Who Speaks for Your Company? Governing the Public Identity Held at Companies House

Companies House is not a back office. It is the UK’s public record of corporate identity, and it is relied upon by banks, credit reference agencies, customers, suppliers, insurers, lawyers and, inevitably, fraudsters. When a director appointment, registered office address or company name changes on the register, the outside world has little choice but to treat that change as authoritative. That is why the register should be understood by boards as a control surface, not simply a compliance formality.

The record others rely on

A company’s public profile at Companies House is used to verify who can speak for the business, where it is based and who owns it. Lenders check it before extending credit. Procurement teams check it before awarding contracts. Payment teams check it before releasing funds. A fraudulent filing therefore does more than create an administrative error; it can redirect trust. A false director appointment may be used to support an impersonation attempt. A changed registered office may divert statutory mail. A manipulated company record can lend credibility to an invoice fraud, a credit application or a supplier onboarding request.

The board does not need to become a filing clerk. It does need to satisfy itself that the company’s public identity is governed with the same discipline as its bank mandates, domain names and supplier master data. The risk is not hypothetical: identity-based fraud frequently begins with small, plausible changes to public records that are difficult to unwind once third parties have acted on them.

How the risk presents

Most legitimate companies interact with Companies House through a small number of people and, often, an agent. That concentration is sensible for efficiency but creates a control point. If credentials are shared, if former employees retain access, or if an external agent’s authority is not clearly bounded, the register can be changed without the board’s knowledge.

Common failure modes include:

• shared WebFiling credentials or authentication codes that are not rotated when roles change;
• an authorised agent with broader authority than the board understands;
• registered office or registered email addresses that are not monitored by the company;
• no routine reconciliation between the public register and internal records;
• no alerting when a filing, director appointment or address change is made.

The Economic Crime and Corporate Transparency Act 2023 introduced reforms intended to strengthen the register, including identity verification and greater powers for the registrar. These measures raise the baseline, but they do not transfer accountability away from the board. Directors remain responsible for what the company files and for the access they grant to others.

Governing the filers

The first board question is simple: who can change our public record? The answer should be documented, limited and reviewed. Boards should require a named owner for Companies House filings, a short list of authorised individuals, and clear rules on the use of agents. Authentication codes should be treated as sensitive credentials, held individually where possible and changed when a role ends. Where an agent files on the company’s behalf, the contract and internal instruction should define precisely what they may file and what requires prior company approval.

The second question is what the company has told Companies House about how to reach it. A registered office address that is not monitored, or a registered email address that is not controlled by the company, weakens the ability to detect and correct problems. Boards should confirm that statutory correspondence reaches a responsible function and that changes to contact details are approved rather than assumed.

Making change visible

Detection is a board-level control because it shortens the window in which a false filing can be used. Companies House offers filing reminders and company monitoring facilities, and commercial services can add further alerts. Whatever the mechanism, the board should expect a named person to receive and review notifications, not a generic inbox that no one owns. A monthly reconciliation between the public register and the company’s own records—directors, secretary, PSC, registered office, charges and company name—turns an abstract risk into a routine check.

The board should also know the correction route before it is needed. Fraudulent or inaccurate filings may require a formal correction application, supporting evidence and, in some cases, liaison with the registrar and other authorities. The company’s response should be pre-agreed: who authorises the correction, who speaks to affected third parties, and who decides whether to notify banks or customers. Speed matters because the damage often occurs off-register, in the decisions third parties make after reading it.

A short board checklist

• Confirm a named owner for Companies House filings and a documented list of authorised filers.
• Review agent authority and ensure the board understands what each agent can file.
• Treat authentication codes and filing credentials as sensitive access, with prompt revocation on role change.
• Verify that the registered office and registered email address are monitored and controlled.
• Subscribe to filing alerts and assign a person to review them.
• Reconcile the public register with internal records at least quarterly, and after any director or ownership change.
• Agree a correction and escalation plan for suspected fraudulent filings.
• Ask for assurance that third parties relying on the register—banks, credit teams and key suppliers—know how to verify changes with the company.

The register is a public statement of who the company is. Boards that govern it deliberately are not indulging in administrative perfectionism; they are protecting the company’s ability to be trusted, paid and believed. In 2026, that is a security control in its own right.