Fake Articles of Association: Detecting KYB Fraud

Fake articles of association are a company's constitutional document — the rules governing share capital, director powers, and shareholder rights, filed at Companies House on incorporation — that has been fabricated, partially altered, or obtained through a fraudulent filing to pass a KYB (Know Your Business) check. Unlike a certificate of incorporation, which only proves a company was formed, articles of association carry evidentiary weight about who controls the entity today, which is exactly why bank onboarding teams, equipment lessors, and vendor risk desks rely on them and why fraudsters target them.

This article is provided for informational purposes only and does not constitute legal, financial, or regulatory advice. Regulatory references are accurate as of the publication date. Consult a qualified professional for guidance specific to your situation.

Why Articles of Association Are a High-Value Fraud Target

Articles of association are the document a company adopts under Section 18 of the Companies Act 2006 to set its own internal rules — share allotment, director appointment and removal, voting thresholds, and distribution of assets — and they are filed publicly with Companies House at incorporation. Because they establish who is legally entitled to act on the company's behalf, a counterparty that accepts a forged or hijacked set of articles is not just misled about paperwork; it is misled about who has authority to sign contracts, open accounts, or receive funds on the company's behalf.

That evidentiary weight is precisely what makes articles of association more dangerous to forge successfully than a bank statement: a convincing fake does not just misrepresent a balance, it misrepresents legal control of the entity itself. Most companies incorporating today adopt the model articles prescribed under the Companies Act 2006, so a forger working from a template has a genuine, publicly available baseline to imitate — the challenge for the fraudster is not the boilerplate governance clauses, but the specific fields (directors, share capital, registered office) that a KYB reviewer actually checks.

Four Ways Fraudsters Fake Articles of Association

Fabrication from Scratch

A fraudster with no genuine document to start from recreates the Companies House layout, certificate wording, and articles format in a word processor or design tool, then invents a company number, director names, and share capital that either do not exist on the register or belong to an unrelated entity. This method is the crudest and the easiest to catch, because it fails the moment anyone searches the fabricated company number on the live register — but it still passes reviewers who confirm a document "looks official" without checking it against Companies House's free register.

Registry-Level Identity Hijack

This is the most dangerous variant because the resulting document is entirely genuine. A fraudster files a fake confirmation statement, a bogus director appointment (Companies House form AP01), or a fraudulent change of registered office against a real, existing company, waits for Companies House to process it, then downloads the now-updated — but illegitimately altered — articles or filing history as if it were legitimate. Companies House itself does not verify the truth of what is filed at the point of submission, which is the structural gap this fraud exploits, and the scale of the problem is documented in the register's own cleanup figures: by January 2025, Companies House had removed 60,700 suspicious registered office addresses, 47,200 officer addresses, and 9,500 fraudulent documents, affecting 75,600 companies in total (Companies House, Reflecting on a landmark year for Companies House). A well-known instance of this pattern involved dozens of unconnected UK companies registered against the same residential addresses in Worksop, Nottinghamshire, without the occupants' knowledge (Which?, Getting Companies House in order).

Partial Field Tampering on a Real Document

A genuine set of articles or a genuine certificate is downloaded and edited in a PDF editor to change one or two specific fields — a director's name, the stated share capital, or the registered office address — while everything else, including the company number, is left untouched. This survives a reviewer who confirms the company number exists but does not compare every field on the document against the corresponding entry on the live register, which is the same gap the House of Commons Library flagged when noting that a meaningful share of the public wrongly assume Companies House checks the accuracy of what is filed (House of Commons Library, Company registration FAQs: address fraud, identity verification).

Full Generative-AI Synthesis

Image and document-generation models can now produce a complete, plausible-looking articles of association or certificate of incorporation from a short prompt, matching Companies House typography, crest placement, and boilerplate governance language without ever touching a real filing. The output typically carries a fabricated company number, invented director names, and share capital figures with no counterpart on the register at all — but because the visual formatting is convincing, it defeats a purely visual check just as effectively as a partially tampered real document, and increasingly more efficiently for the fraudster, since no genuine source document is needed to start from.

What This Fraud Enables

A forged or hijacked set of articles of association is rarely the fraud itself — it is the credential that gets a fraudster through a door that would otherwise stay shut. Four schemes recur across onboarding channels:

• Shell companies for money laundering. A registered entity with plausible-looking constitutional documents and a clean-seeming filing history clears an initial KYB threshold, after which it is used to move funds through business accounts that appear legitimate on paper.
• Supplier and vendor impersonation (CEO fraud, invoice redirect). A forged or partially tampered document lets a fraudster present as a trusted supplier's authorised representative, redirecting payment to an account they control while the underlying company details look correct on a cursory check.
• Equipment financing and leasing fraud. Lessors that rely on articles of association to confirm signing authority and share capital before releasing high-value equipment are exposed when the director named as having authority to sign is fabricated or substituted — a pattern that shows up repeatedly in equipment financing and leasing onboarding.
• Hostile business bank account takeover. A registry-level identity hijack that changes the registered director or PSC on file can be used to convince a bank that new signatories have legitimate authority over an existing business account, particularly where bank KYC onboarding relies on the filing history rather than an independent identity check of the individuals named.

Detecting Fake Articles of Association

The single most effective control is comparing every material field on the document received — company number, director names, registered office, share capital — against the same fields on Companies House's live register, not trusting the PDF a counterparty has sent. This single step catches fabrication, partial tampering, and most AI-synthesised documents, because none of them can produce a matching entry on the register unless the underlying filing was itself fraudulent.

Filing history review is the second layer, because a registry-level hijack leaves a trace: an unusual AP01 director appointment, a confirmation statement filed outside the normal annual cycle, or a registered-office change shortly before the document was presented are all visible on the same public filing history tab. PDF metadata inspection — creation software, author field, and last-modified timestamp — can reveal that a document dated years ago was in fact edited or generated within the past few weeks. For AI-generated documents specifically, look for a company number with no register match at all, subtly inconsistent typography or spacing against a genuine Companies House template, and the absence of the authentication features (digital signature, verification code) that accompany documents genuinely issued through Companies House's own systems.

What Compliance Teams Are Actually Asking

Compliance and fintech practitioners on specialist forums often ask how to distinguish a company that has simply not updated its articles in years from one where the document has been deliberately manipulated, since both can look equally static on the page. The distinguishing signal is not the age of the document but whether the current register entry — status, officers, share capital, PSC data — matches what the counterparty is presenting today; a stale-but-consistent filing is normal, one that contradicts the live register is not.

A second recurring question is what to do when a registry-level hijack means the document itself is technically genuine, since a standard visual or metadata check will not catch fraud that Companies House itself has already processed. The practical answer raised repeatedly on these forums is to treat an unexplained, recent officer or address change as a trigger for direct outreach to the company (via an independently sourced contact, not one on the document itself) before relying on the filing, since the register accepting a filing is not the same as the filing being truthful.

A third question concerns proportionality: whether a single mismatched field is enough to decline onboarding outright, or whether it should simply prompt a query. Most teams treat one inconsistency as grounds for a direct register check and a request for explanation, reserving outright refusal for cases involving officer identity or share capital, or where two or more fields disagree at once.

A Layered Approach, Not a Single Check

Manual document review catches only around 37% of occupational fraud cases, with a median detection delay of 87 days, which is why a single visual pass on articles of association is not a sufficient control on its own (ACFE, 2024 Report to the Nations). CheckFile's approach combines structural checks, metadata analysis, and cross-validation against official registries as one layer among several, not a replacement for a live Companies House lookup. That includes an AI-generation detection layer deployed as a complementary signal alongside structural checks, not a standalone verdict — a hijacked filing that is technically genuine will still need a filing-history and outreach check that no document-level analysis alone can replace.

For teams building out a full onboarding workflow, our complete guide to business entity verification covers the wider process end to end, and our industry verification guide breaks down sector-specific checks across financing, construction, and regulated services. This article is the companion piece to our analysis of forged certificates of incorporation, which focuses on the formation document rather than the governance rules a company adopts alongside it. See CheckFile's security page, pricing, and homepage for more on how the platform fits into a broader onboarding stack.

If your review process still relies on a visual read of a PDF a counterparty has sent, CheckFile's AI-generated document detection adds AI-generation signals as a complement to your existing controls — not a guarantee of catching every forgery, but a meaningful layer alongside register cross-checks and filing history review.

Frequently Asked Questions

Can genuine articles of association still be fraudulent?

Yes, when they result from a registry-level identity hijack — a fraudulent director change or confirmation statement filed against a real company. The document Companies House holds is technically authentic, so the only way to catch this is reviewing the filing history for unexplained recent changes, not just checking that the document itself looks correct.

What is the fastest way to check if articles of association are genuine?

Search the company number on the free register at find-and-update.company-information.service.gov.uk and compare every material field — directors, registered office, share capital — against the document received. This takes under a minute and catches fabricated, tampered, and most AI-generated documents, since none of them can match a genuine register entry unless the underlying filing was itself fraudulent.

How is a fake articles of association different from a fake certificate of incorporation?

A certificate of incorporation only proves a company was formed on a given date; articles of association set out who controls it — director powers, share capital, voting rights. A forged certificate misrepresents that a company exists validly, while forged or hijacked articles misrepresent who is legally entitled to act on the company's behalf today, which is why they carry more weight in onboarding decisions involving signing authority.

Does the Companies House identity verification requirement stop this fraud?

It substantially reduces the risk of registering a brand-new shell company under a fabricated identity, but it does not stop registry-level hijacks of existing companies or document-level tampering and fabrication. Existing directors and PSCs have until 18 November 2026 to complete verification under the transitional arrangements, and independent document and filing-history checks remain necessary regardless.

Is presenting forged articles of association a criminal offence in the UK?

Yes. Using a forged or manipulated document to induce a business decision falls under false representation in Section 2 of the Fraud Act 2006, carrying up to ten years' imprisonment on indictment, and creating forged company documents can also fall within the Forgery and Counterfeiting Act 1981. Delivering false information to Companies House itself is a separate offence under Section 1112 of the Companies Act 2006.