For the 2026/27 tax year, the ID verification process across UK tax and corporate systems demands strict adherence to new digital-first legislative frameworks. HMRC and Companies House have significantly enhanced their statutory powers to confirm taxpayer and director identities, integrating biometric data, mandatory digital contact details, and authorised third-party checks.
Statutory Digital Contact Requirements
The government has aggressively shifted towards a ‘digital by default’ communication model following the enactment of the Finance Bill 2025-26. Section 261 of the Finance Act 2026 empowers HMRC to mandate that persons using their online services provide specified digital contact details, primarily an email address or mobile telephone number.
HMRC uses these details to notify customers of new correspondence across all tax services. If a taxpayer fails to provide or maintain valid digital contact details, HMRC restricts them from completing the relevant online service and can impose a penalty of up to £1,000.
“The Commissioners may by regulations require persons who use an online service provided by HMRC… to provide specified digital contact details… [and] provide for a failure to comply with a requirement by virtue of this section to attract a penalty of a specified amount not exceeding £1,000.”
Furthermore, section 182 of the Finance Act 2026 grants HMRC officers the power to issue information notices specifically to obtain identifying information (name, last known address, and date of birth) to uncover the identity of an “unidentified connected person” during an investigation.
MTD ITSA Biometric and Data-Driven Verification
With Making Tax Digital for Income Tax Self Assessment (MTD ITSA) mandated from 6 April 2026 for those earning over £50,000, HMRC has upgraded its ID verification process for digital onboarding. Taxpayers signing up for the service via their Government Gateway account must satisfy enhanced proof of identity checks.
HMRC utilises two primary verification pathways for this service:
- Biometric Matching: Taxpayers use a mobile application to capture a “selfie” and match their facial biometrics directly to a valid passport or driving licence.
- Data Verification: Taxpayers answer targeted security questions based on granular data HMRC already holds about them, such as details from a recent P60, payslip, credit reference file, or prior Self Assessment return.
When a user creates or accesses their Government Gateway account, HMRC systems record a series of events, securely logging the user’s Internet Protocol (IP) address alongside the metadata of their interaction.
Corporate Filings: Companies Act 2006 Identity Rules
The ID verification process extends heavily into corporate governance under the updated Companies Act 2006 (CA 2006). Section 1067A of CA 2006 strictly prohibits an individual from delivering a document to the Registrar (Companies House) unless their identity is formally verified.
If the Registrar receives a notification that a person has become a registrable person (such as a Person with Significant Control), section 790LM of CA 2006 dictates that the Registrar must direct that person to deliver a verification statement within 14 days.
An individual’s identity is legally “verified” under section 1110A of CA 2006 only if confirmed directly by the Registrar or by an Authorised Corporate Service Provider (ACSP). The ACSP must deliver a verification statement confirming they have verified the individual’s identity in accordance with the Money Laundering Regulations and must specify their anti-money laundering supervisory authority.
Table: Key ID Verification Mechanisms for 2026/27
| Service / Regime | Primary Verification Method | Relevant Legislation / Guidance |
|---|---|---|
| MTD for Income Tax | Mobile app selfie match or data Q&A | HMRC MTD Guidance |
| Companies House Filings | Registrar check or ACSP verification | s 1067A & s 1110A CA 2006 |
| HMRC Online Services | Mandatory digital contact (email/mobile) | s 261 FA 2026 |
| Agent Repayment Claims | Advanced Electronic Signature (AES) | Agent Update 138 / HMRC Manual |
Advanced Electronic Signatures for Tax Agents
Agents processing specific tax claims face strict ID verification process requirements. From 6 April 2025, HMRC mandates that tax agents must use an Advanced Electronic Signature (AES) process when submitting client nominations for Income Tax repayments using P87, R40, and Marriage Allowance forms. This replaces older, less secure authorization methods, placing the burden on the agent to ensure the cryptographic identity of the signing taxpayer.
When agents contact HMRC by telephone, HMRC enforces compulsory verification checks. The HMRC operative must establish that the caller is who they claim to be, clearly identify the specific client they represent, and confirm that a valid 64-8 authorization is registered on the system.
Telephone Verification and Voice ID
For taxpayers interacting with HMRC over the phone, HMRC deploys its Intelligent Telephony Automation (ITA) system. This system uses sophisticated speech recognition technology, known as Voice ID, as a primary ID verification process.
Voice ID measures over 100 distinct characteristics to compare a customer’s enrolled voiceprint against the vocal password spoken during the call. If the system registers a match, the taxpayer automatically passes security without needing to answer traditional data-based security questions. While highly secure, this biometric feature currently supports direct taxpayers across specific business lines (like Self Assessment and Tax Credits) but is not deployed for third-party agent verification.
Consider reviewing the specific record-keeping requirements imposed on Authorised Corporate Service Providers (ACSPs) under section 1110B of the Companies Act 2006 to ensure compliance when verifying client identities for the Registrar.
Join 5,000+ businesses comparing today