{"id":10631,"date":"2023-07-13T10:28:50","date_gmt":"2023-07-13T09:28:50","guid":{"rendered":"https:\/\/www.taxpolicy.org.uk\/?p=10631"},"modified":"2023-07-13T13:52:00","modified_gmt":"2023-07-13T12:52:00","slug":"robot","status":"publish","type":"post","link":"https:\/\/heacham.neidles.com\/2023\/07\/13\/robot\/","title":{"rendered":"Companies House is a giant fraud robot. Will the Economic Crime and Corporate Transparency Bill stop it?"},"content":{"rendered":"\n

Companies House’s rules were created in an era of trust, where incorporating a company took time and expertise. Automation made incorporating a company much faster and easier – but the rules didn’t change. That means Companies House ends up facilitating large-scale frauds<\/strong>.<\/em><\/p>\n\n\n\n

The Economic Crime and Corporate Transparency Bill introduces ID verification requirements, and creates a new investigative and enforcement role for Companies House. Much will depend on how Companies House adapts to that new role. But there are also key vulnerabilities that the Bill does not remove: the “false registered office” fraud, the “dissolve within a year” loophole and the “muppet director” fraud.<\/strong><\/p>\n\n\n

Companies House is just a robot<\/h2>\n\n\n

Blaming Companies House for its failings is like blaming a traffic light for turning red. It’s just following its programming.<\/p>\n\n\n\n

The programming is in the Companies Act 2006 – here’s the key section<\/a> stating what you have to provide to create a company:<\/p>\n\n\n\n

\"9Registration<\/figure>\n\n\n\n

Note what’s missing here: any requirement to prove identity, or prove that the company actually owns the registered office address (or has the right to use it). Compare, for example, with the information banks require<\/a> before you can open a bank account.<\/p>\n\n\n\n

And, once someone has complied with the registration requirements, Companies House is required to accept them<\/a>:<\/p>\n\n\n\n

\"14Registration\nIf<\/figure>\n\n\n\n

And then required to incorporate the company:<\/a><\/p>\n\n\n\n

\"15Issue<\/figure>\n\n\n\n

The obvious missing piece: any requirement on Companies House to follow anti-money laundering procedures. Here’s 118 pages of guidance <\/a>on how financial institutions are expected to prevent, identify, and report financial crime. Banks, law firms, estate agencies… all kinds of businesses are expected to comply with AML rules. Companies House isn’t.<\/p>\n\n\n\n

Nor can Companies House voluntarily comply with AML rules, make sensible checks, or say “this doesn’t feel right” and refuse registration. The word “shall” in sections 14 and 15 above means that Companies House is a robot – if it receives the registration information, it creates the company.<\/p>\n\n\n\n

Companies House has worked this way pretty much unchanged since 1856<\/a> – behaving like a robot, incorporating companies without asking any questions. That more-or-less worked when incorporating companies was reasonably slow and complicated – there were certainly frauds, but the numbers were limited, which made it easier for authorities to track what was going on.<\/p>\n\n\n\n

The big change was automation, and the decision in 2001 to allow online filing… but without changing any of the rules. That suddenly enabled very large-scale fraud. <\/p>\n\n\n

The consequences<\/h2>\n\n\n

Here are just six:<\/p>\n\n\n\n

1. Suspicious behaviour<\/strong> isn’t noticed or acted on<\/strong><\/p>\n\n\n\n

In 2017, thousands of UK companies were set up overnight<\/a> with Philippine directors, all registered to UK addresses. The resultant <\/a>“mini-umbrella company” fraud cost the UK at least \u00a350m in lost tax, and the many MUCs that followed could have cost \u00a31bn<\/a>.<\/p>\n\n\n\n

The exact same fraud continues. Just last Thursday, 74 new companies were simultaneously put into ownership of Filipino directors: <\/p>\n\n\n\n\n\n

These are, in principle, completely lawful transactions. There’s nothing wrong with setting up a company with a Filipino director, or appointing a Filipino director to an existing company. Doing so en masse is, however, extremely suspicious. A bank would which didn’t flag and query (or report) these kinds of transactions would be in deep trouble<\/a>. But Companies House has no procedures for identifying suspicious behaviour.<\/p>\n\n\n\n

2. Companies House believes everything it’s told<\/strong><\/p>\n\n\n\n

You can submit literally almost anything to Companies House and it will accept it.<\/p>\n\n\n\n

A fake name for a director (surely a joke):<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

A fake registered office (surely a fraud):<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

and:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Even less of a joke, Graham Barrow has shown<\/a> that a UK company with a fake address was used by North Korea to breach sanctions.<\/p>\n\n\n\n

These are not isolated incidents. 10,000 people had to apply to Companies House last year to fix companies being wrongly (probably meaning fraudulently) registered at their home and businesses addresses. Likely there are many more that aren’t noticed.<\/p>\n\n\n\n

All of these have the same cause: there is no checking of your ID when you incorporate a company, or become a director. And no checking that the registered office address is in fact yours.<\/p>\n\n\n\n

3. The optionality of the PSC register<\/strong><\/p>\n\n\n\n

Companies are supposed to identify the actual humans who control them – the “people with significant control”. But the rules are widely ignored<\/a>, and there appears to be no enforcement.1<\/a><\/sup>There’s a procedure<\/a> for people at an AML-regulated firm to report discrepancies in PSC data (although it’s not clear if that is ever acted on), but no procedure for the rest of us.<\/span> <\/p>\n\n\n\n

4. The “dissolve within a year” loophole<\/strong><\/p>\n\n\n\n

You don’t have to file any accounts if you dissolve a company within a year of creating it. It’s a loophole that fraudsters exploit at a large scale. Tens of thousands of mini-umbrella companies<\/a> use it every year. Here’s a typical example:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

5. The accounts opt-out<\/strong><\/p>\n\n\n\n

Companies filing accounts at Companies House usually have to include their profit and loss account, with details of revenues and expenses for the year. However, “micro-entities” – broadly meaning companies with revenues of less than \u00a310m – can opt out of this<\/a>:<\/p>\n\n\n\n

\"(3)The<\/figure>\n\n\n\n

Instead, they can just file what are sometimes called “filleted accounts”, containing only basic balance sheet information. That’s fantastic for anyone looking to hide what they’re up to.<\/p>\n\n\n\n

6. The muppet director fraud<\/strong><\/p>\n\n\n\n

Being a director of a company is a serious role, with fiduciary duties and potential liability<\/a> if things go wrong. You are also immediately associated with the company in a permanent public record.<\/p>\n\n\n\n

These are bad things if you’re running a fraud, or expect the company to go bust with unpaid debts and\/or unpaid tax. As the director, those debts could transfer to you<\/a>.<\/p>\n\n\n\n

So the obvious move is to not be a director at all, but be a puppeteer for a bunch of muppet2<\/a><\/sup>I didn’t invent the term for this article – it’s been used for decades. Possibly credit goes to Chris, the brilliant Clifford Chance tax partner who trained me.<\/span> “nominee directors” who you hire off social media, either in the Philippines…<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

… or in the UK:<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

It’s a fraud because it relies upon concealment: if everybody discovers what’s going on, it doesn’t work. There’s no such thing as a “nominee director” as a matter of UK company law. A puppeteer will be a “shadow director”<\/a>, just as liable as a real director. The muppet director strategy is a fraud from start to finish.<\/p>\n\n\n\n

But it’s an easy fraud, because there’s no shortage of people willing to sign up as a director for a few hundred quid, and Companies House realistically has no way to know if a director is real, or a muppet.<\/p>\n\n\n

The new Bill<\/h2>\n\n\n

All these problems have been written about for some time – nothing above is new or original. There is, however, finally some action – a host of new measures<\/a> in the Economic Crime and Corporate Transparency Bill<\/a>. That will end some of the frauds and loopholes, but not others.<\/p>\n\n\n\n

Stopping the robot<\/strong><\/p>\n\n\n\n

Probably the most important element in the Economic Crime and Corporate Transparency Bill<\/a> are a host of new powers for Companies House to require information from companies, modify company information at its discretion if it thinks it’s incorrect, and ultimately even strike off companies if false information was provided to Companies House:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

This is a big change – Companies House is no longer a robot. <\/p>\n\n\n\n

But will Companies House have the resources to use its shiny new powers? The Autumn 2021 Spending Review<\/a> pledged \u00a363m:<\/p>\n\n\n\n

\"providing<\/figure>\n\n\n\n

The SR21 period is 2022\/23 to 2024\/25 – so this is about \u00a320m per year. Presumably that’s enough to establish the new ID verification systems. However it’s not intended to cover ongoing running costs – Companies House is supposed to be self-funded, by means of the incorporation and other fees it charges companies. Currently, online incorporation costs a rather derisory \u00a312. Companies House has dropped unsubtle hints<\/a> this will be going up.<\/p>\n\n\n\n

How high should it go? UK Finance suggested <\/a>\u00a350 to \u00a3100; but there’s a good argument that incorporating a company should be more expensive. Back in 1990, it cost \u00a350 to incorporate<\/a> – that’s \u00a3120 in today’s money. When online incorporation was created, the costs for Companies House were greatly reduced, and so fees were cut commensurately. That looks like a mistake in retrospect – no genuine business would be deterred by a \u00a3120 fee, but it would damage the economics of some large-scale frauds. So we should consider ending the principle that the only purpose of Companies House fees is to fund Companies House. <\/p>\n\n\n\n

In any case, it’s plausible that a \u00a3120 fee would be the right amount to create an effective and proactive compliance and enforcement team. It would raise around \u00a360m per year,3<\/a><\/sup>Assuming a 1\/3 fall in the 750,000 incorporations we currently see each year.<\/span> which doesn’t feel excessive. For context, UK financial institutions report an average annual anti-money laundering and compliance cost of \u00a3186m <\/a>(that’s per financial institution, not the sector overall), and these are now very mature systems. Companies House would be starting from scratch.<\/p>\n\n\n\n

Stopping Adolf Tooth Fairy Hitler<\/strong><\/p>\n\n\n\n

The Bill includes an identify verification requirement<\/a> for incorporation and all delivery of documents to Companies House:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Over the twelve months after the Bill comes into force, as each company files its annual confirmation and accounts, every company will have at least one person whose identity has been confirmed. That should end Adolf Tooth Fairy Hitler.<\/p>\n\n\n\n

Stopping proper accounts being optional<\/strong><\/p>\n\n\n\n

The very limited accounts filing requirements for micro-entities are finally being tightened. The Economic Crime and Transparency Bill requires all companies to file a profit and loss account<\/a>. <\/p>\n\n\n\n

But nothing to stop Cardiff flat owners receiving 11,000 tax bill<\/strong><\/p>\n\n\n\n

So far as I can see, the ID verification requirements won’t stop the “fake registered office” frauds. <\/p>\n\n\n\n

Provided I verify that I am Dan Neidle, nothing stops me from putting a random Cardiff address as my registered office address. That would be a foolish thing for me to do, as (in theory) I could easily be found and prosecuted. But prosecution is going to be little deterrent for people on the other side of the world.<\/p>\n\n\n\n

How could registered office be verified?<\/p>\n\n\n\n