CCI staff share recent surveys, reports and analysis on risk, compliance, governance, infosec and leadership issues. Share details of your survey with us: editor@corporatecomplianceinsights.com.
Fewer than 1 in 10 multinationals have finished UK ID verification ahead of deadline
Multinational enterprises with UK entities are nearing the end of a 12-month transition period for Companies House identity verification requirements, but most have not finished that work, according to a survey by corporate services firm Vistra, which found that less than 10% had completed all their requirements.
The survey of 300 directors at multinationals with a UK presence found that 84% of directors said their organizations were prepared for the new identity verification requirements under the UK’s Economic Crime and Corporate Transparency Act (ECCTA), but only 9% reported completion ahead of the Nov. 18 end of the transition window. On average, 61% of relevant directors and persons with significant control (PSCs) had completed verification.
Just 26% of respondents said they had checked that Companies House records for their directors and PSCs were accurate, 20% had identified all directors and PSCs requiring verification, and 22% had obtained and recorded the Companies House personal codes needed to tie verifications back to a company’s filings. Among UK-based respondents, 86% said their organization was prepared, but none reported that all relevant directors and PSCs had completed verification.
The research follows the first court action for identity verification offenses, with three directors fined in September following prosecutions brought by the UK’s Insolvency Service. Cross-border structures are also compounding the challenge: More than three-quarters (76%) of respondents said verifying directors and PSCs based outside the UK had created additional compliance complexity.
The ECCTA push is a cousin of the Corporate Transparency Act, which also aimed at corporate transparency through disclosure of ownership and control. The US Treasury Department this year formally limited the scope of disclosure only to foreign-registered entities, dropping the list of covered firms from more than 32 million to an estimated 28,000.
Boards’ self-rated effectiveness drops as competing priorities crowd the agenda
Only 58% of corporate directors rate their boards as highly effective at collaborating with the CEO and management, down from 69% in 2025, a survey by accounting and advisory firm BDO USA found.
In a survey of more than 200 public company directors across industries including technology, retail, manufacturing, financial services, energy, healthcare and life sciences, BDO found 20% of directors say their boards are ineffective at conducting meaningful member evaluations and executing refreshment strategies, compared with 9% in 2025. Just under a quarter (22%) said their boards were ineffective at crisis response, up from 13% last year.
Those declines come as boards contend with crowded agendas. More than half (51%) of directors cited keeping pace with AI and emerging technologies as the most significant challenge for their boards over the next 12 months, followed by balancing competing priorities on the agenda (36%) and prioritizing capital allocations amid resource constraints (35%). Among governance areas at risk of being deprioritized, 42% of directors identified board effectiveness itself — including evaluations, refreshment, structure and continuing education — more than any other area measured.
Other findings from the report include:
- 20% of directors say their boards do not have a clear governance framework for overseeing AI adoption and cybersecurity risk; 15% say their boards lack the right skills and experience to oversee AI, cybersecurity and data governance.
- Technology and innovation is now the most sought-after area of board expertise (49%, up from 42% in 2025); cybersecurity and data protection expertise is sought by 45%, up from 35%.
- 34% of directors identified investing in new or enhanced products and services as the board’s top growth priority, and 20% prioritized customer experience and retention — more than double the 9% reported in 2025. Strategic M&A or partnership transactions dropped to 13% as a primary growth focus from 30% last year.
- Top external concerns for the next six to 12 months are the pace of AI and cyber capabilities (57%); tariff, sanctions and trade policy changes (46%); regulatory uncertainty amid the US midterm elections (41%); and geopolitical conflict (38%).
Compliance teams skipping AI verification are fined nearly 3 times as often
Compliance teams that act on AI-generated regulatory guidance without expert review are nearly three times more likely to report a regulatory fine, a survey by regulatory intelligence provider Enhesa found.
In a survey of 273 senior compliance, risk, EHS, legal and sustainability decision-makers at multinational companies with 5,000 or more employees, Enhesa found that 40% of compliance teams act on AI-generated regulatory guidance always or often without expert review. Of those teams, 37% reported a regulatory fine, compared with 13% of teams that don’t skip verification.
More than half (56%) of compliance teams reported a negative outcome in the past 12 months that they attribute to unverified or incorrect AI output, including incorrect or incomplete filings (30%), regulatory fines or penalties (21%), missed regulatory deadlines (20%) and failed audits (18%).
Other findings from the report include:
- 76% of compliance teams now run AI across the entire function or fully autonomously on at least one core compliance task.
- The sharpest reported benefit from AI was speed to identify and react to regulatory changes (48%); just 26% reported improvement in anticipating future regulatory risk.
- 64% of compliance teams said they had put sensitive material into personal or non-corporate AI tools in the past year, most often proprietary chemical or manufacturing data (33%); those teams rep
Ransomware attackers increasingly threatening physical harm to employees — and following through
Ransomware attackers are turning to physical and psychological threats against employees and their families to pressure organizations into paying, according to a survey by identity system security and recovery software provider Semperis.
In its survey of 1,200 security and IT professionals across nine countries that experienced at least one successful ransomware attack in the past 12 months, Semperis found that psychological intimidation was used in nearly a quarter of all attacks and 40% of attacks involved psychological or physical threats against staff. In 53% of those cases, victims reported that attackers followed through on the threats; 24% of victims or family members were swatted and 25% sought psychological or medical treatment because of the attack.
AI is continuing to reshape the landscape, with threat actors weaponizing it in 84% of attacks surveyed. Repeat attacks remain the norm: 69% of ransomware victims were targeted multiple times in the past year, and 31% paid their attackers more than once.
Other findings from the report include:
- 79% of respondents said attacks happened on an evening or weekend; 14% occurred during material corporate events like mergers, acquisitions, IPOs or mass staffing changes.
- 59% of respondents paid a ransom, with 53% of those paying more than once; 23% paid specifically because they could not eject attackers from their environment.
- 44% of respondents said attackers exploited the organization’s own AI agents or systems, and 23% said their defensive AI tools failed to detect or stop the attack.
