once an ACSP verifies an applicant’s identity, they will deliver a verification statement to Companies House to confirm that they have followed the correct procedure. The verification statement will be published alongside the applicant’s appointments on the register to maximise transparency. Alongside the verification statement, ACSPs must give the registrar information about the evidence they relied on to verify an individual’s identity. This means that Companies House will not lose access to crucial identity data if someone uses an ACSP, and will provide them with assurance that identity checks have been completed correctly. The regulations add other checks and balances to the ACSP regime. ACSPs will be required to maintain records relating to identity verification for seven years from the date when they determined the identity-verification request. The registrar can suspend and deauthorise an ACSP if they consider that they are not fit and proper to carry out the functions of an ACSP. The registrar can perform spot checks on ACSPs and ask them to provide information about their identity-verification obligations. All those provisions combined ensure that Companies House has the tools at its disposal to ensure that the ACSP regime is as effective and robust as possible. The second set of regulations, the Unique Identifiers (Application of Company Law) Regulations 2024, are technical and apply provisions on unique identifiers contained in the Registrar (Identity Verification and Authorised Corporate Service Providers) Regulations 2024 to other entities. A key mechanism underpinning the operation of identity verification is the use of unique identifiers, or personal codes, that are used to identify individuals who have had their identity verified, as well as registered ACSPs. The first set of regulations will enable the allocation of unique identifiers to individuals associated with companies. These regulations give the registrar powers to allocate unique identifiers to ACSPs and individuals associated with other entities—namely, limited partnerships, limited liability partnerships, companies authorised to register, unregistered companies and Scottish qualifying partnerships. Identity-verification requirements will eventually apply to other entities registered at Companies House, so it is necessary that we make these regulations to ensure that the requirements can operate in practice. I want to provide an update on the timings of identity verification. Companies House published its outline transition plan in October 2024, which confirmed that it aims to start requiring identity verification from autumn 2025. In a few weeks, ACSPs will be able to register, and individuals will be able to voluntarily verify their identity with Companies House, giving people lots of time to complete the process before legal requirements start. I beg to move.

My Lords, I rise on the principle that the Executive should be accountable. I shall be brief. I thank the Minister for shedding some light on these dense and complicated regulations. They are obviously of help to the department, to Ministers and to business, but I dare say the Chancellor of the Exchequer was not reading them on her recent outward journey to the People’s Republic of China. I found the factsheet helpful, and I acknowledge the strong statements therein. It states that the requirements will “make it challenging for individuals to create a fictitious identity, or fraudulently use another person’s identity, to set up or run a company”, and talks about being “registered with a UK supervisory body for anti-money-laundering purposes”. As the Minister implied, economic crime is debilitating to the nation and, without a doubt, we have problems with it in Britain. Who is the registrar and when was she or he appointed, for what term and at what salary? Is Companies House running smoothly, so as to cope with requests and approaches from directors and people with significant control? Are there bottlenecks or significant hold-ups, perhaps even labour disputes? Are there impediments to those who file? How many money laundering cases did the registrar take to court in 2023 and 2024? These questions are designed to be helpful. If they are not answered immediately, perhaps there might be a letter.

My Lords, I thank the Minister for his explanation. For those of us who worked on the economic crime Bills, this is a welcome development. I am interested in the timeline, because it seems some time ago that we debated the Bill, which I believe has become an Act, and we find ourselves looking to the autumn of 2025 before some of these vital identity-verification processes will reach the statute book. I certainly do not blame the Minister, because he is new to this, but what is behind the delay and how many more statutory instruments are we due? I think there are still quite a few on the stocks. When can we expect them and what functions will they unlock? When we debated the original Bill, I think we all felt this to be a real and present issue that needed immediate, or near-immediate, attention. Clearly, things are dragging on and I wonder what is causing that. Further to the noble Lord’s comments about the functioning of Companies House, we were absolutely clear that this would be a culture change for Companies House, which will cease to be a filing cabinet and start having to investigate and verify what is coming across its desk. The previous Minister was confident that funding was in place and that the process to create that new culture was under way. We would benefit from the new set of eyes from the Minister, if not now then perhaps in a separate meeting where we can review the functioning, including the future functioning, of Companies House—a follow-on from the meetings that were so helpful during the formulation of the Bill.

16:00:00

I have a number of queries about ACSPs. First, why do we need them? The Minister was clear about what they do but not about why we need them. In the first instance, this process will be handled directly by Companies House, but will also be handled indirectly through the ACSPs. I have some concerns about those ACSPs because past experience has shown that there are bad operators out there offering services which are designed deliberately to obfuscate the proper ownership of these companies. The Minister was clear as to what information needs to be gathered. He was not clear as to what happens if an ACSP is proved not to be doing that. What is the process for suspending, eliminating or deauthorising an ACSP? Does the ACSP have the right to transfer ownership? Let us say that one client registers a company through an ACSP and a second client comes to the same ACSP—can there be inter-ownership transfer at an ACSP level or does all of this have to be supervised and authorised by Companies House?

In theory, I can see a service provider being open and transparent, but experience has shown that there are bad actors. I am afraid that the City of London has provided a significant number of those when it comes to obfuscating the ownership of companies and the movement of money around them. I leave the Minister with those questions.

I have one question on the second statutory instrument around the use of codes. I sort of understand why they need to be there. Can the Minister say whether they will be used for other purposes in categorising companies or will they be used discretely by Companies House only in this activity? With that, I welcome the spirit of these statutory instruments.

My Lords, I too thank the Minister for his explanation. These regulations are clearly a crucial step in modernising and strengthening the UK’s corporate governance. Building on the Companies Act 2006, they were laid before Parliament, as the noble Lord, Lord Leong, noted, by the previous Conservative Government in May 2024 to address the growing concerns about corporate fraud and business registration transparency. The regulations introduce unique identity verification for individuals involved in setting up and controlling companies and will ensure that the integrity of the business registration process is robust. The initiative aims to combat the use of fraudulent or stolen identities in business dealings and will make it harder for individuals to engage in corporate fraud. The core aim of the regulations is to ensure that only properly verified individuals can establish and control companies. The registrar is granted the authority to impose further requirements on applicants, with the flexibility to adapt as identity-verification technologies evolve. The regulations also introduce unique identifiers for verified individuals and authorised corporate service providers, streamlining the registration process and ensuring that the Companies House register remains accurate and reliable. I think I was the Minister whom the noble Lord, Lord Fox, referred to. I sincerely hope that the funding remains robust, as it was a few months ago. I look forward to hearing an answer to that question. The ACSPs are now subject to stricter oversight, including anti-money laundering regulations, with provisions for suspension or deauthorisation if they fail to meet required standards. I will come back to that in a second. The noble Lord, Lord Fox, also asked why we need ACSPs. They, or their equivalents, are common in many jurisdictions and they provide an incredibly useful service to people who wish to set up a business but have neither the time nor the inclination to get into the weeds of doing so and prefer to subcontract it. I think it is perfectly reasonable that ACSPs exist and they just need to be properly verified. While the intention behind the regulations is clear—they improve the integrity of company registration and prevent fraud—there are several areas where further clarification is required. Given that the regulations were last discussed under the previous Government, I would like to understand how the current Government intend to address the evolving nature of identity-verification technologies. In addition, these regulations impose new obligations on ACSPs, particularly in terms of record-keeping and in providing additional information to the registrar. Although these measures are essential for transparency, I ask the Government, as the noble Lord, Lord Fox, also asked, to clarify how these new duties will be enforced. What penalties will be applied to ACSPs that are found to be non-compliant and what measures are in place to ensure that these rules are upheld consistently across all service providers? I am also concerned about smaller businesses and individuals who may be impacted by these additional verification processes. Will the Government ensure that the new regulations do not create undue burdens on smaller enterprises, which may already be facing significant challenges in meeting regulatory and other requirements? Finally, while the power to suspend or deauthorise an ACSP is necessary to combat fraud, I would like assurances that proper safeguards will be in place to protect service providers from unjust penalties or removal. In conclusion, these regulations are important reforms to strengthen the UK’s business environment and combat fraud. As with any regulatory framework, careful consideration is needed on enforcement, monitoring and adaptation, so a review process will be essential to assess the regulations’ impact on businesses of all sizes to ensure that they deliver their intended benefits without imposing unnecessary burdens.

With the Committee’s permission, I have just one question that I had meant to ask the Minister. It is around the obligation to retain identity information over seven years, which the noble Lord just mentioned. In the event of the ACSP going out of business, what is the expectation of how that information, which would not otherwise be retained, would be retained for the potential use of Companies House?

I thank all noble Lords who have spoken for their valuable contributions to the debate. I will respond to some of the points raised but, if I do not cover some, I will ensure that I write. As to my noble friend Lord Jones’s question about the registrar, the current Registrar of Companies in England and Wales is Louise Smyth. I will write specifically on his other, quite technical questions. The noble Lord, Lord Fox, raised a few questions, so I ask noble Lords to bear with me while I go through them. His first question was on the timeline. Identity verification will be required from approximately 7 million people in year 1. Since the Act received Royal Assent, Companies House has been busy cleaning the register. From March to November 2024, Companies House removed around 50,400 registered office addresses, 39,600 office addresses and 36,700 addresses of persons with significant control. It redacted around 37,100 incorporation documents to remove personal data used without consent and removed around 7,800 documents from the register, including 800 false mortgage satisfaction filings, which have previously required court orders. Companies House has been really busy since the Act received Royal Assent, putting this in place. It has also employed more people to do this work, increasing its workforce from 1,400 to 1,700, with another 100 due to be in place before the end of the year. We need people to do this and Companies House is getting those people. In answer to the question about funding from the noble Lord, Lord Sharpe, Companies House has been investing in new capabilities to prepare for the implementation of these reforms, as part of its wider transformation programme. This includes £108 million of funding for transformation across previous spending reviews and increased fees to fund a course of measures. As noble Lords know, incorporation fees have now gone up to £50 and any filing fees for confirmation statements have gone up from £15 to £34—so that is extra funding coming in. In addition, funding of £20 million has been awarded via the economic crime levy for new intelligence cells in Companies House and the Insolvency Service, allowing both agencies to plan to step up their anti-money laundering work. A significant amount of preparation has been undertaken to reach this point, including system development, recruitment and training. I shall move on to the couple of other questions that were asked. On the statistics, I mentioned earlier that something like 7 million unique officers or directors will need to be identified by spring 2025. The annual cost to UK business of verifying this identity is estimated to be close to £19.5 million in ongoing operational expenses. Companies House is very experienced in dealing with a high volume of transactions. For example, in 2023-24, it processed something like 14.2 million filings. Companies House has been preparing customers, and there is a lot happening in the education and engagement process; in fact, the Companies House website shows a timeline when this is done, thus informing stakeholders about the introduction of these identity-verification requirements. Various questions were asked about ACSPs. Let me go through them. A firm will not be able to register as an ACSP unless it is supervised under the UK’s anti-money laundering regulations, and the registrar will not accept applications if the applicant is not fit and proper. From then on, the ACSP must be supervised under the UK’s anti-money laundering regulations at all times. Companies House and the supervisors will regularly share intelligence and changes to an ACSP’s supervisory status; Companies House can suspend or deauthorise any ACSP if it thinks that it is no longer fit and proper to perform these functions. In answer to the question from the noble Lord, Lord Fox, about what happens to an ACSP if it goes bust or closes, the ACSP must keep records of all of these IDVs for at least seven years. So records will be kept. I assume—I am looking at my officials now—that these records will eventually be passed over to the Registrar of Companies, but I will confirm that point in writing.

On Companies House’s right to suspend an ACSP, what right of appeal does the ACSP have in those circumstances? Does it go to judicial review? What happens?

I do not want to go down that legal route. Based on normal administrative law, I assume that judicial review would apply, but I will come back with a more definitive answer in writing, if I may. As I mentioned earlier, ACSPs will be required to keep records relating to the identity-verification checks they complete and to respond to Companies House’s spot checks. Failure to comply will be a criminal offence. The noble Lord, Lord Fox, asked how many more SIs we will see. All I can say is that a mix of SIs will be laid in spring this year—before the summer, I assume—including ones applying reforms to limited liability partnerships. I hope that that satisfies the noble Lord. In respect of the question from the noble Lord, Lord Sharpe, about enforcement, currently, if an individual officer does not comply to have their identity verified, sanctions are applied. It can be either a financial sanction or a criminal offence; that applies also to ACSPs. I hope that I have answered all noble Lords’ questions. If not, I will definitely write to noble Lords.

Motion agreed.