Companies House authentication codes: access, security and recovery

Identify which credential the filing actually needs

The company authentication code is issued for the company and acts as the electronic equivalent of an officer’s signature for supported filings. A Companies House personal code belongs to a verified individual and links their identity to relevant roles. Account login credentials identify the user signing into a service. These items have different purposes and are not interchangeable.

HMRC access and the company’s tax references are separate again. A formation agent may deliver several documents and numbers after registration; label them securely rather than pasting everything into a shared spreadsheet. Never publish filing codes with incorporation documents or email them to a contact whose authority has not been checked.

Request access through official channels

Use the official Companies House service to request a code or reminder. The normal delivery route is postal delivery to the registered office, and it can take up to 10 working days. The service does not normally disclose the code over a phone call or ordinary email. Keep the registered office reachable so a legitimate recovery letter can be received securely.

If the registered office cannot be accessed, check the official alternative process, including available delivery to an eligible officer’s home address. Do not improvise by changing the office to an address you have no right to use. Start recovery well before an accounts or confirmation statement deadline and verify the current service requirements.

1. 1

   Confirm the company number from the public register.

2. 2

   Check whether an authorised current officer or adviser already holds the code.

3. 3

   Request recovery using the official service.

4. 4

   Arrange secure receipt of post at the appropriate address.

5. 5

   Store the recovered code in a controlled password manager.

6. 6

   Test filing access early and record who is authorised to use it.

Share only with people who need filing authority

An accountant or formation service may need access to make agreed filings. Confirm the scope of engagement and how credentials are stored. Sharing the code does not make the agent responsible for every filing decision or relieve directors of their duties. Ask to approve material changes before submission, and keep filing receipts.

Use individual logins where supported and restrict who can retrieve the company code. A password manager with role-based access is usually safer than an email chain or printed sheet at a shared desk. Avoid guessable replacement codes and review access when directors, staff or advisers change. The security process should survive the departure of the person who originally formed the company.

• List authorised filers and the documents they may submit.
• Store the code separately from public company documents.
• Verify unusual change instructions through a trusted channel.
• Keep submission and acceptance evidence.
• Review access after every role or adviser change.

Change access when the relationship ends

If a departing accountant, director or employee no longer needs the code, review and change it through the supported official process. Tell the remaining authorised filers securely so legitimate work is not interrupted. Removing someone from a staff email group does not remove their knowledge of a shared credential.

A handover should include current filing status, upcoming deadlines, statutory records and confirmation of the new access arrangements. Keep a record of which submissions were made before and after the handover. If an outgoing agent also supplies the registered office, arrange the office transition and mail access before cancelling everything at once.

Respond to suspicious changes promptly

Monitor the company’s public record and use available Companies House notifications or protected-filing services where appropriate. If you see an unexpected appointment, address change or other filing, check the submitted document and contact Companies House through official guidance. Secure relevant accounts and change compromised filing access without destroying evidence.

A suspicious filing may have consequences beyond the register, particularly for banking and legal service. Inform affected providers if necessary and consider legal advice. Avoid accusing a former adviser without evidence; an error and deliberate misuse require different responses, but both need a corrected record and stronger access controls.

Worth knowing: Recovery is only part of the job: identify how access or instructions failed and prevent the same problem recurring.

Worked scenario: an accountant handover before a deadline

Illustrative scenario: a founder changes accountants six weeks before the confirmation statement is due. The old accountant holds the authentication code, while the founder has only their personal verification code. The founder confirms the difference, requests or recovers the company code through the official route and appoints the new accountant with a clear filing brief.

Before the handover closes, the founder reviews the latest accounts, pending changes, PSC information and official mail access. The company code is changed where appropriate and the new accountant confirms access in advance of the deadline. Waiting until the due date to discover the wrong code would have created an avoidable filing problem.

Build a controlled access and recovery plan

A small company should identify which credentials are actually needed for each filing task. The company authentication code, a person’s verification code, an account login and an HMRC tax reference are different things. The director labels them in secure storage without putting them in a public document folder. They decide who can file accounts, make appointments or submit address changes, and who approves those instructions. Sharing a company code with an adviser gives practical access; it does not make every future filing authorised or transfer directors’ legal responsibilities.

The director checks the registered office and recovery process before an urgent filing is needed. If the code is missing, they request it through the official service and arrange secure receipt of the postal response. They use the current guidance for alternatives where the ordinary office route cannot be accessed. They do not respond to an unsolicited email asking them to reveal the code, and they verify suspicious support requests through a known official channel. A recovery letter takes time, so the filing plan includes a reasonable buffer rather than requesting access on the deadline itself.

When an accountant or staff member leaves, the company reviews authority, shared credentials and recovery email access. It changes the company code where appropriate and supplies the new one only to current authorised filers. The outgoing adviser provides filings, acceptance receipts and pending tasks without retaining unnecessary ongoing access. The company checks any relationship between accounting services and an address subscription before ending both. A backup responsible person can recover access during travel or illness, but the backup arrangement should not mean every employee receives unrestricted credentials.

The directors periodically compare filings with the decisions they approved. They use available notifications and monitoring features where suitable and investigate unexpected changes promptly. If a suspicious filing occurs, they preserve evidence, secure accounts and follow the official correction or dispute process. They consider whether banking or contractual records were also affected. A strong code alone is not enough if the organisation accepts false instructions or never reviews the register. Security combines controlled access, verified instructions, timely recovery and a clear record of what was approved and accepted.

Make security a recurring director responsibility

Review credentials alongside the company’s annual compliance check, and immediately after changes in staff or advisers. Confirm the registered office, registered email and recovery methods remain controlled. Maintain a backup authorised person so illness or travel does not block a time-sensitive filing.

A secure credential is not enough if inaccurate changes are approved. Require a second check for important filings such as director appointments, office moves and share information, and reconcile accepted filings with statutory records. The aim is both safe access and accurate company information.

Common questions

Official sources & further reading

This guide draws on the official guidance below. Rules, fees and individual circumstances can change; check the relevant source before acting.

• Companies House: Authentication code guidance
• Companies House: Protect your authentication code
• Companies House: Verify your identity

General UK information, primarily for private companies limited by shares. This is not personalised legal, tax or financial advice. An accountant or solicitor can help apply the rules to your situation.