Companies House Authentication Code Explained

🔍 Understanding the Authentication Code

Think of your Companies House authentication code as the digital equivalent of a director's signature. In the past, every document submitted to the Registrar of Companies required a physical "wet ink" signature. However, as the UK moves toward a "digital-first" filing system, the authentication code has become the primary method for verifying that a filing is legitimate and authorized by the company officers.

The Role of the Code in Digital Filing

When you log in to the Companies House WebFiling portal, the system needs to know that you have the authority to make changes to a specific company's record. Without this code, anyone with a WebFiling account could theoretically change your company's directors, registered office address, or share structure. The code acts as the ultimate gatekeeper for your company's public record.

How the Code Differs from Your Company Number

It is a common mistake for new business owners to confuse their Company Registration Number (CRN) with their authentication code. While your CRN is public information displayed on the public register, your authentication code must remain strictly confidential. If the CRN is your company's "username," the authentication code is its "password."

• Unique Identity: Every company has its own specific code; it is not tied to the individual director.
• Alphanumeric Format: The code consists of six characters (e.g., A1B2C3).
• Confidentiality: Only trusted individuals should have access to this code to prevent corporate identity theft.

🎯 How to Obtain Your Authentication Code

The process of obtaining your code depends on whether you have just formed your company or if you are an established business that has lost its original credentials. Because of the high security risks associated with unauthorized filings, Companies House is very specific about how these codes are distributed.

New Company Formations

If you use a professional service like Formation Direct to register your company, your authentication code is usually generated during the incorporation process. For those who register directly with Companies House, the code is typically sent via post to the company's registered office address within five working days of incorporation. This ensures that only someone with access to the company’s official premises can receive it.

Requesting a Code for an Existing Company

If you have an existing company but do not have a code, you can request one through the Companies House website. You will need to provide the company's registration number and an email address. However, note that the code itself will never be emailed to you. It is always sent by physical mail to the registered office address on file to prevent hacking attempts.

• Delivery Time: Allow 3 to 5 working days for the letter to arrive by post.
• Address Verification: Ensure your registered office address is up to date before requesting a code.
• Multiple Codes: A company can only have one active authentication code at a time; requesting a new one cancels the old one.

🛡️ Why the Authentication Code is Vital for Security

Corporate identity theft is a growing concern in the UK. Fraudsters often attempt to hijack companies by changing the registered office address to a location they control, then appointing themselves as directors to take out loans or purchase goods in the company’s name. The authentication code is your primary defense against these attacks.

Preventing Unauthorized Changes

Without the code, a fraudster cannot easily change your company details online. This is why Companies House insists on sending the code via post. This "physical link" ensures that the person requesting the code has a legitimate connection to the business location. It is a simple but effective method of multi-factor authentication.

The Risks of Sharing Your Code

While you may need to share your code with your accountant or a formations agent to handle your statutory filings, you should be extremely cautious. Only share the code with regulated professionals. If an employee who had the code leaves the company on bad terms, it is standard practice to change the code immediately to protect the company's integrity.

• Accountant Access: Your accountant needs the code to file your annual accounts and tax returns.
• Internal Records: Keep a secure record of the code in a password manager or a locked physical file.
• Regular Updates: Consider changing your code annually as part of your internal security audit.

⚠️ Lost or Expired Authentication Codes

It is a common scenario: you realize your Confirmation Statement is due tomorrow, but you can’t find your authentication code. Because the code is sent by post, a lost code can lead to significant delays and potential late-filing penalties if not addressed quickly.

How to Reset Your Code

If you lose your code or suspect it has been compromised, you must log in to your WebFiling account and select the option to "Request an authentication code." You will then choose the option to "Change" or "Request a reminder." To ensure security, Companies House will void the previous code and issue a brand-new one via the post. There is no "instant" way to recover a code online.

Filing Deadlines and Delays

The biggest risk of a lost code is missing your filing deadlines. Companies House does not typically accept "I lost my code" as a valid excuse for the late filing of accounts. If your accounts are late, you may face automatic financial penalties starting at £150 and rising to £1,500 depending on the length of the delay.

• Plan Ahead: Check that you have your code at least two weeks before any filing deadline.
• Expiry: Codes do not technically expire, but they are replaced whenever a new one is requested.
• Change of Address: If you move your registered office, remember that the code will still be sent to the old address until the change is processed.

📋 Managing Your Code: Best Practices

Effective corporate governance involves managing your digital credentials as carefully as your physical assets. By following these best practices, you can simplify your administrative tasks and enhance your company’s security profile.

Assigning a "Gatekeeper"

In a company with multiple directors, it is often wise to designate one person (or your professional company secretary) as the gatekeeper of the authentication code. This prevents confusion over where the code is stored and ensures that filings are not duplicated or contradictory.

Integrating with Third-Party Software

Many businesses now use cloud accounting or secretarial software to manage their confirmation statements. These platforms will require your authentication code to connect directly to the Companies House API. Always ensure that the software you use is reputable and employs high-level encryption to store your sensitive data.

• Audit Log: Keep a log of who has been given the code and for what purpose.
• Instant Revocation: If a service provider's contract ends, change the code immediately.
• Digital Hygiene: Never store the code in an unencrypted spreadsheet or a sticky note on a computer monitor.

⚡ Action Steps for Company Directors

To ensure your company remains in good standing and secure from unauthorized changes, take these immediate actions regarding your Companies House authentication code:

• Locate Your Code: Confirm that you currently have your 6-character code accessible.
• Test Your Login: Log in to the Companies House WebFiling service to ensure the code works.
• Verify Your Address: Check that your registered office address is current so that future code reminders reach you.
• Update if Necessary: If you suspect the code is known by former employees, request a new one today.

Ready to Launch Your New Limited Company?

Formation Direct Ltd offers fast, compliant UK company registration — helping entrepreneurs and business owners get their Limited Company set up correctly from day one. View our Formation Packages and get officially registered in as little as 3 working hours.