New research from Vistra, reveals that only 28% of UK directors are ready for the Economic Crime and Corporate Transparency Act (ECCTA) despite the risk of unlimited fines. The smallest firms are most exposed, with none stating they are ready to meet ECCTA deadlines. While larger firms show greater readiness, just 37% of the largest are very prepared.

The ECCTA is the UK’s most significant Companies House reform since 1844. By autumn 2025, all directors, persons of significant control (PSCs), and company filers must verify their identity. Yet, only 250,000 of an estimated 7 million or under 4% have done so. Another key change, coming into force on 1 September 2025 as part of the Economic Crime and Corporate Transparency Act, is the new “Failure to Prevent Fraud” offence, enforceable by the Crown Prosecution Service and Serious Fraud Office, which could make firms criminally liable for employee fraud unless reasonable safeguards are in place. This offence only applies to firms which meet two of three of the following criteria: more than 250 employees, more than £36 million turnover and more than £18 million in total assets so will only impact the largest firms.

Vistra surveyed 100 UK company directors to gauge their readiness for the ECCTA requirements and found that 39% of UK directors are unaware of the ECCTA deadlines despite non-compliance having serious consequences. Directors and PSCs, as well as the companies they represent, may not be permitted to file documents or partake in acquisitions, and company officers could even be disqualified. There are potentially severe financial repercussions too, including unlimited fines.

Nearly half (49%) of larger firms in the study (500+ employees) are very confident they have the processes inplace to be able to satisfy the ‘reasonable procedures’ requirement of Failure to Prevent Fraud offence.

Just 21% say they are already compliant with the ECCTA’s identity verification obligation, but official Companies House numbers show that less than 3% have completed this step, potentially highlighting a lack of understanding of requirements. Worryingly, 83% of small firms don’t have a process in place for identity verification despite the upcoming autumn deadline. Less than half (43%) are very confident in knowing who their PSCs are.

Over half (58%) of firms believe the ECCTA is a burden, while just 23% say it’s not. Given the volume of administrative work involved for some groups, businesses unable to clear time to complete this should now consider outsourcing key aspects of ECCTA compliance to reduce internal strain and ensure nothing is overlooked.

Meg Ogunsola, Global Director of Entity Management Solutions at Vistra, commented: “The ECCTA is arguably the most important piece of legislation that people aren’t prepared for, and it affects millions across the UK as well as others working globally for UK-based entities. Many businesses still underestimate the scale and urgency of the ECCTA and many are taking a ‘wait and see’ approach that’s both risky and short-sighted. Acting early is the smart move as millions are yet to complete ID checks and bottlenecks are likely, which could disrupt business operations and leave firms exposed to severe financial penalties.

“Furthermore, Companies House has confirmed that it will be taking a hard-line stance against firms that have not completed ID verification by the deadline. With ID verification through Companies House’s platform limited to biometric documents and UK driving licences, overseas directors and those reliant on paper documents should act fast and find alternative solutions. Given the scale of the reforms and the administrative burden, it’s no surprise that we are seeing many organisations seek specialist support to ensure they meet their obligations efficiently and effectively.”

Alan Hughes, Executive Director, Head of International Legal Services at Vistra, commented: “With just a couple of months to go until the Failure to Prevent Fraud offence comes into force, there’s a dangerously low level of readiness among businesses. Action needs to be taken now in order to ensure that reasonable fraud prevention measures are implemented to prevent firms from being held criminally liable for the actions of persons associated with them. This would include, for example, employees or subsidiary entities, who commit fraud for the organisation’s benefit.

“Firms must also ensure that their directors and senior employees undergo appropriate training so that they are aware of their duties and responsibilities under the ECCTA. This will also enable them to confirm that their businesses policies and procedures contain reasonable fraud prevention measures and provisions, for example, supplier contracts, service agreements and employment contracts.”