Companies House Personal Codes explained

What is a Companies House Personal Code?

A Personal Code is the unique reference Companies House issues to an individual once their identity has been verified. It is the proof of verification used when filing documents that require a verified identity.

The code is eleven characters long and is issued in a format Companies House defines. Each verified individual has one Personal Code that travels with them across every appointment they hold.

How is the Personal Code issued?

One of two routes:

1. GOV.UK One Login. The individual completes identity verification through One Login and the Personal Code is generated automatically on success. It is displayed on screen and sent to the email address on the One Login account.
2. An Authorised Corporate Service Provider. The ACSP performs the identity checks itself, submits the verification through its ACSP credentials, and Companies House issues the Personal Code. The ACSP receives the code and passes it to the client.

For more on the two paths, see verify directors via GOV.UK One Login and ACSP registration explained.

How long is a Personal Code valid for?

Personal Codes have an expiry date set by Companies House. The exact validity window has been adjusted during the transition rollout; firms should treat the expiry date on the issued code as authoritative rather than assuming a fixed period.

When a code expires, the individual cannot use it for new filings until it is reissued. A reissue does not require the individual to verify their identity again from scratch if their verified identity record at Companies House is still current. A reissue does generate a new code, and the new code needs to be linked to every appointment in place of the expired one.

Why does the Personal Code need to be linked to each appointment?

Verification proves the individual is who they say they are. The Personal Code linked to an appointment proves the right verified individual is acting in the right role at the right company.

Linking is a separate step that happens at appointment time (for new directors and PSCs) or at confirmation statement time (for existing officers being verified during the transition window). Companies House records the link and future filings against that appointment carry the verified identity through.

The same Personal Code can be linked to multiple appointments held by the same individual. A director who sits on three boards has one Personal Code and three links.

How should my firm store the Personal Code safely?

Treat the Personal Code as sensitive credential data.

• Store the reference in masked form only. The first three and last two characters are typically enough for human identification; the middle characters should never be stored in clear.
• Do not record the code in shared spreadsheets, shared inboxes or general client correspondence. Personal Codes in plain text in email is the most common way they leak.
• Store the expiry date as a separate field so reminder logic can fire ahead of expiry without exposing the code.
• Keep the full code in your client's control wherever possible. The individual holds the authoritative copy via their One Login email. Your firm holds the working reference for tracking.
• Apply the same access controls you apply to payroll PII. Personal Codes are sensitive identifiers for live UK citizens.

What happens if a Personal Code is lost or expires?

If lost: the individual can recover the code from their One Login account (for self-verified individuals) or request reissue through the ACSP that originally performed the verification.

If expired: the individual needs a fresh Personal Code issued. The reissue route depends on how the original verification was done. Once the new code is in place, your firm needs to update the link against every appointment that previously carried the expired code.

A practical implication for your firm: track the expiry date alongside the code reference, and set chase reminders far enough ahead that reissue can happen before any filing deadline.

How do I track Personal Codes across my client base?

For every director and PSC, your firm should hold:

• The Personal Code reference, stored masked.
• The Personal Code expiry date.
• The date the code was issued, and the route (One Login or ACSP).
• Every appointment the code has been linked to (which companies, which roles).
• The next filing deadline that depends on this code being valid.

Across a typical firm of one hundred corporate clients with three to four officers each, that is three to four hundred Personal Codes to track, each with its own expiry, each linked to one or more appointments, each tied to one or more upcoming filing deadlines. The full workflow is covered in the Companies House IDV 12-month transition checklist. For how the per-client deadlines are set, see confirmation statement deadline rules.