The date being circulated everywhere is 18 November 2026: the end of the transition period, by which every existing director and person with significant control of a UK company must have verified their identity with Companies House. It is a real deadline, and it is now about ten weeks away. It is also, for most companies, the wrong date to be working to. The requirement doesn't actually bite on 18 November. It bites the moment your company next files a confirmation statement, because the filing will not go through without a personal code for every director. For a company with a confirmation statement due in October, the deadline is October.
That distinction is the whole practical shape of this. Identity verification became mandatory on 18 November 2025 under the Economic Crime and Corporate Transparency Act 2023, with a twelve-month transition for people already in post. Because every company files a confirmation statement once a year, a twelve-month window guarantees that everyone's confirmation statement falls inside it. The 18 November 2026 date isn't a separate deadline so much as the backstop that catches the last few companies whose statement happens to fall right at the end.
Who has to verify
The obligation is personal, not corporate. It applies to:
- Directors of UK companies, including directors of dormant companies
- Equivalents of directors, which covers LLP members, general partners in limited partnerships, and managing officers
- Directors of overseas companies registered in the UK
- People with significant control (PSCs), whether or not they are also directors
- Authorised Corporate Service Providers (ACSPs), which is the route most accountancy practices will be filing through
Company secretaries are not caught. Shareholders who fall below the PSC threshold are not caught. But the dormant company point catches people out regularly: a dormant company still files a confirmation statement, so its directors still need verified identities to file it, even though the company does nothing else all year.
The personal code: once per person, not once per company
When you complete verification you are issued a Companies House personal code, an eleven-character identifier that belongs to you rather than to any company. You verify once, in your own name, and then supply that same code on filings for every company you're involved with.
This is genuinely good news for anyone holding several directorships, but it has a sharp edge. Because the code is provided as part of each company's filings, your effective deadline is set by the earliest confirmation statement across all the companies you're a director of. Someone sitting on four boards doesn't get four deadlines. They get one, and it's the soonest of the four.
⚠️ An unverified director blocks the whole filing, not just their own part of it. A confirmation statement can't be submitted without a personal code for each director, so one person who hasn't got around to it stops the company filing at all, and a confirmation statement that goes unfiled is its own separate offence with its own consequences.
The PSC timing rule almost nobody knows about
Directors verify through the confirmation statement, which is intuitive enough. PSCs have a different and much stranger timetable, and it depends on whether they're also a director of the same company.
| Director (in post before 18 Nov 2025) | With the company's next confirmation statement |
| PSC who is also a director | 14 days, starting the day after the confirmation statement date |
| PSC who is not a director | First 14 days of your month of birth |
| PSC added after 18 Nov 2025 | When first added to the register, or within 14 days |
| Everyone, at the very latest | 18 November 2026 |
Read that third row again, because it is the one that ambushes people. A PSC who holds more than 25% of a company but isn't on the board has a deadline driven by their own birthday. If your date of birth is 22 January, your window opens on 1 January and closes on 14 January. It has nothing to do with the company's year end, its accounting date, or its confirmation statement. Nothing else in UK company compliance works this way, which is precisely why it gets missed.
The common owner-managed setup, one person who is both the sole director and the sole PSC, is caught by both rules at once. They verify once and receive one code, but that code has to be supplied twice: once as a director within the confirmation statement, and once as a PSC in the fourteen days beginning the day after the confirmation statement date.
How to actually do it
There are two routes, and for most people the free one is fine.
GOV.UK One Login is the direct route and costs nothing. You verify through the app using a passport or driving licence, or by answering security questions, or in person at a Post Office if the digital options don't work for you. Most people finish it in well under fifteen minutes and get their personal code immediately.
An Authorised Corporate Service Provider is the other route. Accountants, solicitors and company formation agents can register as ACSPs and verify clients' identities on their behalf, usually for a fee. This is worth it where a client is unlikely to complete the process unprompted, or where the practice wants the verification evidence held centrally rather than trusting that each client got round to it.
✓ Get the code before you need the filing. Verification and filing are separate steps, and there is no reason to leave them adjacent. Do the One Login verification now, store the eleven-character code somewhere you'll find it, and the confirmation statement becomes an ordinary filing rather than a scramble.
What happens if you don't
The immediate consequence is mechanical: you cannot file. No confirmation statement, no new director appointments, no new incorporations. For a company mid-transaction, mid-funding round, or mid-anything that requires a clean Companies House record, that is a problem measured in days rather than pounds.
Behind that sits a genuine criminal offence. Acting as a director without a verified identity is an offence under section 167M of the Companies Act 2006, and the company itself is in breach where its directors remain unverified. This is a different category of thing from a late filing penalty, and it is worth being clear with clients that it is not simply a fee.
Companies House has published a graduated enforcement approach: guidance and communication first, then a default letter warning of action, then enforcement proper. The tools available include financial penalties at company or individual level, referral to the Insolvency Service, prosecution, director disqualification, court orders, and striking the company off the register. Under the ECCTA 2023 financial penalty regulations the maximum penalty is £10,000, though Companies House has said that for the time being it does not intend to issue penalties above £2,000. Penalties can be fixed, charged at a daily rate for each day the offence continues, or both. Companies House has indicated it is likely to treat non-compliance as "serious", and therefore a prosecution candidate, where a person or company has committed three or more offences over a five-year period.
The realistic risk for an ordinary compliant company isn't a fine. It's discovering on the day of the filing deadline that a co-director you rarely speak to has never heard of any of this.
If you advise companies, the list to run this week
This is a data exercise before it is an advisory one, and it's more tractable than it first looks:
- Pull every client's confirmation statement date and sort ascending. That ordering is your actual work queue, not the 18 November date.
- For each company, list every director and every PSC, and mark who has supplied a personal code. The gaps are the job.
- Flag PSCs who are not directors separately and note their month of birth. These sit outside the confirmation statement rhythm entirely and will not surface any other way.
- Don't skip dormant companies. They file confirmation statements like everyone else, and they're the ones nobody thinks about until the filing bounces.
- Check directors with multiple directorships against their earliest statement date across all of them, not the one you happen to be looking at.
- Decide, deliberately, whether you're registering as an ACSP and verifying clients yourself or chasing them through One Login. Chasing works until it doesn't, and the failure mode is a blocked filing.
The clients who will miss this are not the disorganised ones. They're the ones with a dormant holding company they forgot they were a director of, or a spouse holding 30% of the shares who has never filed anything at Companies House in their life and has no reason to think they're expected to start now.
💡 Rooby tip: Rooby tracks tax liabilities rather than Companies House filings, so it won't chase personal codes for you. But the principle is the same one Rooby is built on: a deadline that was knowable months in advance shouldn't arrive as a surprise. If you're already going client by client for verification codes, it's a sensible moment to look at where their Corporation Tax and VAT positions have drifted since you last checked.
The wider direction of travel
Identity verification is the visible part of a larger set of Companies House reforms under ECCTA, alongside the registrar's new powers to query and reject suspect information, and the move to software-only accounts filing. The register is shifting from a passive repository that accepted more or less whatever it was sent, to something Companies House actively polices. Verification is simply the first stage of that to reach every single company on the register at once, which is why it feels bigger than it is.
For the individual director it's fifteen minutes and a code. The work is not the verifying. It's knowing which fifteen minutes are due when, and getting the people who don't read this sort of thing to spend them before the filing lands.
Rooby pulls live Corporation Tax and VAT positions straight from Xero, so every number is current before the deadline, not after it.