Since April 2016, companies have been required to maintain information on individuals who exercise significant influence or control over them. This can be seen in the context of a global push towards greater corporate transparency, in which the UK is leading the way. The new regime relates to people known as “people with significant control” and legal entities, regardless of where they are resident or formed.
All UK companies (whether private or public, unless listed on certain specified markets in the UK and overseas) must comply, as well as limited liability partnerships.
The key obligations for UK companies are to:
- Take reasonable steps to determine if there are any people with significant control over the company, and, if so, identify them; and
- Create and maintain a register of people with significant control over the company (known as the “PSC register“).
The PSC register is publicly accessible, both at the company’s registered office and subsequently on the public register at Companies House (once annual filings are made). Third parties can inspect the company’s PSC register upon providing a proper purpose for the request (this will be given a wide interpretation, so expect journalists investigating a specific point that may well require access to a PSC register to be granted such access). The information on the public register at Companies House will be freely available and with no charge for access. The usual residential address will not be included as public information; however, it will be available to credit reference agencies (“CRAs“) and certain public authorities.
In exceptional circumstances, where there is a serious risk of violence or intimidation, there is a regime for suppressing all information relating to PSCs, or preventing their residential addresses from being shared with CRAs. A combined application, if successful, will prevent all PSC information being disclosed on the public register and prevent the PSC’s residential address being disclosed to CRAs. This ensures a PSC’s residential address is protected from disclosure to CRAs from the time of application.
The entire application process has been set up to secure confidentiality. Applications must be completed on original orange paper forms provided by Companies House and submitted in tamper proof envelopes. The address to which the applications are sent is separate from the general Companies House filing address and their databases are completely separate. Companies House submits the applications to a law enforcement agency for a risk assessment. The assessment is advisory and the ultimate decision as to whether to grant the application lies with Companies House. There is a team of approximately 10 individuals dealing with the applications at Companies House and it is currently taking around 14 days for applications to be dealt with.
There is no set list of circumstances where protection will be granted or any set thresholds as to what evidence will be sufficient to establish a credible risk. The guidance sets out that the evidence needs to show a “serious risk of violence or intimidation to the PSC or someone who lives with the PSC”. The risk must come from either the activities of the company or from the PSC’s association with the company. Companies House have said that it is advisable to seek a letter of authority from the Police or other authorising body outlining why you require your personal information protected and submit this with your application form in order to assist with the application. They do say however, that evidence may not be required in all circumstances.
If applications are submitted before 30 June 2016, there is a transitional regime whereby if the application is unsuccessful, the individual has 12 weeks to cease being a PSC in order to ensure that their details will never be made available for public inspection.