How to Check a UK Company: 14 Official Sources and Which Have an API
How to check a UK company: Companies House API, HMRC VAT check API, UK Sanctions List, FCA register and more, with rate limits and an onboarding sequence.
Luka Abramovic21 min read
If your supplier screening still downloads OFSI's Consolidated List, it has been checking against a closed list since 28 January 2026. The UK Sanctions List is now the only source for UK sanctions designations (GOV.UK). The list also misses companies that are frozen without being named, because an asset freeze extends to entities a designated person owns or controls, including through more than 50% of the shares or votes. To check a UK company properly, screen its people with significant control against the list too, using the ownership and control data Companies House already publishes for them.
Below are 14 official UK sources for checking a supplier or customer: what each proves, what it doesn't, how a system reaches it and how to use it in onboarding. Access rules and limits are as of September 2026. This is a practical summary, not legal advice. For sanctions obligations, OFSI's general guidance is the authority.
The 14 sources at a glance
Apply for HMRC access first, because it's the slow one. HMRC says registering for its VAT-check API takes around two weeks, and production credentials come only after you've tested in its sandbox and accepted its terms of use (HMRC's published API definition). Companies House (via its developer hub), the FCA and the Charity Commission issue keys through developer-portal sign-ups, and OSCR's API is by request. The rest are open APIs, public files or web searches.
| Source | What it proves | What it does not prove | How a system reaches it |
|---|---|---|---|
| 1. Companies House register | The company exists, with its status, registered office, filing deadlines, officers, people with significant control (PSCs), charges and insolvency cases | That it trades or can pay, or employs the person emailing you | API key, 600 requests per 5 minutes; a Streaming API; bulk files |
| 2. Disqualified directors register (Companies House) | A person is disqualified from acting as a director, by court order, undertaking or sanctions designation | That a matching name is the same person | The same API and key |
| 3. HMRC Check a UK VAT number | The number is registered, with HMRC's name and address for it; the verified mode adds a consultation number as evidence | That the business invoicing you is the one registered | Registered application; OAuth 2.0 client credentials, scope read:vat; HMRC's standard 3 requests per second |
| 4. HMRC Check a UK EORI number | A GB EORI number is valid; name and address only if the business agreed to share them | Anything about XI numbers, which HMRC sends to the European Commission's checker | Open access, no credentials; up to 10 numbers per request |
| 5. UK Sanctions List (FCDO) | A person or entity is designated under UK sanctions | That an unlisted company is clear: entities a designated person owns or controls are frozen without being listed | Files in seven formats (ODT, ODS, XML, HTML, TXT, CSV, PDF) at static URLs; an online search |
| 6. The Gazette | An insolvency notice was published, such as a winding-up petition, a winding-up order or a bankruptcy order | That a company with no notice is solvent | Notices as data, via format-specific URLs or content negotiation |
| 7. Individual Insolvency Register (Insolvency Service, England and Wales) | An individual, such as a sole trader, has a current bankruptcy, individual voluntary arrangement (IVA) or debt relief order, or one that ended in the last three months | Older cases, which drop off three months after they end, or any case in Scotland or Northern Ireland | Web search by name |
| 8. Accountant in Bankruptcy Register of Insolvencies (Scotland) | An individual or business in Scotland is insolvent: sequestrations (Scottish bankruptcies), protected trust deeds, and insolvency documents that Scottish companies and LLPs must file with the AiB | Insolvency elsewhere in the UK | Web search |
| 9. FCA Financial Services Register | A firm's FCA status and permissions | That the firm contacting you is the firm on the register: anyone can quote a reference number | API key from the FCA's developer portal, currently free; 50 requests per 10 seconds; no service-level agreement |
| 10. FCA Mutuals Public Register | A mutual society is registered with the FCA, or used to be | FCA authorization, a separate function recorded on the Financial Services Register | Web search |
| 11. Charity Commission for England and Wales | A charity is on the Register of Charities for England and Wales | Registration in Scotland | Developer portal: subscribe to the Register of Charities product for a key; rate and quota limits may apply |
| 12. OSCR Scottish Charity Register | A charity is on the Scottish Charity Register | Registration in England and Wales | An API launched in beta in May 2023, on request and not for marketing; register downloads |
| 13. ICO register of fee payers | The organization has paid the data protection fee | That it handles personal data lawfully | Web search; a dataset download updated daily |
| 14. Confirmation of Payee (Pay.UK) | The name you entered matches, or nearly matches, the account name, and whether it's a business or personal account | That the account belongs to the supplier you think: it checks the name you type | Only through your bank or payment provider |
Companies House: status, people and control
Every other check keys off the company number, so normalize it first. It is eight characters: an optional two-letter prefix, then zero-padded digits. SC marks a Scottish company and NI a Northern Irish one. OC, SO and NC mark LLPs in England and Wales, Scotland and Northern Ireland, OE an overseas entity and FC an overseas company. No letters means a company in England and Wales. A spreadsheet that stores 01234567 as a number turns it into 1234567, which the API won't find. This pads numbers the way Companies House's own website code does (ch.gov.uk source):
import re
def company_number(raw):
s = re.sub(r"\s", "", str(raw)).upper()
m = re.fullmatch(r"([A-Z]{0,2})(\d+)", s)
if not m or len(s) > 8:
raise ValueError(f"not a company number: {raw!r}")
prefix, digits = m.groups()
return prefix + digits.zfill(8 - len(prefix))
def vat_number(raw):
s = re.sub(r"[\s.-]", "", str(raw)).upper().removeprefix("GB")
if not re.fullmatch(r"\d{9}|\d{12}", s):
raise ValueError(f"not a UK VAT number: {raw!r}")
return sThe same padding in a spreadsheet, for cleaning a supplier export:
=IF(A2 = "", "", LET(s, UPPER(SUBSTITUTE(A2, " ", "")),
p, IF(ISNUMBER(--LEFT(s, 1)), "", LEFT(s, 2)),
d, MID(s, LEN(p) + 1, 20),
p & REPT("0", 8 - LEN(p) - LEN(d)) & d))Then call the API. The key is the HTTP Basic username and the password is empty, which the colon after the key does in curl (authentication guide):
curl -u "$CH_API_KEY:" https://api.companieshouse.gov.uk/company/01234567The limit is 600 requests in five minutes, and exceeding it is expensive: every request for the rest of that window gets a 429 (rate limiting guide). An unpaced batch job spends its 600 in seconds, fails for minutes, and a naive retry loop turns the failures into another burst. Pace it just under two requests per second and it never trips.
The profile fields that decide pass, refer or stop
These fields come from Companies House's own enumerations, SDK and website code (api-enumerations, api-sdk-node, ch.gov.uk). The actions are our defaults.
| Field | Value | What it means | Our default |
|---|---|---|---|
company_status | dissolved, converted-closed, removed, closed | The entity no longer exists in that form | Stop |
company_status | liquidation, administration, receivership, voluntary-arrangement, insolvency-proceedings | A formal insolvency process is under way | Refer to credit or finance |
company_status_detail | active-proposal-to-strike-off | The status still says active, but the company is on its way off the register | Refer; no credit or prepayment |
corporate_annotation | Present | A registrar's warning, such as a strike-off under section 1002A because the incorporation application was misleading, false or deceptive | Refer |
registered_office_is_in_dispute | true | The registrar has replaced the registered office with the Companies House default address, which the company can only leave by paper form AD01 with evidence of its link to the new address | Refer |
undeliverable_registered_office_address | true | Companies House has had mail returned from the registered office | Refer |
accounts.overdue, confirmation_statement.overdue | true | A filing is late | Refer above a spend level you set |
has_insolvency_history | true | Read /company/{number}/insolvency for the case types and dates, such as petition and winding-up dates | Refer with the case list attached |
type, jurisdiction | A registered society type, or scotland | Another register holds part of the record (see the sector and insolvency sections) | Route to the extra check |
Officers: identity verification and disqualification
From 18 November 2025, directors and PSCs must verify their identity with Companies House. Existing directors confirm it with their next confirmation statement, during a 12-month transition, and each PSC has a 14-day window to provide their verification details (Companies House). In Companies House's own service code, officer and PSC responses carry an identity_verification_details object, with identity_verified_on once the person has verified and appointment_verification_statement_due_on for the date it's due (company-appointments API, PSC data API). Until that date, an unverified existing director is normal. Refer only when the due date has passed with no verification date. A rule that flags every unverified director fires on every supplier whose confirmation statement hasn't come round yet.
Verification proves a director is a real, identified person, not that they're allowed to be a director. That's the disqualification check. For each active director, search the disqualified officers register by name, then compare the month and year of birth from the officers list. A match on name and birth month and year goes to a person. It can also surface a sanctions designation: Companies House's disqualification types include one for people designated under the Sanctions and Anti-Money Laundering Act 2018 (disqualified_officer_descriptions.yml).
Both lists include history: skip officers with resigned_on and PSCs or statements with ceased_on, or your screening flags a director who resigned in 2019.
People with significant control, and a misspelled key
The PSC list at /company/{number}/persons-with-significant-control shows who holds more than 25% of the shares or votes, can appoint or remove a majority of the board, or otherwise has significant influence or control. Each PSC's natures_of_control gives the band, such as ownership-of-shares-50-to-75-percent. A company with no PSC to list files a statement instead, at /company/{number}/persons-with-significant-control-statements, and most statements mean ownership isn't known yet:
| Statement key | Meaning | Our default |
|---|---|---|
no-individual-or-entity-with-signficant-control | The company believes no one is registrable | Pass and record it |
psc-exists-but-not-identified | A PSC exists but isn't identified | Refer |
psc-details-not-confirmed | Identified, but particulars not confirmed | Refer |
steps-to-find-psc-not-yet-completed | The company hasn't finished looking | Refer |
psc-contacted-but-no-response | A notice to a suspected PSC went unanswered | Refer |
restrictions-notice-issued-to-psc | The company has issued a restrictions notice | Refer |
Look at the first key again: "signficant" is misspelled in Companies House's own enumerations, and that is the value the API returns. A rule written with the correct spelling never matches, so every company that legitimately has no PSC lands in the referral queue. Copy keys from the enumerations file rather than retyping them.
Keep the checks current without polling
- The Streaming API pushes changes to companies, officers, PSCs, filings, charges and insolvency cases over long-lived connections, filtered at your end to your supplier numbers. Each event carries a
timepoint. Store the last one processed and reconnect with?timepoint=set to it, so a restart resumes instead of missing events (streaming service source). - Bulk files. The Free Company Data Product is a monthly snapshot of every live company, including status and the next accounts and confirmation statement due dates, published within five working days of month end. The PSC snapshot lists every PSC and is overwritten daily before 10am. Join both on the normalized company number, and one download replaces thousands of calls.
HMRC: VAT and EORI numbers
If a VAT check built into your finance system stopped working in February 2025, this is the likely reason: HMRC removed version 1 of its Check a UK VAT Number API on 17 February 2025, and version 2 needs a registered application. HMRC describes the API as solely for traders doing due diligence on VAT-registered businesses (API definition). A check is two calls, shown with HMRC's documentation examples:
# 1. Application token, valid for 4 hours: cache it and reuse it
curl -X POST https://api.service.hmrc.gov.uk/oauth/token \
-H "content-type: application/x-www-form-urlencoded" \
--data "client_id=$HMRC_CLIENT_ID&client_secret=$HMRC_CLIENT_SECRET&grant_type=client_credentials&scope=read:vat"
# 2. Verified check: the supplier's VAT number, then yours, digits only
curl https://api.service.hmrc.gov.uk/organisations/vat/check-vat-number/lookup/553557881/146295999727 \
-H "Accept: application/vnd.hmrc.2.0+json" \
-H "Authorization: Bearer $HMRC_TOKEN"
# Response
{ "target": { "name": "Credite Sberger Donal Inc.", "vatNumber": "553557881",
"address": { "line1": "131B Barton Hamlet", "postcode": "SW97 5CK", "countryCode": "GB" } },
"requester": "146295999727",
"consultationNumber": "ypAeKRPlW",
"processingDate": "2019-01-31T12:53:05+00:00" }- 200. Store
consultationNumberandprocessingDateon the supplier record as your evidence of the check. Without your own VAT number HMRC runs the simple check, which returns no consultation number, so always send it. Compare the name and postcode with Companies House: a trading name can differ legitimately, but ask before the first payment. - 404, "targetVrn does not match a registered company". The number isn't registered. Our default is to hold VAT on that supplier's invoices and ask them.
- 400, INVALID_REQUEST. The number isn't 9 or 12 digits. If a GB prefix or a space got through, fix the normalizer; if digits are missing, ask the supplier.
- 403, "requesterVrn does not match a registered company". Your own VAT number in the configuration is wrong. Alert whoever runs the integration, not accounts payable.
- 429. HMRC's standard limit is 3 requests per second per application, and its guidance is to pause before retrying and to avoid batching (reference guide). Tokens last 4 hours (authorization guide).
For suppliers who move goods across the border, HMRC's Check a UK EORI number API needs no credentials: POST up to 10 numbers per request to /customs/eori/lookup/check-multiple-eori. Each must match ^(GB)[0-9]{12,15}$, and XI numbers are rejected with a pointer to the European Commission's checker. The name and address come back only if the business agreed to share them, so a valid result without a name is normal (API definition).
Sanctions: the UK Sanctions List and the ownership test
With OFSI's Consolidated List closed since 28 January 2026, the FCDO's UK Sanctions List is the only list to screen against. It is published in seven formats with a static URL for each, so a job can fetch the CSV or XML directly (GOV.UK), and a format guide documents the fields. If a screening tool or vendor still names OFSI's list as its source, ask when they switched. Then screen in this order:
- Screen more than the supplier's name: its registered name, any trading names, each active director and each current PSC.
- Apply the ownership test with the PSC data. OFSI's guidance applies an asset freeze to entities owned or controlled, directly or indirectly, by a designated person. Three of the test's limbs are more than 50% of the shares, more than 50% of the voting rights and the right to appoint or remove a majority of the board (OFSI), and each has a PSC key.
ownership-of-shares-50-to-75-percentmeans more than 50% and not more than 75%, the75-to-100bands mean more than 75%, and Companies House definesright-to-appoint-and-remove-directorsin the board limb's own words. A designated person holding any of them puts the supplier inside the test even though it isn't on the list. Stop, and escalate to whoever owns sanctions compliance. - Know what the PSC data misses. The bands start above 25%, and a corporate PSC is only the first link in a chain, so indirect or split holdings need a person to trace them. The test's control limb, whether a designated person could expect the company to be run as they wish, has no threshold at all, which is why any designated PSC goes to a person. The 50% threshold may also move. OFSI's call for evidence on ownership and control ran from February to April 2026, and the government says it is exploring aggregating holdings and changing "more than 50%" to "50% or more", in line with the EU and US (OFSI blog). Keep the threshold in configuration, not code.
- Re-screen when the list changes, not only at onboarding. Store the file date with each result, and re-run the whole supplier base whenever a new file appears.
The ownership test, applied to PSCs whose names matched the list:
OWNERSHIP_TEST = re.compile(
r"^((ownership-of-shares|voting-rights)-(50-to-75|75-to-100)-percent"
r"|right-to-appoint-and-remove-directors)")
def meets_ownership_test(psc):
return not psc.get("ceased_on") and any(
OWNERSHIP_TEST.match(n) for n in psc.get("natures_of_control", []))Insolvency: The Gazette and the insolvency registers
Companies House shows an insolvency once a case reaches it, through has_insolvency_history and the case list. Three gaps remain, each with its own check:
- Petitions come before orders. The Gazette publishes winding-up petitions as well as winding-up orders (Gazette data service), and until an order or appointment reaches Companies House, the company can still show as active. Before you prepay a supplier or extend credit to a customer, search The Gazette for the company's name and number. Each notice can be fetched as data (data formats), so a match is stored as structured evidence rather than a screenshot.
- Scottish companies file some insolvency documents elsewhere. Companies House's own API notes say the law requires some Scottish company and LLP insolvency documents to be filed with the Accountant in Bankruptcy (api-enumerations). For numbers beginning SC or SO, also search the AiB register.
- Sole traders have no company record. For a sole trader or a partner in England or Wales, search the Individual Insolvency Register by name. It holds only current bankruptcies, IVAs and debt relief orders and those that ended in the last three months (GOV.UK), so a clean result says nothing about last year. It doesn't cover Scotland, where sequestrations and protected trust deeds are on the AiB register, and Northern Ireland keeps separate registers.
Sector registers: the FCA, mutual societies and charities
Don't run every supplier through every register. Route from what Companies House and the purchase request already tell you:
- The profile's
typeis a registered society (registered-society-non-jurisdictionalorindustrial-and-provident-society). Companies House holds only partial data on these, and its own enumeration text points to the FCA's Mutuals Public Register, so search that. - You're buying a regulated financial service. Look the firm up on the Financial Services Register by its firm reference number, and for anything that matters use the phone number and website shown there, not the ones in the email. The FCA offers no service-level agreement on the API, so an outage should send the check to a person rather than pass it.
- The supplier or customer is a charity. Check the Charity Commission's register for England and Wales or OSCR's for Scotland, depending on where it's registered. A Scottish charity number such as SC039669 has the same shape as a Scottish company number, so it passes the company-number normalizer and can return an unrelated company. Keep charity and company numbers in separate fields.
Data protection: the ICO register of fee payers
When a supplier will handle personal data for you, such as a payroll bureau or an IT provider, our default is to confirm it appears on the ICO's register of data protection fee payers and store the registration details on the supplier record. Use the web search for a handful of suppliers and the dataset, updated daily, for a supplier base. A new registration can take up to two working days to appear (ICO), so re-check a newly registered supplier missing from today's file in a few days rather than failing it.
Bank details: Confirmation of Payee
Confirmation of Payee (CoP) isn't a register you can call: it runs between banks, and you reach it through your bank or payment provider when you add a payee. The Payment Systems Regulator required most payment providers that send Faster Payments or CHAPS for customers to implement it by 31 October 2024 (PSR). What you control is the name you send and what each result triggers. For a business account, CoP compares against the registered business name or a trading name registered to the account (Pay.UK FAQs), so send the exact Companies House name, not the name on the supplier's letterhead.
| Result | What it means | Our default |
|---|---|---|
| Match | The name matches the account | Continue, subject to your first-payment rules |
| Close match | The bank shows you the actual account name | Continue if it's the Companies House name or a trading name you already hold, and update the payee name. Otherwise refer |
| No match | The name doesn't match the account | Stop and call back |
| Unable to check | The receiving provider doesn't offer CoP | Treat as no match: call back before paying |
| Account type differs | A personal account for a limited company, or the reverse | Refer |
The call-back on a number already on file, and the payment hold that enforces it, are covered in our back office automation examples, along with checking a new supplier against existing records before creating one (supplier setup).
Worked example: re-checking 2,000 suppliers inside the limits
An illustrative example. A business re-checks its 2,000 UK suppliers every month: profile, officers and PSCs from Companies House, a disqualification search for two directors per supplier on average, a verified VAT check and a sanctions screen.
| Check | Calls per supplier | Calls in total | Limit | Shortest run inside the limit |
|---|---|---|---|---|
| Companies House profile, officers and PSCs | 3 | 6,000 | 600 per 5 minutes (2 per second) | 3,000 seconds: 50 minutes |
| Companies House disqualification searches | 2 | 4,000 | The same key and limit | 2,000 seconds: 33 minutes more, 83 in all |
| HMRC VAT check, verified mode | 1 | 2,000 | 3 per second | 667 seconds: 11 minutes, alongside the above |
| UK Sanctions List | 0 | 1 file download | None per supplier | Seconds, plus local matching |
Change one input and the design changes. At 20,000 suppliers the same Companies House work is 100,000 calls, at least 50,000 seconds or nearly 14 hours at the limit, and a monthly re-check still misses whatever changed on day two. At that size, use the bulk files and streams as the baseline, and call the API only for companies that changed.
The supplier onboarding check sequence
Run these steps in order when a supplier is created or its details change. "Refer" means the case goes to a named person with the evidence attached, in a queue someone actually works (what that queue needs is in our guide to connecting business systems). "Stop" means no purchase order or payment until it's resolved. The thresholds are our defaults, so set your own.
| Step | Check | Pass | Refer to a person | Stop |
|---|---|---|---|---|
| 1. Identifiers | Normalize the company number (8 characters), VAT number (9 or 12 digits) and EORI (GB plus 12 to 15 digits) | All valid | An invalid format: ask the supplier | None |
| 2. Company profile | GET /company/{number} | Status active (open and registered are live statuses too) and no flags from the profile table | Any flag from the profile table, or a name that differs from your record | Not found after normalizing, or dissolved, converted-closed, removed or closed |
| 3. Officers | Active directors, with a disqualification search for each | Verified, or verification not yet due; no disqualification match | Verification overdue; a name match with the same birth month and year | A disqualification match a person has confirmed |
| 4. PSCs | The PSC list, or PSC statements if there are none | Current PSCs listed, or the no-registrable-person statement | Any statement that ownership is unknown or unconfirmed; a corporate PSC outside the UK | None |
| 5. Sanctions | Company name, trading names, directors and PSCs against the UK Sanctions List | No potential match | A potential match, for a person to compare dates of birth, nationality and addresses | A confirmed match, or a designated person holding more than 50% of shares or votes, or the right to appoint or remove a majority of the board |
| 6. VAT | HMRC verified check, when the supplier charges VAT | 200 with a consultation number; name and postcode consistent with Companies House | A name or address that differs | 404: no VAT paid on its invoices until resolved |
| 7. Sector registers | When triggered: registered society, charity, regulated financial service, personal data, Scottish company, sole trader | Registered and current | Not found where expected, including a registration too new to appear | Not authorized for the regulated activity you're buying |
| 8. Bank details | Confirmation of Payee through your bank | Match | A close match to an unknown name; a business or personal account mismatch | No match or unable to check, until a call-back confirms the details |
| 9. Evidence | Store source, time, result and reference per check: HMRC consultation number and processing date, sanctions file date, CoP result | Every step, whatever the outcome | ||
| 10. Monitoring | Streams or a paced monthly re-run; a full sanctions re-screen whenever the list changes | Any change re-runs steps 2 to 5 for that supplier | ||
Steps 2 to 4 as code, using the fields above. The sanctions ownership test is in the sanctions section:
STOP = {"dissolved", "converted-closed", "removed", "closed"}
LIVE = {"active", "open", "registered"}
NO_PSC = "no-individual-or-entity-with-signficant-control" # sic: Companies House's spelling
def profile_check(p):
status = p["company_status"]
if status in STOP:
return "stop", [status]
flags = [] if status in LIVE else [status]
if p.get("company_status_detail") == "active-proposal-to-strike-off":
flags.append("strike-off proposed")
if p.get("corporate_annotation"):
flags.append("registrar annotation")
if p.get("registered_office_is_in_dispute"):
flags.append("office replaced with the default address")
if p.get("undeliverable_registered_office_address"):
flags.append("mail returned from registered office")
if p.get("accounts", {}).get("overdue") or p.get("confirmation_statement", {}).get("overdue"):
flags.append("filing overdue")
if p.get("has_insolvency_history"):
flags.append("insolvency history")
return ("refer" if flags else "pass"), flags
def verification_overdue(person, today): # today as "YYYY-MM-DD"
ivd = person.get("identity_verification_details") or {}
due = ivd.get("appointment_verification_statement_due_on")
return not ivd.get("identity_verified_on") and due is not None and due < today
def statements_check(items): # only when the PSC list is empty
current = [i["statement"] for i in items if not i.get("ceased_on")]
ok = current and all(s == NO_PSC for s in current)
return ("pass" if ok else "refer"), currentIf you're automating supplier or customer onboarding and want these checks inside your ERP or accounts payable workflow, bring an export of your supplier master, with company and VAT numbers as they're stored today, and one supplier that caused trouble. We'd start by normalizing the identifiers and running the Companies House and VAT checks against the export, which shows how many records fail before a single rule is written. That's where our internal systems and automation work begins.