Companies House Reforms 2026: What Every UK Director Must Do

The Companies House reforms every UK director and accountant must act on now, before the penalties arrive.

Updated June 2026

On 13 March 2026, Companies House discovered that its own online filing service had a flaw. A logged-in user, under specific conditions, could access and potentially amend another company’s records. Directors’ residential addresses. Registered email addresses. Day-of-birth data. All may have been visible to the wrong person.

The service was taken offline for three days while an investigation ran. Millions of UK businesses were left exposed because of a vulnerability inside the system they trusted.

Nobody was expecting it. And that is exactly the problem.

Key point: This breach did not happen because of a weak password or a phishing email. It happened because the system changed, and the risk was invisible, until it was not.

Why This Matters More Than You Think

Most business owners treat Companies House as a background task. You incorporate, you file a confirmation statement once a year, and you forget about it until the next reminder.

That approach worked fine for decades. It does not work anymore.

The Economic Crime and Corporate Transparency Act 2023 (ECCTA), legislation passed to fight money laundering, fraud, and the misuse of UK company structures, has fundamentally changed the relationship between every UK company and Companies House. Between 2024 and 2028, the obligations on directors, shareholders, and their accountants are being rebuilt from the ground up.

Directors who assume that company compliance is still what it was five years ago are wrong, and the cost of getting this wrong is not abstract. It is fines, struck-off companies, delayed filings, and compromised data. Let us walk through each change clearly, with no jargon, so you know exactly what is coming and what you need to do.

Change 1: Identity Verification, the Clock Is Already Running

From 18 November 2025, identity verification became mandatory for all UK company directors, LLP (Limited Liability Partnership) members, and PSCs (Persons with Significant Control, individuals who own more than 25% of a company or otherwise control it).

If you are a director appointed after that date, you must verify before you take the role. If you were already a director when the requirement came in, you have until 18 November 2026, or until you file your next confirmation statement (an annual return confirming company details), whichever comes first.

Action required: Deadline for existing directors and PSCs is 17 November 2026, or before your next confirmation statement, whichever is earlier. Missing this means you cannot file.

Verification is done through GOV.UK One Login, a government identity system, and is free if you do it directly. You will need a UK photo driving licence or a biometric passport. Once verified, you receive an 11-character Personal Code, which you then attach to every company role you hold.

If you do not have biometric ID, you can verify in person at a Post Office or through an Authorised Corporate Service Provider (ACSP), a regulated firm such as an accountancy practice that is officially recognised by Companies House to carry out verification on behalf of clients.

The practical implication: every accountant advising business clients now needs to be tracking this. The filing system will not allow unverified directors to submit returns.

Change 2: Your Company Must Have a Registered Email Address

Since 4 March 2024, every new company incorporated in the UK must supply a registered email address at the point of formation. Every company already on the register was also required to add one.

This address does not appear on the public register. It is kept private by Companies House and used only for official communications. But it must be active, monitored, and capable of receiving notices.

Risk: If you incorporate a company and give an email address that nobody checks, you will miss statutory notices. That creates real legal risk for the company and its directors.

This sounds straightforward. In practice, it trips up clients more than you would expect. Companies set up with a personal email that the director no longer uses. Inboxes that route Companies House emails to spam. Registered emails attached to a member of staff who has since left.

The simple fix: use a dedicated business email, add it to your compliance calendar for annual review, and ensure at least two people in your organisation have access to it.

Change 3: Fees Have Risen, and Risen Again

On 1 May 2024, Companies House increased its filing fees significantly for the first time in years. The cost of incorporating a new company jumped from £12 to £50. On 1 February 2026, it rose again, to £100 for digital incorporation. The annual confirmation statement now costs £50.

These increases are not arbitrary. They fund Companies House’s expanded powers under ECCTA: fraud investigation, identity verification infrastructure, and the enhanced register.

The increase matters most for accountancy firms and company formation agents handling high volumes. If your pricing has not been updated since before May 2024, you may be absorbing costs that should be passed to clients.

For accountants: Review your service pricing to reflect the 2024 and 2026 fee increases. £100 for incorporation is now the baseline, not the exception.

Change 4: Software-Only Filing, from April 2028

This is the biggest structural change since Companies House was established.

From April 2028, paper filing of accounts closes permanently. The web-based filing route, the one most small businesses and their accountants use today, also closes. Every UK company, regardless of size, will be required to file accounts using commercial software that produces iXBRL-tagged data.

iXBRL stands for Inline eXtensible Business Reporting Language. It is a digital format that makes financial data machine-readable, enabling Companies House to analyse and verify it automatically. You do not need to understand the technical side, but your software provider does.

What changes specifically for small companies and micro-entities (companies with turnover under £10.2 million and £632,000 respectively):

• The option to file abridged accounts (a simplified version that omits the profit and loss account) is removed.
• Small companies and micro-entities must file a profit and loss (P&L) account for the first time, though they can opt out of having it published on the public register.
• Small companies will no longer be required to file a directors’ report.
• Accounts and reports must all be filed together, with no more partial submissions.

Critical: If you currently file paper accounts or use Companies House’s own web route, that route will not exist from April 2028. You need accounting software that is iXBRL-compliant before that deadline, not in 2028.

Set up systems in advance, not at the last minute. The 2028 deadline feels distant, but it is not. Accounting software migrations take time. Training takes time. Testing takes time. Start the conversation with your clients and accountants now.

Change 5: The WebFiling Breach, and What It Tells Us

Let us return to where we started: March 2026.

When Companies House integrated WebFiling with the new GOV.UK One Login system in October 2025, a bug was introduced. That bug allowed a logged-in user to access data from another company’s filing profile, including the day of birth of directors and PSCs, residential addresses, and the company’s registered email address. It also allowed changes to be made: addresses and contact details could be altered without the company’s knowledge.

The vulnerability remained in place for approximately five months before it was identified. Companies House confirmed no reports of data having been accessed or changed without permission, but the investigation was ongoing at the time of writing.

The lesson is not that Companies House is untrustworthy. The lesson is that every system change creates a new attack surface, and that directors who assume their company data is always protected, regardless of what they do, are carrying a risk they have not priced.

Compliance is not a box you tick. It is the ongoing work of knowing what changed, when it changed, and what you need to do about it.

The companies most at risk from this type of incident are those with outdated email addresses on file, unverified directors who have not engaged with the identity changes, and no advisor monitoring their register in real time.

What You Should Do Right Now

Five changes, several deadlines, and real penalties for missing them. Here is the practical action list:

• For directors and PSCs, verify your identity now. Do not wait for your confirmation statement. Use GOV.UK One Login, complete the process, and keep your Personal Code on file.
• For all companies, audit your registered email. Who owns it? Who has access? Is it monitored? Update it if there is any doubt.
• For accountancy firms, review incorporation and compliance pricing. The fee increases since 2024 are material. Ensure your client-facing costs reflect the current reality.
• For accounts preparation, start the software conversation in 2026, not 2028. Identify which clients still use web-filing or paper. Map them to a compliant software solution. Test before the deadline closes.
• For all business owners, monitor for further breach disclosures. Follow ACCA and ICAEW guidance on the WebFiling incident. If your company data looks unusual or unfamiliar, report it to Companies House immediately.

The Bigger Picture

Companies House is not just a filing database anymore. Under ECCTA, it has become an active regulator with powers to query information, reject filings, investigate discrepancies, and refer cases to law enforcement.

That is a significant shift, and it places a greater responsibility on every company director and their advisors to keep accurate, timely, and verified records.

Morgan Housel writes that reasonable, well-informed people can disagree about the future, but they cannot disagree about the present. The changes described in this article are not speculative. They are law, or confirmed policy with published deadlines.

The question is not whether these changes apply to you. They do. The question is whether you act now or wait until a missed deadline or a compromised filing forces the issue.

Talk to a Zazentax Adviser

At Zazentax, we work with founders, directors, and growing businesses to keep company obligations current, not as a reactive fix, but as a built-in part of how we work together.

If you want to review your company’s compliance position in light of the ECCTA changes, we are ready to help. Get in touch.

Zazentax – Smarter Accounting and Automation for UK Businesses