The Economic Crime and Corporate Transparency Act 2023 (ECCTA) received Royal Assent on 26 October 2023. Companies House calls it the biggest change to its role since corporate registration began in 1844. For most companies, the Act does four practical things. It requires identity verification for every director and person with significant control, which has been compulsory since 18 November 2025. It gives Companies House powers to query and reject filings. It creates a corporate failure to prevent fraud offence for large organisations, in force since 1 September 2025. And it provides for software-only accounts filing, with fuller small-company accounts, which Companies House plans to introduce from April 2028. The accounts provisions are not yet in force: commencement regulations have still to be made. The rollout is phased, so the important question is which parts already apply to you.
ECCTA timeline: what is in force and what is coming
The dates below are taken from Companies House's outline transition plan, last updated in August 2026, and from the commencement notes on legislation.gov.uk. Companies House says the future dates depend on Parliamentary time and are kept under review.
| Date | Change |
|---|---|
| 26 December 2023 | Senior manager test for attributing economic crimes to companies (section 196) |
| 4 March 2024 | Registrar can query and reject filings; appropriate registered office address; registered email address; lawful purpose statement |
| 1 May 2024 | Higher Companies House fees to fund enforcement |
| 18 March 2025 | Authorised Corporate Service Providers (ACSPs) can register |
| 8 April 2025 | Voluntary identity verification opens |
| 1 September 2025 | Failure to prevent fraud offence in force (section 199) |
| 18 November 2025 | Identity verification compulsory for new directors and PSCs; 12-month transition starts for existing ones |
| No earlier than end of 2026 | Transition ends and compliance action begins; limited partnership reforms |
| No earlier than November 2027 | Verification of anyone filing; third-party agents must be ACSPs |
| April 2028 (planned) | Software-only accounts filing; small and micro companies file a profit and loss account, with an option not to publish it; abridged accounts abolished |
Identity verification for directors and PSCs
Section 167M of the Companies Act 2006, inserted by ECCTA, states that "an individual must not act as a director of a company unless the individual's identity is verified". A director who acts without verifying commits an offence, and so do the company and every officer in default. Existing directors provide their personal code with the company's first confirmation statement after 18 November 2025, so the transition runs for 12 months from that date. Our guide to verifying your identity with Companies House covers the process and the separate PSC deadlines.
Changes to registers, addresses and filings
- Registered office. This must be an appropriate address. A Royal Mail PO Box or an equivalent service is not allowed, and Companies House can begin strike-off action if a company does not provide one;
- Registered email address. Every company must give Companies House an email address. It is not shown on the public register;
- Lawful purpose. Companies confirm on incorporation, and again in every confirmation statement, that their future activities will be lawful;
- PSC information. From 18 November 2025 companies no longer keep their own PSC register. Instead they notify Companies House directly within 14 days. See our explainer on what a PSC is;
- Registrar's powers. Companies House can query and reject information it suspects is wrong, remove inaccurate entries without a court order, and impose financial penalties for offences.
Failure to prevent fraud
Section 199 makes a large organisation guilty of an offence if an "associate" commits a listed fraud offence intending to benefit the organisation. An associate can be an employee, an agent, a subsidiary or anyone who performs services on the organisation's behalf. The offence covers bodies corporate and partnerships, wherever they are formed. Section 201 defines a large organisation as one that met two or more of these conditions in the financial year before the fraud:
- Turnover. More than £36 million;
- Balance sheet total. More than £18 million;
- Employees. More than 250 on average.
The only defence is to show that the organisation had reasonable fraud prevention procedures in place, or that it was not reasonable to expect any. On conviction on indictment the penalty is a fine.
Worked example. A group subsidiary had turnover of £40 million and 180 employees last year, with a balance sheet total of £15 million. It meets only one condition, so it is not large in its own right. Section 202 tests a parent undertaking on group aggregates, using more than £36 million net turnover, more than £18 million net balance sheet total and more than 250 employees. If the group meets two of these conditions, the parent is in scope and can be liable for fraud committed by employees of its subsidiaries. The subsidiary itself can also be guilty under section 199(2) if one of its own employees commits fraud intending to benefit it, even though it is not large on its own figures.
Corporate criminal liability: superseded in 2026
Section 196 of ECCTA allowed an economic crime committed by a "senior manager" to be attributed to the company, from 26 December 2023. That section, along with sections 197 and 198, has since been omitted. From 29 June 2026, section 250 of the Crime and Policing Act 2026 applies the senior manager test to offences generally, not just economic crimes. Where a senior manager acting within their authority commits an offence, the body corporate or partnership also commits it. Commentary written before mid-2026 that describes the ECCTA rule as limited to economic crime is now out of date.
What to do now
- Check every director and PSC has a personal code before your next confirmation statement;
- Confirm the registered office and email address are appropriate and monitored;
- Test the size thresholds for failure to prevent fraud each year and, if you are in scope, document a risk assessment and proportionate procedures;
- Plan for April 2028 by moving to software that can file full accounts, including a profit and loss account for small companies.
Sources: Economic Crime and Corporate Transparency Act 2023, including s199, s201 and s219; Companies Act 2006 s167M; Crime and Policing Act 2026 s250; Companies House, ECCTA outline transition plan. See also our guide to the corporate criminal offence.
Acumon's company secretarial team handles verification codes and Companies House filings, and our anti-fraud advisers can help in-scope organisations put reasonable prevention procedures in place.