You can rely on Companies House to verify the client company itself: its name, number, registered office, directors and status. You cannot rely on it alone for the people who own or control the company. Regulation 28(9) of the Money Laundering Regulations 2017 says you do not meet the beneficial owner duty “by relying solely” on information filed with the registrar, and that still applies after identity verification at Companies House became a legal requirement on 18 November 2025. So the client file needs two things side by side: what the register said, with the date you read it, and what you did beyond the register to be satisfied you know who the owners are. EntityWatch reads Companies House for you, dates every fact and drafts the note, and it is free for up to five companies.
Get started free: write your first client note
By Martin Nymann, AddonNordic ApS, the company behind EntityWatch. Updated 29 October 2026.
- What can Companies House evidence for client due diligence?
- Why is the register not enough for beneficial owners?
- Does Companies House identity verification change this?
- What do you need besides the register?
- What should the client file record?
- What if the register and the client disagree?
- How does EntityWatch help?
- Frequently asked questions
What can Companies House evidence for client due diligence?
It can evidence the company’s own identity, and it is a weak or empty source for everything about the people behind it. Regulation 28(3) asks you to obtain and verify the name of a body corporate, its company number and its registered office, and to take reasonable measures to determine and verify its constitution and the names of its board. Regulation 28(18)(b) says documents “issued or made available by an official body” count as independent of the client, even when the client hands them to you. The Companies House record is that kind of document.
The table splits the duty field by field.
| What regulation 28 asks for | Can the Companies House record carry it? | What else the file needs |
|---|---|---|
| Company name, number, registered office (28(3)(a)) | Yes. An official-body source under 28(18)(b) | The date you read it |
| Principal place of business, if different (28(3)(a)(iii)) | Not always. The register holds the registered office | The client’s own confirmation, recorded |
| Constitution and governing law (28(3)(b)(i)) | Yes, from the articles filed at Companies House | Note which version you relied on |
| Names of the board (28(3)(b)(ii)) | Yes, from the list of officers | Senior people who run the business but are not directors |
| Beneficial owners (28(4)) | A starting point only. Regulation 28(9) rules out relying on it alone | Your own reasonable measures to verify who they are |
| Ownership and control structure (28(3A)) | Partly. It shows the next layer, not the whole chain | Your understanding of the chain, written down |
| Purpose and intended nature of the relationship (28(2)(c)) | No | Your own assessment |
Two cautions. For a company listed on a regulated market, regulation 28(5) switches off 28(3)(b), 28(3A) and 28(4). And some supervisors take a stricter line than the text: ICAS’s practice support team has written that, in its view, the restriction in 28(9) should apply to all CDD identity checks, not just beneficial owners. Check what your own supervisor expects and record which approach you took.
Why is the register not enough for beneficial owners?
Because the law says so in terms. Regulation 28(9) states that you “do not satisfy” the beneficial owner requirements in 28(4) “by relying solely on information delivered to the registrar” about registrable persons, registrable relevant legal entities or registrable beneficial owners. That covers the people with significant control (PSC) register and the register of overseas entities.
The reason is practical. The PSC register is filed by the company itself. It can be late, it can name a holding company rather than a person, and it can be wrong. Regulation 28(4)(b) asks you to take reasonable measures so that you are “satisfied that it knows who the beneficial owner is”. A copy of what the client told Companies House is not, on its own, evidence that you are satisfied.
This matters most where the register names a corporate shareholder. Then you have to follow the chain until you reach people, as set out in our guide to tracing a client’s owners through a holding company.
Does Companies House identity verification change this?
No. Since 18 November 2025, identity verification has been a legal requirement at Companies House for directors and people with significant control, according to GOV.UK’s guidance on verifying your identity for Companies House. Existing directors verify with their company’s next confirmation statement, and existing PSCs have a 14-day window, so the register is being filled in over time.
On the same day, 18 November 2025, regulation 28(9) was rewritten by S.I. 2025/1037, and the new wording still says relying solely on the registrar’s information does not satisfy 28(4). So verification by Companies House tells you a named person is who they say they are. It does not tell you that the person really owns or controls your client, and Companies House is not a “relevant person” you can rely on under regulation 39. Treat a verified status as useful evidence. If a director or PSC will not verify, treat that as a risk factor and write it down.
What do you need besides the register?
Enough to be satisfied about the owners, in proportion to the risk. Regulation 28(12) says the extent of your measures must reflect your firm-wide risk assessment and the risk in the particular case, and 28(16) says you must be able to show your supervisor that the extent was appropriate.
For a typical owner-managed company, that usually means:
- Read the register and keep a dated record of the PSC entries, officers and any statements the company has filed.
- Ask the client to confirm the owners in writing, including anyone holding through a nominee, a trust or a holding company.
- Compare the two. Same people, same percentages, same dates?
- Verify the identity of each beneficial owner from a reliable, independent source, as regulation 28(18)(a) defines “verify”. An electronic identity check can meet that standard where 28(19) is satisfied.
- Record what you concluded and why, including any doubt you could not resolve.
If you have exhausted all possible means and still cannot identify an owner, regulation 28(6) to (8) lets you treat the senior managing official as the beneficial owner, but only with a written record of every step you took and every difficulty you met.
Get started free: write your first client note
What should the client file record?
A record a reviewer can follow without asking you. At inspection, the question is not whether you looked at Companies House, but whether the file shows what you relied on and what you added. A short note should cover:
- The register extract: company name, number, registered office, status, officers and PSC entries, with the date you read them and the source.
- What the register could not give you: principal place of business, the full ownership chain, purpose of the relationship.
- The client’s own account of its owners, and whether it matched the register.
- How each beneficial owner’s identity was verified, and from which source.
- Your risk assessment for the client, with the factors that drove it. Our guide to the AML client risk assessment sets out what to record.
- Your decision and who approved it, dated.
Regulation 40 asks you to keep these records for five years after the relationship ends. For how the pieces fit together, see the AML client file, section by section.
What if the register and the client disagree?
Then you may have to tell Companies House. Regulation 30A(1) asks you to collect an excerpt of the register before you establish the business relationship, or to establish that it holds nothing. Regulation 30A(2) requires you to report “any material discrepancy” you find between that excerpt and what otherwise becomes available to you about the client’s beneficial ownership. The report goes to the registrar of companies.
Record the discrepancy, what you did about it and when you reported it. A file that shows the register said one thing, the client said another and nothing happened is the kind of gap an inspection finds. The same check is part of ongoing monitoring: see which Companies House changes should trigger a client review.
How does EntityWatch help?
It does the register part for you and keeps it dated, so your time goes on the part only you can do. You enter a UK company number, and EntityWatch reads Companies House: identity, status, officers and people with significant control, each fact dated and sourced. It screens the company, its officers and its owners against the UK, EU, UN and OFAC lists, and drafts the due diligence note with a risk class and the rule behind each factor. Where the register returns no beneficial owners, the note says so and tells you to establish whether senior management should be recorded instead. You approve the note, and if you change the risk class you must give a written reason, which is kept with the signed version.
What it does not do: it does not verify a person’s identity documents, and it does not replace your own judgement about who owns the client. The note is built to show where the register ends and your work begins. See how it works, which countries are covered and pricing.
Frequently asked questions
Can I use Companies House to verify a client company’s identity?
Yes, for the company’s name, number, registered office, constitution and board. Regulation 28(18)(b) treats documents made available by an official body as independent of the client. Some supervisors take a stricter view, so check yours and record the approach you took.
Is the PSC register enough to verify beneficial owners?
No. Regulation 28(9) says you do not satisfy the beneficial owner requirements by relying solely on information delivered to the registrar. Use the register as a starting point, confirm the owners with the client and verify their identity from a reliable, independent source.
Does Companies House identity verification count as my own check?
No. Identity verification at Companies House has been a legal requirement since 18 November 2025, but regulation 28(9) was rewritten on the same day and still rules out relying solely on the registrar. Companies House is also not a relevant person you can rely on under regulation 39.
What do I do if the register and the client disagree about who owns the company?
Record the difference and report any material discrepancy to Companies House under regulation 30A(2). Keep a note of what you found, what you did and the date you reported it.
To read Companies House for a client and get a dated draft note in one step, get started free with five companies and write your first client note.
This article is general information about the UK Money Laundering Regulations 2017, not legal advice.
This content was generated with artificial intelligence.