---
title: "Get ECCTA identity verification compliance snapshot"
method: GET
path: "/v1/company/{company_number}/compliance"
tags: ["Compliance"]
---

# Get ECCTA identity verification compliance snapshot

`GET /v1/company/{company_number}/compliance`

## Request

- Base URL: `https://api.registrum.co.uk`
- URL: `https://api.registrum.co.uk/v1/company/{company_number}/compliance`
- Auth: API key in header `X-API-Key`

ECCTA identity verification compliance snapshot for a company.

Returns a verification health report for all current directors and active
individual PSCs under the Economic Crime and Corporate Transparency Act 2023.
Mandatory identity verification was introduced in November 2025, with enforcement
beginning 18 November 2026.

**Fields:**

- `directors_total` / `pscs_total` - count of persons ECCTA identity verification
  actually applies to: current (non-resigned) directors minus corporate officers
  and secretaries, and active individual PSCs minus corporate/legal-person PSCs.
  **Not the board size.** It is smaller than `/company/{number}/directors`'
  `total_current`, which counts every current officer including secretaries and
  corporate officers.
- `directors_verified` / `pscs_verified` - count Companies House's public register
  shows as verified: either an `identity_verified_on` date (verified through an
  ACSP) or an open-ended verification window (verified directly with Companies
  House, which publishes no date).
- `directors_pending` / `pscs_pending` - count with a verification deadline that has
  NOT yet passed. Nothing has been missed; during the Nov 2025 - Nov 2026 transition
  this is the majority state for UK directors.
- `directors_overdue` / `pscs_overdue` - count whose deadline has passed with no
  verification recorded.
- `directors_unknown` / `pscs_unknown` - count where `identity_verification_details`
  is entirely absent from the CH API response (pre-ECCTA data, not evidence of
  non-compliance).
- `directors_unverified` / `pscs_unverified` - **deprecated aliases**, kept only for
  backwards compatibility. They now mean exactly `overdue` (CH-Api#52, fixed
  2026-07-30); before that fix they also counted `pending` people, which branded
  roughly 70% of UK directors non-compliant during the transition. Use
  `directors_pending`/`directors_overdue` (or the PSC equivalents) instead.
- `verification_rate` - `verified / (verified + pending + overdue)`, **directors and
  PSCs combined into one figure**. Unknowns are excluded from both the numerator and
  the denominator. `0.0` when nobody is verified, pending or overdue.
- `verification_risk` - `compliant` | `pending` | `partial` | `high_risk` |
  `unknown`. A future deadline is deliberately not treated as risk on its own
  (`pending`); only a passed deadline with no verification drives `high_risk`.
- `risk_score` - `1.0 - verification_rate`, or `null` when no person has a known
  status (verified, pending or overdue) - i.e. everyone is `unknown`.
- `unverified_persons` - every director/PSC who is `pending` **or** `overdue` (both,
  not overdue-only), each carrying its own `status` (`pending` | `overdue`) and
  `deadline`. **Read `status` before describing anyone here as non-compliant** - a
  `pending` entry has missed nothing. `deadline` may be `null` (an open-ended
  verification window with no printable date); never substitute a fallback date for
  a null one. **This list is longer than the `*_unverified` counts by design**: the
  deprecated aliases count `overdue` only, this list carries `pending` too -
  comparing `len(unverified_persons)` to `directors_unverified + pscs_unverified`
  and expecting them to match is the mistake to avoid.
- `eccta_enforcement_deadline` - 2026-11-18

Corporate entity and legal person PSCs are exempt from individual verification and
are excluded from all counts.

**Plan gating:** Pro or Enterprise only. Free and Web plan requests return 403.

**Cache:** 30-day TTL. Officers and PSC are fetched concurrently.

**Credits:** 1 credit per call.

**Example:** `/v1/company/00445790/compliance`

## Path parameters

- `company_number` string, required: Companies House company number (e.g. `00445790` for Tesco PLC). Numeric-only numbers are zero-padded.

## Response `200`

Compliance snapshot returned successfully

- ComplianceEnvelope: Response envelope for GET /v1/company/{company_number}/compliance.
  - `status` string: 'success' or 'error'
  - `data` ComplianceResponse: ECCTA identity verification health snapshot for a company.
    - `company_number` string, required: 8-character Companies House number
    - `directors_total` integer: Current, in-scope directors: resigned officers are excluded, AND so are corporate officers and secretaries, who are outside ECCTA identity verification (requires_identity_verification()). This is NOT the board size and does NOT equal /company/{number}/directors' `total_current`, which counts every current officer including secretaries and corporate officers.
    - `directors_verified` integer: Current directors with a confirmed ECCTA identity_verified_on date.
    - `directors_pending` integer: Current directors with a Companies House verification deadline that has NOT yet passed. They have missed nothing. During the Nov 2025 - Nov 2026 ECCTA transition this is the majority state for UK directors.
    - `directors_overdue` integer: Current directors whose verification deadline has passed with no verification recorded.
    - `directors_unverified` integer: DEPRECATED alias of `directors_overdue`, kept for backwards compatibility. It previously also counted directors with a future deadline, which mislabelled roughly 70% of officers as non-compliant (CH-Api#52). Use `directors_pending` and `directors_overdue`.
    - `directors_unknown` integer: Current directors where identity_verification_details is absent from the CH API response.
    - `pscs_total` integer: Active individual PSCs (corporate entities and legal persons are exempt from ECCTA IV).
    - `pscs_verified` integer: Active individual PSCs with a confirmed ECCTA identity_verified_on date.
    - `pscs_pending` integer: Active individual PSCs whose verification deadline has NOT yet passed.
    - `pscs_overdue` integer: Active individual PSCs whose verification deadline has passed with no verification recorded.
    - `pscs_unverified` integer: DEPRECATED alias of `pscs_overdue`, kept for backwards compatibility. See `directors_unverified`.
    - `pscs_unknown` integer: Active individual PSCs where identity_verification_details is absent.
    - `verification_rate` number: verified / (verified + pending + overdue), with directors and individual PSCs combined into one figure (not reported separately). Unknown persons are excluded from both the numerator and the denominator. Returns 0.0 when nobody is verified, pending or overdue.
    - `verification_risk` string, required: 'compliant' - all persons verified; 'partial' - some verified, some not; 'pending' - nobody verified yet but NO deadline has passed, so nothing is wrong; 'high_risk' - at least one person's deadline has passed with no verification; 'unknown' - no identity_verification_details on any person. A future deadline is deliberately NOT a risk: during the ECCTA transition most UK directors legitimately have one, and treating that as risk brands almost the whole register high_risk (CH-Api#52).
    - `unverified_persons` UnverifiedPerson[]: Every director/PSC whose status is 'pending' OR 'overdue' - see UnverifiedPerson.status. This is deliberately longer than directors_unverified + pscs_unverified, which count 'overdue' only; do not expect the two to match. Persons with an unknown status (no identity_verification_details on record) are excluded from this list.
      - `name` string, required: Full name as registered at Companies House
      - `role` string, required: Officer role (e.g. 'director') or 'individual' for PSCs
      - `kind` string, required: 'director' or 'psc'
      - `status` string: 'pending' - Companies House shows a verification deadline that has NOT yet passed; 'overdue' - the deadline has passed with no verification recorded.
      - `deadline` string, nullable: The person's own verification deadline from Companies House (appointment_verification_end_on, else appointment_verification_statement_due_on). This is authoritative and per-person - prefer it over any deadline computed from the company's confirmation-statement date.
    - `eccta_enforcement_deadline` string: The ECCTA identity verification enforcement deadline: 18 November 2026.
    - `risk_score` number, nullable: Numeric risk score from 0.0 (fully compliant) to 1.0 (fully non-compliant). Computed as 1.0 - verification_rate when at least one person's status is known. null when all persons have no identity_verification_details field (status unknown).
  - `cached` boolean: True if this response was served from cache rather than fetched live
  - `cache_age_seconds` integer, nullable: How many seconds ago this data was fetched from Companies House (null if not cached)
  - `fetched_at` string, nullable: ISO 8601 instant (UTC) when this data was actually fetched from Companies House. Use this, not cache_age_seconds, to show a user when the data was last checked: an age is measured at the moment this response was produced, so anything that caches the response downstream will overstate freshness by however long it held it. This instant does not drift. Null when unknown - render nothing rather than a guessed date.
  - `data_source` string: 'live' - fetched from Companies House right now; 'cached' - served from local cache (data is recent, no upstream call needed); 'cached_rate_conserved' - served from cache because the CH API budget is above 70% utilisation; data may be up to 30 days old in this state
  - `credits_used` integer: Number of API credits consumed by this request
  - `credits_remaining` integer, nullable: API credits remaining this month (null in dev mode)

## Other responses

- `400`: Invalid company number format, or the company number is empty (blank path segment)
- `401`: Missing or invalid API key
- `403`: Pro or Enterprise plan required
- `404`: Company not found at Companies House
- `422`: Validation Error
- `502`: Companies House API is temporarily unavailable
- `503`: Request shed to protect shared Companies House capacity; retry after the seconds given in the Retry-After header

---

[API](https://skmtc.dev/registrum/apis/registrum-api.md) · [All operations](https://skmtc.dev/registrum/apis/registrum-api/llms.txt) · [OpenAPI document](https://skmtc.dev/registrum/apis/registrum-api/revisions/2bf0ecf7cc02?raw)