Ensuring data entered represents a valid possible entry and is complete remains an important challenge for the register, making it much more difficult to cross-reference PSC data with other datasets. Many of the data-quality issues could be overcome by changing the way data is entered in the first place (e.g. validated UK addresses). As part of a new incorporation form developed with HM Revenues and Customs (HMRC), Companies House has now created a more intuitive process, integrating age prompts and validated nationality and country fields, due to be rolled out by the end of June 2018.
Recommendation #1: Companies House should integrate additional data validation systems, such as automated checks, UK postal address validation and multiple-choice drop-down menus wherever possible to improve data quality.
One of the biggest weaknesses of the UK PSC register is the lack of systematic verification of data submitted – i.e. it is solely self-reported data from companies. Verification is an important step for increasing the accuracy of beneficial ownership information, making it more difficult and risky to lie. It would also in turn help the Insolvency Service and law enforcement agencies investigating financial crime. However, Companies House is not currently tasked with verification of PSC data and there is limited proactive follow-up, increasing the risk of misleading and inaccurate data.
Fortunately, the 5th EU Anti-Money Laundering Directive (2018) introduces new requirements for EU countries to ensure beneficial ownership data is “adequate, accurate and current, and shall put in place mechanisms to this effect.” The new rules also require entities conducting customer due diligence, such as accountants, real estate agents and banks, to file reports with national authorities if they find discrepancies between the information they have and information in the public register. The EU Directive suggests mentioning discrepancies in the register until they are resolved. The UK Government recently stated it would implement the 5th Anti-Money Laundering Directive, as the 2019 deadline for transposing the new rules falls within the Brexit ‘implementation period’.
Requiring the submission of proof of identity, which would show that all named PSCs are existing people.
Requiring the submission of documents proving ownership or control of the company.
Cross-checking data against other government datasets, in particular shareholder data, which would help weed out inconsistencies.
Making shareholder data for UK companies available as open data, which would in turn allow this information to be cross-checked with PSC data.
Improving systems for members of the public to report inaccuracies in the register, and publishing statistics on the frequency and outcome of these reports.
Increasing opportunities for collaboration with civil society and other relevant stakeholders to improve verification systems and sharing learnings and best practices publicly, especially with other data publishers.
Identifying suspicious companies: One of the most important gaps we have identified is that Companies House does not currently have any system for proactively identifying suspicious companies through PSC data.
Certain types of corporate entity are less likely to declare their PSCs, notably SLPs and LLPs. Both SLPs and LLPs have a separate legal personality and as such, can themselves open bank accounts or purchase property. In addition, an SLP does not have to file financial accounts if either of its partners is a limited company. With these risk factors in mind, filings from SLPs and LLPs should automatically be subject to further scrutiny by Companies House.
Companies House should proactively identify and pursue cases of non-compliance, as well as develop a red flagging system to identify suspicious companies for referral to law enforcement.
Companies House should invest more resource into data science approaches for examining PSC data, including experimenting with network database technologies and automated approaches for red flagging suspicious companies.
The PSC regime should extend to include all relevant types of UK companies and partnerships.
The public version of the PSC register only discloses the name, and month and year of birth of the PSC. This can make it difficult to see when several records refer to the same person. This is challenging, both for comparing entries within the register and for cross-referencing the register with other datasets such as lists of politicians, sanctions lists and company officers.
Allocate unique identifiers to individuals, in the form of a number sequence that is specific to the database – not a piece of personal data such as a personal ID or passport number.
Link PSC records with other company datasets held by Companies House, building on existing technology that already links some records for company officers across companies. This would identify individuals who are both PSCs and directors or secretaries of more than one company, as well as help match records against other datasets.
Under the PSC rules, another company can control a company if it is a ‘Relevant Legal Entity’, meaning it should either itself declare a PSC or receive an exemption if listed on a relevant stock exchange. The rationale for granting exemptions to companies listed on the stock exchanges was that they already require disclosure of significant shareholdings.
There is no systematic verification of corporate PSCs, even with simple steps such as checking its company number. Similarly, it is possible to file a foreign company as the corporate PSC without having to provide any proof that they are an existing company or their listing on a relevant stock exchange. As a result, there is a clear risk that companies could obscure who controls them simply by listing a corporate PSC.
As of 26 June 2018, Companies House will be able to chase companies regarding this exemption, having allowed a year for companies to update this information voluntarily in their annual confirmation statement. Some of the likely misunderstanding when filings such exemptions will be partially addressed by a more intuitive incorporation form expected by the end of June 2018.
Companies House should verify the status of UK companies listed as corporate PSCs by checking the company numbers supplied. To simplify this process, users could select valid entities from a pre-populated multiple-choice list of company numbers.
Companies House should verify the status of foreign corporate PSCs by asking for and checking their company numbers (e.g. through third-party aggregators such as OpenCorporates) and their ticker symbols (an identification code for a stock) if it is listed on a relevant stock exchange.
The UK Government should assess the shareholding transparency provisions for stock exchanges that hold an exemption on the PSC register, and remove the exemption if they do not provide equivalent transparency to the PSC regime. As part of this, the Government should conduct checks on a random sample of cases to ascertain the level of beneficial ownership information that is publicly available through the stock exchanges, with a view to also linking to this information through the Companies House website.
Credible dissuasive sanctions are the only way to ensure companies provide accurate PSC data. In the UK, disclosing misleading or false PSC information to the register, whether deliberate or “recklessly”, may result in a criminal offence and a fine and/or prison sentence of up to two years.
So far, no fines have been issued for PSC filings, including for SLPs, and there is no evidence of cases being referred for investigation.
In March 2018, Companies House issued its first prosecution for a false filing of company information, sanctioning Kevin Brewer who had set up fake companies and registered UK politicians as directors and shareholders without their knowledge. Unfortunately, this is not the victory it may seem. Kevin Brewer had set up these companies as a stunt to expose the lack of checks conducted by Companies House during incorporation. He was fined £12,000 and remains the only person to have been prosecuted.
Companies House, the Insolvency Service and the Crown Office and Procurator Fiscal Service in Scotland should enforce sanctions by issuing fines and, where appropriate, prosecuting companies and individuals who are non-compliant with the PSC rules. This should include the large number of Scottish Limited Partnerships who have failed to identify a PSC and are liable for daily fines of £500.
When a trust exercises control over a UK company, the PSC register requires the registration of trustees, as well as anybody else who has significant influence or control over the activities of that trust or company. This runs contrary to EU regulations, whose definition of the beneficial owner of a trust is much wider, and automatically includes the settlor, trustee, protector, beneficiaries or class of beneficiaries, and any other person exercising effective control over that trust. It is also inconsistent with the UK’s current register of trusts with tax consequences, held by HMRC. By failing to include specific categories of owners such as the settlor and beneficiaries, there is a real risk of using trustees to obscure the real owners of a UK company.
Trusts present unique money-laundering risks, proving so elusive to track down and prosecute that law enforcement authorities admit to giving up investigations when they come across a trust. As a result, the extent of their use for criminal purposes is critically underreported. The UK Government’s own money laundering assessment found trusts are “known globally to be misused for money laundering”, with overseas trusts presenting particularly high money laundering risks.
The PSC rules should be amended to require the recording of settlor(s), trustee(s), protector(s), and beneficiaries of a trust as PSCs when a trust is identified as controlling a UK company.
The UK only requires beneficial owners to report themselves as PSCs if they control 25% of the shares or voting rights in a company. This high threshold creates a risk that significant interests in a company may not appear in the register, and money launderers will simply be able to structure company ownership so that no shareholding passes the threshold. The result is that deliberate strategies to avoid PSC disclosure may be lost among hundreds of thousands of companies filing that they have no PSC. There are examples where owning as little as 10% of a company raised serious red flags, and even cases related to extractive industries where a 1% company stake is worth reporting – where company ownership can be extremely profitable and corruption risks are very high.
Not only is the threshold too high, but there are also challenges resulting from the banding of ownership stakes in a range from 25% to 50%, 51% to 75%, or 76% to 100%. This will always result in an imprecise figure and can make it difficult to compare data across jurisdictions. As the vast majority of UK companies have only up to six PSCs, there is limited additional burden in requiring companies to file a specific percentage.
There should be no ownership threshold and companies should be required to report their PSCs’ holdings of shares or voting rights in exact percentages.
Companies House is responsible for registering company information and making it available to the public, as part of its statutory role as the UK registrar of companies. With regard to the PSC register, Companies House is responsible for ensuring companies comply with the PSC rules, such as pursuing companies that fail to file PSC information. Companies House is not formally responsible for verifying PSC data – meaning it can to some extent accept PSC statements at face value – and lacks investigative powers. This limits Companies House ability to proactively refer companies and relies on other UK investigative bodies to find and look into suspicious activity revealed by the register.
Problems are also apparent in the way Companies House directly incorporates companies. By law, private sector formation agents should not establish a business relationship without having completed customer due diligence, but a legal loophole means this standard does not apply to Companies House. Consequently, Companies House cannot refuse a request to incorporate a company and companies incorporated by them are not sufficiently subject to checks, increasing the risk that UK companies are used by criminals.
In terms of prosecutions, Companies House only has a limited role and mainly deals with cases related to filing of accounts and confirmation statements.
The Insolvency Service is responsible for prosecuting the vast majority of offences under the Companies Act, but as mentioned above, has yet to prosecute a single case related to PSC filings.
There is no verification of PSC data, no systematic sanctioning for non-compliance and no method for using the data in the PSC register to identify suspicious filings and generating investigative leads – all opportunities for policing the register that are currently being missed.
The Secretary of State for Business, Energy and Industrial Strategy (BEIS) should direct Companies House, under s.1061 of the UK Companies Act, to take all reasonable steps to monitor and ensure compliance with company law –including the completeness and accuracy of PSC submissions. This should clarify that Companies House has direct responsibility for validating and verifying PSC data, both during incorporation and as part of its role in overseeing the register.
The Government should also consider giving Companies House investigative powers to pursue suspicious companies, or ensure this task is carried out by other parts of Government in close coordination with Companies House.
The Government should set up a cross-agency working group to facilitate cooperation and support an effective PSC regime, including Companies House, HMRC, the Department for Business, Energy and Industrial Strategy (BEIS), the National Crime Agency and the Insolvency Service.
Source: Companies We keep, Global Witness 2018 (https://www.globalwitness.org/en/campaigns/corruption-and-money-laundering/anonymous-company-owners/companies-we-keep/)