German-British Chamber of Industry and Commerce breach the Companies Act 2006.
Response from Companies House and my reply.
Latest communication with Companies House relating to my compliance assessment of the German-British Chamber of Industry & Commerce and complaints to Companies House, which can be found at the following link:
Identity fraud underpins serious organised crime. The Cabinet Office and Government Digital Service Guidance on “How to prove and verify someone's identity” highlights the risks related to identity fraud, How to prove and verify someone's identity - GOV.UK (www.gov.uk).
Response from Companies House, Monday, October 14th 2024, 15:12.
Dear Alison Wright,
Thank you for your email. Further to the reply issued by the Technical Complaints Team, I am now responding on the element of your enquiry concerning how the individual's name appears when searched on the Companies House online service.
To briefly explain; our information processing system tries to determine whether multiple directorships relate to the same person by analysing the following details:
* The officer's full name
* Their date of birth
* Their usual residential address ('URA'), which is separately recorded to their correspondence/service address and is not displayed to the public.
Unless all the above information matches exactly, the appointments may appear on separate profiles on the Companies House website.
I note from the link you have provided in your enquiry that the individual's name appears three times when searched. The first result contains the details of current/resigned appointments. The second and third link to an appointment to a company which is now dissolved. When a company is dissolved, the details of its officers can no longer be updated. Therefore, if the registered details we hold for an individual's other appointments are subsequently updated, this can create different 'profiles' for them.
I hope this explanation is of use. Please contact me again if I can clarify further.
Kind regards,
Alan M
Customer Support
03031234500
Re: RE: Your Communication with Companies House, Ref: COH956408X
Dear Alan,
Thank you for your reply. As an IBM Systems Engineer I have expert knowledge of government systems, risk identification and management, I must express serious concerns about the weaknesses in Companies House’s deduplication process that I have brought to your attention. This issue has a profound affect on the legitimacy of audits, compromising our financial systems and the integrity of our governance structures.
Your acknowledgement that “our information processing system tries to determine whether multiple directorships relate to the same person” confirms that Companies House has a duty to associate multiple directorships to the same individual. This aligns with the requirement for a “single unique identifier” as described in Section 1082 of the Companies Act 2006. The term “profile” you’ve used is inaccurate and potentially misleading in this context.
Cybersecurity protocols mandate that system users have single unique identifier, and it is duty of the provider, in this case, the Companies House registrar, to provide a system that is cyber-secure according to zero-trust principles. Given that Companies House records are used by financial institutions and supply chains, the breach of individuals having multiple unique identifiers represents a high risk, potentially exposing the public to money laundering, terrorism financing and trafficking.
Effective deduplication systems typically begin with the name and date of birth. The registration form requires individuals to provide “Former name(s) Please provide any previous names (including maiden or married names) which have been used for business purposes in the last 20 years”. This information, combined with the date of birth, should be sufficient information to associate a new registration with an existing unique identifier. It should not be dependent of the usual residential address being presented in exactly the same format. If it is, this represents a significant design flaw.
The incidence of two different individuals having the same name and date of birth, and registering a business, is statistically very low. The default should be to assume they are the same individual if the name and date of birth match, with a process to rectify any rare instances of error for those with common names.
This issue is critical because interests held under one identity are concealed from anyone examining interests held in another unique identifier. The term “unique” explicitly indicates that there should be only one. Your use of the word “profile” is misleading and suggests an attempt to provide excuses rather than address the fundamental issue at hand.
The ability for individuals to have multiple identities within the Companies House system undermines the principle of a single unique identifier, which is crucial for maintaining data integrity and preventing fraud. The risk to the public increases further when the individual with multiple unique identifiers are politically sensitive individuals and further still when they are also associated with:
Dissolved Companies with Overdue Accounts: This pattern can be a red flag for potential financial mismanagement or deliberate attempts to obscure financial activities.
Similar Company Names: The existence of multiple companies with very similar names can facilitate clone company fraud, where fraudsters impersonate legitimate businesses.
The combination of these factors creates an environment where synthetic identity fraud becomes easier to perpetrate. These issues collectively suggest that the Companies House system has vulnerabilities that could be exploited for fraudulent activities. The fact that fraud is the most frequent crime in the UK could indeed be partly attributed to these systemic weaknesses in company registration and oversight.
These issues point to potential gaps in regulatory oversight and the need for more robust verification processes. Ultimately, these vulnerabilities put the public at risk of various forms of financial fraud and misconduct.
These observations underscore the urgent need for reforms in the Companies House system to enhance data integrity, improve verification processes, and strengthen measures against fraud. It's a systemic issue that requires comprehensive solutions to protect public interests and maintain the integrity of the UK's business ecosystem.
Based on my extensive research and reporting, I can provide quantitative data that illustrates the scale of the problem with multiple identities in the Companies House system: Since January 2022, I've published over 100 reports on establishment individuals and boards, garnering approximately 6,000+ total views.
These reports, published regularly with multiple entries each month, cover a wide range of high-profile figures, government agencies, charitable foundations, and corporate entities. With an average open rate of 35-40%, some reports have received over 300 views, with one reaching over 1,000 views. My work consistently focuses on issues of multiple identities in Companies House records and undeclared interests, demonstrating a pattern of investigating corporate governance and compliance issues across numerous cases. Despite the sensitive nature of my findings, I've received no complaints or challenges, suggesting tacit acknowledgment of my work's accuracy and importance in highlighting this systemic issue.
Based on the issues identified with the Companies House system, I present the following specific recommendations to address the problem of multiple identities and improve the overall integrity of the system:
Education and Training:
Develop comprehensive training programs for auditors and KYC (Know Your Customer) professionals on the issue of multiple identities and synthetic identity fraud.
Create awareness campaigns for company directors and secretaries about the importance of maintaining a single unique identifier.
Improved Deduplication System:
Implement a robust tracking system for deduplication that maintains a record of merged identities.
When identities are consolidated, ensure that the individual's record captures the fact that they've been de-duplicated, including timestamps and reasons for the merge.
Deduplication Amnesty Period:
Establish a defined amnesty period (e.g., 6 months) during which individuals can notify Companies House of the need for deduplication without penalties.
After this period, implement stricter enforcement and potential fines for maintaining multiple identities.
Auditor Obligations:
Require auditors to check for multiple identities as part of their standard due diligence process.
Include this check in the audit report and make it a mandatory disclosure.
Investigation Triggers:
Automatically flag for investigation instances where an individual has multiple identities and is associated with dissolved companies with overdue accounts.
Similarly, flag cases where an individual is associated with multiple companies with very similar names.
Government Grant Recipients:
Prioritize investigations for companies that have received government grants to ensure proper use of public funds.
Enhanced Verification Process:
Implement a more stringent identity verification process for new company registrations and director appointments, possibly including biometric data.
Regular System Audits:
Conduct regular audits of the Companies House database to identify potential duplicate identities and other anomalies.
Cross-Reference with Other Databases:
Establish data-sharing agreements with other government agencies to cross-reference identities and detect inconsistencies.
Penalties for Non-Compliance:
Introduce clear penalties for individuals who knowingly maintain multiple identities or fail to update their information.
Public Reporting Mechanism:
Create a secure, anonymous reporting system for the public to flag potential cases of multiple identities or other irregularities.
Blockchain Integration:
Consider implementing blockchain technology to create immutable records of identity changes and merges, enhancing transparency and traceability.
AI-Powered Detection:
Develop and deploy AI algorithms to continuously scan the database for potential duplicate identities and suspicious patterns.
Mandatory Annual Confirmation:
Require all registered individuals to annually confirm their identity details and explicitly state they have no other identities in the system.
Collaboration with Financial Institutions:
Work closely with banks and other financial institutions to share best practices in identity verification and fraud detection.
These recommendations aim to address the systemic issues within Companies House, enhance the integrity of the database, and reduce the risk of fraud and misrepresentation. Implementation would require careful planning and potentially legislative changes, but could significantly improve the reliability and usefulness of the Companies House system.
Furthermore, this systemic issue appears to be in direct conflict with Companies House's legal obligations under the Companies Act 2006, particularly:
Section 1082, which requires a single unique identifier for individuals. The prevalence of multiple identities for the same individual contradicts this requirement.
Section 853A, which mandates the registrar to keep a register of people with significant control. The current system's inability to consistently link multiple identities compromises the integrity of this register.
Section 1063, which requires the registrar to keep the register properly indexed. The existence of multiple identities for the same individual suggests that the indexing system is not functioning as intended by the Act.
Section 1087, which governs the material available for public inspection. The current system's shortcomings may be leading to incomplete or misleading information being available to the public, potentially violating this section.
Section 1063A, which requires the registrar to take reasonable steps to prevent falsification of the register. The ease with which multiple identities can be created and maintained could be seen as a failure to fulfil this obligation.
Given these legal requirements and the evidence of systemic issues, it is not only reasonable but arguably necessary for Companies House to seek judicial consideration of its current practices relating to single unique identifiers. This would ensure that Companies House is fulfilling its statutory obligations and maintaining the integrity of the register as intended by the Companies Act 2006.
Addressing these issues is crucial for maintaining public trust, supporting anti-money laundering efforts, and ensuring the UK's compliance with international standards for corporate transparency and governance.
Sincerely,
Alison Wright
great work as ever Alison thanks