The Economic Crime and Corporate Transparency Act 2023 (ECCTA) introduces significant new obligations and liabilities for directors. This guide explains what these are and provides some practical steps to help you prepare. 

Some of the provisions affecting directors are already in force while others are expected to take effect over the course of 2025 and 2026. 

New prohibition on acting as a director if identity not verified

ECCTA introduces new identity verification (IDV) requirements for all directors. For further details on how this can be done, please see here.

An individual will be prohibited from acting as a director if their identity has not been verified (unless exempt). While breach does not affect the validity of acts as a director, in practice the prohibition means that a director should not act on behalf of a company in their capacity as a director until their identity has been verified.  The offence can attract an unlimited fine. 

Companies will also have a duty to ensure that individuals do not act as directors unless their identity has been verified. Breach could lead to fines for the company and its directors. Directors who act without verification will also be liable to be disqualified.

Which directors will the IDV requirements apply to?

The IDV requirements will apply to all directors of UK companies. They are also expected to extend to directors of overseas companies with a UK establishment registered at Companies House.

When will the IDV requirements come into force?

The timing for this requirement differs for new and existing appointments: 

• New company incorporation: From autumn 2025, proposed directors will need to have their identify verified before the application to register a company can be made.  
• New director appointments: From autumn 2025, all new directors appointed to existing companies will need to have their identity verified before the notice of their appointment is filed at Companies House and, more importantly, before they act as a director. 
• Existing directors: Existing directors will have a transition period of up to 12 months in which to comply. Once the law takes effect, Companies will need to confirm that their directors have had their identity verified in their next confirmation statement.

Companies with an autumn confirmation statement date may wish to encourage their directors to have their identity verified over the summer to avoid potential financial penalties for late filing of the confirmation statement. Individuals likely to be appointed to new directorships in the autumn (for example, on acquisitions) may also find advance IDV beneficial.

IDV requirements also impact other individuals who deal with Companies House – please see here for further details.

New prohibition on acting if appointment notification filed late

A company must notify Companies House within 14 days of a person becoming, or ceasing to be, a director. 

ECCTA will prohibit an appointed director from continuing to act as such beyond those 14 days. This is unless the individual 'reasonably believed' that Companies House had been informed of the appointment. Breach will not affect the validity of the appointment nor that person’s acts as a director, but it may give rise to fines.

The notification to Companies House of a director's appointment must include confirmation that the director's identity has been verified. 

The notification will also need to contain certain 'required information' about that director. This includes name, date of birth and nationality, service address, usual residential address and country of residence.

If any of this required information changes in the future (for example, a director changes their name or moves house), the company must notify Companies House within 14 days of the change occurring. It will be an offence not to do so, which may give rise to a fine.

New restrictions on corporate directors

It is anticipated that certain restrictions on the use of corporate directors will come into effect in parallel with ECCTA.  

It is expected that a corporate director will only be permitted if all its directors are natural persons who have had their identities verified, and that only UK corporate entities with legal personality will be able to act as a corporate director. 

New director disqualification provisions

An individual cannot be appointed as a director if they have been disqualified under directors' disqualification legislation. If a director is so appointed, the appointment will be void. ECCTA also provides for all directorships to terminate automatically on disqualification.

If an individual has been disqualified as a director, they also will be unable to act as a subscriber or a proposed person with initial significant control on an application to incorporate a new company. 

ECCTA has already expanded the director disqualification regime so that individuals subject to relevant financial sanctions are disqualified from being directors. 

New failure to prevent fraud offence

From 1 September 2025, ECCTA will introduce a new corporate offence of failing to prevent fraud. Under this offence, large organisations may be held criminally liable where an associate (including employees, agents and subsidiaries) commits a specified fraud offence intending to benefit the organisation or any of its customers. 

A 'large organisation' is one which meets two out of three of the following criteria: over 250 employees, turnover of over £36 million and assets of over £18 million.

Breach is punishable by a potentially unlimited fine. There is a defence if the organisation can show that it has reasonable procedures in place to prevent fraud.

Please see our article here for a summary of the offence and how companies can prepare.

Extension of the 'identification doctrine'

ECCTA has broadened the category of persons whose conduct may result in criminal liability attaching to the company if they commit a specified economic crime (eg fraud, false accounting, false statements etc).

The category of persons now includes senior managers within the business acting within the actual or apparent scope of their authority. It extends to UK and non-UK companies of all sizes.  This means it will be easier for businesses to be prosecuted and held liable for the acts of senior decision makers within their organisation.

Please see our article here for a summary of this change and how companies can prepare.

Liability

As mentioned already, a number of offences can be triggered by a failure to comply with the new IDV requirements under ECCTA. These carry various penalties, including unlimited fines and disqualification. 

Companies House now has the option to impose civil financial penalties as an alternative to commencing criminal proceedings for most offences under the Companies Act 2006. These include those mentioned in this guide. This provides Companies House with a quicker and easier route to bring claims against a company for breach.

In addition, it is an offence carrying an unlimited fine for any person to provide false, misleading or deceptive information "without reasonable excuse" to Companies House. Where this is done knowingly, it could result in a prison sentence. In both cases, this would include any statement made in relation to directors' IDV requirements. It would also include any statement made in relation to notifications to Companies House on a director's appointment or on a change to their required information, and in relation to the confirmation statement.

Practical steps to prepare for the changes

General

• Ensure that all directors are aware of the new requirements under ECCTA as outlined above and keep up to date on developments (in particular, in relation to the IDV requirements).

IDV requirements

Practical steps to prepare for directors' IDV requirements are set out in here, but in summary:

• All directors should ensure they have suitable identity documents easily available. If passport renewals are imminent, individuals may wish to get their identify verified first, so that they are not left without a suitable document with a deadline looming. 
• Directors of companies with autumn 2025 confirmation statement dates are encouraged to get their identity verified over the summer, to avoid last minute issues. 
• If board appointments are envisaged taking place shortly after the law takes effect, the proposed directors should get their identity verified in advance to ensure they can act as directors immediately upon their appointment taking effect. 

Companies House notification requirements

• Ensure appropriate procedures are in place for the prompt filing of director appointments and changes to a directors' required information at Companies House.

Restrictions on corporate directors

• Companies should identify whether it, or its wider group, has any corporate directors. If so, it should either prepare to remove them if they are not a UK corporate entity with legal personality or take steps to ensure that (a) all directors of that corporate director are natural persons and (b) are aware of their obligation to have the identity verified.

Failure to prevent fraud

• Large organisations should assess risk levels and review their internal fraud prevention policies and procedures (including training) to ensure they are compliant when the new offence becomes live in September 2025. They should also ensure that appropriate communication of the new offence and internal policies is provided. 

Identification doctrine

• Where they have not done so already, companies should identify senior decision makers within their organisation, review the risks attached to their responsibilities and the scope of their authority. 

Get in touch with your usual contact for further information as to how we can help.