Multinational enterprises with a presence in the United Kingdom are facing a significant compliance challenge as the November 18th deadline for Companies House identity verification requirements looms. A recent survey conducted by corporate services firm Vistra reveals a stark reality: fewer than 10% of these organizations have successfully completed the mandatory verification process for all their directors and persons with significant control (PSCs). This oversight highlights a widespread gap in preparedness, despite an 84% self-reported readiness among directors surveyed.
The Vistra survey, which polled 300 directors from multinational companies operating in the UK, indicates a substantial disconnect between perceived preparedness and actual completion. While a significant majority of directors believe their organizations are ready for the new identity verification mandates under the UK’s Economic Crime and Corporate Transparency Act (ECCTA), only a mere 9% have finalized all necessary steps before the end of the 12-month transition period. On average, only 61% of the relevant directors and PSCs have undergone the verification process.
Delving deeper into the compliance efforts, the survey uncovers specific areas of lagging progress. A mere 26% of respondents have confirmed the accuracy of their directors’ and PSCs’ records with Companies House. Furthermore, only 20% have definitively identified all individuals requiring verification, and a similarly low 22% have successfully obtained and recorded the essential Companies House personal codes that link individual verifications to corporate filings. This indicates a fragmented approach to fulfilling the ECCTA’s core objectives.
The situation appears even more critical when examining UK-based respondents. While 86% of these directors stated their organizations were prepared, not a single one reported that all eligible directors and PSCs had completed their verification. This suggests a potential overestimation of internal readiness or an underestimation of the complexities involved in the process, even for entities directly within the UK jurisdiction.
This widespread non-compliance follows closely on the heels of the first legal repercussions for identity verification offenses. In September, three directors were fined by UK courts following prosecutions initiated by the Insolvency Service, underscoring the seriousness with which the government is treating these new regulations. The ECCTA, enacted in March 2023, aims to enhance corporate transparency and combat economic crime by requiring the verification of individuals associated with UK companies.
The challenges are compounded by the inherent complexities of cross-border corporate structures. A significant majority of respondents, 76%, reported that verifying directors and PSCs based outside the UK presented additional compliance hurdles. This suggests that international operations significantly amplify the administrative burden and potential for delays in meeting the verification requirements.
The UK’s ECCTA initiative shares common ground with the United States’ Corporate Transparency Act (CTA), both designed to increase transparency regarding beneficial ownership and control of companies. However, the scope and implementation of these acts have differed. The US Treasury Department, in a significant revision earlier this year, formally limited the CTA’s disclosure requirements primarily to foreign-registered entities, drastically reducing the number of affected businesses from over 32 million to an estimated 28,000. The UK’s approach, by contrast, appears to be more comprehensive in its immediate application to a broader range of entities with UK connections.
Boards Grapple with Diminishing Effectiveness Amidst Competing Priorities
Beyond the immediate concerns of regulatory compliance, a separate survey highlights a worrying trend in board effectiveness. A recent study by accounting and advisory firm BDO USA indicates a decline in how corporate directors perceive their boards’ ability to collaborate with the CEO and management. Only 58% of directors now rate their boards as highly effective in this crucial area, a noticeable drop from 69% in 2025. This suggests a growing disconnect or friction between leadership and oversight functions within public companies.
The BDO survey, which encompassed over 200 public company directors across a diverse range of industries including technology, retail, manufacturing, financial services, energy, and healthcare, also pointed to a rise in perceived ineffectiveness in other critical board functions. Twenty percent of directors now believe their boards are ineffective at conducting meaningful member evaluations and executing strategic refreshment plans, a significant increase from just 9% in 2025. Furthermore, the ability of boards to respond effectively to crises has also been called into question, with 22% of directors deeming their boards ineffective in this regard, up from 13% the previous year.
These findings emerge at a time when boards are increasingly burdened by an expanding agenda and competing priorities. More than half of the directors surveyed (51%) identified keeping pace with the rapid advancements in Artificial Intelligence (AI) and emerging technologies as the most significant challenge facing their boards in the coming 12 months. This is closely followed by the challenge of balancing numerous competing priorities on the board’s agenda (36%) and the complex task of prioritizing capital allocations amidst ongoing resource constraints (35%).
Governance areas themselves are not immune to this pressure. When asked about which governance areas were at risk of being deprioritized, a significant 42% of directors pointed to board effectiveness itself. This broad category includes crucial aspects such as board evaluations, director refreshment strategies, board structure optimization, and the provision of ongoing director education. The fact that board effectiveness is cited more frequently than any other governance area suggests a potential for self-inflicted governance weaknesses as boards struggle to manage their multifaceted responsibilities.
AI-Driven Compliance Without Verification Leads to Increased Fines
The rapid integration of Artificial Intelligence (AI) into regulatory compliance processes is presenting new challenges, with a survey by regulatory intelligence provider Enhesa revealing a strong correlation between skipping AI-driven verification and increased instances of regulatory fines. The study indicates that compliance teams that rely on AI-generated regulatory guidance without expert human review are nearly three times more likely to face a penalty.
Enhesa’s survey of 273 senior compliance, risk, EHS, legal, and sustainability decision-makers at multinational companies with 5,000 or more employees found that a substantial 40% of compliance teams routinely or always act on AI-generated regulatory guidance without subjecting it to expert review. Among these teams, a concerning 37% reported experiencing a regulatory fine. In stark contrast, only 13% of teams that consistently conduct verification of AI outputs faced similar penalties.
The negative consequences of relying on unverified or incorrect AI outputs extend beyond direct fines. More than half of compliance teams (56%) reported experiencing adverse outcomes in the past 12 months that they attributed to AI-generated information. These negative outcomes included incorrect or incomplete regulatory filings (30%), regulatory fines or penalties (21%), missed regulatory deadlines (20%), and failed audits (18%). This data underscores the critical need for human oversight and validation when leveraging AI for sensitive compliance tasks.
Ransomware Attacks Escalate with Threats of Physical Harm
In the realm of cybersecurity, ransomware attackers are exhibiting a disturbing escalation in tactics, moving beyond purely digital extortion to include direct threats of physical and psychological harm against employees and their families. A survey by identity system security and recovery software provider Semperis highlights this alarming trend, indicating that attackers are increasingly leveraging these more extreme measures to pressure organizations into paying ransoms.
The Semperis survey, which polled 1,200 security and IT professionals from nine countries who had experienced at least one successful ransomware attack in the past year, found that psychological intimidation was employed in nearly a quarter of all attacks. More alarmingly, 40% of attacks involved explicit psychological or physical threats directed at staff. The situation is further exacerbated by the fact that in 53% of these cases, victims reported that the attackers followed through on their threats. This included instances of "swatting" (making false emergency service calls to a victim’s address) affecting 24% of victims, and 25% of victims or their family members requiring psychological or medical treatment as a direct consequence of the attack.
AI is also playing a significant role in shaping the ransomware landscape, with threat actors weaponizing the technology in 84% of the attacks surveyed. This suggests that AI is being used to enhance the sophistication, targeting, and execution of ransomware campaigns. The persistent nature of these attacks is also a major concern, with repeat attacks remaining the norm. A substantial 69% of ransomware victims reported being targeted multiple times within the past year, and 31% admitted to paying their attackers on more than one occasion. This cycle of repeated attacks and payments highlights the difficulty organizations face in eradicating ransomware threats and the evolving tactics of cybercriminals.
