New economic crime and corporate transparency law: Key implications for UK businesses

1. Introduction

Highly significant changes to the law, which are expected to come into force at the end of this year and throughout next year, will have major implications for UK companies and other legal entities. 

The Economic Crime and Corporate Transparency Act 2023 (the Act), which received Royal Assent on 26 October 2023, introduces a wide range of innovative and far-reaching measures to prevent economic crime and improve corporate transparency. This includes radical reform to the role of Companies House and the powers of the Registrar of Companies (the Registrar). 

There will be significant new obligations in several areas that UK companies and other legal entities (such as limited liability partnerships, partnerships and limited partnerships) will need to prepare for, some of which will soon be in force. 

2. Overview

The Act is divided into five substantive parts comprising over 200 sections and 13 schedules. 

Part 1 of the Act contains important reforms aimed at improving transparency of companies and their directors, shareholders and other persons with significant control (PSCs) over companies, as well as enhancing the role of Companies House and the powers of the Registrar.

This briefing focuses on the reforms in Part 1 of the Act.

Part 2 concerns Partnerships, particularly Limited Partnerships, which are routinely used as vehicles for investment funds. The reforms aim to increase transparency of limited partnerships and prevent their use by criminals for fraudulent purposes. There are changes concerning the registration of limited partnerships and significant new obligations for the general partner and limited partners of a limited partnership.  These changes will be of most concern to fund managers and investors. 

Part 3 deals with changes to the Register of Overseas Entities (ROE), which requires anonymous foreign owners of UK property to disclose their identities to ensure that criminals cannot own property in the UK whilst hiding behind secretive chains of shell companies. The reforms aim to ensure the provisions governing the ROE remain consistent with changes the Act makes to companies and other corporate entities. 

Part 4 is concerned with cryptoassets (such as Bitcoin) and features a range of additional powers to seize and recover suspected criminal cryptoassets. The reforms are designed to counter the increasing illicit use of cryptoassets in money laundering and other criminal acts in the UK.

Part 5 features reforms that make the most significant changes to corporate criminal liability laws for a generation, introducing the offence of 'failure to prevent fraud' and provisions that expand the scope of corporate criminal liability. 

• Offence of failure to prevent fraud. This new standalone criminal offence means that any 'large' organisation (including commercial and charitable organisations) may be held criminally liable for failing to prevent fraud committed for its benefit by a person associated with it (for example, an employee, agent or subsidiary of the organisation) unless it has reasonable procedures in place to prevent the fraud.
  
  A 'large' organisation is one that fulfils two or more of the following conditions in a financial year: more than 250 employees; £36 million in sales; or £18 million in assets. An organisation found to be liable under this offence can be subject to an unlimited fine.
  
  For more information about the new offence, see our article here.
• Expanding the scope of corporate criminal liability. The Act also widens the scope of corporate criminal liability for specified economic crimes. In summary, if a 'senior manager' of a company (or LLP, limited partnership or partnership) acting within the scope of their actual or apparent authority commits an offence, the relevant organisation can also be guilty of the offence.
  
  A 'senior manager' can be anyone who plays a significant role in the decisions or the management of the organisation. The economic crimes to which the Act applies are wide-ranging and include fraud, false accounting, money laundering, sanctions evasion, bribery, and tax evasion. The 'senior manager' test applies to organisations of all sizes and not just 'large' organisations (as defined above for the failure to prevent fraud offence).
  
  For more information on this new provision and how it may change the management of criminal risk for businesses, see our article here.

The government has published a series of factsheets on key aspects of the Act.

3. Implementation

The economic crime provisions in Part 5 of the Act expanding the scope of corporate criminal liability are scheduled to come into force by 26 December 2023. 

The majority of the Act's other provisions are expected come into force in stages throughout 2024 and will be implemented by commencement or more substantive regulations, none of which have yet been published. 

Many provisions of the Act require the development of systems and processes at Companies House before they can be implemented. Companies House has been preparing for the upcoming changes and the Registrar has stated in a recent blog that she expects to introduce some measures in early 2024 including: new rules requiring all companies to supply a registered email address; stronger checks on company names; greater powers to query and reject information; and steps to identify and remove inaccurate information from the public register at Companies House. 

The rest of this briefing addresses some of the key reforms introduced by Part 1 of the Act.

4. Identity verification 

The Act introduces new identity verification procedures for company directors, PSCs, relevant officers of registrable legal entities (RLEs) and those delivering documents to Companies House.

Directors

An individual will not be able to act as a director unless they have verified their identity. A company will also need to ensure that an individual does not act as a director unless their identity has been verified.  These obligations apply in respect of both new and existing directors.  An individual who fails to verify their identity and continues to act as a director, and a company that fails to ensure that an individual has been verified, will commit a criminal offence.  However, the validity of the acts of an unverified director will be unaffected. 

When forming a company, statements must be submitted to the Registrar confirming that the proposed new directors have verified their identity, and that none of them is disqualified or ineligible to be a director.  Failure to comply with this obligation will result in the rejection of an application to form a company. 

For existing companies, the identity of proposed new directors must be verified before their appointment.  Whilst this can be planned for, it could prove troublesome where, for example, unexpected circumstances necessitate the urgent appointment of a new director whose identity has not previously been verified. 

PSCs

PSCs will also need to verify their identity. There are corresponding requirements for RLEs who are required to verify the identity of their 'relevant officer'.  Non-compliance will result in the status of the PSC or relevant officer of the RLE being flagged as 'unverified' at Companies House and continued non-compliance will constitute a criminal offence punishable by the imposition of a fine. 

The Act places the burden of identity verification on PSCs and RLEs instead of companies. Although companies will have the option of providing Companies House with the required verification confirmation, they are not obliged to do so.  This recognises that companies may not always be able to compel their PSCs or RLEs to act.  Instead, the Registrar will have the ability to enforce compliance against PSCs and RLEs and require their identity to be verified. 

LLPs and limited partnerships

Members of LLPs and general partners of limited partnerships will also have to verify their identity.

Consequences of non-compliance

The consequences of not complying with the identity verification regime will depend on the precise circumstances but could include: criminal proceedings; civil penalties; company formations being rejected; inability to make filings; and the companies register being annotated to show the individual's status as 'unverified'. Persistent evasion by directors could also lead to disqualification. 

5. Procedure for verifying identity

Two types of identity verification will be possible: direct identity verification via Companies House, and an indirect route through an authorised corporate service provider (ACSP).

Direct identity verification

Direct identity verification with Companies House will involve linking a person with a primary identity document, such as a passport or driving licence. The person undergoing verification will take a photograph or scan of their face and the identifying document.  The two will be compared, using likeness matching technology, and the identity verified.  If successful, the person will be notified in a matter of minutes.  Alternative methods will be available for individuals without photographic ID and non-digital identity verification will be available for users who cannot use the digital identity verification system.

Indirect identity verification

For indirect identity verification, relevant ASCPs, which are likely to be intermediaries such as accountants, legal advisers or company formation agents, must be registered with a supervisory body for anti-money laundering purposes.  As such, they will have an existing obligation to carry out customer due diligence checks on their clients, and any identity verification checks undertaken by ASCPs must achieve the same level of assurance as identity checks undertaken directly by Companies House.

Practical issues

In most cases, Companies House expects identity verification to be a one-off requirement. Once a person is verified, they obtain a verified status. However, there may be instances where re-verification is required, for example if the Registrar has reason to doubt the validity of the identity verification, such as on suspicion of fraud.

Once the new law for identity verification comes into force, there will be a transition period for existing directors, PSCs, relevant officers of RLEs and those undertaking filings with Companies House, so that each will have some time within which to verify their identity. 

6. Delivering documents to Companies House 

There will be new, stricter rules on who may deliver documents to Companies House.

Delivery by individuals

Individuals will be able to deliver any document to Companies House on their own behalf (or on behalf of another individual) so long as their identity has been verified, and the document they are delivering is accompanied by a statement confirming that verified status.  Alternatively, individuals will be able to file documents at Companies House via an ACSP authorised by the Registrar.

Delivery on behalf of companies

Companies will be able to file documents with the Registrar using any of the following methods: (i) delivery by officers or employees of the company; (ii) delivery by officers or employees of a corporate officer of the company; and (iii) delivery via an ACSP.  In each case, any filing should be accompanied by a confirmatory statement (which differs depending on who the filer is) as specified in the Act.  The same applies to filings by LLPs and limited partnerships.

The new filing provisions may cause issues for corporate groups.  Companies with company secretaries will no doubt have their identities verified to help facilitate filing obligations. Group companies that do not have secretaries or employees will need to rely on directors or file via an ACSP. 

Unsurprisingly, disqualified directors will be barred from delivering documents to Companies House. 

Offences and enforcement 

As well as creating several new criminal offences (such as the failure to prevent fraud and acting as a director without identity verification), the Act enhances the current general 'false statements' offence and also allows for a new civil penalty regime to be introduced. 

The general false statement offence in the Companies Act 2006 currently provides that if a person knowingly or recklessly delivers a document or makes a statement to Companies House that is materially misleading, false or deceptive, they can be fined and/or imprisoned for a term of up to two years.

When the Act comes into force, it will split the 'false statement offence' into two separate categories: a basic offence and an aggravated offence.  The basic offence applies when a person, without reasonable excuse, delivers a document or makes a statement to the Registrar that is misleading, false or deceptive.  The punishment for committing the basic offence is a fine.

The aggravated offence applies when a person knowingly delivers or causes to be delivered a document or makes a statement to the Registrar that is misleading, false or deceptive.  The punishment for the aggravated offence is a fine and/or imprisonment for up to six months.

The Act includes a power for the Secretary of State to introduce a financial penalty regime which will enable the Registrar to impose a financial penalty directly as an alternative to pursuing a criminal prosecution through the courts.  The power can be used where the Registrar determines that a person engaged in conduct that amounts to an offence under the Act.  It is envisaged that a criminal prosecution will be used only in egregious cases. 

7. New powers for the Registrar of Companies 

Several reforms in the Act are intended to allow the Registrar to become a "more active gatekeeper over company creation and a custodian of more reliable data" and to ensure that Companies House has more tools at its disposal to prevent abuse of corporate entities.

The Act introduces four new objectives for the Registrar to promote the integrity of the companies register.  These are: ensuring that any person required to deliver a document to Companies House does so; ensuring that the information filed is accurate and complete; ensuring that records do not create a false or misleading impression; and minimising the extent to which companies and individuals can conduct or facilitate unlawful activities.

Rejecting a document for inconsistencies

Currently the Registrar must accept documents that meet the requirements for proper delivery, and has limited powers to correct, query or reject documents.  The Act gives the Registrar a new power to reject a document for inconsistences with information already held at Companies House or where the Registrar has reasonable grounds to doubt that the document complies with information requirements as to its contents. 

This power will be used with discretion using a risk-based approach, considering what presents the biggest risk to the integrity of the companies register.  This is one of the measures the Registrar has said will come into effect in early 2024. 

Requesting additional information

The Registrar will have the power to request in writing additional information to enable it to determine whether a person has complied with any relevant statutory obligations and whether any document delivered complies with the requirements for proper delivery.  An offence will be committed by any person who does not comply with these requirements and the Registrar may impose sanctions for non-compliance. 

The Registrar will also have greater powers to remove information from the companies register and share information with bodies such as other law enforcement and regulatory bodies. 

8. Company and business names

There is evidence that the process of registering company names at Companies House is increasingly being abused by some applicants who have been able to register names that are then used in the commission of crime. 

Restrictions on names

The Act includes additional restrictions on the registration of company or business names.  A company will be unable to register a company name that the Registrar believes is intended to facilitate a dishonesty or deception offence, gives a false impression of a connection with a foreign government or international institution, or includes computer code.  Similarly, a company will be unable use a business name that suggests a connection with a foreign government or international institution. 

Objecting to a company name

It is currently possible to object to a company's registered name if it is sufficiently similar to another name in the UK and, as such, would be misleading in the UK.  The Act introduces an extra-territorial dimension by enabling a person to object to a company's registered name as being misleading if it is similar to another name anywhere in the world. 

Directing a company to change name

It is currently possible for the Secretary of State to direct a company to change its name if it is misleading and likely to cause harm in the UK.  The Act expands this power extra-territorially, enabling the Secretary of State to direct a company to change a company name if it is misleading or poses a risk of harm anywhere in the world.

The Act also gives the Secretary of State a new power to direct a change of company name where it deems that it has been used or is intended to be used by the company to facilitate the commission of an offence involving dishonesty or deception. 

The Secretary of State will also be able to direct a company name change where the name at the time of registration could have been objected to or was illegal.  A person who fails to respond to a direction to change their company name within 28 days will be guilty of an offence and liable to a fine.

Where a company is directed to change its name, it will be unable to use the former prohibited name again as either a company or business name.  A director or shareholder of the company concerned will also be unable to use the prohibited name in connection with any other company. 

These changes shift the burden onto companies to ensure that intended company names are lawful. 

9. Registered addresses 

Companies will soon have to comply with new obligations regarding registered office and email addresses. 

Registered office address

Companies will need to ensure that their registered office is an 'appropriate address', meaning an address where documents delivered would be expected to come to the attention of a person acting on their behalf and where acknowledgment of delivery can be provided.  In practice, this means that a company will not be able to use a PO Box as a registered office address. An offence will be committed by a company and its directors if they fail to comply with this requirement.  This measure is likely to be implemented in early 2024.

Registered email address

Companies will also need to register an 'appropriate' email address with the Registrar.  This means an email address where correspondence would be expected to come to the attention of a person acting on the company's behalf.  An offence will be committed by a company and its directors if they fail to comply with this requirement.  This measure is also likely to be implemented in early 2024.

10. Forming a new company

An application to register a new company will, for the first time, need to state that its subscribers wish to form the company for lawful purposes and that its intended future activities will be lawful.

The application must also include statements confirming that the proposed directors and any PSCs are not disqualified from acting as a company director.

11. Company registers and record keeping

The Act will introduce new record keeping and filing requirements, some of which are likely to be administratively burdensome.

Location of statutory registers 

The Act abolishes the existing requirement for companies to maintain the following four statutory registers at their registered offices:  the register of directors; the register of directors' residential addresses; the register of secretaries; and the PSC register.  Instead this information will have to be communicated to the Registrar and will be kept at Companies House.  There will be a duty for companies to keep this information up to date. 

The Act refashions existing duties and introduces some new duties for companies to collect and report information about their PSCs which reflect the fact that the PSC register will now be held centrally at Companies House. 

Register of members and obligations on companies and members

The Act introduces obligations on companies to ensure that information concerning members is provided to the Registrar and kept up to date.  The Act also imposes duties on members to provide relevant information to their companies and ensure that it is kept up to date.  There are offences in the Act for failing to comply with these new requirements without a reasonable excuse.

It will be necessary for every company to maintain and update its own register of members.  For individual members, the register of members will need to record the full forename and surname, as well as a service address.  For corporate members, the register of members will need to record the corporate or firm name and a service address. 

There are also obligations on members to provide their details to companies on becoming members and also when that information changes.  This must be done within two months of becoming a member or the relevant change occurring.  The Act also obliges private companies to retain in their register of members historic information about a member where that information changes. 

To ensure that the register of members includes the required information, the Act permits companies to send notices requesting any missing information from members and former members which recipients must provide within one month. 

Members of companies who fail to inform the company of their details within the relevant timeframes without a reasonable excuse can face criminal sanctions which can vary from significant fines to custodial sentences of up to two years.  Where an offence is committed by a firm, the offence is also committed by every officer of the firm who is in default. 

One-off confirmation statement

The Act requires companies to provide information about their members to Companies House in a one-off confirmation statement to be filed the first time they are required to file a confirmation statement after the relevant part of the Act comes into force. 

Private companies will need to provide the name and address of each member and the number of shares of each class that they hold on the date of the confirmation statement. 

Publicly traded companies must provide the name and address of each member who holds at least five per cent of the issued shares of any class of the company and the number of shares of each class that they hold on the date of the confirmation statement.

Although private and publicly traded companies are already obliged to provide these details, the one-off confirmation statement will enable Companies House to display information in a more user-friendly manner in the future.

12. Directors 

The Act has further important implications for directors and companies with corporate directors.

Disqualification

As noted above (see Identity verification for directors) the Act creates a new offence for companies to permit an individual to act as a company director unless the relevant company has notified the Registrar of the director's appointment and confirmed that the director's identity has been verified. 

The Act also provides for directors to be disqualified for persistently failing to comply with identity verification requirements and filing obligations.

Any individual disqualified under the existing UK directors' disqualification regime may not be appointed as a director of a company without the permission of the court.  An existing director will automatically cease to hold office if disqualified as a director.

The Act also makes it an offence for any individual who has become a 'designated person' under the Sanctions and Anti-Money Laundering Act 2018 to be a director of a company or be concerned in its promotion, formation or management without the leave of the court.

Corporate directors

The government already has the powers to restrict the use of corporate directors but in parallel with the Act, it will bring the restrictions into force.  Regulations will be issued setting out the more limited basis upon which companies will be able to retain or appoint corporate directors. 

Broadly, any corporate director will need to have 'legal personality' and all the directors of the corporate director will have to be natural persons and have had their identity verified (as described above).  Existing companies will be given 12 months in which to comply and within that time must ensure that its corporate directors comply with the new requirements.

LLPs may continue to appoint corporate members without natural persons but will need to provide details of a natural person in a management position who must have had their identity verified.

13. Financial reporting

With the objective of ensuring the companies' register is more reliable and accurate, the Act reforms how certain companies report information and what information they report, when filing their annual accounts with Companies House.

Filing obligations

There are concerns that many 'small' and 'micro-entity' companies currently use options for filing their accounts that require minimal disclosure when they are not eligible to do so.

The Act provides that companies that qualify as 'small' companies will need to file a profit and loss account and a directors' report.  A 'small' company is one that fulfils two or more of the following conditions in a financial year: a turnover of £10.2 million or less; £5.1 million or less on its balance sheet; or 50 employees or fewer.

Companies that qualify as 'micro-entities' will need to file a profit and loss account but will have the option of not filing a directors' report.  A 'micro-entity' is a company that fulfils two or more of the following conditions in a financial year: a turnover of £632,000 or less; £316,000 or less on its balance sheet; or 10 employees or fewer.

The government hopes that these amendments will make filing requirements easier to understand, reduce fraud and error, and improve transparency.  The changes will also remove the option for companies to prepare abridged accounts.

Exemption from audit

The Act provides that a company claiming exemption from audit will have to include on its balance sheet a statement by its directors identifying the relevant exemption and confirming that the company qualifies for it.  The requirement for companies to file such a statement will provide the Registrar with additional evidence to take stronger enforcement action for any subsequent false audit exemption filings.