Companies House Compliance Changes: Navigating IDV Delays & WebFiling Security

Understanding the Latest Companies House Compliance Changes

The landscape of UK company compliance is rarely static, and recent announcements from Companies House underscore this reality. Accounting and bookkeeping practices across the UK are currently navigating significant shifts, including revised timelines for identity verification (IDV) requirements for presenters, a pause on key Economic Crime and Corporate Transparency Act (ECCTA) accounts filing reforms, and the immediate aftermath of a WebFiling security incident in March 2026. These Companies House compliance changes demand a proactive 'check and adjust' strategy from firms to ensure continued adherence and mitigate risks.

This comprehensive guide will break down each of these critical updates, providing clarity on deadlines, implications, and practical action items. By understanding these developments, your practice can refine its compliance planning, safeguard client data, and maintain operational efficiency amidst evolving regulatory demands.

Companies House ID Verification Delay: Presenter Requirements Shift to November 2026

The Economic Crime and Corporate Transparency Act (ECCTA) 2023 introduced a fundamental overhaul of corporate transparency, with mandatory identity verification (IDV) at its core. This aims to improve the integrity and accuracy of the Companies House register by ensuring that individuals forming, running, or controlling UK companies are genuinely who they say they are.

Current Status of IDV for Directors and PSCs

• Mandatory for new appointments: Since 18 November 2025, IDV has been compulsory for all new directors, Persons with Significant Control (PSCs), and LLP members upon incorporation or appointment.
• Existing officers' transition: Existing directors, PSCs, and LLP members have a 12-month transition period, starting 18 November 2025, to verify their identities. This is generally linked to their company's next annual confirmation statement, with a final deadline of 17 November 2026 for all existing officers.

Failure to comply with these IDV requirements can lead to financial penalties and restrictions on company filings, and unverified individuals may face criminal sanctions.

Presenter ID Verification Postponed

One of the most impactful changes for accounting and bookkeeping firms is the requirement for 'presenters' – anyone filing documents at Companies House – to verify their identity or be registered as an Authorised Corporate Service Provider (ACSP). This was initially slated for Spring 2026 but has now been officially postponed to no earlier than November 2026.

Companies House cited several reasons for this delay, including allowing more time to complete the IDV process for directors and PSCs, addressing stakeholder feedback, and ensuring that systems and processes are fully operational before enforcement begins.

Key takeaway: While the presenter IDV is delayed, the underlying obligation for directors and PSCs to verify their identity is firmly in place. Practices should use this extended period to prepare for ACSP registration if they haven't already, as it will be mandatory to file on behalf of clients from November 2026 onwards.

Action Items for Practices:

• Review ACSP registration: If your firm files on behalf of clients, ensure you understand the requirements for becoming an ACSP and initiate the registration process if not already completed. ACSPs must be subject to UK anti-money laundering (AML) supervision.
• Communicate with clients: Remind clients about the mandatory IDV for their directors and PSCs, especially those approaching their 17 November 2026 deadline. Provide guidance on the verification routes available (direct with Companies House or via an ACSP).
• Update internal processes: Integrate ACSP registration and client IDV tracking into your firm's compliance workflow and client onboarding procedures.

ECCTA Accounts Filing Reforms Paused: A Reprieve for Small Entities

Another significant development is the formal pause on several ECCTA reforms related to accounts filing. Originally intended to come into effect from 1 April 2027, these reforms aimed to streamline and enhance the transparency of financial reporting for small and micro-entities.

What Reforms Are on Hold?

The paused reforms included:

• Requiring micro-entities to file both a balance sheet and a profit and loss account (they were previously exempt from filing the P&L).
• Requiring small companies to file a balance sheet, profit and loss account, and a directors' report (the P&L and directors' report were previously optional).
• Removing the option to file abridged accounts for small and micro-entities.
• Mandating software-only filing for all accounts, closing web and paper routes for these submissions.

Companies House has confirmed that these measures are currently under review, and a final decision will be announced shortly. Crucially, the government has committed to providing a minimum of 21 months' notice before any new implementation date is introduced.

Key takeaway: This delay offers a significant reprieve for many small businesses and charities, addressing concerns about increased regulatory burdens and the potential public disclosure of sensitive financial data.

Action Items for Practices:

• Continue existing filing methods: For the time being, small and micro-entities should continue to follow existing filing regulations for their accounts.
• Monitor official announcements: Keep a close watch on Companies House updates regarding the revised timeline for these accounts filing reforms.
• Advise clients on data readiness: While delayed, the direction of travel for greater transparency remains. Encourage clients to maintain robust internal financial records, preparing for the eventual transition to more detailed public filings.

Addressing the WebFiling Security Incident: Immediate Checks and Safeguards

In March 2026, Companies House identified and addressed a security vulnerability affecting its WebFiling service. The incident, which occurred between October 2025 and 13 March 2026, allowed a logged-in user to potentially access or amend limited information of another company without consent.

Details of the Incident

• What was affected: Specific non-public data, such as directors' dates of birth, residential addresses, and company email addresses, may have been visible to other logged-in WebFiling users. It was also possible for unauthorised filings (e.g., accounts, changes of director) to have been made on another company's record.
• What was NOT affected: Companies House confirmed that passwords were not compromised, identity verification data (e.g., passport information) was not accessed, and existing filed documents could not have been altered.
• Companies House response: The service was taken offline on 13 March 2026, investigated, and restored on 16 March 2026 after independent testing. The incident was reported to the Information Commissioner's Office (ICO) and the National Cyber Security Centre (NCSC).

Key takeaway: Although Companies House believes the scope was limited to individual records and not large-scale data extraction, the potential for unauthorised access and filings underscores the critical need for vigilance.

Action Items for Practices:

• Review client records immediately: Advise all clients to check their registered details and filing history on the Companies House register to ensure everything is accurate and no unauthorised changes have occurred.
• Report discrepancies: If any discrepancies or suspicious filings are identified, contact Companies House immediately at [email protected], using 'WebFiling issue' in the subject line and providing evidence.
• Address late filing penalties: If any filings were delayed due to the WebFiling service being down between 13-16 March 2026, file as soon as possible and appeal any automatically applied late filing penalties through Companies House's online service, keeping a record of the delay.
• Enhance internal security protocols: Reinforce strong password policies, multi-factor authentication, and regular security awareness training for all staff accessing Companies House services.

Proactive Compliance Planning in a Shifting Landscape

These recent announcements highlight the dynamic nature of UK company compliance. For practice managers and compliance officers, adopting a proactive 'check and adjust' strategy is paramount to navigating these ongoing Companies House compliance changes effectively.

Integrate Changes into Your Compliance Calendar

Don't view these delays as a reason to postpone preparation. Instead, use the extended timelines to solidify your firm's readiness. For instance, while presenter IDV is delayed, the groundwork for ACSP registration and client ID verification can still be laid.

• Update internal policies: Ensure your internal compliance manuals and training materials reflect the latest deadlines and requirements from Companies House and the ECCTA 2023.
• Regular monitoring: Implement a system for regularly checking official Companies House news and guidance for further updates, particularly concerning the accounts filing reforms.
• Client communication strategy: Develop a clear communication plan to inform clients promptly about relevant changes to their registered office obligations, confirmation statement requirements, and other UK company filing obligations.

Strengthening Internal Controls and Data Security

The WebFiling incident serves as a stark reminder of the importance of robust cybersecurity. Beyond Companies House, firms must ensure their own systems and client data are secure.

• Access management: Regularly review who has access to client Companies House accounts and ensure permissions are appropriate.
• Data integrity checks: Implement periodic checks of client data held by your firm against public registers to catch any anomalies early.
• Incident response plan: Have a clear plan in place for responding to potential data breaches or security incidents, aligning with ICO guidance and your AML compliance obligations.

Leveraging Digital Tools for Enhanced Companies House Compliance

In this environment of evolving regulations and security challenges, digital tools are not just helpful – they are essential. Modern SaaS platforms designed for accountants and bookkeepers can significantly streamline your compliance efforts and enhance security.

• Centralised client data: A robust practice management system can centralise all client company information, including director and PSC details, filing deadlines, and IDV status, making it easier to track and manage.
• Automated reminders: Digital tools can provide automated reminders for upcoming Companies House deadlines, such as confirmation statements and annual accounts, reducing the risk of late filings and associated penalties.
• Secure document exchange: Utilise secure portals for exchanging sensitive client information, reducing reliance on email and mitigating risks highlighted by incidents like the WebFiling breach.
• Streamlined IDV processes: While Companies House has its own IDV routes, future integrations or ACSP-enabled platforms can help manage the verification process more efficiently for your clients.
• Audit trails and reporting: Digital platforms often provide comprehensive audit trails of filings and communications, invaluable for demonstrating compliance and investigating any discrepancies.

By investing in and effectively utilising digital solutions, firms can transform complex compliance tasks into manageable, secure, and efficient processes, freeing up valuable time to focus on client advisory.

Conclusion: Staying Agile in UK Company Compliance

The recent announcements from Companies House – the delayed presenter IDV, the paused ECCTA accounts reforms, and the WebFiling security incident – collectively underscore the need for agility and vigilance in UK company compliance. While some deadlines have shifted, the underlying commitment to greater transparency and accuracy in the Companies House register remains steadfast.

For UK accounting and bookkeeping practices, the message is clear: stay informed, proactively review and adjust your internal processes, strengthen your cybersecurity defences, and leverage the power of digital tools. By doing so, you can confidently navigate these Companies House compliance changes, safeguard your clients' interests, and uphold the integrity of the UK's corporate register.