Nominee Director Onboarding Process: What Happens Next

Registering interest should do no more than place your details into an initial review. It does not make you a director, complete KYC, verify you for Companies House or promise a paid appointment. A careful nominee director onboarding process uses separate decision points: acknowledgement, proportionate screening, risk education, invited checks, possible matching, your own investigation and, only then, informed consent to an appointment.

As at 19 July 2026, this site’s legal entity, data-controller details and regulatory status have not all been independently confirmed in its published materials. Do not use a public upload route or send identity or bank documents merely because you have registered. Wait for a verifiable invitation and satisfactory privacy information.

This page starts after an expression of interest and owns the post-registration sequence. For the earlier eligibility, provider and company decision gates, use how to become a nominee director in the UK.

What registration does and does not mean

Registration is an expression of interest. The information requested at that point should be limited to what is genuinely needed to decide whether a preliminary conversation is appropriate. The ICO’s data minimisation guidance says personal data must be adequate, relevant and limited to what is necessary for the stated purpose.

Registration should not be treated as:

• consent to act for an unknown company;
• authority to submit an appointment filing;
• agreement to any fee, indemnity or service terms;
• successful AML customer due diligence;
• Companies House identity verification; or
• a promise that the application will progress.

Keep any acknowledgement and check that it identifies the recipient and links to privacy information matching the form. A receipt proves delivery, not that an opportunity or company has been checked.

A careful sequence after expressing interest

The stages below describe a safe decision sequence, not guaranteed operational promises. A stage may not occur, and you may pause or leave before appointment.

1. Initial screening

An initial review may compare the information supplied with the site’s stated programme criteria. For example, this programme may set an 18-plus or UK-residence criterion. Those are programme rules, not the general legal requirements for all UK directors: the statutory minimum age is normally 16, and a director does not generally have to live in the UK.

Screening should also test whether you understand that a nominee director is still a director in law. The label and a private agreement do not reduce the duties attached to office. Read the programme eligibility information and the responsibilities material before deciding whether to continue.

No response time or acceptance rate should be assumed. A request for more information should explain why it is needed. It should not become an open-ended demand for sensitive material.

2. Education before identity documents

Before any high-risk document request, you should receive a clear explanation of:

• the legal status and duties of a director;
• the public-record consequences of appointment;
• the expected access to company information and continuing oversight;
• how fees, PAYE, conflicts, resignation and liability would be addressed;
• the checks that would apply to you, the provider and the proposed company; and
• the fact that you can refuse without being appointed.

Written terms may allocate day-to-day work, but they cannot transfer away independent judgement or reasonable care, skill and diligence. If the explanation describes the role as passive, anonymous or merely lending a name, stop.

3. A separate, invited KYC stage

If the application progresses, a later invitation may ask for evidence of identity or address. First establish who is asking. The party may be the site operator, a separate regulated provider or another organisation involved in a proposed appointment. Their roles and privacy responsibilities should not be blurred.

Ask for the controller’s legal name and contact details, the specific purpose and lawful basis, the document options, recipients, international transfers, retention period and your rights. The ICO lists these matters in its privacy-information guidance. If the answers are absent or inconsistent with the form, do not upload.

Read the fuller guide to KYC for company directors before responding. A passport, selfie, proof of address and full bank statement are not a universal document bundle required by law for every route. The requester should justify each item and say whether a less intrusive or redacted alternative is acceptable.

Three checks that must stay separate

Confusing the following processes can cause a candidate to disclose too much data or wrongly believe an official requirement has been completed.

Site onboarding documents

A website may collect information for its own application or fraud-prevention process. That is an operational choice that needs a lawful purpose and accurate privacy notice. It does not, by itself, prove AML supervision or complete an official filing requirement.

Without current evidence, do not treat this site as an ACSP, supervised TCSP, verified controller or secure processor. Unconfirmed handling arrangements do not justify an uninvited upload.

AML customer due diligence by a regulated provider

Under the Money Laundering Regulations, a business that acts as, or arranges for another person to act as, a director by way of business may be a trust or company service provider. HMRC explains that ordinary recruitment is not automatically arranging, while selecting a director and completing appointment formalities may be. The classification depends on the facts.

Where a regulated provider is involved, it must identify the correct customer, examine beneficial ownership and control, understand the purpose of the relationship and apply risk-based monitoring. Checking a candidate alone does not replace checks on the client, business owner or ultimate beneficial owner. You may therefore be asked questions, but you should also expect the proposed company and controlling parties to be reviewed.

Statutory Companies House identity verification

Mandatory Companies House identity verification began on 18 November 2025. It is completed through GOV.UK One Login or an Authorised Corporate Service Provider, not merely by sending documents to an onboarding site. The official Companies House verification guidance explains the approved routes and the personal code produced after successful verification.

New directors appointed from that date provide their personal code as part of incorporation or appointment. Directors already in office before that date connect their verified identity through the relevant company’s confirmation statement during the transition. Their individual due dates depend on that filing timetable; 18 November 2025 was the start of the regime, not one deadline shared by everyone.

Provider and business-owner review

Screening should not run in one direction. Before any match is presented, the party arranging the process should be able to explain how it identifies its customer, the proposed company’s beneficial owner and the ownership and control structure. A Companies House entry is useful evidence, but it is not government approval of the business or appointment.

Ask for enough information to understand:

• the provider’s legal identity and relevant supervisory status;
• who its customer is and who ultimately owns or controls the company;
• the company’s actual activity, countries, customers and expected funds;
• why an additional director is wanted;
• who would pay any fee and through which payroll arrangement; and
• what ongoing monitoring and escalation would occur.

HMRC says a TCSP must have the correct AML supervision before operating. Its TCSP guidance distinguishes regulated arranging from normal recruitment. “KYC compliant” is no substitute for a legal name, supervisor and verifiable status.

Matching is a possibility, not an outcome

Passing an initial review or a document check does not guarantee that a suitable company exists. It does not guarantee that a company will select you, that you will accept, or that an appointment or fee will follow.

If a possible match is introduced, start a new decision. Obtain the company number and current filings, identify its directors and PSCs, understand its business and financial position, and speak through independently verified contact details. Ask why you are needed and what decisions you would be expected to make.

You should receive proposed appointment terms before consenting. Review the parties, duties, information rights, conflicts, fee payer, PAYE treatment, term, termination, indemnity and any D&O insurance. An indemnity cannot remove statutory duties or guarantee that a solvent payer will meet every claim.

Consent and formal appointment

Appointment should occur only after you have had time to read the final documents, ask questions and obtain independent advice where needed. Do not sign blank, incomplete or backdated papers. Do not let anyone use your personal code until you know which trusted filing party needs it and for what filing.

The company must complete the proper appointment process and filing. Your name then appears as a director, not as a lower-responsibility “nominee” category. From appointment, you must exercise independent judgement and obtain enough information to supervise relevant matters. An owner, accountant or platform can assist, but cannot take those duties away.

Pausing, withdrawing and asking about data

You may withdraw your interest before appointment. Use a written message and keep a copy. Ask the recipient to confirm whether your application is closed, which personal data it still holds, why it retains that data, who received it and when it will be deleted or reviewed.

Deletion is not absolute. Regulation 40 generally requires a relevant person to keep specified customer-due-diligence and transaction records for five years after the date on which it knows, or has reasonable grounds to believe, that the transaction is complete or the business relationship has come to an end. At the end of that period, personal data must be deleted unless another enactment requires or permits retention or the data subject has consented to it. This rule must not be applied automatically to every early-stage application or every document; other applicant data needs its own lawful retention schedule.

If documents went to an unverified recipient, send no more. Preserve messages, contact the purported organisation independently and seek help from the ICO, your bank, Companies House or the official fraud-reporting service as appropriate.

Two illustrative outcomes

A reason to continue checking: after education, an identifiable organisation privately names the controller and provider, explains document alternatives and retention, and keeps Companies House verification separate. A proposed company is disclosed for your review. This supports further checks, not trust.

A reason to stop: a contact promises a fee, treats registration as binding and demands a passport and unredacted statement through a public link. They hide the controller, owner and company, then call the upload “Companies House approval”.

Decision checklist

Before moving beyond registration, answer:

• Do I know the legal entity holding my application?
• Is the privacy information complete and consistent with the requested data?
• Is any KYC provider identified, appropriately supervised and clear about its role?
• Have Companies House verification and private onboarding been explained separately?
• Do I understand that no match, appointment or payment is guaranteed?
• Can I pause without pressure and receive an answer to a data question?

One “no” or “not sure” is enough to stop and ask for evidence. The proportionate next step is to compare any message you receive with the stated process and the privacy notice. Until the site’s controller and processing facts are confirmed, do not upload identity or banking documents without a specific, verifiable invitation.