Using the Companies House API for UK customer onboarding and KYC

What the Companies House API provides

The Public Data API exposes live register information: legal name, company number, status, incorporation date, type, registered office, previous names and SIC codes, with linked resources for officers, persons with significant control, filings, charges and insolvency. Authentication is an API key over HTTP Basic. The standard limit is 600 requests in five minutes; excess traffic gets 429. Companies House API · Authentication

Company lookup and KYC are not the same check

The first real problem: matching the right company

In 2024 a partner agency’s client needed a customer spreadsheet enriched with company numbers and SIC codes. The first idea was to crawl register pages with an SEO spider. Because the API is free to registered applications, we wrote a small server-side script instead: search each business name, fetch the profile. The responses were consistent. The matches were not.

1. Trading names, abbreviations and previous names broke “take the first result”. The client’s reviewer found cases where the register search returned the wrong entity while a general web search found the right one. We said it upfront: a script prepares the enrichment, a person verifies it.
2. SIC codes arrive as bare codes such as 25110. A local lookup table of descriptions has to be joined at export time.
3. The output was a spreadsheet, not an API. The client wanted their own account reference on every row. Enrichment is a data product for an operations team.

The durable workflow is name and address → candidate companies → scored matches → customer or reviewer confirmation → company number. The number anchors the relationship, not the search ranking.

The second problem: safe synchronisation

On a UK accounting platform we maintained, a scheduled Companies House job started blanking client names and creating duplicate records on a specific day in September 2024. Restoring the previous day’s backup fixed it for a day; the next run reproduced the damage. Sole-trader records were untouched, which was the clue: only limited companies were synchronised. Disabling the job restored the platform. The fault was architectural. Registry data had become authoritative over data customers had already confirmed, and with no snapshot or change history there was nothing to compare the damaged rows against.

Sole traders, limited companies and unregistered businesses onboard differently

A UK wholesale marketplace we worked with from 2023 onboarded retailers into trade-credit accounts. The first form asked for a “company house number” as free text in a modal. We replaced it with a search component that returned candidates, so the retailer confirmed an entity rather than typing an identifier. Downstream, the trade-credit provider’s API had separate resources for limited companies, sole traders and unregistered businesses, keyed on the organisation number.

Three controls made the difference: a back-office review table showing each evidence field as accepted, pending or rejected; every KYC state change stored as an event; and a scheduled job that flags duplicate retailer accounts before review, still running in 2026. One bug worth remembering: a retailer submitted the form before the email one-time code had been verified. Validate the contact channel before accepting the submission, not after.

Implementation essentials

const baseUrl = "https://api.company-information.service.gov.uk";

async function companiesHouseGet<T>(path: string): Promise<T> {
  const apiKey = process.env.COMPANIES_HOUSE_API_KEY;
  if (!apiKey) throw new Error("Companies House API key is missing");

  const response = await fetch(`${baseUrl}${path}`, {
    headers: {
      Authorization: `Basic ${Buffer.from(`${apiKey}:`).toString("base64")}`,
      Accept: "application/json",
    },
    signal: AbortSignal.timeout(8000),
  });

  if (response.status === 429) throw new Error("Rate limit reached");
  if (!response.ok) throw new Error(`Companies House returned ${response.status}`);
  return response.json() as Promise<T>;
}

Companies House identity verification became a legal requirement on 18 November 2025, with a twelve-month transition for existing directors and PSCs running to mid-November 2026. Officer and PSC resources may carry an optional identity_verification_details object, and records gain it progressively. Missing data should produce “unavailable” or a review state, not an automatic rejection. When verification is required · Streaming API

Privacy and release checklist

Public register data is still personal data when you store officer or PSC information. Collect only what the decision requires, define retention, restrict access and explain the registry check in your privacy notice. The same applies to a request we often get from UK accountancy and formation businesses: programmatic company-profile pages built from register data. Public, common, and still personal data. ICO data minimisation

Technical and operational guidance. Businesses with regulatory obligations should have their due-diligence policy reviewed by a UK compliance professional.