How ACSPs verify a client's identity for Companies House

ACSP identity verification can look straightforward until a real file lands on your desk. A client may already have passed AML onboarding, uploaded a passport, or completed a platform check, but that does not automatically mean your business can submit a Companies House verification statement. The standard has its own route rules, evidence requirements, final attestation and record-keeping obligations. This article is general information only and is not legal advice.

In practice, the safest approach is to run Companies House verification as a separate controlled workflow. That means collecting the required personal details, choosing the correct document-checking route, testing whether the identity evidence is genuine and belongs to a real person, and keeping a file that shows exactly what was done.

This guide focuses on the operational verification process once an authorised agent is carrying out the check. It does not cover the separate decision to register as an ACSP, or personal-code recovery after Companies House has accepted a verification.

The six verification steps your file must evidence

Build your workflow so staff cannot submit a successful verification statement until all six Companies House steps are complete.

• Collect the person's full name, any former names, date of birth, home address, 12 month address history and email address.
• Choose the correct evidence route: Option 1 with identification document validation technology, or Option 2 with documents checked by a person.
• Check the evidence is real and valid for that route.
• Check the identity belongs to a real person and matches the individual in front of you or engaging remotely.
• Keep the full record, including documents, check outputs and any failed attempts, for seven years from completion.
• Only then decide whether you can honestly attest to Companies House that the standard has been met.

That order matters. If your process jumps from document collection to online submission, it leaves a gap.

Step 1 starts with better intake, not better software

The first Companies House step is basic but easy to under-document. Your team must ask for the person's full name and any former names, date of birth, home address, address history for the last 12 months, and email address.

This is one place where ordinary AML onboarding often falls short. A client profile may hold a current address but not the full 12 month address history. It may record a legal name but not a recent former name after marriage or deed poll. It may hold a shared office email rather than the individual's own email, even though Companies House uses the supplied email to send that person's personal code.

In practice, use a dedicated intake form for Companies House verification rather than relying on whatever your engagement or AML forms already capture. Your engagement letter can help define who is responsible for providing accurate identity information and supporting documents, but it does not replace the statutory check itself.

Choose the right route before you ask for documents

Step 2 is where many internal processes go wrong, because Option 1 and Option 2 are different routes with different evidence requirements.

Option 1 is the technology route. It uses identification document validation technology, often called IDVT. For this route, the individual provides one qualifying photographic identity document and the technology must validate the document's cryptographic features where present and its physical security features, such as holographs. This is not the same as a member of staff looking at a passport on a video call.

Option 2 is the person checked route. If the documents are being checked by a human, whether in person or remotely, Companies House says you must use Option 2. Under this route, one document is not enough. The individual must provide either two photographic identity documents from Group A, or one Group A document plus one Group B document. If the person does not live in the UK, at least one document must be government issued.

Do not freeze a static list of acceptable documents into your training notes and assume it will stay correct. Companies House maintains the live document lists and route-specific exceptions, so staff should check the current official list at the time of verification.

Expired documents can be allowed, cancelled ones cannot

A common trap is treating all expired documents the same. Companies House allows certain specified expired documents for certain routes, but not every expired document. For example, some passports or UK biometric residence permits may still be usable within stated limits for the relevant route if the official conditions are met.

That is very different from a document that has been cancelled or replaced with a newer one. A cancelled passport, or one marked as replaced, should not be treated as acceptable evidence just because it was once valid. Your procedure should make staff record whether a document is simply expired within a permitted exception, or whether it has been cancelled, replaced or otherwise falls outside the current list.

That distinction is especially important when you receive pre-existing files from another department. A document stored for AML years ago may not be usable for a current Companies House verification, either because the route is wrong, the exception does not apply, or the document has since been replaced.

Checking the document is real is only part of the job

Step 3 is to check the evidence is real. Step 4 is to check it is a real identity and belongs to the person claiming it. Those are separate tasks.

For Step 3, your team should have a route-specific method for validating the document itself. Under Option 1, that means the IDVT process must do what the standard requires, not merely extract data or compare a selfie. Under Option 2, staff checking documents must be trained to detect false documents and follow the Home Office best-practice guidance identified by Companies House.

For Step 4, the question becomes broader: does this identity make sense as a real person with a traceable life pattern, and does it connect to the client you are dealing with? In a remote check, the reviewer must clearly see the person's face and compare it with the photo on the document. Companies House guidance also calls for extra evidence where documents do not confirm 12 months of address history or the person has changed their name.

For a remote client with a recent name change and patchy address history, a sensible escalation might be to ask for additional evidence showing the change of name and recent activity at the claimed home address. Examples mentioned by Companies House include recent bank or credit card statements showing transactions, utility or council tax bills, insurance documents showing the home address, or other evidence you would expect for a real person. If the extra material still does not resolve the doubt, stop there and do not attest success.

Using a provider does not outsource your responsibility

Many ACSPs will use a commercial ID platform for some or all of the process, especially for remote clients. That can be efficient, but it does not move the legal responsibility away from the ACSP.

You still need to be satisfied the provider completes all required steps. If it only completes some of them, your firm must do the rest. You also need to be able to explain and evidence why you concluded the provider's steps were appropriate.

In workflow terms, that means mapping the provider's output against each Companies House step. Does the platform capture former names and 12 month address history, or just current identity data? Does it perform true IDVT for Option 1, or only image capture and facial matching? Does it produce an audit trail you can retain? Who in your firm reviews exceptions, mismatches and warning flags? These are practical control questions, not extra statutory steps, but they matter if Companies House later asks you to justify the process.

It is also sensible to reflect this in supplier terms, internal policy and client engagement wording so responsibility for providing accurate information, and your right to request extra evidence, are clearly documented.

When to submit, when to refuse, and what to keep

Step 5 is record keeping, and Step 6 is the final decision. Keep all evidence and information used to verify identity for seven years from the date the checks are completed. That includes copies of documents, evidence of the checks carried out, records of failed verification attempts and, after a successful submission, a saved copy of the details shown on the Companies House confirmation page.

When you do submit a successful verification, Companies House asks for details about the documents and the checks used, such as document reference details, expiry date where relevant, country of issue where relevant, whether the documents were checked by a person or using IDVT, and the date the checks were completed. You do not send full document copies with the online statement, but you must be able to produce your records if asked. After a successful submission, Companies House says you must print or save the confirmation-page details you submitted and keep that copy for your records.

If verification fails, do not submit a success statement in hope that later filings can be fixed. The online statement requires you to confirm that you are satisfied the person is who they claim to be and that the Companies House standard has been met. If you are not satisfied, the correct outcome is non-submission, with a complete retained record of what was provided and why the check did not pass.

Because these files contain identity documents and related personal data, your retention schedule should reflect both the seven year Companies House duty and UK GDPR storage limitation principles. In practice, keep access restricted, store the file securely, record the lawful business purpose, and document when the seven year period ends. Do not promise early deletion where you still need the data to meet the Companies House record keeping requirement.

Key Takeaways

• Companies House verification is its own process, even if the client has already completed AML onboarding or a platform check.
• You need the required intake information first, including former names, 12 month address history and the person's email address.
• Choose the correct route before reviewing documents: Option 1 uses IDVT, while Option 2 applies where a person checks the documents.
• A genuine-looking document is not enough on its own. You also need to decide whether the identity belongs to a real person and whether extra evidence is needed.
• Keep copies of the documents, check evidence, failed attempts and submission records for seven years.
• Only submit a successful statement when you can honestly confirm the Companies House standard has been met.

This ACSP workflow is separate from a director or PSC choosing whether to verify directly; our Companies House identity verification guide covers that choice. If you need help defining the client engagement, an outsourced ID-platform agreement or data-handling terms for this service, Sprintlaw UK can help with those legal documents. Call 0808 134 7754 or email team@sprintlaw.co.uk.