How to use your Companies House personal code

The personal code is the piece of Companies House identity verification that most people underestimate. You finish the verification, an email arrives, and inside it is a short string like XKJ4-••••-2223. That code is not a receipt. It is the piece of infrastructure that connects your verified identity to every company role you hold, and how you use it matters.

This guide is about the practical side: what the code is, where you actually type it, who you should and should not give it to, and what to do when something goes wrong.

What the code represents

Companies House does not store your passport image forever. Once your identity is verified, it stores a confirmation that the check happened and issues you a code. When you use that code on a future filing, you are effectively saying: “the check on file for this code is me, and it applies to this action”.

The code is unique to you, not to any one company. If you are a director of three companies, the same code works for all three. If you resign one directorship and take on a new one, the same code follows you across. You do not verify again unless the underlying identity has changed - a new legal name, for example.

Where you actually use it

You need the personal code whenever you take an action at Companies House that requires proof it is really you. In practice, that means:

• Filing a confirmation statement where you are listed as a director or PSC
• Appointing or removing yourself as a director of a company
• Updating your details on the PSC register
• Authorising an ACSP or accountant to file on your behalf
• Any filing that under ECCTA requires a verified individual behind it

You do not need it for everything. Reading the public register, buying a company report, or looking up another company’s accounts does not touch your code. It is only invoked when the register itself is being changed and Companies House needs to confirm who is doing the changing.

The rule for sharing it

Your personal code is more sensitive than most people initially treat it as. It is not a password, but it functions like one when combined with your Companies House login. If someone has your code and access to a filing route in your name, they can, in principle, make filings against your identity.

The rule is: give your code only to people who need it to file on your behalf, and only to organisations you would trust with a signed letter of authority. Your accountant, your company secretary, an ACSP you have engaged. Never a stranger who asks for it “to complete your record”. Companies House does not cold-call anyone about their personal code.

Storing it safely

Treat it the way you would treat a UTR or National Insurance number. That means:

• Save it in a password manager under your Companies House record, not in a plain document called “codes”
• Do not store it in the body of an email - if the email account is ever compromised, the code goes with it
• If you have to send it to an accountant, use a secure client portal rather than a chat app or plain-text email where possible
• Keep a printed copy somewhere physically secure if you are the kind of person who forgets password-manager master keys

People who work in regulated fields - solicitors, accountants, compliance officers - already have habits for this kind of secret. If you do not, adopt those habits. The code protects your identity on a public register that lenders, banks and prospective business partners actually look at.

What to do if the code is lost or exposed

A lost code is inconvenient but recoverable. Companies House has a reissue process - it will require you to re-authenticate, but it does not restart the identity verification itself. You keep your verified status; only the code changes.

A code you suspect is compromised - shared with someone you no longer trust, sent by mistake to the wrong email, exposed in a data breach - should be reported and reissued immediately. Any filing made against the old code before you report the compromise is legally treated as your action; after you report it, the old code is invalid and cannot be used.

If you work with a filing agent

Most directors use an accountant or company secretary to file. That relationship still works under the new regime, but the filing agent needs your personal code to submit anything on your behalf. What you should look for from a competent agent:

• A written agreement or letter of engagement that includes handling your personal code
• A secure way to transfer the code to them - a client portal, encrypted email, or a document exchange
• A confirmation email from Companies House every time your code is used on a filing, so you have an audit trail
• A clear process for reissuing the code if the agent’s systems are ever compromised

A firm that shrugs at any of this is not a firm you want holding your Companies House credentials. Ask the questions before you hand the code over, not after.