The short answer: an ICO registration check confirms whether an organisation is on the UK Information Commissioner's Office (ICO) register of fee payers - that is, whether it has told the ICO it processes personal data and paid the data protection fee that goes with it. It does not confirm that the organisation is financially sound, that it owns the bank account on its invoice, or that a payment to it is safe.
That distinction matters because the two questions arrive together. A procurement team checking a new supplier wants to know the company is real and compliant. A treasury team wants to know the money lands in the right account. The ICO register answers the first question only, and only the data-protection part of it.
What an ICO registration check actually confirms
The ICO is the UK's independent data protection regulator. Under the Data Protection (Charges and Information) Regulations 2018, most organisations that process personal data have to pay an annual charge to the ICO - usually called the data protection fee - unless an exemption applies. The register of fee payers is the public list of organisations that have done so.
So a positive result confirms a narrow, factual thing: the organisation appears on that register, with a registration number, a fee tier and a status. It is a useful compliance signal when you are handing personal data to a supplier - payroll providers, marketing agencies, software vendors, anyone processing customer or employee records on your behalf.
Registration is about data, not money
The ICO register records who has paid a data-protection fee. It says nothing about bank accounts, invoices, ownership or solvency. Treat it as one line in a supplier file, not as a payment control.
How to check an ICO registration step by step
The check is quick and free. Use the official ICO search rather than a third-party lookup site, because the official register is the source every other tool copies from.
- 1 Go to the ICO's own register search on ico.org.uk - the search box for the register of fee payers.
- 2 Search by the organisation's legal name as it appears on the contract or invoice, not a trading name or a brand.
- 3 If the name is common, narrow the results with the registration number if you already have it, or with the organisation's address.
- 4 Open the entry and read three things: the registration number, the fee tier and the status.
- 5 Save a dated screenshot or note of what you found, so the check is auditable later.
If nothing appears, do not jump to conclusions. Try the registered company name from Companies House, try the parent company, and try variations with and without legal suffixes. Many organisations trade under a name that differs from the entity that pays the fee.
One warning worth repeating: several commercial sites offer a paid 'ICO determination' or 'registration certificate' service. The ICO's own self-assessment tool and register search are free, and paying a third party does not make a registration more valid.
Reading the result: registration number, tier and status
An ICO registration number is usually written as ZA followed by six digits - for example ZA123456. It identifies the entry on the register. It is not a company number, a VAT number or a payment reference, and it should never be used to identify a bank account.
The fee tier describes the size and type of the organisation, as the ICO defines it. The ICO publishes three tiers, and the fee rises with the tier:
- Tier 1 covers the smallest organisations - micro organisations, judged mainly by staff numbers and turnover.
- Tier 2 covers small and medium organisations.
- Tier 3 covers large organisations.
The tier tells you roughly how big the fee payer is. It is not a rating of security, quality or trustworthiness, and a Tier 3 entry is not 'safer' than a Tier 1 entry - it simply means a larger organisation paying a larger fee.
Status is the part people misread. An entry can show as registered, or as in progress while a payment or renewal is being processed. 'In progress' is not a red flag on its own: renewals happen annually and there is a gap between paying and the register updating. What matters is whether the organisation can explain the status and whether the entry is current rather than lapsed.
What an ICO check does not tell you
This is where supplier due diligence goes wrong. A clean ICO entry is often screenshotted onto a trust page as if it were a badge of legitimacy. It is not. An ICO check does not confirm:
- Who owns or controls the company - that is Companies House territory, where you can see directors, filings and accounts.
- Whether the company is solvent or trading - accounts and filing history again, not the ICO register.
- Whether the company owns the bank account printed on its invoice - no public register holds that.
- Whether the invoice itself is genuine, or whether the email that delivered it came from the real supplier.
- Whether the organisation handles data well - registration is a fee, not an audit.
In other words, the ICO register answers a compliance question. The question 'is this the right account to pay?' is answered somewhere else entirely - by a name-to-IBAN check run by a payment service provider.
ICO registration vs Verification of Payee: two different checks
Verification of Payee (VoP) is the EU/SEPA name check required by the Instant Payments Regulation. Before a euro credit transfer is sent, the payer's payment service provider (PSP) asks the payee's PSP whether the name supplied matches the account holder, and gets back one of four outcomes: match, close match, no match or not available. The UK has its own version, Confirmation of Payee, built around sort codes and account numbers.
Put the two side by side and the difference is obvious:
- The ICO check asks: has this organisation registered as a data controller and paid its fee? It is answered from a public register, once, at onboarding.
- The payee check asks: does this account belong to the party I named? It is answered by the payee's bank, at the moment of payment.
- The ICO check is about data protection compliance. The payee check is about where the money lands.
Neither replaces the other. A fraudster can register with the ICO - it is a fee, not a vetting process - and a perfectly compliant supplier can still have its email compromised and its invoice swapped for one with different bank details. If you want the background on the EU scheme, start with what Verification of Payee is; the mechanics of checking an account holder are covered in how to verify the account holder of an IBAN.
Where an ICO check fits in supplier onboarding
The practical answer is: as one step among several, in a fixed order. A workable sequence for a new supplier looks like this.
- 1 Company check: confirm the legal entity, directors and filing history at Companies House, and match the name on the contract.
- 2 Data-protection check: look the entity up on the ICO register and record the registration number, tier and status.
- 3 Bank-detail check: run a name-to-IBAN check on the account you are about to pay, and store the verified name that comes back.
- 4 Change control: re-run the bank-detail check whenever the supplier's account details change, and confirm the change by phone on a number you already held.
The third and fourth steps are the ones that stop money leaving for the wrong account. For the wider process, including how to handle stored beneficiary data, see the supplier and vendor onboarding guide and the Verification of Payee page for businesses.
Never treat an ICO entry as proof of bank details
A registration number on a supplier's letterhead tells you the organisation paid a data-protection fee. It tells you nothing about the account number underneath it. Verify the account separately, every time the details change.
Common confusions and quick answers
Most of the confusion around ICO checks comes from three questions, so here they are plainly.
- When is registration required? Most organisations processing personal data must pay the fee, but exemptions exist - for example some small organisations that process data only for limited purposes. The ICO's free self-assessment tool tells you whether your own organisation needs to register.
- How do I find my own ICO reference number? Search the register by your organisation's legal name, or check the confirmation the ICO sent when the fee was paid. The number is on that record.
- Is an ICO number a company registration number? No. A company number comes from Companies House and identifies the legal entity. An ICO number identifies a fee-payer entry on the data-protection register. They are issued by different bodies for different purposes.
RoxPay delivers Verification of Payee on the SEPA scheme through one REST API and a dashboard, returning the standardised outcomes - match, close match, no match and not available - in well under a second, with the verified name on a close match, for a single payment or a whole payment file.