Companies House data turns vendor due diligence from a guessing game into a documented process — every UK-registered company has a public filing history, and most red flags show up there before a single email gets sent. This guide walks through the exact checks to run, what each one tells you, and where they fit into a repeatable vendor risk assessment process.
Why this matters
A vendor pitching you a slick security questionnaire response can still be six months from insolvency or run by a director with three other failed companies on record. Companies House exposes both in under ten minutes, at no cost.
Most SMEs skip this step because it feels like extra admin bolted onto procurement. In 2026, with supply chain attacks and vendor breaches driving a growing share of incidents reported to the NCSC, skipping it is the more expensive option.
Folding a Companies House check into your vendor risk assessment process gives procurement and security teams a shared, documented reason to approve or reject a vendor — not a gut feeling.
What you'll need
- The vendor's full registered company name and, ideally, company number
- A free Companies House account (no paid tier is required for basic searches)
- 15-20 minutes per vendor for a first pass
- A simple template or spreadsheet to log findings against your risk criteria
- Access to your existing vendor risk register, if one exists
The steps
1. Pull the company profile and confirm it's active
Search the vendor's exact registered name on the Companies House register, not the trading name on their website. Confirm the status reads "active" — not "dissolved," "in liquidation," or "proposal to strike off."
A vendor mid-strike-off with no active status is an automatic Skip until they can explain it. This takes under two minutes and eliminates the worst-case scenario immediately.
Common mistake: searching the trading brand name instead of the registered entity — many vendors trade under a name that differs entirely from their Companies House record.
2. Check the filing history for overdue accounts
Every UK company has a filing deadline — accounts are due 9 months after the financial year end for private companies. Overdue accounts on the filing history tab are a solvency warning sign, not an administrative slip.
A vendor more than 30 days overdue on statutory filings in 2026 should trigger a follow-up question before you proceed, not an automatic rejection — but repeated late filings across multiple years is a Hold signal.
Expected outcome: a clean filing history with accounts submitted on or ahead of deadline for the last 2-3 years.
3. Review the People with Significant Control (PSC) register
The PSC register lists anyone owning 25%+ of shares or voting rights, or otherwise exercising significant control. Cross-check the names here against who actually signed your contract or answered your security questionnaire.
If the PSC is another company rather than a named individual, trace that parent entity through its own Companies House record — ownership chains ending in an offshore holding company with no UK filing history is worth a direct question to the vendor.
4. Check director history across other companies
Each director's Companies House profile links to every other directorship they hold, past and present. A director sitting on the board of three dissolved companies inside the last five years is a pattern worth flagging, not an isolated data point.
This step catches serial phoenixing — directors who dissolve one company and re-emerge under a new entity with the same staff and clients. It's rare, but it's exactly the kind of thing a five-minute check surfaces that a questionnaire never will.
5. Review the charges register for secured debt
The charges section shows any fixed or floating charges registered against company assets — typically bank loans or invoice financing secured against the business. A vendor with multiple active charges isn't automatically a bad bet, but it does mean their assets are already pledged elsewhere if things go wrong.
Buy confidence goes up when charges are minimal or fully satisfied; a Hold is reasonable when several charges stack up with no accompanying growth story in their filed accounts.
6. Cross-check SIC codes and registered office against their pitch
The Standard Industrial Classification (SIC) code the vendor filed tells you what Companies House thinks they actually do. A company claiming to be a specialist penetration testing firm but filed under a generic "other business support" SIC code is worth a clarifying question.
Similarly, a registered office at a mass-registration address (a formation agent's building housing hundreds of companies) isn't disqualifying on its own, but combined with a young incorporation date and no filed accounts, it raises the bar for what else you need to see.
7. Log the findings and fold them into your risk process
Document every check against your existing risk criteria — don't leave it as a one-off search. Vendors get reassessed annually or when a contract renews, and having a dated record matters if a regulator or auditor asks how you vet suppliers.
Common mistake: running this check once at onboarding and never again — a vendor that was clean in 2024 can be a different company by 2026 if directors, ownership, or filing status changed.
Turn vendor checks into a repeatable process
Automate vendor risk tracking alongside your ISO 27001 and Cyber Essentials evidence.
Troubleshooting
- Vendor is dormant with no filed accounts — dormant company accounts are legitimate for holding entities, but ask directly why an active-trading vendor shows dormant status.
- No PSC listed at all — this usually means ownership sits below the 25% threshold across multiple small shareholders, or the filing is simply overdue. Ask for a shareholder breakdown if the vendor handles sensitive data.
- Vendor recently incorporated with under 12 months of history — you can't judge filing patterns yet. Weight your due diligence toward director history and financial guarantees instead.
- Registered name doesn't match the contract or invoice — confirm which entity you're actually contracting with before signing; mismatches here are a common source of disputes later.
- Accounts filed but no profit and loss statement — micro-entity and small company exemptions mean many vendors legally file abbreviated accounts with no P&L. Request management accounts directly if you need more detail.
- Overseas parent company with no UK filing — Companies House only covers UK-registered entities; you'll need the parent's home-country equivalent register for full visibility.
Tools and resources
- Companies House free company search and filing history (the primary source for every check above)
- Companies House WebCHeck or the Companies House API for bulk or automated lookups
- Vendor risk management software built for UK SMEs, to track findings alongside broader supplier risk scoring
- Your existing vendor onboarding checklist or procurement policy
- A shared risk register spreadsheet or tool your security and procurement teams both access
What to do next
Companies House checks answer whether a vendor is real, solvent, and stable — they don't tell you how the vendor handles your data day to day. Pair this process with how you respond to security questionnaires faster so both sides of vendor risk — theirs and yours — move through the same documented workflow.
Frequently asked questions
One last thing
The filing history tab shows exact submission dates, not just deadlines — a vendor that files accounts within days of the statutory deadline every single year, rather than months early, is telling you something about how tightly they run their back office, and it's usually the same team handling your data.