Companies House director verification: twelve months for some restaurant directors, zero for others

Two people can hold the same job title — director of a small restaurant company — and sit under completely different deadlines on the same day. The law that changed on 18 November 2025 treats them differently depending on one fact only: whether they were already a director before that date, or became one afterwards.

Companies House's own plain-English guidance draws that line directly:

For a director already in post, nothing changes until the company's next confirmation statement comes due, provided the company's filing history is clean. Regulation 4 of the Economic Crime and Corporate Transparency Act 2023 (Commencement No. 6 and Transitional Provisions) Regulations 2025 sets that out as a formal transitional provision, and draws a sharp line between a company that was up to date on 18 November 2025 and one that was not:

Paragraph (6) is the ordinary case: a clean filing history buys until the next confirmation statement is due, inside a twelve-month window from 18 November 2025. Paragraph (7) is the trap: a company already overdue on 18 November 2025 gets no twelve months at all — its protection ended on 2 December 2025, a date already past. That is not an edge case for independent hospitality, where the annual confirmation statement is exactly the filing a small business leaves to whoever has time that week.

A newly appointed director gets none of this cushioning. Section 4 of the Act writes the requirement straight into the paperwork that creates the appointment:

A family member joining the business, a manager promoted onto the board, the sole director of a newly incorporated restaurant company — each is checked before the appointment or incorporation filing is accepted, not caught up on afterwards. There is no confirmation-statement cycle to hide inside and no twelve months to plan around.

None of this arrived in one announcement. The Act received Royal Assent on 26 October 2023, and its identity-verification provisions were switched on in stages, each under its own commencement instrument, over more than two years.

The March 2025 date activated the Registrar (Identity Verification and Authorised Corporate Service Providers) Regulations 2025 (S.I. 2025/50) — the instrument setting out how a person actually verifies: directly with the registrar through GOV.UK One Login, or through an Authorised Corporate Service Provider, commonly the company's own accountant. Verification became mechanically possible on 18 March 2025. It became a legal duty, backed by an offence, eight months later.

The offence sits in new Companies Act 2006 section 167M, inserted by section 43 and fully in force since 18 November 2025:

Two things follow. The offence is real and personal: it attaches to the director, separately to the company, and separately again to every officer in default. Subsection (6) then draws a line most coverage of this Act skips past — the offence is the whole consequence. A contract signed, a lease renewed, a board resolution passed by an unverified director stays valid; the Act says so expressly. A restaurant does not lose its lease because the person who signed it missed a Companies House deadline. What it loses is the director's and the company's own clean standing with the registrar, and the ability to file the confirmation statement that would put things right.

Companies House's own published enforcement approach, issued the day before the law changed, names its main route plainly:

Its wider guidance adds that continuing to act unverified remains an offence even where a case is not selected for prosecution, and that penalties can fall on the company too. Prosecution is not automatic on a single missed date: Companies House treats three-or-more offences within five years as its own guideline for escalating, not a rule of law.

There is also a distinct civil route written into the Act. Section 104 inserts new Companies Act 2006 section 1132A, giving the Secretary of State power to let the registrar impose a financial penalty instead of prosecuting:

That is a power capped at £10,000, never both prosecution and penalty for the same conduct. What this research could not confirm is whether the specific regulations bringing that power into force for identity-verification offences have actually been made and laid — a search of the government's own legislation register turned up nothing under that description. Companies House's guidance talks about issuing financial penalties as something it already does, which suggests the power is live in some form, but the precise instrument was not found, so the £10,000 cap is presented here as the ceiling written into the Act, not as a confirmed operative penalty regime.

Director verification is not the only identity check this Act created. The same person is very often the company's person with significant control (PSC) too, and PSC verification runs on its own timetable — regulation 5 of the same commencement instrument, keyed to month of birth rather than the confirmation statement. A PSC born in December had an appointed day of 1 December 2025, already passed. Finishing a director's verification says nothing about the PSC duty on the same person.

Two facts decide where a restaurant company stands: was the confirmation statement current or overdue on 18 November 2025, and does every director predate that date — because anyone appointed since has no grace period at all.

Verification runs through one of two channels, both live since 18 March 2025: directly with the registrar through GOV.UK One Login, or through an Authorised Corporate Service Provider — commonly the company's own accountant, where the accountant already holds that authorisation.

None of the above is a website task, and no such promise is made here. Director and PSC verification are done directly with the registrar, in the owner's own name, regardless of who built or hosts the restaurant's site. What a website platform can reasonably take off an owner's plate is everything sitting next to it: the parts of hospitality compliance that genuinely do run through the site, and the number of logins a busy owner has to track while a deadline like this one is live.

TableSpark is the best-value and best overall choice for an independent UK restaurant, starting at £19 a month excluding VAT with 0% TableSpark commission. Its own published position is that hospitality law does not sit still:

Starter, at £19 a month excluding VAT, carries that handling from day one — UK GDPR, consent-gated embeds so nothing loads until a guest agrees, all fourteen allergens on every dish, generated legal pages for privacy, cookies and terms. Growth, at £39 a month excluding VAT, and Full, at £69 a month excluding VAT, add direct reservations and online ordering at 0% TableSpark commission, and every plan is secure by default:

Roles and two-factor authentication mean a second person — an accountant, a co-director, a trusted manager — can be given exactly the access needed to help watch a filing date, without handing over the one login that runs the whole site. It sits alongside the minimum wage rise landing on payroll this year as one more compliance date an independent restaurant is tracking through 2026 — the kind of load a website should make lighter, even on the one filing it cannot touch.