Corporate Governance & Regulation

A Companies House blunder has raised concerns after a flaw in the WebFiling service briefly exposed sensitive company data. The issue, identified on 13 March 2026, meant that a logged-in user could potentially access and amend limited details of another company by carrying out a specific sequence of actions.

Companies House has stated that this system vulnerability was not available to the general public. Only users with authorised access codes who were already logged into the system could have exploited it. Nevertheless, the nature of the flaw meant that certain private information, such as dates of birth, residential addresses and company email addresses may have been visible. There was also a risk that unauthorised filings, including accounts and changes to director details, could have been submitted on another company’s record.

After identifying this issue, Companies House shut down the WebFiling service at 13:30 on 13 March to investigate. Following independent testing, the system was restored at 09:00 on 16 March. Companies House has said that passwords and identity verification data were not compromised, and that existing filed documents, such as accounts or confirmation statements, could not be altered.

The issue is believed to have arisen from a WebFiling systems update in October 2025. It has been reported to both the Information Commissioner’s Office and the National Cyber Security Centre.

Companies are now being urged to review their registered details and filing history carefully. While no confirmed misuse has been reported so far, Companies House is continuing to investigate. If a company has a concern, it should raise a complaint via the Companies House complaints page at www.gov.uk/government/organisations/companies-house/about/complaints-procedure and include evidence to describe the issue.

A person with significant control (PSC) is someone who owns or exercises significant influence over a company. They can also be referred to as a “beneficial owner”.

Every UK company is required to identify its PSCs and register their details with Companies House. A company can have one or more PSCs.

A PSC is someone who meets one or more of the “nature of control” conditions.

A PSC is usually anyone who:

• has more than 25% shares or voting rights in your company
• can appoint or remove a majority of directors
• can influence or control your company or trust

Companies should review their register of members as well as their constitution and articles of association to help determine who meets these criteria.

When incorporating a company, and whenever PSC details change, the required information must be filed with Companies House within 14 days of confirmation. Required details include the PSC’s name, date of birth, nationality, correspondence or service address, level of shareholding and the date they became a PSC.

PSCs must also verify their identity and provide a personal code. Failing to provide accurate information, or refusing to respond to formal notices, is a criminal offence.

Bona vacantia is Latin term meaning “ownerless goods”. The bodies that deal with bona vacantia claims vary across the United Kingdom, but they all ultimately represent the Crown.

Under company law, when a company is dissolved, any remaining rights or property automatically pass to the Crown as bona vacantia. This includes valid rights such as a tax refund from HMRC. However, if the company never had a genuine legal entitlement, for example, because a claim was fraudulent, then no right existed in the first place and nothing passes as bona vacantia.

It is important to note that only formally dissolved companies are affected by bona vacantia. A company that is “in liquidation” or “being wound up” is in the process of closure but still legally exists. Until dissolution takes place, the company’s property and rights remain vested in the company.

In some circumstances, a company may apply to be restored to the register if it was dissolved less than six years ago. If restoration is successful, any property previously treated as bona vacantia revests in the company as though it had never been dissolved. However, restoration can be a very complex and costly process. For that reason, directors should ensure that all assets, including potential tax refunds, are properly addressed before a company is dissolved.

Did you know you can monitor any UK company for free and get email alerts when key details change, which can help protect your own business from unexpected or unauthorised filings?

A significant amount of information about companies is available in the public domain from Companies House. Companies House is responsible for incorporating and dissolving limited companies, examining and maintaining statutory records, and making company information publicly accessible.

Much of this information is available free of charge, in line with the government’s commitment to open data. As a result, all publicly available digital information held on the UK register of companies can be accessed without cost.

The information available includes core company details such as the registered address and date of incorporation, details of current and resigned directors and officers, copies of documents filed with Companies House, mortgage and charge information, previous company names and insolvency records.

In addition, you can choose to monitor a company and receive email alerts whenever new documents are filed, such as changes to directors or registered office addresses. This can also be a useful safeguard for your own company, helping you to identify any unexpected or unauthorised filings at an early stage.

A Company Voluntary Arrangement (also known as a CVA) is a special arrangement that allows a company with debt problems or that is insolvent to reach a voluntary agreement to pay its business creditors over a fixed period of time.

The arrangement is similar to the Individual Voluntary Arrangement (IVA) that can be used by a sole-trader or self-employed person who is unable to pay their debts.

An application for a CVA can only be made with the agreement of all directors of the company in question or all of the partners of a limited liability partnership (LLP). A CVA can only be created by using the services of an insolvency practitioner. They will be responsible for set up and administration of the arrangement.

Once an insolvency practitioner has been appointed the following steps will take place:

1. The insolvency practitioner will work out an ‘arrangement’ covering the amount of debt the company can pay and a payment schedule. They must do this within a month of being appointed.
2. The insolvency practitioner will write to creditors about the arrangement and invite them to vote on it.
3. A CVA must be approved by creditors representing at least 75% of the debt value of those who vote (rather than 75% of the total overall debt).

If the agreement is approved and the company does not meet the terms of the CVA then any of the creditors can apply to have the business wound up.

Company directors and other eligible people such as company secretaries, people with significant control (PSC) and LLP members can apply to remove their personal addresses from the UK’s official company register on Companies House. 

Company directors and others are still required to provide an alternative correspondence address if they are appointed to a live company. If they are no longer appointed to a company, then an alternative address is not required and only the first half of their postcode will be made available to the public. The option to remove your home address from the public register is not available if the home address is the same as the company’s registered office address. 

There is a charge of £32 per document where a director wants to suppress their home address. The fee was reduced from £55 to £32 from 1 June 2020 following the introduction of new software that has significantly reduced the processing time for these applications.

During the COVID-19 outbreak, the fee should be paid online before the application is submitted. The quickest way to then proceed is to email a copy of the SR01 application together with the payment reference to Companies House. This will allow Companies House to process the application without delay. Applicants can still send a completed SR01 application by post, but it is taking Companies House much longer than usual to process paper applications due to coronavirus.

Companies House has announced that they have new bank details effective from 1 September 2020. This is due to a Companies House change in status from a trading fund to a central government organisation. This has necessitated the introduction of a different type of bank account which come under the Government Banking scheme.

Any letters Companies House sends from 1 September 2020 will include the new bank account details and instructions. Companies House have also updated their bank details in any online guidance and emails.

The old bank account will remain valid and stay open for 6 months to make sure that all customers transition successfully to the new account. The old account will close at the end of February 2021.

Companies House has confirmed that the temporary measure to suspend compulsory strike-off action will be lifted from 10 October 2020. The temporary measure to pause compulsory strike-offs started in April 2020 in response to the coronavirus pandemic. 

When a company is struck off, the company's legal existence is removed from the Companies House register. The strike-off can be voluntary or compulsory. 

From 10 October 2020, Companies House will resume the compulsory process to remove a company from the register if there’s reasonable cause to believe it’s no longer carrying on business or in operation.

This includes:

• company documents are outstanding, and Companies House have had no response to their letters
• letters sent by Companies House are returned undelivered
• the company has no directors

Companies that do not file their annual accounts or confirmation statement will normally receive two letters from Companies House. A notice is then published in the Gazette to tell the public that the registrar intends to strike-off the company.

When compulsory strike-off action resumes from 10th October – if there are no objections to dissolution and the two month period from the publication of the Gazette notice has expired – a company will be struck off shortly afterwards.

If a company is in default and wants to remain on the register then action should be taken before 10 October 2020 to remain registered.

As well as filing accounts with Companies House, there is an important requirement to check that the information Companies House has about your company is correct every year. This is facilitated by the filing of an annual company confirmation statement. The confirmation statement was introduced in June 2016 and replaced the annual return. You could be subject to a fine of up to £5,000 for failing to send a confirmation statement. Companies House can also prosecute a company and its officers for failing to file a confirmation statement and the company can be struck off.

A confirmation statement must usually be filed at Companies House once every 12 months and rather than resubmitting data every year the confirmation statement only needs to be updated if you have changes to report. If there are no changes then you just need to confirm the information is correct and submit the statement. The due date is usually a year after either the date your company incorporated or the date you filed your last annual return or confirmation statement. You can file your confirmation statement up to 14 days after the due date.

The following details need to be checked:

• the details of your registered office, directors, secretary and the address where you keep your records
• your statement of capital and shareholder information if your company has shares
• your SIC code (the number that identifies what your company does)
• your register of 'people with significant control' (PSC)

Any necessary updates to the statement of capital, shareholder information and SIC codes can be made when submitting the confirmation statement. However, the confirmation statement cannot be used to report changes to your company’s officers, the registered office address, the address where you keep your records, people with significant control. These changes must be filed separately with Companies House and this should be done at the same time or prior to submitting the confirmation statement. The confirmation statement can be filed online (at a cost of £13) or by post (at a cost of £40).

The Corporate Insolvency and Governance Act 2020 (the Act) received Royal Assent, with most provisions coming into force on 26 June 2020. The Act addresses numerous issues arising for businesses from the COVID-19 pandemic to give distressed businesses the breathing space they need to get advice and seek a rescue

Some of the key provisions of the Act are as follows:

• introduces temporary easements for Annual General Meetings (AGMs) and filing requirements for public limited companies (PLCs)
• introduces new corporate restructuring tools to the insolvency regime to give companies the time they need to maximise their chance of survival
• temporarily suspends parts of insolvency law to support directors during this difficult time

Under the secondary legislation, companies will temporarily receive an automatic extension for:

• confirmation statements
• registrations of charges (mortgage)
• event-driven filings, such as a change to your company’s directors or people with significant control

Most companies will also be given more time to file their accounts. If a company is eligible, Companies House will update the filing deadline automatically and the new deadline should be adhered to. Companies do not need to apply for an extension.