Open Ownership response to BEIS consultation on Corporate Transparency and Register Reform

Responses to questions 4-44

How identity verification might work in practice

Q4. Do you agree that the preferred option should be to verify identities digitally, using a leading technological solution? Please give reasons.

Identities should be verified digitally, leveraging new technologies where helpful and in line with verification practices already in place in the private sector. This will enable improved accuracy of the data due to standardisation and the possibility for in-line validation of inputs; time and cost savings due to the automation of the process; and increased security, provided a strong, multi-factor authentication is used. Digital ID verification is also an essential step towards interoperability and greater cooperation and transparency with other jurisdictions. The list of acceptable forms of IDs in the UK is well established and should come at no great cost or surprise to companies and TCSPs.

Please see our response to Questions 1-3 for a description of what this should entail.

Q5. Are there any other issues the government should take into account to ensure the verification process can be easily accessed by all potential users?

No response. That some individuals may lack government-issued IDs, and that there will be challenges with ID verification of non-UK citizens especially when this occurs remotely, is already covered in the consultation paper.

Q6. Do you agree that the focus should be on direct incorporations and filings if we can be confident that third party agents are undertaking customer due diligence checks? Please give reasons. &

Q7. Do you agree that third party agents should provide evidence to Companies House that they have undertaken customer due diligence checks on individuals? Please give reasons. &

Q8. Do you agree that more information on third party agents filing on behalf of companies should be collected? What should be collected? &

Q9. What information about third party agents should be available on the register?

As paragraph 70 of the consultation paper acknowledges, the majority of UK companies investigated for possible money laundering have been incorporated via a third party agent. Research by the World Bank suggests that regulatory compliance by third party agents is far from perfect, and that this is linked to the abuse of anonymously owned companies for grand corruption purposes.[9] Research by Transparency International UK has identified substantial weaknesses in the standard of customer due diligence by trust and company service providers based here.[10]

A lack of transparency and accountability in relation to third party agents therefore has the potential to seriously undermine the goals of this reform. Any weakness in the process of identity verification conducted by third party agents is likely to be exploited by those wishing to abuse UK companies, and therefore we caution against focussing only on direct incorporations. In order to close this potential loophole, Open Ownership recommends the following measures:

1. Companies House conducts spot checks on data submitted by third party agents. In order to identify inaccuracies in the information submitted by CSPs, Companies House conducts spot-checks to re-verify the data. We recommend that Companies House adopts a risk-based approach, co-developed with stakeholders including civil society, to carrying out these spot checks. These could target data from reporting entities where the stakes for misreporting are high, such as those with substantial market share or with high-value government contracts, or data that displays certain red-flags indicating that the entity may be a money laundering risk.
2. Evidence of third-party verification is collected. Evidence that third party agents have completed due diligence and identity verification for all Directors and PSCs should be required, along with the details of who checked them. Companies House should also require details of which identities have been checked.
3. Only UK-regulated TCSPs should be permitted to register and report data on UK companies. Companies House should only permit agents that are regulated in the UK or in jurisdictions with at least equivalent regulatory standards to form companies and submit information to Companies House. This will prevent individuals from circumventing UK anti-money laundering (AML) regulations when incorporating UK companies. The principle of permitting only local agents to register companies is well established in a number of other jurisdictions and we see no reason that it wouldn’t work in the UK.
4. Information about third party agents should be collected. Collecting information about third party agents will support regulation of these agents and strengthen accountability for poor professional practice by allowing data users to identify any that regularly provide false or poor quality data to Companies House, or that are regularly involved in incorporating entities used for money laundering. The following data points should be collected and available to the public as structured data:
   1. The name of the third party agent that undertook identity verification
   2. The name of the person within the third party agent who was responsible for conducting the identify verification
   3. Which document types were checked by the third party agents
   4. The name and country of the AML supervisory body, and proof of AML registration (e.g. AML registration number) of the third party agent. For UK supervised firms, this could be validated against a pre-populated list of registration details obtained from AML supervisors, so only those officially registered with a UK AML supervisor are allowed to submit information.
5. Sanctions against third party agents with poor professional practice. Sanctions against reporting entities and PSCs for misreporting or failure to comply should be extended to third party agents that facilitate the reporting of poor quality or unverified data to Companies House. For instance, third party agents should be required to guarantee payment of administrative sanctions levied against PSCs or reporting entities unless they can prove they acted with professional diligence.

Who identity verification would apply to and when

Q10. Do you agree that government should (i) mandate ID verification for directors and (ii) require that verification takes place before a person can validly be appointed as a director? Please set out your reasons.

Yes to both. Mandating verification for directors would dramatically improve accuracy of data in the register and make it substantially harder for criminals to hide their identities when incorporating companies. Given the vast majority of new directors are operating legitimately, the approach of mandating successful identity verification prior to incorporating a company (or appointing a new director to an existing company) is important to prevent the minority who wish to abuse the system. It will increase trust in UK companies, and for the vast majority of directors should be simple and quick to complete.

Q11. How can verification of People with Significant Control be best achieved, and what would be the appropriate sanction for non-compliance?

Identity verification of PSCs should be mandatory, and should be supported by adequate sanctions that are effectively enforced. If identity verification for PSCs is voluntary, it is reasonable to assume that criminals looking to abuse UK companies will not choose to verify their identities. Making verification for PSCs voluntary would therefore be a lost opportunity to substantially improve data quality in the register - which the recent BEIS implementation review highlighted as a being key concern for users - and strengthen the UK’s defences against money laundering. We support proposal that PSCs are responsible for verifying their information, but in order to incentivise compliance, sanctions should apply to the company as well as the PSC. This will incentivise companies to maintain up to date records of their PSCs and provide updated information to Companies House in a timely manner. Sanctions against the company may also be easier to enforce in cases where the PSC failing to verify their information is a foreign national.

Please see our response to Questions 1-3 for our positions on how verification of the identities of PSCs can be best achieved. Following on from Question 10, we would add that since majority of PSCs are also directors, their info will already be verified.

Q12. Do you agree that government should require presenters to undergo identity verification and not accept proposed incorporations or filing updates from non-verified persons? Please explain your reasons.

Yes, presenters should be required to verify their identity (unless they are a Director who has already verified their identity with Companies House). Mandatory identity verification for presenters would make it harder for unauthorised individuals to file information and would increase the risks to presenters for filing false information. To have these positive impacts, it is essential that both filing of incorporations and updates are only possible for presenters who have verified their identity with Companies House.

Q13. Do you agree with the principle that identity checks should be extended to existing directors and People with Significant Control? Please give reasons.

Yes, existing Directors and PSCs should be required to verify their identity with Companies House, as not doing so will create a two-tier system in which only information about new Directors and PSCs is verified. This would create a significant loophole allowing current Directors and PSCs to avoid identity verification. Given the large number of companies already on the UK register, not requiring the Directors and PSCs of existing companies to comply with the new verification requirements would completely undermine the policy intention of strengthening the UK’s defences against money laundering and increasing trust in the UK’s system.

For most companies, verifying the identity of their Directors and PSCs should be relatively simple and swift. Only 13% of companies on the PSC register have three or more PSCs [11], and for many companies - especially small businesses - the PSCs are the same people as the Directors so would already be verified.

Requiring better information about shareholders

Q14. Should companies be required to collect and file more detailed information about shareholders?

We welcome the proposed increase in info about shareholders; historical shareholdings are valuable for due dil etc. There is value for data users in understanding all companies an individual is associated with, be it as PSC, director or shareholder. Open Ownership understands the critical role played by shareholder data in verifying and triangulating beneficial ownership data. Both datasets tend to be used together in investigations, which is why access to structured, high quality shareholder data is crucial.

Q15. Do you agree with the proposed information requirements and what, if any, of this information should appear on the register?

The level of information required for PSCs or directors should thus apply also to shareholders and should include, for individuals, a person’s name, residential address and date of birth, and for corporate shareholders, a corporate or firm name, the registered or principle office, but also a company number, a link to the company register and information on the country of incorporation, and, if listed on a recognised stock exchange a company number, name of the stock exchange and ticker symbols.

Q16. Do you agree that identity checks should be optional for shareholders, but that the register makes clear whether they have or have not verified their identity? Please give reasons.

No response.

Linking identities on the register

Q17. Do you agree that verification of a person’s identity is a better way to link appointments than unique identifiers?

In principle, the purpose of identity verification should be to ensure that individuals filing with Companies House are who they say they are, in order to prevent false information from being submitted. In doing so, verifying identity will also enable Companies House to link records for each natural person together, for example showing on the register where an individual is a PSC of one company and a director of another. The ability for register users to view all records for a particular individual is important in enabling law enforcement and civil society to uncover and investigate links between entities and people, and for businesses to undertake robust due diligence on customers and clients.

Whilst identify verification is better than unique identifiers from a user experience perspective, as it is easier for individuals to remember existing ID details than using a new unique ID for submissions to Companies House, it is essential that the publicly available bulk data contains unique identifiers that allow data users to link together all records for a particular individual. This should include both PSC and director positions. Not including this would be a significant lost opportunity to increase the usability of the bulk data. The public identifier used could be fictitious (created by Companies House), and thus mitigate the privacy concerns raised in paragraph 119.

Q18. Do you agree that government should extend Companies House’s ability to disclose residential address information to outside partners to support core services?

No response.

Reform of the powers over information filed on the register

Q19. Do you agree that Companies House should have more discretion to query information before it is placed on the register, and to ask for evidence where appropriate?

Many of the recommendations in our response to Questions 1-3 rely on granting Companies House additional powers to query information prior to placing it on the register. Open Ownership supports granting Companies House these powers and believes that, where appropriately used, they will increase the accuracy of data on the register and consequently increase trust in the UK’s system. As our recommendations suggest, not all of these queries of information at the point of delivery should rely on algorithmic assessment tools. We have also suggested that these queries need not stop at the point of delivery.

Q20. Do you agree that companies must evidence any objection to an application from a third party to remove information from its filings?

No response.

Reform of company accounts

Q21. Do you agree that Companies House should explore the introduction of minimum tagging standards?

No response.

Q22. Do you agree that there should be a limit to the number of times a company can shorten its accounting reference period? If so, what should the limit be?

No response.

Q23. How can the financial information available on the register be improved? What would be the benefit?

No response.

Clarifying People with Significant Control exemptions

Q24. Should some additional basic information be required about companies that are exempt from People with Significant Control requirements, and companies owned and controlled by a relevant legal entity that is exempt?

Yes, in cases where a relevant legal entity (RLE) is recorded on the UK register, the following should be collected and published on the register. This information will make it easier for data users to understand who owns companies where RLEs are involved, both when undertaking due diligence and when investigating suspicious activity:

• Where the RLE is incorporated in a jurisdiction with equivalent disclosure requirements, the jurisdiction of incorporation, company number, and a link to the company register. Companies House should maintain a list of jurisdictions that meet this criteria, and refuse submissions for RLEs incorporated in jurisdictions not on this list.
• Where the RLE is publicly traded on a regulated market, the company number, name of the stock exchange & stock ticker. In addition, we recommend that Companies House scopes how ownership information about publicly owned companies could be made available as structured data as part of this suite of reforms. Currently, although shareholder information for listed companies may technically be available, there are significant barriers to access (e.g. payment, lack of structured data, foreign language exchanges).

Dissolved company records

Q25. Do you agree that company records should be kept on the register for 20 years from the company’s dissolution? If not, what period would be appropriate and why?

Yes, understanding historical data is very important to achieving the UK’s anti-money laundering aims. In complex money laundering cases involving UK companies that have recently come to light (e.g. Danske Bank), the relevant connections between individuals and companies have only been identified several years after they were active. Therefore, maintaining public records for a 20 year period after dissolution is important for facilitating the use of the UK register data for anti-money laundering purposes.

Public and non-public information

Q26. Are the controls on access to further information collected by Companies House under these proposals appropriate? If not, please give reasons and suggest alternative controls?

No response.

Information on directors

Q27. Is there a value in having information on the register about a director’s occupation? If so, what is this information used for?

No response.

Q28. Should directors be able to apply to Companies House to have the “day” element of their date of birth suppressed on the register where this information was filed before October 2015?

No response.

Q29. Should a person who has changed their name following a change in gender be able to apply to have their previous name hidden on the public register and replaced with their new name?

This situation will only affect a small number of people, and the AML risk of allowing previous name to be hidden is likely to be extremely low. Therefore the most appropriate strategy to minimise harm may be to redact data relating to their old name from the register.

Q30. Should people be able to apply to have information about a historic registered office address suppressed where this is their residential address? If not, what use is this information to third parties?

No response

Q31. Should people be able to apply to have their signatures suppressed on the register? If not, what use is this information to third parties?

No response.

Compliance, intelligence and data sharing

Q32. Do you agree that there is value in Companies House comparing its data against other data sets held by public and private sector bodies? If so, which data sets are appropriate?

Open Ownership agrees that Companies House should compare its data against other data sets held by public and private sector bodies in order to verify information being submitted and to raise red flags. This question is addressed throughout our response to Questions 1-3.

Q33. Do you agree that AML regulated entities should be required to report anomalies to Companies House? How should this work and what information should it cover?

Requiring regulated entities to report discrepancies they have identified on the register to Companies House, and introducing new powers for Companies House to enable proactive sharing of information with law enforcement are both necessary to ensure accuracy of PSC information on the register and to effectively deter the use of UK companies for money laundering and illicit purposes.

These proposals require the Government to develop an effective reporting system which allows inaccuracies to be flagged and tracked in real time. In addition to introducing a new reporting duty for regulated entities, it is critical that there should be a facility for regulated businesses, competent authorities and members of the public to provide bulk data where they see large scale potential inaccuracies on the UK company register. The public, open, and structured nature of the PSC Register allows anomalies, mistakes, and suspicious entries to be identified by society at large, requiring a reporting arrangement that is not just focussed on isolated, individual instances of potential non-compliance.

To ease reporting by obliged entities, the Government should consider removing the 25% threshold for PSC disclosure. Obliged entities are required to look at ownership and control in exact percentages as part of their due diligence requirements. Comparing exact percentages to the threshold and banding as stipulated by the PSC register is likely to create challenges where obliged entities have more information in their records which they cannot compare directly to the published company record.

Regulated businesses, competent authorities and individuals who report discrepancies as part of the reporting system mentioned above, should be kept informed as to the status of the discrepancy in a timely manner. Discrepancy reports and their outcome (e.g. resolved, referred to law enforcement, fine or criminal penalty issued and enforced) should be published on a quarterly basis.

Q34. Do you agree that information collected by Companies House should be proactively made available to law enforcement agencies, when certain conditions are met?

Yes. Please see our response to Questions 1-3.

Q35. Should companies be required to file details of their bank account(s) with Companies House? If so, is there any information about the account which should be publicly available?

Yes; information on companies’ UK and non-UK bank accounts (name of the bank, address of the branch and account number) would facilitate identification of suspicious companies and support money laundering and corruption investigations. We would support both the name of the bank and jurisdiction of the bank to be made public.

Other measures to deter abuse of corporate entities

Q36. Are there examples which may be evidence of suspicious or fraudulent activity, not set out in this consultation, and where action is warranted?

No response.

Q37. Do you agree that the courts should be able to order a limited partnership to no longer carry on its business activities if it is in the public interest to do so?

No response.

Q38. If so, what should be the grounds for an application to the court and who should be able to apply to court?

No response.

Q39. Do you agree that companies should provide evidence that they are entitled to use an address as their registered office?

Establishing that a company has permission to use the given address as their registered office would make it harder for criminals to register companies using unauthorised addresses. It is important that this applies both to the address given at incorporation, and subsequent changes of address.

Q40. Is it sufficient to identify and report the number of directorships held by an individual, or should a cap be introduced? If you support the introduction of a cap, what should the maximum be? &

Q41. Should exemptions be available, based on company activity or other criteria?

Existing research shows that there are many cases of individuals directing an exceptionally high number of companies. Analysis conducted for Transparency International UK by Companies House has identified that as of July 2017 there were 1,980 officers with 50 or more appointments to active companies.[12] Global Witness found that there were over 800 directors in 2018 who directed more than 100 companies.[13]

There might be legitimate explanations for why one person directs a large number of companies, however a high number of directorships can also suggest that they are acting as ‘nominees’, and hence providing anonymity for those wishing to hide the real ownership of a company. ‘Nominee’ directors are also often found in money laundering cases.[14] Moreover, combining a high number of directorships can preclude an individual from spending adequate time in actual running of the business and fulfilling his/her responsibilities.

To prevent the abuse of the system, it seems reasonable to impose rules on the number of directorships held by an individual. While we would not support any general exemption from restricting the number of directorships held by one person, we recognise that different rules might need to apply to different types of companies (e.g. listed vs. non-listed). While setting the rules on the number of directorships the UK government should consider the size and internal organisation of companies, as well as the nature, scope and complexity of companies’ activities; it should also look into examples of rules on concurrent directorship from across Europe (e.g. France, Germany, and Austria [15]).

Q42. Should Companies House have more discretion to query and possibly reject applications to use a company name, rather than relying on its post-registration powers?

No response.

Q43. What would be the impact if Companies House changed the way it certifies information available on the register?

No response.

Q44. Do you have any evidence of inappropriate use of Good Standing statements?

No response