Identity verification is one of the most important aspects of operating a registered office service. While there is often confusion between Companies House identity verification requirements and the due diligence expected of registered office providers, they are related but not identical.

If you are offering a registered office address to third parties, you should think in terms of three layers of compliance:

• Companies House requirements

• Anti-Money Laundering (AML) and Know Your Customer (KYC) best practice

• Protecting your own business from fraud and misuse

1. Why identity verification matters

A registered office provider can unknowingly become involved in:

• Money laundering

• VAT fraud

• Missing trader fraud

• Tax evasion

• Director disqualification avoidance

• Fake companies

• Phoenix companies

• Online scams

• Counterfeit businesses

If HMRC, Companies House, the police or a creditor contacts your business because a fraudulent company is registered at your address, you'll need to demonstrate that you carried out reasonable checks before accepting the customer.

Good due diligence also protects your reputation. If dozens of dubious businesses become associated with your address, it can damage your brand and may lead banks, suppliers or search engines to view your location less favourably.

2. Companies House requirements

Under reforms introduced by the Economic Crime and Corporate Transparency Act 2023 (ECCTA), Companies House has been given significantly stronger powers to improve the integrity of the UK companies register.

These include:

• Mandatory identity verification for certain individuals connected with companies (being phased in),

• Greater powers to query or reject information,

• The ability to remove inaccurate or fraudulent filings, and

• Stronger enforcement where information is false or misleading.

It's important to note that Companies House identity verification is a requirement on individuals and authorised filing agents - not on registered office providers themselves. However, if you're supplying a registered office service, it is prudent to align your onboarding process with these higher standards.

3. What should you verify?

For every customer, you should verify:

Individual identity

Obtain:

• Passport

• UK driving licence

• National identity card (where applicable)

These should be current and appear genuine.

Residential address

Request recent evidence such as:

• Utility bill,

• Bank statement,

• Council tax bill, or

• Mortgage statement.

Many operators ask that documents be dated within the last three months.

Company details

Check:

• Company name,

• Company number (if already incorporated),

• Date of incorporation,

• Registered directors,

• Persons with significant control (PSCs).

These details can be compared against the public Companies House register.

Beneficial ownership

Where a company is owned by another entity or has a more complex structure, you should understand who ultimately controls it. This helps identify whether there are hidden owners or unusual arrangements that merit additional scrutiny.

4. Know Your Customer (KYC)

A typical KYC process includes:

Step 1 – Customer application

Collect:

• Company name

• Trading name

• Director names

• Contact details

• Nature of business

• Website

• Expected mail volume

• Countries traded with

Step 2 – Identity documents

Verify:

• Photo ID,

• Proof of address, and

• Company documentation (if applicable).

Step 3 – Business verification

Review:

• Website,

• LinkedIn profile,

• Trading history,

• VAT registration (where relevant),

• Business activity.

The aim is to confirm that the business appears genuine and consistent with the information provided.

Step 4 – Risk assessment

Consider factors such as:

Low risk

• Local consultant

• Small marketing agency

• IT contractor

• Accountant

• Recruiter

Medium risk

• Overseas directors

• Newly incorporated companies

• High mail volumes

High risk

• Cryptocurrency businesses

• Money transfer services

• Unregulated financial activities

• High-value trading with little information

• Frequent changes of directors or ownership

Higher-risk applicants may justify enhanced due diligence or a decision not to provide the service.

5. Sanctions and PEP screening

Many operators use screening tools to check whether applicants appear on:

• UK sanctions lists,

• international sanctions lists, or

• Politically Exposed Person (PEP) databases.

A match doesn't necessarily prevent onboarding, but it should trigger further investigation before proceeding.

6. Ongoing monitoring

Identity verification isn't a one-off exercise.

You should keep customer information up to date by:

• Confirming details periodically,

• Reviewing changes in directors or ownership,

• Monitoring unusual mail volumes,

• Checking for unusual patterns (for example, repeated legal correspondence).

7. Record keeping

Maintain secure records of:

• Identification documents,

• Proof of address,

• Onboarding forms,

• Screening results,

• Correspondence,

• Contracts, and

• Any decisions made during due diligence.

Access should be restricted to authorised staff, and records should be retained only for as long as necessary to meet legal and business obligations, taking account of UK data protection requirements.

8. Identity verification technology

Manual checks work for a handful of customers, but become inefficient as your virtual office portfolio grows.

Many operators now use digital identity verification platforms that can:

• Scan passports and driving licences,

• Detect fraudulent documents,

• Compare a selfie to the ID document,

• Perform liveness checks,

• Verify proof of address, and

• Maintain an auditable record of the verification process.

These services can reduce onboarding time from days to minutes while improving consistency.

9. Should every customer be verified?

From an operational standpoint, yes.

Even if someone only wants a registered office address for a dormant company, your address becomes associated with that company on the public register. Applying the same onboarding standards to every customer helps avoid inconsistent decision-making and reduces the risk of abuse.

10. A practical onboarding checklist

Before activating a registered office service, ensure you have:

• Verified the identity of at least one director or authorised representative.

• Verified a current residential address for that individual.

• Confirmed the company's details (or obtained incorporation details if it is being formed).

• Understood the nature of the business and its intended activities.

• Checked whether enhanced due diligence is appropriate based on the risk profile.

• Obtained a signed service agreement and acceptable use confirmation.

• Recorded all verification steps and stored them securely.

• Configured procedures for handling, scanning and forwarding mail.

A note on regulation

One important distinction is that not every provider of registered office services is automatically subject to the UK Money Laundering Regulations solely because they offer an address service. Whether you fall within the regulated sector depends on the exact services you provide and your business model. If you also provide services such as company formation, company secretarial work, or other trust and company services, additional regulatory obligations may apply.

Given the legal and reputational risks, many experienced flexible workspace operators voluntarily implement AML/KYC procedures that meet or exceed regulated-sector standards, even where they are not legally required to do so. This provides stronger protection for the business, reassures insurers and banking partners, and helps demonstrate that reasonable steps were taken if a customer is later found to have misused the address.