More than 335,000 companies¹  declare they have no beneficial owner – which is allowed if no individual holds more than 25% of the shares of the company.

More than 10,000 companies declare a foreign company as their beneficial owner which is unlikely to meet the requirements – of these 72% are linked to a secrecy jurisdiction.²

More than 9,000 companies are controlled by beneficial owners who control over 100 companies.

328 companies are part of circular ownership structures, where they appear to control themselves.

345 companies have a beneficial owner who is a disqualified director

390 companies have company officers or beneficial owners who are politicians elected to national legislatures, either in the UK or in another country³ 

7,848 companies share a beneficial owner, officer or registered postcode with a company suspected of having been involved in money laundering

More than 208,000 companies are registered at a company factory⁵

The UK Government should clearly mandate and resource Companies House to verify beneficial ownership data submitted to the register and sanction non-compliance.   

Companies House should develop a capability to identify and investigate suspicious activity revealed in the data, in coordination with other relevant Government departments. 

Loopholes for suppressing beneficial ownership information need to be closed, including by making it more difficult to file statements saying there is no beneficial owner and checking up on companies that are listed as the controlling entity. 

What does control of the average UK company look like?

What is the quality of the data in the PSC register?

What is the extent of non-compliance with the register? 

What are the remaining loopholes for hiding company ownership?

Open data enables wider use of the data in question, ensuring a broader range of people can benefit from the information. The UK beneficial ownership register is a testament to this fact. As there is no paywall or restriction to use, major internet search engines index the register, enabling the public to easily access individual records without knowledge of how to use the Companies House website itself. Statistics show paywalls were an important barrier to the use of UK company data. 

Open data registers enable thorough analysis of data contained within them, including providing a birds-eye view to assess data completeness and quality as a whole, as opposed to systems where it is only possible to search per record. This is a huge advantage of the UK PSC register. 

Open data systems can improve data quality and reduce the incentive for lying, thanks to the number of people who can scrutinise the information. Without the open data format of the UK PSC register, Global Witness would never have been able to identify potential non-compliance and mistakes. In closed systems – including registers that are ‘public’ but behind a paywall or those that do not support access to raw data – it would be much more difficult to identify these issues.

Open data registers can be linked to other public interest datasets such as information on politically exposed individuals, sanctions lists or procurement. Combining PSC information with other data sources can enable investigative journalists to undertake public interest research.

Open data systems, when correctly implemented, allow for the development of a multitude of new tools and systems by civil society and the private sector. In this case, Global Witness used the UK PSC register to create tools tailored to the needs of anti-corruption campaigners and investigative journalists (see Chapter III).

Lack of unique identifiers for individual PSCs, making it less easy to analyse. While the register includes the month and year of birth for an individual PSC, this is not enough in some cases to distinguish between two people, particularly for common names. The use of a correspondence address in combination with month and year of birth to create a unique ID for the PSC may also not be effective, as PSCs often list different correspondence addresses for different companies under their control. This makes it very difficult to accurately assess how many and which companies a given person actually controls. This is a fundamental challenge for investigations using PSC data.

Lack of standardisation for certain data fields, which would help ensure the data provided is valid and realistic. For example, we found a number of PSCs with impossible or highly unlikely dates of birth, including someone who has not yet been born. Although the number of impossible dates of birth was small, it suggests there may be a wider problem of data validation. We found similar issues with misspellings and inconsistencies in both the nationality and address country fields, making it hard to summarise information using these fields. Companies House has since addressed this issue by introducing data validation from the outset in the new incorporation form, using age prompts and restricted menus rather than free text input fields. 

An automated system for red flagging companies

A visual tool for exploring the PSC register and other associated public interest datasets

Identifying patterns – Some loopholes only manifest themselves as patterns. The clearest example of this is circular ownership structures, as explained above. In addition, the PSC tool introduces the possibility of asking not only which entities directly control a company but also which entities exercise control via other companies. We have seen how some of the issues with the current UK register – such as foreign corporate PSCs which are unlikely to be listed on a relevant stock exchange – are more extensive when relationships of indirect control are considered. If you want to find and quantify the extent of indirect control, it is useful to employ database technologies that naturally focus on the relationships between entities. So-called “graph” or “network” databases lend themselves to this type of enquiry. 

Exploring relationships – Relationships between a large set of individuals, companies and addresses can be complicated. An interactive visual interface can enable the user to identify connections they might not otherwise have found using the simple web search interface or table. We used a tool called Linkurious, which sits on top of Neo4J – a widely used graph database technology – to give Global Witness campaigners and our partners’ access to our database and interrogate it intuitively.

Cross-referencing with other datasets – The searchable database we built incorporated a range of data sources including the Tax Justice Network Financial Secrecy Index 2018 and information on politicians from EveryPolitician.org. Users can navigate seamlessly between the two datasets and explore the business holdings of politicians. For example, this function can help verify financial disclosures from politicians and identify discrepancies.

The register’s availability as open data. As previously detailed, the open data format of the register provides a huge opportunity for law enforcement, Companies House, civil society organisations, journalists and others to analyse the data for mistakes and suspicious behaviour, as we have now done. 

The ongoing efforts to update and improve the PSC rules to close new loopholes. Such improvements include bringing new legal entities within scope (i.e. SLPs) and moving from annual PSC registration to event-driven reporting, as required by the 4th EU Anti-Money Laundering Directive in June 2017. Companies are now required to file changes to PSC within 28 days, giving a boost to proactive compliance and enabling UK authorities to chase companies that are failing to report or are taking too long to identify their beneficial owners.

A large-scale education drive by Companies House on the new PSC requirements, which should result in a better ability to distinguish between suspicious filings and honest misunderstandings about how to file PSC information correctly. 

Data validation: Ensuring data entered represents a valid possible entry and is complete remains an important challenge for the register, making it much more difficult to cross-reference PSC data with other datasets. Many of the data-quality issues could be overcome by changing the way data is entered in the first place (e.g. validated UK addresses). As part of a new incorporation form developed with HM Revenues and Customs (HMRC), Companies House has now created a more intuitive process, integrating age prompts and validated nationality and country fields, due to be rolled out by the end of June 2018. 

➔ Companies House should integrate additional data validation systems, such as automated checks, UK postal address validation and multiple-choice drop-down menus wherever possible to improve data quality. 

Data verification: One of the biggest weaknesses of the UK PSC register is the lack of systematic verification of data submitted – i.e. it is solely self-reported data from companies. Verification is an important step for increasing the accuracy of beneficial ownership information, making it more difficult and risky to lie. It would also in turn help the Insolvency Service and law enforcement agencies investigating financial crime. However, Companies House is not currently tasked with verification of PSC data and there is limited proactive follow-up, increasing the risk of misleading and inaccurate data. Despite this clear need, as of February 2018, the UK Government had no plans to introduce automated verification of beneficial ownership data.  

Fortunately, the 5th EU Anti-Money Laundering Directive (2018) introduces new requirements for EU countries to ensure beneficial ownership data is “adequate, accurate and current, and shall put in place mechanisms to this effect.”⁶²  The new rules also require entities conducting customer due diligence, such as accountants, real estate agents and banks, to file reports with national authorities if they find discrepancies between the information they have and information in the public register.  The EU Directive suggests mentioning discrepancies in the register until they are resolved. The UK Government recently stated it would implement the 5th Anti-Money Laundering Directive, as the 2019 deadline for transposing the new rules falls within the Brexit ‘implementation period’.   

In addition to verification as set out in the EU rules, Companies House should take other steps to verify and improve the accuracy of PSC data, such as: 

➔ Requiring the submission of proof of identity, which would show that all named PSCs are existing people. Denmark already requires beneficial owners to submit a scanned copy of their passport or other national ID, limiting the possibilities for false registrations.  This is a reasonable request, given that proof of identity is also needed when opening a bank account.

➔ Requiring the submission of documents proving ownership or control of the company. This could include proof of shareholding through a company’s confirmation statement or voting rights set out in its articles of association. While this would not necessarily rule out all false disclosures, it would give Companies House a starting point for compliance work – and raise the stakes for those submitting false filings, forcing them to produce some form of fraudulent document. 

➔ Cross-checking data against other government datasets, in particular shareholder data, which would help weed out inconsistencies. 

➔ Making shareholder data for UK companies available as open data, which would in turn allow this information to be cross-checked with PSC data. 

➔ Improving systems for members of the public to report inaccuracies in the register, and publishing statistics on the frequency and outcome of these reports. The feedback form could also be linked to the function to ‘follow’ a company, enabling the reporter to receive updates on actions that result from their submission. In addition, a drop-down menu that sends the report directly to the appropriate team would ensure more effective follow-up, particularly as there is likely to be a big increase in reporting from banks, lawyers, real estate agents and others as a result of the 5th Anti-Money Laundering Directive. 

➔ Increasing opportunities for collaboration with civil society and other relevant stakeholders to improve verification systems and sharing learnings and best practices publicly, especially with other data publishers.

Identifying suspicious companies: One of the most important gaps we have identified is that Companies House does not currently have any system for proactively identifying suspicious companies through PSC data. Our analysis identifies a number of ways in which UK companies avoid disclosure of their PSCs – some of which are illegal under UK rules and should serve as a prompt for further investigation.

We have also found that certain types of corporate entity are less likely to declare their PSCs, notably SLPs and LLPs. Both SLPs and LLPs have a separate legal personality and as such, can themselves open bank accounts or purchase property. In addition, an SLP does not have to file financial accounts if either of its partners is a limited company. With these risk factors in mind, and based on the fact that LLPs and SLPs are known to have been involved in previous money laundering cases,   filings from SLPs and LLPs should automatically be subject to further scrutiny by Companies House. 

Companies House should also attune to new risks as they emerge. For example, we identified a small but significant uptake in Northern Irish Limited Partnerships and England & Wales Limited Partnerships since SLPs were required to disclose their PSCs (see chart below). As the PSC regime extends to new company types, money launderers will seek to exploit other less well known, and less regulated corporate entities, to which the UK Government should be vigilant. 

➔ Companies House should proactively identify and pursue cases of non-compliance, as well as develop a red flagging system to identify suspicious companies for referral to law enforcement. 

➔ Companies House should invest more resource into data science approaches for examining PSC data, including experimenting with network database technologies and automated approaches for red flagging suspicious companies.

➔ The PSC regime should extend to include all relevant types of UK companies and partnerships. 

Unique identification: As highlighted in the data analysis (Chapter II), the public version of the PSC register only discloses the name, and month and year of birth of the PSC. This can make it difficult to see when several records refer to the same person. This is challenging, both for comparing entries within the register and for cross-referencing the register with other datasets such as lists of politicians, sanctions lists and company officers.

To address this problem Companies House should: 

➔ Allocate unique identifiers to individuals, in the form of a number sequence that is specific to the database – not a piece of personal data such as a personal ID or passport number.⁶³ 

➔ Link PSC records with other company datasets held by Companies House, building on existing technology that already links some records for company officers across companies. This would identify individuals who are both PSCs and directors or secretaries of more than one company, as well as help match records against other datasets.

Corporate PSCs: Under the PSC rules, another company can control a company if it is a ‘Relevant Legal Entity’, meaning it should either itself declare a PSC or receive an exemption if listed on a relevant stock exchange.⁶⁴  We refer to these companies as corporate PSCs. However, there is no systematic verification of corporate PSCs, even with simple steps such as checking its company number. Similarly, it is possible to file a foreign company as the corporate PSC without having to provide any proof that they are an existing company or their listing on a relevant stock exchange. As a result, there is a clear risk that companies could obscure who controls them simply by listing a corporate PSC.

At the same time, our analysis found only 58 companies filed a trading exemption – a number far lower than we expected, given the many UK companies listed on the FTSE 100 and FTSE 250 alone. Of those 58 companies, we found a significant number are unlikely to qualify for this exemption, including, for example, a small inn in Scotland. This raises questions again about the level of scrutiny applied to filings. As of 26 June 2018, Companies House will be able to chase companies regarding this exemption, having allowed a year for companies to update this information voluntarily in their annual confirmation statement. Some of the likely misunderstanding when filings such exemptions will be partially addressed by a more intuitive incorporation form expected by the end of June 2018.

It is also unclear whether a listing on any of the specified relevant stock exchanges  – in European Economic Area countries, Switzerland, the USA, Israel and Japan⁶⁵ – offers comparable levels of transparency to the PSC register. The rationale for granting exemptions to companies listed on these exchanges was that they already require disclosure of significant shareholdings.⁶⁶  However, since the list was originally developed, the PSC register has raised the bar for corporate transparency standards.

➔ Companies House should verify the status of UK companies listed as corporate PSCs by checking the company numbers supplied. To simplify this process, users could select valid entities from a pre-populated multiple-choice list of company numbers. 

➔ Companies House should verify the status of foreign corporate PSCs by asking for and checking their company numbers (e.g. through third-party aggregators such as OpenCorporates) and their ticker symbols (an identification code for a stock) if it is listed on a relevant stock exchange. 

➔ The UK Government should assess the shareholding transparency provisions for stock exchanges that hold an exemption on the PSC register, and remove the exemption if they do not provide equivalent transparency to the PSC regime. As part of this, the Government should conduct checks on a random sample of cases to ascertain the level of beneficial ownership information that is publicly available through the stock exchanges, with a view to also linking to this information through the Companies House website.

Sanctions: Credible dissuasive sanctions are the only way to ensure companies provide accurate PSC data. In the UK, disclosing misleading or false PSC information to the register, whether deliberate or “recklessly”, may result in a criminal offence and a fine and/or prison sentence of up to two years.⁶⁷ Currently, Companies House and other executive agencies refer cases to the Insolvency Service, where the criminal enforcement team prosecutes breaches of Insolvency and Company Law.  In Scotland the Crown Office and Procurator Fiscal Service holds responsibility for prosecuting Scottish corporate entities, including SLPs, for breaches of PSC rules. However, so far, no fines have been issued for PSC filings,  including for SLPs,  and there is no evidence of cases being referred for investigation. 

In March 2018, Companies House issued its first prosecution for a false filing of company information, sanctioning Kevin Brewer who had set up fake companies and registered UK politicians as directors and shareholders without their knowledge.  Unfortunately, this is not the victory it may seem. Kevin Brewer had set up these companies as a stunt to expose the lack of checks conducted by Companies House during incorporation.  He was fined £12,000 and remains the only person to have been prosecuted.

➔ Companies House, the Insolvency Service and the Crown Office and Procurator Fiscal Service in Scotland should enforce sanctions by issuing fines and, where appropriate, prosecuting companies and individuals who are non-compliant with the PSC rules. This should include the large number of Scottish Limited Partnerships who have failed to identify a PSC and are liable for daily fines of £500. 

Trusts:   When a trust exercises control over a UK company, the PSC register requires the registration of trustees, as well as anybody else who has significant influence or control over the activities of that trust or company.⁶⁹  This runs contrary to EU regulations, whose definition of the beneficial owner of a trust is much wider, and automatically includes the settlor, trustee, protector, beneficiaries or class of beneficiaries, and any other person exercising effective control over that trust.⁷⁰  It is also inconsistent with the UK’s current register of trusts with tax consequences, held by HMRC.  By failing to include specific categories of owners such as the settlor and beneficiaries, there is a real risk of using trustees to obscure the real owners of a UK company.

Trusts present unique money-laundering risks, proving so elusive to track down and prosecute that law enforcement authorities admit to giving up investigations when they come across a trust. As a result, the extent of their use for criminal purposes is critically underreported.  The UK Government’s own money laundering assessment found trusts are “known globally to be misused for money laundering”, with overseas trusts presenting particularly high money laundering risks.  

➔ The PSC rules should be amended to require the recording of settlor(s), trustee(s), protector(s), and beneficiaries of a trust as PSCs when a trust is identified as controlling a UK company. 

Thresholds: The UK only requires beneficial owners to report themselves as PSCs if they control 25% of the shares or voting rights in a company. This high threshold creates a risk that significant interests in a company may not appear in the register, and money launderers will simply be able to structure company ownership so that no shareholding passes the threshold. The result is that deliberate strategies to avoid PSC disclosure may be lost among hundreds of thousands of companies filing that they have no PSC. Global Witness has previously identified examples where owning as little as 10% of a company raised serious red flags,  and even cases related to extractive industries where a 1% company stake is worth reporting – where company ownership can be extremely profitable and corruption risks are very high. 

Not only is the threshold too high, but there are also challenges resulting from the banding of ownership stakes in a range from 25% to 50%, 51% to 75%, or 76% to 100%. This will always result in an imprecise figure and can make it difficult to compare data across jurisdictions. As the vast majority of UK companies have only up to six PSCs, there is limited additional burden in requiring companies to file a specific percentage. 

➔ Ideally, there should be no ownership threshold and companies should be required to report their PSCs’ holdings of shares or voting rights in exact percentages. 

Institutional Setup: Companies House is responsible for registering company information and making it available to the public, as part of its statutory role as the UK registrar of companies. With regard to the PSC register, Companies House is responsible for ensuring companies comply with the PSC rules, such as pursuing companies that fail to file PSC information.  Companies House is not formally responsible for verifying PSC data – meaning it can to some extent accept PSC statements at face value – and lacks investigative powers. This limits Companies House ability to proactively refer companies and relies on other UK investigative bodies to find and look into suspicious activity revealed by the register. 

As a result of its limited mandate, Companies House’s efforts have so far focused more on addressing superficial inaccuracies than on systematically examining the reliability of information. While Companies House has taken some steps to pursue likely non-compliant companies – including writing to 2,500 companies with corporate PSCs in secrecy jurisdictions⁷²  – this falls far short of a comprehensive approach. 

Problems are also apparent in the way Companies House directly incorporates companies. By law, private sector formation agents should not establish a business relationship without having completed customer due diligence, but a legal loophole means this standard does not apply to Companies House.  Consequently, Companies House cannot refuse a request to incorporate a company and companies incorporated by them are not sufficiently subject to checks, increasing the risk that UK companies are used by criminals. 

In terms of prosecutions, Companies House only has a limited role and mainly deals with cases related to filing of accounts and confirmation statements. The Insolvency Service is responsible for prosecuting the vast majority of offences under the Companies Act, but as mentioned above, has yet to prosecute a single case related to PSC filings. 

This all points to the wider problem of a fragmented institutional setup and a lack of political will to capitalise on the opportunity at hand to use the register to detect and deter crime. There is no verification of PSC data, no systematic sanctioning for non-compliance and no method for using the data in the PSC register to identify suspicious filings and generating investigative leads – all opportunities for policing the register that are currently being missed. 

➔ The Secretary of State for Business, Energy and Industrial Strategy should direct Companies House, under s.1061 of the UK Companies Act, to take all reasonable steps to monitor and ensure compliance with company law –including the completeness and accuracy of PSC submissions. This should clarify that Companies House has direct responsibility for validating and verifying PSC data, both during incorporation and as part of its role in overseeing the register.

➔ The Government should also consider giving Companies House investigative powers to pursue suspicious companies, or ensure this task is carried out by other parts of Government in close coordination with Companies House.

➔ The Government should set up a cross-agency working group to facilitate cooperation and support an effective PSC regime, including Companies House, HMRC, the Department for Business, Energy and Industrial Strategy (BEIS), the National Crime Agency and the Insolvency Service. 

Resources at Companies House: Until recently, Companies House only had six staff responsible for policing the 4 million companies on the PSC register.  In January 2018, the Government confirmed there are now 20 staff employed to deal with PSC compliance activities.  As a point of comparison, there are currently 3,765 staff working at the DWP investigating benefit fraud and error.  It is impossible for Companies House to take on more responsibility for verifying data and policing the PSC register without adequate resources. One possible source for funding could be the future income generated from fines for non-compliance with the PSC rules. 

➔ The Government should give Companies House more resources, including staff and funding, to carry out thorough verification, identify suspicious activity, and pursue prosecutions related to PSC information.