Companies House GOV.UK One Login: Ending Shared Account Risks and Securing Client Access

Companies House GOV.UK One Login: A New Era for Secure Filings

The landscape of company administration in the UK is undergoing a significant transformation, driven by Companies House's phased adoption of GOV.UK One Login. This shift is more than just a new sign-in screen; it represents a fundamental change in how individuals access government services, especially for crucial Companies House filings. For accounting and bookkeeping practices, understanding and navigating this transition is paramount, particularly concerning the urgent need to move clients away from the inherent risks of shared company login credentials.

The move towards individual, secure access is designed to enhance transparency, bolster security, and combat economic crime, aligning with the broader objectives of the Economic Crime and Corporate Transparency Act 2023 (ECCTA). Firms that proactively guide their clients through this change will not only ensure compliance but also strengthen their own operational security and client relationships.

Understanding the Companies House GOV.UK One Login Transition

GOV.UK One Login is the government's initiative to create a single, secure sign-in for a wide range of public services. Instead of juggling multiple usernames and passwords for different departments, users will eventually access over 110 government services, including Companies House and HMRC, with one set of verified credentials.

Phased Rollout: Key Dates and Services

WebFiling Services: As of 13 October 2025, GOV.UK One Login became mandatory for signing into Companies House WebFiling accounts. Users attempting to access WebFiling from this date are prompted to connect their existing account to GOV.UK One Login. Without this connection, access to WebFiling is not possible, except for filing charge (mortgage) documents.
"Find and Update Company Information" Service: From late August 2026, GOV.UK One Login will become the primary sign-in option for the "Find and update company information" service. While new users are already mandated to use it, existing users will eventually be required to migrate. Companies House has confirmed that ample notice will be provided before this becomes compulsory for all.

This phased approach allows for a smoother transition, but it underscores the ongoing nature of these significant changes. The core benefit of GOV.UK One Login is enhanced security, primarily through mandatory multi-factor authentication (MFA) via an authenticator app or SMS.

The Imperative to End Shared Company Accounts

One of the most critical implications of the GOV.UK One Login rollout is the definitive end to shared company login credentials. Companies House explicitly states that each GOV.UK One Login must be linked to one individual, using their own email address and phone number. This means that the common practice of a team sharing a single Companies House account will soon be obsolete and actively discouraged.

Risks of Shared Credentials

Shared accounts, while seemingly convenient, pose substantial security and compliance risks:

Lack of Accountability and Audit Trails: When multiple individuals use the same login, it becomes impossible to determine who made specific changes or accessed sensitive information. This eliminates a crucial audit trail, making it difficult to investigate errors or unauthorised activity.
Increased Security Vulnerabilities: Shared passwords are often weaker, spread more easily, and are less likely to be updated regularly. This significantly increases the risk of a data breach, as a single compromised credential can grant attackers access to critical company information.
Compliance Challenges: For regulated businesses, particularly those adhering to AML compliance, demonstrating clear accountability for filings is essential. Shared accounts undermine this, potentially leading to compliance violations and fines.
Post-Employment Access: When an employee leaves, shared credentials can inadvertently grant them continued access to company systems, posing a significant insider threat.
Security Lockouts: Companies House warns that sharing an account after it has been linked to GOV.UK One Login can trigger security controls that lock users out, causing significant disruption to filing processes.

The message is clear: businesses must start planning their transition away from shared accounts immediately to avoid potential disruption and security incidents.

Navigating Mandatory Identity Verification (ECCTA 2023)

While distinct from the GOV.UK One Login sign-in changes, mandatory identity verification (IDV) is a closely related and equally important reform driven by the Economic Crime and Corporate Transparency Act 2023 (ECCTA). This Act aims to strengthen the UK's defences against economic crime, improve corporate transparency, and enhance the integrity of the Companies House register.

Who Needs to Verify Their Identity and When?

Identity verification became a legal requirement for:

Individual company directors (existing and newly appointed).
Persons with Significant Control (PSCs).
LLP members.
Individuals who deliver documents to Companies House (presenters).

The IDV requirement came into force on 18 November 2025. New directors and PSCs must verify their identity before their appointment can be registered or within 14 days of their details being added to the PSC register, respectively. Existing directors and PSCs have a transitional period, with the final deadline for verification being 18 November 2026.

Existing directors must submit their personal code when their company next files its confirmation statement. If an individual is both a director and a PSC of the same company, the personal code must be provided separately for each role.

How Identity Verification Works

Individuals can verify their identity through two main routes:

Directly with Companies House via GOV.UK One Login: This is typically a digital process using the GOV.UK One Login app (matching a live image to a primary identity document like a passport or driving licence), answering security questions online, or in person at a Post Office.
Indirectly via an Authorised Corporate Service Provider (ACSP): Accounting firms can register as ACSPs to verify client identities to the statutory standard. This involves retaining records and filing a verification statement.

Once successfully verified, Companies House issues a unique personal code. This code belongs to the individual, not the company, and is essential for linking their verified identity to their Companies House roles.

Failing to verify identity by the deadline is a criminal offence, potentially leading to criminal prosecution for both the individuals concerned and the company.

Practical Steps for Accounting Firms and Client Guidance

Accounting practices play a pivotal role in ensuring their clients navigate these changes smoothly. Proactive guidance is key to preventing disruptions to filing obligations and maintaining strong client relationships.

1. Advise Clients on Individual GOV.UK One Login Creation

Educate clients that every individual who needs to access Companies House services must create their own GOV.UK One Login. This includes directors, company secretaries, and anyone authorised to file on behalf of the company. Emphasise that this requires a unique email address and phone number for each person.

2. Guide on Linking Existing Companies House Accounts

For existing users, the process involves linking their current Companies House accounts (both WebFiling and "Find and update company information") to their new GOV.UK One Login. Advise clients to:

Ensure their existing Companies House account email addresses are up-to-date and accessible.
Where possible, use the same email address for their GOV.UK One Login and their Companies House accounts to streamline the linking process.
Be prepared for a prompt to connect accounts upon their next sign-in to WebFiling.

3. Facilitate Identity Verification as an ACSP

Consider registering your firm as an Authorised Corporate Service Provider (ACSP) if you haven't already. This allows you to verify clients' identities directly, offering a valuable service and ensuring compliance. To register, a senior person within your firm must verify their ID, and your practice must be supervised for anti-money laundering purposes.

4. Proactive Client Communication

Develop a clear communication strategy to inform clients about these changes well in advance of deadlines. Provide step-by-step guides or workshops on creating a GOV.UK One Login and understanding the identity verification process. Highlight the security benefits and the risks of non-compliance.

Action Item: Create a dedicated client-facing FAQ or guide covering "What is GOV.UK One Login?", "Why do I need it?", "How do I create one?", and "What is identity verification?"

Enhancing Practice Security and Efficiency with Digital Tools

The shift to individual logins and mandatory identity verification aligns perfectly with the capabilities of modern digital tools. Accounting software and practice management platforms can play a crucial role in helping firms manage these changes efficiently and securely.

Centralised Client Data: Digital platforms allow for a centralised record of client GOV.UK One Login status, personal codes (where shared by clients for filing purposes), and identity verification progress. This reduces administrative overhead and ensures all relevant information is readily available.
Secure Communication: Utilise secure client portals within your software to exchange sensitive information, such as personal codes or identity verification documents, rather than insecure email. This enhances data protection and supports your GDPR compliance efforts.
Workflow Automation: Integrate compliance workflows into your practice management software to track client IDV progress and trigger reminders for upcoming deadlines, such as confirmation statements that require personal codes. This helps prevent missed deadlines and potential penalties.
Audit Trails: Digital tools inherently provide robust audit trails, recording who accessed what information and when. This complements the individual accountability fostered by GOV.UK One Login, strengthening your firm's internal controls and AML compliance framework.

By embracing these digital solutions, firms can transform a regulatory challenge into an opportunity to enhance their service offering, improve internal processes, and provide greater assurance to clients regarding their Companies House obligations.

Your Action Plan for a Smooth Companies House Transition

The transition to Companies House GOV.UK One Login and mandatory identity verification is a significant step towards a more secure and transparent corporate register. For UK accounting practices, proactive engagement is not just beneficial but essential.

Review Internal Processes: Assess how your firm currently manages client Companies House access. Identify any reliance on shared credentials and develop a clear strategy for transitioning to individual GOV.UK One Logins for all relevant personnel.
Educate Your Team: Ensure all staff are fully aware of the GOV.UK One Login requirements, the phased rollout dates, and the nuances of identity verification. Provide training on how to guide clients through the process.
Communicate with Clients Proactively: Start conversations early. Explain the changes, their implications, and the steps clients need to take. Offer support in creating GOV.UK One Logins and completing identity verification.
Consider ACSP Registration: If not already an ACSP, evaluate the benefits of registering to provide identity verification services, adding value to your client offering.
Leverage Digital Solutions: Utilise practice management software and secure client portals to streamline the management of client information, track compliance, and ensure secure communication.
Stay Informed: Regularly check official Companies House and GOV.UK guidance for any updates or further phased implementations. The regulatory environment is dynamic, and staying current is crucial.

Conclusion

The move to Companies House GOV.UK One Login marks a pivotal moment for UK corporate governance. By embracing individual, secure access and mandatory identity verification, the aim is to create a more reliable and trustworthy public register, directly combating economic crime. For accounting firms, this transition is an opportunity to reinforce their role as trusted advisors, guiding clients through complex regulatory changes while simultaneously enhancing their own operational security and efficiency. Act now to secure your clients' future Companies House filings and ensure seamless compliance.