Open Ownership response to BEIS consultation on Corporate Transparency and Register Reform

Responses to Questions 1-3

Q1. Do you agree with the general premise that Companies House should have the ability to check the identity of individuals on the register? Please explain your reasons. &

Q2. Are you aware of any other pros or cons government will need to consider in introducing identity verification? &

Q3. Are there other options the government should consider to provide greater certainty over who is setting up, managing and controlling corporate entities?

Rather than systematically examining the reliability of information it receives, Companies House currently focuses on addressing superficial inaccuracies. Lack of verification of the data submitted remains the biggest weakness of the UK Persons of Significant Control (PSC) register.

This has been shown not only by Global Witness analyses of the PSC register [1]; Financial Action Taskforce (FATF) review in 2018 has similarly recognised the lack of verification as the weak point in the integrity of the UK regulatory system.[2]

Open Ownership has chosen to submit responses to Questions 1-3 as a position paper, addressing approaches to verification and their costs and benefits. In doing so, we seek to place our recommendations to the UK in the context of what we believe to be an overall best practice framework for verification. In our in-line responses to further questions, we will often refer to this position paper with specific page references.

Open Ownership’s position is that good verification represents a series of linked technical and administrative strategies. We will address identity verification and its pros and cons as one critical element in a set of strategies that the UK government can employ to ensure that data about PSCs is good quality and ensures policy impact.

Technical strategies

Data about beneficial ownership can be broken down into data about people, data about entities, and data about the relationships between them. The best strategies for verifying each type of statement will vary. The emphasis is on strategies that make it more difficult for someone to submit false information, and that make it simpler to tell the difference between a genuine mistake and information that is deliberately misleading. In other words, verification is not only about checking the accuracy of every statement, but also about closing loopholes through standardisation. A tool such as the Beneficial Ownership Data Standard (BODS) can enable this by providing a structured format for representing people, entities, and relationships as data, which limits the possibility for mistakes and renders data more easily compared with other key datasets. This could enable patterns to be identified in the data that could help flag suspicious activity, allowing Companies House or another agency to proactively detect crime, corruption, or money laundering.

For the purposes of this consultation, we focus below on verification of data about people and verification of data about relationships, which we feel is equally critical. Our recommendations reflect lessons learned from developing BODS and linking PSC data with international datasets via the Open Ownership Register.

Verifying data about people

Verifying identities will make it harder for someone to submit false information, either through falsely declaring that an individual holds a registrable position with a company, or through declaring information about a fictitious individual. This will make it much harder for criminals wishing to abuse UK companies to hide their identity.

We recognise that there will be particular challenges with verifying data about foreign nationals, but urge the UK to explore the most rigorous options available for verification in these cases. In general, we advocate that ID verification take place in line with the following strategies:

• There is a live facial recognition match test against government-issued ID documents provided to make sure the person claiming a particular identity is indeed the person whose photo appears on the ID or to whom that identity is assigned.
• If the person is a UK national, their identity is validated against the relevant UK dataset and credit reference databases to ensure it is real.
• If the person is a foreign national, their identity is checked against any datasets securely held by the UK government. “Zero-knowledge proofs” could permit information sharing between the UK and foreign governments, wherein the foreign government simply confirms whether or not the information the foreign national has provided to the UK matches their own records without providing further personally identifying information.[3]
• If an individual is submitting PSC information on behalf of someone else, then they should be required to verify their own identity, and provide evidence that they are authorised to submit information on their behalf or on behalf of the reporting entity.
• The system should make it clear to end users when an individual’s identity has been verified.
• PSCs unable to be verified through the above processes could be referred to a regulated professional to carry out necessary money laundering checks and verification of their data.

Verifying data about relationships

In addition to identify verification, the government should consider taking steps to verify how a PSC is linked to the company in question. In the most complex examples, PSCs exert control indirectly - through multiple intermediary companies - and these intermediaries may be incorporated in multiple jurisdictions. Our suggested strategies centre on the principle that greater transparency over the relationships between people and entities gives more power prospective business partners, civil society, or law enforcement to assess risk and identify red flags. It also increases the cost to individuals or third parties wishing to submit false information.

We suggest that the government pursue verification of data about relationships through the following strategies:

• Declaring companies are required to provide evidence and documentation of their entire corporate structure. The documentation should be made available to the public.
• Identifying information for shareholders of any Relevant Legal Entities (RLEs) should be made available to the public as structured data. This information is currently available in unstructured forms through registers of members and incorporation documents.
• We join colleagues at Global Witness in calling for the lowering of the 25% control threshold for beneficial ownership disclosure. This remains one of the biggest loopholes for avoiding scrutiny and we have long argued for the 25% control threshold to be replaced with a requirement for companies to report their beneficial owners’ holdings of shares or voting rights in exact percentages. As shown by Global Witness’ analyses of PSC register data, applying the 25% ownership and voting thresholds creates a risk that significant interests in a company are not disclosed and enables beneficial owners to structure company ownership in order to avoid public disclosure.[4] Deliberate strategies to avoid PSC disclosure are also harder to identify among the hundreds of thousands of companies that report not having a PSC.
• Removing the banding stakes would also make it easier and more efficient for obliged entities to check the register and identify discrepancies. Banding will always result in an imprecise figure and can make it difficult to compare data across jurisdictions.

Administrative strategies

At the heart of the issue of verification is an administrative question: which agency should be empowered to conduct verification? Our recommendation is that Companies House needs to be given the powers and resources to carry out comprehensive verification of all the information it receives and holds on companies. Additionally, it or another agency should be empowered to investigate errors and inconsistencies, including those flagged by users, and actively seek to correct misreported data. This should be linked to a sanctions regime such that reporting companies or PSCs that fail to provide evidence backing up data that has been flagged, or provide corrected data that isn’t evidenced, may be subject to administrative fines or struck off Companies House.

Empower Companies House to verify and conduct red flagging

We support the idea of a risk based approach to identifying information for query by Companies House (consultation paper paragraph 132). There is much to be gained from using fairly simple algorithms to identify ‘red flags’ in information, such as circular ownership structures or frequent changes in PSCs. In addition, substantial gains can be made by using simple algorithms to identify where the information submitted does not comply with disclosure requirements, for example where a company based in an overseas jurisdiction without an equivalent transparency framework is listed as a PSC. A company deliberately suppressing information on who controls it should be considered a major red flag, and research by Global Witness identified that more than 10,000 companies declare a foreign company as their beneficial owner which is unlikely to meet the requirements – of these 72% of are linked to a secrecy jurisdiction through their registration or correspondence address.[5]

We also support the proposal that Companies House could cross-reference its data with other data sets suggested by paragraphs 207-209 of the consultation paper. Some datasets have already been mentioned in the section on verifying identities above; they could include the Driver and Vehicle Licensing Agency database, National Insurance data and credit reference databases; and risk intelligence databases to screen for red flags such as companies being incorporated on behalf of Politically Exposed Persons (PEPs) or those on international sanctions lists. Companies House could also seek to raise red flags with intelligence and law enforcement data; data from the regulated sector; data available from leaks such as the Panama Papers; and international datasets about companies.

In general, care should be taken to ensure that machine learning and other algorithmic assessment tools do not inadvertently lead to biases in how companies are selected for query (for example, disproportionately querying companies with foreign named PSCs). A rigorous ethical assessment of algorithmic and machine learning assessments should be conducted.

Referring red flags to law enforcement

Red flags, once raised, should be referred to an agency with the capacity to follow up with a full law enforcement investigation as needed. Companies House should be empowered to refer cases to designated authorities, such as Insolvency Service, tax authorities, financial intelligence unit or other relevant law enforcement bodies for further investigation or prosecution.

Empowering users to verify data

In most cases, literally following the money is the only way to verify the accuracy of beneficial ownership information.[6] Given that this is incredibly resource-intensive, we urge the government to consider administrative strategies that can help correct the record in high-risk cases. In recommending this, we take inspiration from an unexpected model: Slovakia. Though the government’s struggles with corruption are well-known, their public, open data beneficial ownership register has been uniquely impactful as a starting point for accountability and a deterrent for criminal behaviour. The primary reason for this is a clever legislative mechanism that reverses the burden of proof of beneficial ownership. Anyone can submit a claim querying data to the Registration Court, which administrates the register. If the Court finds it reasonable, there is a proceeding to verify the data. The beneficial owner is then responsible for submitting evidence that the beneficial ownership information is correct. If queried data remains incorrect or incomplete, the court can fine the company, remove them from the register, and - because Slovakia’s register is linked to public procurement - current government contracts can be cancelled.

This reverse burden of proof is based on two principles:

• It is reasonable to ask people who register data to prove it is correct, because they have the best access to the data;
• It is fair for the burden of proof to be on owners, because they benefit most from the ownership.

The strength of this approach is that it provides strong incentives for any reporting company that is suspected of submitting deliberately misleading data to correct the record in a way that gives users true confidence in the data. Companies House already receives reports from data users about incorrect or missing data that it processes and pursues. Risk assessment parameters, co-developed with civil society, should be applied to these reports, enabling Companies House or another agency to adjudicate next steps. The highest-risk cases should be subject to an administrative procedure similar to those in place in Slovakia, wherein higher standards of evidence from reporting companies can be required and sanctions levied if it is not provided.

This suggested administrative process would harness the “many eyes” of the public to build greater trust in the data held by Companies House, and enable greater accountability for those entities that fail to cooperate.

Costs and benefits of implementing these strategies

Although it is estimated that the vast majority of information about individuals on the register is accurate (consultation paper paragraph 33), it is precisely the small minority of companies providing inaccurate information that are most likely to be being used for criminal purposes. Abuse of companies by a small minority has serious and widespread impacts. It enables money laundering and other criminal activity, undermines trust in legitimate UK companies, and damages the international reputation of the UK business environment by adding cost and uncertainty to due diligence processes. Verifying the information held by Companies House, including the identities of individuals, would provide for greater confidence by those doing business in the UK and a reduced risk of UK legal entities being abused for financial crime.

Verifying data on the register will also make this data of greater value to those using it for the intended policy impact: for example, government departments and businesses undertaking due diligence on potential contractors, or law enforcement and civil society exposing corrupt and criminal behaviour. Moreover, it will support compliance with the 5th Anti-Money Laundering Directive (5MLD) (Directive 2018/843), which requires MS to ensure that beneficial ownership information is “adequate, accurate and current” and includes “the details of the beneficial interests held”; it also requires the obliged entities, and where appropriate also competent authorities, to report any discrepancies between PSC data available to them and that on the company register and MS to take actions to resolve these discrepancies.[7]

Though Open Ownership is sympathetic to the overarching concern with introducing more friction into the company registration process and the desire to keep the UK at the top of ease of doing business rankings, we believe the wide-ranging benefits stated above outweigh any additional costs to those seeking to do business in the UK. Moreover, we argue that these additional costs are proportionate and similar to registration process in other jurisdictions. One example is Denmark, where beneficial owners are required to submit a scanned copy of their passport or other national ID, limiting the possibilities for false registrations.[8]

Next page: Responses to questions 4-44