What will you be doing during the third week of March? According to a US website, there will be various celebrations underway. Perhaps you will be making the most of national cocktail-making day, or maybe national cleaning week will grab your attention. (Although, on a personal note, I am happy to say that it is not national cleaning week in the UK.) While reading through the possible celebrations (and the list is endless), international waffle day rather caught my eye.

If you are a director of a corporate trustee, however, you might be creating, or logging into, your GOV.UK One Login account. From 25 March, a Companies House timeline indicates that directors of UK registered companies should be able to undertake voluntary verification of their identity. This will become a mandatory requirement during the autumn of 2025. Directors of existing companies, including directors of corporate trustees, will be required to undergo this new identity checking measure as part of their company’s annual confirmation statement. You can find out the date by which your company must submit its annual confirmation statement by heading to the Companies House website and searching against your company’s name.

Given that there is a 14-day window in which to submit an annual confirmation statement, before penalties might be incurred, it makes sense to tackle the verification process well in advance of the deadline. Pensions managers and company secretaries, take note – you never know which trustee directors are going to decide to take a last-minute holiday and head off to the sun (or snow) or worse still, a round the world cruise with no Wi-Fi connection, oblivious to the need to verify their identity before falling foul of the Economic Crime and Corporate Transparency Act 2023 (ECCTA).

The rules for verification should, in theory, be simple to follow but as you will know that is not always the case when trying to log onto a government website, especially when you have a deadline to meet. You might already have a GOV.UK One Login account, for example if you have recently applied for a basic DBS check (perhaps because you were renewing a professional trustee accreditation).

There are three ways that trustee directors (or any director for that matter) will be able to prove their identity with GOV.UK One Login:

• First, by using the GOV.UK ID Check app
• Second, by answering security questions on the GOV.UK One Login website
• Third, at a Post Office

For me, the simplest way would be to use the first option, which involves downloading the app to my phone and then using my phone to scan my passport and take a selfie with my phone camera. The biometric chip in my passport should do the rest. It will also be possible to use your driving licence and for those without a UK passport or driving licence, it will be possible to use a non-UK passport with a biometric chip, a UK biometric residence card, or permit, or a UK frontier worker permit.

The second option is to have a photo identity document to hand and answer some security questions on the GOV.UK One Login website. In theory, this should be simple, I mean how many times did your mother change her maiden name, or how many times did the spelling of your first primary school change? But, for me, trying to remember the exact spelling of security responses that I have used in the past tends to prove futile.

And then there is the “turn up at your local post office” option. That doesn’t get you out of having to negotiate the GOV.UK One Login service, it just means that you have to create an account on the service first and then when you do arrive at the post office, they will scan your passport for you and take your photo. That feels a bit like adding another degree of potential human error into the equation – just stick to option 1 and use a smart phone and passport, is all I can say.

But why will you have to do all of this?

It flows from measures introduced by ECCTA to tackle and thwart the use of UK registered companies for criminal purposes. The government has discovered that it is actually incredibly easy to create a legitimate looking UK registered company around a totally fraudulent business. A shelf company using a person’s (any person’s, it turns out) residential address works quite well as a registered office address for a company.

Until recently, Companies House did not have the resources, or the statutory objectives, to check the legitimacy of company documents being filed with it. Companies House served merely as a filing repository rather than as a regulator.

ECCTA gives Companies House more teeth to act as a regulator, with objectives that include ensuring that information filed at Companies House is accurate, ensuring that records kept by Companies House do not create a false or misleading impression to members of the public, and preventing companies and others from carrying out unlawful activities.

Since 2 May 2024, Companies House has had the power to issue new financial penalties, although sadly the limit is currently set at a maximum of £2,000 per offence, which seems small change compared to TPR’s powers to issue financial penalties of up to £1 million in certain circumstances. Companies House still has some catching up to do, but it’s a step in the right direction.

You might be thinking that this is taking a sledgehammer to crack a nut and that there can’t be that many companies registered for fraudulent purposes. Part two of this blog considers whether that is the case.

In the meantime, what will you be doing on 25 March? I, for one, might be scanning my passport, but I shall make sure that I have a waffle to hand.