Multinational enterprises with operations in the United Kingdom are facing a significant compliance challenge as the November 18 deadline for Companies House identity verification requirements approaches, with a new survey revealing that fewer than 10% have completed the necessary work. The findings from a survey conducted by corporate services firm Vistra underscore a widespread struggle among businesses to meet the stringent new regulations introduced under the UK’s Economic Crime and Corporate Transparency Act (ECCTA) 2023.
The survey, which polled 300 directors at multinational corporations with a UK presence, indicated a notable disconnect between perceived preparedness and actual completion. While a substantial 84% of directors stated their organizations were ready for the identity verification mandate, only a mere 9% reported having successfully completed all requirements by the end of the transition period. On average, across all surveyed companies, only 61% of relevant directors and Persons with Significant Control (PSCs) had finalized their verification.
Digging deeper into the compliance efforts, the Vistra survey highlighted specific areas of delay. Just 26% of respondents confirmed they had meticulously checked the accuracy of Companies House records for their directors and PSCs. Furthermore, only 20% had successfully identified all individuals who require verification, and a mere 22% had secured and recorded the essential Companies House personal codes necessary to link these verifications to the company’s official filings. The situation is particularly concerning for UK-based respondents, where 86% claimed organizational readiness, yet not a single one reported that all pertinent directors and PSCs had undergone verification.
This widespread non-compliance comes at a critical juncture, following the first instances of legal action for identity verification offenses. In September, three directors were fined by UK courts following prosecutions initiated by the UK’s Insolvency Service, serving as a stark warning to other non-compliant entities. The complexity of international corporate structures further exacerbates the challenge, with over three-quarters (76%) of respondents citing the verification of directors and PSCs based outside the UK as a significant source of additional compliance complexity. This underscores the intricate web of regulations and cross-border data management that businesses must navigate.
The ECCTA’s drive for enhanced corporate transparency shares common ground with similar legislative efforts globally, most notably the Corporate Transparency Act (CTA) in the United States. The CTA, enacted with the objective of combating illicit finance by requiring the disclosure of beneficial ownership information, has itself undergone significant adjustments. Initially set to encompass over 32 million entities, the U.S. Treasury Department recently revised the scope, limiting disclosure primarily to foreign-registered entities and reducing the estimated number of covered firms to approximately 28,000. This evolution in U.S. legislation suggests a global trend towards greater accountability in corporate structures, albeit with varying implementation strategies.
Board Effectiveness Declines Amidst Competing Priorities
Beyond the immediate concerns of regulatory compliance, a separate survey by accounting and advisory firm BDO USA reveals a worrying trend in board effectiveness. The BDO survey, which questioned over 200 public company directors across diverse sectors, found that only 58% of directors now rate their boards as highly effective in collaborating with the CEO and management. This represents a notable decline from 69% in 2025, indicating a potential erosion of boardroom synergy and strategic alignment.
The findings also point to a growing ineffectiveness in crucial governance functions. Twenty percent of directors surveyed stated their boards are ineffective at conducting meaningful member evaluations and executing refreshment strategies, a significant increase from the 9% reported in 2025. Similarly, the ability of boards to respond effectively to crises has diminished, with just under a quarter (22%) deeming their boards ineffective in this area, up from 13% in the previous year.
These declines in perceived board effectiveness are occurring against a backdrop of increasingly crowded board agendas. Directors are grappling with a multitude of complex challenges, with over half (51%) identifying keeping pace with Artificial Intelligence (AI) and emerging technologies as the most significant hurdle for their boards in the next twelve months. This is closely followed by the challenge of balancing competing priorities on the agenda (36%) and the critical task of prioritizing capital allocations amidst resource constraints (35%). Worryingly, when asked about governance areas at risk of being deprioritized, a substantial 42% of directors pointed to board effectiveness itself – encompassing areas like evaluations, refreshment, structure, and continuing education – more than any other governance function. This suggests that the very mechanisms for ensuring effective oversight are themselves becoming vulnerable to being sidelined.
Compliance Teams Face Increased Fines When Skipping AI Verification
The rapid integration of Artificial Intelligence (AI) into regulatory compliance processes presents both opportunities and significant risks, according to a survey by regulatory intelligence provider Enhesa. The study found that compliance teams that rely on AI-generated regulatory guidance without thorough expert review are nearly three times more likely to incur regulatory fines.
The Enhesa survey, which polled 273 senior compliance, risk, EHS, legal, and sustainability decision-makers at multinational companies with 5,000 or more employees, revealed a concerning practice: 40% of compliance teams habitually or always act on AI-generated regulatory guidance without seeking expert verification. Among these teams, a significant 37% reported experiencing a regulatory fine. In stark contrast, only 13% of teams that adhere to verification protocols faced similar penalties.
The ramifications of unverified or incorrect AI output extend beyond direct fines. Over half (56%) of compliance teams reported negative outcomes in the past twelve months directly attributable to flawed AI-generated information. These adverse events included incorrect or incomplete filings (cited by 30% of respondents), regulatory fines or penalties (21%), missed regulatory deadlines (20%), and failed audits (18%). This highlights the critical need for robust human oversight and validation processes when leveraging AI for critical compliance functions.
Ransomware Attacks Escalate to Physical and Psychological Threats
The evolving threat landscape of cybercrime has taken a more sinister turn, with ransomware attackers increasingly resorting to physical and psychological threats against employees and their families to coerce payment. A survey by identity system security and recovery software provider Semperis reveals a disturbing escalation in the tactics employed by cybercriminals.
The Semperis survey, which interviewed 1,200 security and IT professionals in nine countries who had experienced at least one successful ransomware attack in the past twelve months, found that psychological intimidation was employed in nearly a quarter of all attacks. Furthermore, 40% of attacks involved psychological or physical threats directed at staff. Alarmingly, in 53% of these cases, victims reported that the attackers followed through on their threats. The survey detailed severe consequences, with 24% of victims or their family members experiencing "swatting" incidents (false emergency reports made to provoke a response from law enforcement) and 25% requiring psychological or medical treatment as a direct result of the attack.
AI continues to play a pivotal role in reshaping the cyber threat landscape. Threat actors are weaponizing AI in a significant 84% of the attacks surveyed, indicating its growing use in sophisticated cyber operations. The problem of repeat attacks remains persistent, with 69% of ransomware victims being targeted multiple times within the past year. Moreover, 31% of victims paid their attackers more than once, underscoring the financial incentives that fuel these persistent criminal enterprises.
These findings collectively paint a picture of a complex and evolving regulatory and threat landscape for multinational corporations. The delayed compliance with UK identity verification requirements, coupled with a potential decline in board effectiveness and the escalating sophistication of cyber threats, necessitates a proactive and strategic approach from corporate leadership. The integration of AI, while offering efficiency gains, demands rigorous validation and oversight to mitigate significant risks. The escalating nature of ransomware attacks, now encompassing direct threats to individuals, highlights the need for comprehensive cybersecurity strategies that extend beyond data protection to encompass the physical and psychological well-being of employees.
