Website redesign checklist: what a cold buyer checks

Four kinds of people arrive at a company website with a question rather than an interest: a prospect deciding whether you are worth a meeting, a partner deciding whether to be associated with you, a procurement team filling in a form, and — if you take card payments — someone underwriting your merchant account.

They are not reading. They are checking. And the thing worth understanding is that for the regulated ones, your website is explicitly not the evidence.

The Money Laundering Regulations 2017 require a firm to obtain and verify a corporate customer's name, company number and registered office address. Regulation 28(18) defines what verification means: information "obtained from a reliable source which is independent of the person whose identity is being verified". Your own site is not independent. It cannot prove anything about you.

What it can do is contradict the register. That is the whole risk, and it is why the details below matter out of all proportion to how boring they are.

This article describes what the sources say. It is not legal advice, and a decision that turns on any of it is one to take with a solicitor.

The instrument in force is the Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations 2015. It replaced the 2008 Regulations, which are still widely cited.

Regulation 24(2) provides that every company "shall disclose its registered name on its websites". Regulation 25 requires four further particulars on business letters, order forms and websites: the part of the United Kingdom in which the company is registered, its registered number, the address of its registered office, and — where applicable — its status as a limited company. Regulation 20 requires any such disclosure to be in "characters that can be read with the naked eye". The instrument specifies no location on the site.

Failure without reasonable excuse is an offence under regulation 28, committed by the company "and every officer of the company who is in default", carrying a fine not exceeding level 3 on the standard scale.

The duty does not extend to every business. Section 1202 of the Companies Act 2006, which governs sole traders and partnerships trading under a business name, lists business letters, written orders, invoices and receipts, and written demands for payment. Websites appear nowhere in that section.

A separate instrument reaches further. Regulation 6 of the Electronic Commerce (EC Directive) Regulations 2002 requires an online service provider to make available, "in a form and manner which is easily, directly and permanently accessible", its name, the geographic address at which it is established, contact details including an email address, its trade register and registration number, and — where it undertakes an activity subject to VAT — its VAT number. Regulation 13 makes those duties enforceable "at the suit of any recipient of a service" as an action for damages for breach of statutory duty. That is a private claim rather than a regulatory one, which is an unusual enforcement route and rarely mentioned.

For EU-established businesses the parallel provision is Article 5 of Directive 2000/31/EC, which uses the same "easily, directly and permanently accessible" standard and runs from the provider's name at (a) to its VAT number at (g). The Digital Services Act did not replace it: Article 89 of Regulation (EU) 2022/2065 deletes Articles 12 to 15 of the Directive, which are the liability provisions. Article 5 survives unamended.

If the site takes payments, a second set of rules applies, and the version circulating online is usually not the one in the rulebooks.

Visa's current public rules state that an electronic commerce merchant website must contain a customer service contact including an email address or telephone number, and must display the merchant outlet's country either on the checkout screen or within the checkout sequence — noting that "a link to a separate web page does not" satisfy that. The frequently reproduced ten-item checklist covering export restrictions, privacy policies and security capabilities does not appear in that rule. Those terms are Stripe's, from its own published website checklist, which describes itself as "based on the rules published by the card networks" rather than as a reproduction of them.

Mastercard's rules add the sharper requirements. Contact details must "remain displayed for at least 90 calendar days after the last day on which a Transaction was performed" — a duty that outlives trading. Merchant location "must be disclosed before the Cardholder is prompted to provide Card information", and the disclosed name and country must match what appears in the authorisation and clearing messages. On establishing where a business is, the rules state that "the Uniform Resource Locator (URL) of a website" does not satisfy the requirement.

Two further provisions are commonly overstated. Terms for a recurring or instalment arrangement must be accepted "separately from any other terms", so a single bundled acceptance does not satisfy it. And a merchant is "required to accept the return of products or the cancellation of services unless specific disclosure was provided at the time of the Transaction" — the absence of a stated policy is itself the policy. The requirement for a direct online cancellation link, often quoted as a general subscription rule, is conditional: it applies where the merchant is a negative option billing merchant.

Anything written about UK cookie rules before this year is now describing a superseded regime.

Regulation 6 of the Privacy and Electronic Communications Regulations was substituted in its entirety with effect from 5 February 2026 by section 112 of the Data (Use and Access) Act 2025. The exceptions moved into a new Schedule A1. Two of them are new: storage for statistical purposes about how a service is used, and storage to adapt a site's appearance or functionality, are both permitted on the basis of clear information plus "a simple means of objecting, free of charge". That is an opt-out footing rather than consent, and it is a genuine divergence from the EU position.

The Information Commissioner's Office is explicit about the limit of that. Its current guidance states that "there are no advertising purposes that meet the strictly necessary exception", and that online advertising purposes "are not exempt from PECR's consent requirements and never have been" — listing frequency capping, ad measurement, click fraud detection and product improvement among them.

The ceiling also moved. Schedule 1 paragraph 18 of PECR substitutes a list including regulation 6 into section 157(2)(a) of the Data Protection Act 2018, which is the higher-maximum limb; section 157(5) sets that at £17,500,000 or 4% of total annual worldwide turnover, whichever is higher.1 The previous maximum was £500,000.1

Beyond the required, there is a small body of research that actually measured which page elements move a credibility judgement — and it is old, which is worth saying up front. The best of it is a Stanford study from 2001 with 1,410 participants,2 who rated 51 site elements on a seven-point scale from "much less believable" to "much more believable".

The factor with the largest positive effect was what the authors called "real-world feel". The individual items are unglamorous: a quick response to customer service questions scored +2.02, listing the organisation's physical address +1.86, a contact phone number +1.71, a contact email address +1.53.

The negatives are more useful still, because they are cheap to avoid: a domain name that does not match the company name scored −1.06, a typographical error −1.28, a link that does not work −1.45, and a site that is rarely updated −1.67.

A second study, at CHI 2004, found something different and worth holding alongside it: design appeal predicted rejection, while credibility of information and personalisation predicted selection. Design is how a site gets eliminated. Content is how it gets chosen.

A number can be famous and still have no birth certificate.

"94% of first impressions are design-related" is one of the most repeated figures in web design and one of the least sourced.3 Where an attribution is given at all, it is usually to Google or to Stanford. Google's 2012 work on visual judgement reports a different figure on a different question. Stanford's number is 46.1%, it comes from a 2002 report, and it describes a share of participant comments rather than of impressions.3

The academic paper the figure is usually pinned to is Sillence, Briggs, Fishwick and Harris, "Trust and mistrust of online health sites", CHI 2004. Its published abstract describes fifteen women, observed over four consecutive weeks while researching a health decision, and reports that "design appeal predicted rejection (mistrust) and credibility of information and personalisation of content predicted selection (trust) of advice sites".

The number 94 appears nowhere in that abstract. The paper itself sits behind a paywall, so this article does not claim to have read it — only that the figure everyone quotes is not in the record anyone can reach.

Two more, briefly. The claim that users decide whether to trust a site in 50 milliseconds misstates the study it comes from, which measured visual appeal ratings of screenshots. And the "Companies (Trading Disclosures) Regulations 2008" are still cited across law-firm blogs; they were replaced in 2015.

Everything above, compressed. The first group is what the sources require; the second is what the research associates with being believed.

• Registered name, registered number, place of registration and registered office address, legibly, somewhere on the site
• A geographic address and a contact email that a person can actually reach
• A VAT number where the business undertakes an activity subject to VAT
• Details that match the public register exactly — not approximately
• If cards are taken: a customer service contact, the merchant country inside the checkout sequence rather than behind a link, a stated returns position, and recurring terms accepted separately
• If anything is stored on a visitor's device: information about it, and a free and simple way to object where the new statistical and appearance exceptions are relied on
• No broken links, no typographical errors, a domain that matches the company name, and evidence of having been touched this year

None of this makes a business credible. It removes the reasons to doubt one, which is a different job and the only one a website can actually do.

The two client rebuilds on this site were both built against this standard: Developer Genome, a London fintech whose bar was a payments underwriter, and CityRoamer. The method is on the redesign service page.