Every main contractor has had the moment: a subcontractor is already on site, and someone discovers their insurance lapsed last month. Onboarding is the cheapest point to get documents, because the subcontractor wants the work. Once they're on site and invoicing, your leverage drops and the chasing starts.
This guide sets out what to collect before a subcontractor starts, why each item matters, how to scale the list to the risk of the package, and how to check what you've received rather than just filing it. It also covers ongoing monitoring, passing your client's requirements down the chain, and offboarding. The detail is mostly UK (CIS, VAT, SSIP, CDM 2015), with notes for US contractors where the documents differ.
Why day one matters
Collecting documents isn't box-ticking. Each one protects you against a specific failure:
- Insurance decides who pays when something goes wrong. If a subcontractor's cover has lapsed or excludes the work, the claim can land on you.
- Tax details decide whether you deduct correctly. Under the UK Construction Industry Scheme (CIS), getting the deduction wrong can leave you liable for the tax you should have withheld.
- Health and safety evidence is how you show you checked competence. In the UK, CDM 2015 requires anyone appointing a contractor to take reasonable steps to satisfy themselves that the contractor has the skills, knowledge and experience, and organisational capability, to do the work safely.
- Bank details are a favourite target for fraud. A single redirected payment can cost more than the whole package margin.
- Client requirements don't stop at you. If your contract says every subcontractor must hold a particular accreditation or insurance level, you're in breach the day one turns up without it.
The documents, by category
Company and identity
- Full legal name and trading name, exactly as they'll appear on invoices and insurance.
- Company registration number (UK: check it on Companies House, confirm the company is active and note the directors). For sole traders and partnerships, the individual or partners' names.
- Registered and trading addresses, and a named contact for compliance.
- Ownership or group structure, if your client asks for it or you need to check for conflicts.
Tax
UK.
- CIS details: the subcontractor's Unique Taxpayer Reference (UTR), plus their National Insurance number (individuals) or company registration number (companies). You need these to verify them with HMRC before the first payment, unless you've included them on a CIS return in the current or previous two tax years. HMRC tells you whether to pay gross, deduct at the standard rate (20%) or the higher rate (30%, if they can't be matched). Record the verification reference.
- VAT registration number, checked using HMRC's online VAT number check. For construction services within CIS, the domestic reverse charge may apply, which changes who accounts for the VAT. Agree with the subcontractor in writing whether it applies, and make sure their invoices are worded correctly. If in doubt, ask your accountant.
US.
- A completed Form W-9 with the subcontractor's legal name, entity type and taxpayer identification number. You need it for 1099 reporting, and without a valid TIN you may be required to apply backup withholding. Reporting thresholds have changed recently, so check current IRS guidance rather than relying on last year's figure.
- Contractor licence numbers where the state or trade requires them, checked with the issuing state board.
Insurance
Ask for certificates and enough of the policy detail to see limits, the named insured, the period and any relevant exclusions.
UK packages usually need:
- Employer's liability, which is compulsory for most employers and must be at least £5 million by law (most policies provide £10 million).
- Public liability, at the limit your client requires (often £5 million or £10 million on commercial work, but check your contract).
- Professional indemnity if they design anything, including temporary works or contractor's design portions.
- Contract works or plant cover where your subcontract makes them responsible for it.
US packages usually need a certificate of insurance (commonly the ACORD 25 form) showing general liability, auto, workers' compensation and umbrella or excess cover. A certificate is for information only and doesn't itself change the policy. If your contract requires you to be an additional insured, or requires a waiver of subrogation, ask for the endorsements themselves, not just a tick on the certificate.
Things to check on every certificate:
| Check | Why |
|---|---|
| Named insured matches the legal entity you're contracting with | A policy for "Smith Electrical Ltd" doesn't cover "Smith Electrical Services Ltd" |
| Limits meet your subcontract and your client's requirements | Your client's requirement is the floor, not your own preference |
| Policy period covers the work, with the expiry recorded | The date is what you'll be chasing in six months |
| The described business or activities cover the package | A policy for "electrical installation" may not cover working at height or hot works |
| Exclusions and excesses are acceptable | Some policies exclude heat, depth or height above a stated limit |
| Issued by the broker or insurer, not retyped by the subcontractor | Altered certificates do exist |
Health and safety
- Health and safety policy, signed and dated by a director within the last twelve months.
- Accreditations, for example an SSIP member scheme (CHAS, SafeContractor, Constructionline and others), or the Common Assessment Standard where your client asks for it. Check the certificate on the scheme's own website.
- RAMS for the package, specific to your site, not a generic set. See RAMS that get approved first time for what a reviewer should look for.
- Accident and enforcement history: reportable incidents (in the UK, under RIDDOR) and any enforcement notices or prosecutions in the last few years, or a clear statement that there were none.
- Trade-specific registrations where the law requires them. In Great Britain, examples include Gas Safe registration for work on gas appliances, an HSE licence for licensed asbestos work, and waste carrier registration for anyone carrying waste. Electrical contractors are commonly registered with a competent person scheme such as NICEIC or NAPIT.
People and competence
- A list of operatives and supervisors who will be on site, with their card or ticket types, numbers and expiry dates.
- Construction skills cards (in the UK, usually CSCS or a partner scheme), plant operator cards (for example CPCS or NPORS), and supervisor training such as SSSTS or SMSTS where your site rules require them.
- Task-specific training relevant to the package: working at height, harness use, abrasive wheels, confined spaces, first aid.
- Right to work. In the UK the legal duty to check right to work sits with whoever employs the worker. Many main contractors ask subcontractors to confirm in writing that they've carried out checks for their own staff. The rules on checks for self-employed and agency arrangements have been under review, so check current Home Office guidance for your situation.
References and track record
- Two or three references from recent, similar work, ideally with a contact you can phone.
- For larger packages, financial standing: latest accounts or a credit check, so you're not relying on a subcontractor who may not last the job.
Bank details
Bank detail fraud usually arrives as a convincing email, apparently from the subcontractor, saying their bank details have changed. Treat the bank details as a controlled record:
- Collect them on letterhead or a signed form, not in the body of an email.
- Verify by phone using a number you already hold (from the contract or their website), never one given in the same message.
- Use Confirmation of Payee (in the UK) where your bank offers it, to check the account name matches.
- Make a small test payment on high-value packages and get it confirmed.
- Apply the same steps to every change request, and have someone other than the person who received the request approve the change.
Commercial
- Signed subcontract or order, with scope, programme, price and payment terms.
- Agreed retention, valuation and payment application dates.
- Any collateral warranties, parent company guarantees or bonds your client requires.
Proportionate by risk
Not every subcontractor needs the full set. A one-day supply-only delivery isn't the same as a steel erection package. Asking for everything from everyone wastes time and trains subcontractors to send rubbish.
A simple three-tier approach works for most small and mid-sized contractors:
| Tier | Typical packages | What to collect |
|---|---|---|
| Low | Supply only, deliveries, short visits with no hazardous work | Company and tax details, bank verification, public liability, site rules acknowledgement |
| Medium | Routine trades on site: decorating, joinery, general labour | Low tier, plus employer's liability, H&S policy, accreditation if held, operative list with cards, task RAMS, references |
| High | Work at height, lifting, hot works, demolition, excavation, confined spaces, electrical or gas, any design | Medium tier, plus specific RAMS reviewed before start, plant and operator certificates, supervisor competence, PI if they design, trade registrations, enforcement history, financial check on large packages |
Write the tiers down and decide the tier when the package is let, not on the day the subcontractor arrives.
Verify, don't just collect
A folder of PDFs is not evidence of anything until someone has checked it. For each document, the check should take a minute or two:
- Companies House: entity active, name and number match.
- HMRC: CIS verification done, VAT number valid.
- Insurance: named insured, limits, dates and activities checked against the subcontract; call the broker if anything looks altered.
- Accreditations: looked up on the scheme's own register.
- Cards: checked with the card scheme's online or app check, and the photo matches the person at the gate.
- References: at least one phoned, not just a letter on file.
- Bank details: verified by call-back before the first payment.
Record who checked, when, and how. A note such as "CSCS verified via app, 14/10, JB" is the difference between a file and an audit trail.
A day-one checklist
Send this as one request, with a single deadline, before the start date. Trickling requests over several emails is how items get missed.
| Item | Tier | Verified by | Expiry recorded |
|---|---|---|---|
| Legal name, company number, addresses | All | Companies House check | n/a |
| CIS verification (UK) or W-9 (US) | All | HMRC verification ref / TIN on file | n/a |
| VAT number and reverse charge position (UK) | All | HMRC VAT check | n/a |
| Bank details on signed form | All | Call-back to known number | n/a |
| Public or general liability | All | Certificate checked against subcontract | Yes |
| Employer's liability or workers' compensation | Medium, High | Certificate checked | Yes |
| Professional indemnity (if designing) | High | Certificate checked | Yes |
| H&S policy, signed in last 12 months | Medium, High | Read and dated | Review date |
| Accreditation certificates | Medium, High | Scheme register | Yes |
| Package RAMS | Medium, High | Reviewed and approved | Per job |
| Operative list with cards and tickets | Medium, High | Card scheme check | Yes, per person |
| Trade registrations (gas, asbestos, waste) | As applicable | Official register | Yes |
| References | Medium, High | Phone call | n/a |
| Signed subcontract or order | All | Countersigned | n/a |
| Client-specific requirements | As applicable | Checked against main contract | As applicable |
Hold site access until the required items are complete. It sounds strict, and it's the only rule that holds. If you allow exceptions, make them a named manager's written decision with a date for closing the gap.
Flow down your client's requirements
Your main contract will usually say something about subcontractors. Read it before you let the package, and copy the relevant requirements into the subcontract:
- Insurance levels and types, which may be higher than your own standard.
- Accreditations the client requires, such as a particular SSIP scheme, the Common Assessment Standard or ISO certification.
- Approval rights: some clients must approve subcontractors before appointment.
- Site rules, inductions and drug and alcohol policies.
- Policies such as modern slavery, anti-bribery, data protection or environmental requirements.
- Reporting obligations, such as hours worked, incidents, waste or fuel data.
- Payment terms, especially on public sector work, where you may be required to pay your supply chain within set timescales.
A useful habit is a one-page "client requirements" sheet for each contract, attached to every subcontract let under it.
Keep it current
Onboarding gets you a complete file on day one. It decays from day two. Insurance renews annually, cards expire, accreditations need reassessment, and RAMS need revising when the job changes.
- Record every expiry date as you receive the document. That's your renewal calendar.
- Chase 30 days ahead of each expiry, and again at 14 days.
- Review active subcontractors at least annually, and at the start of each new package.
- Re-check before re-engaging a subcontractor you haven't used in a while.
- Score performance after each package: safety, quality, programme and paperwork. It makes the next selection easier and gives you evidence for ISO 9001 or a client audit.
For a fuller approach to tracking expiry dates, see Certificates expire on a schedule. Your tracking shouldn't depend on memory.
Offboarding
The end of a package needs a short checklist too:
- Revoke site access: passes, keys, fobs, system logins.
- Collect handover documents: test certificates, commissioning records, as-built information and O&M material for the health and safety file.
- Close out snags and agree the final account, including retention release dates.
- Complete tax obligations: final CIS deductions and returns, or year-end 1099 reporting in the US.
- Record a performance review and update the approved list.
- Archive the file, don't delete it. Keep records for as long as tax, insurance and contract obligations require, and ask your adviser if unsure.
Common mistakes
- Accepting a certificate for the wrong entity. The most common insurance gap.
- Filing without reading. An exclusion for the exact work being done is only useful if someone spots it.
- Generic RAMS. A set written for another site, with the wrong address and hazards.
- Paying before CIS verification. Easy to do when a subcontractor is brought in at short notice.
- Changing bank details on the strength of an email.
- No owner. Onboarding sits between commercial, site and office, and without a named owner each assumes another has it.
Start here
Take your current subcontractor list and pick the five on site this month. For each, check three things: insurance in date for the right entity, CIS verification recorded, and bank details verified by call-back. Fix the gaps you find, then turn the checklist above into your standard request.
Software helps with the repetitive parts: sending one consistent request, reading expiry dates off uploaded certificates, flagging mismatched entity names and chasing renewals before they lapse. The decision to let someone on site stays with a person.
If the subcontractor's paperwork is incomplete on day one, it will still be incomplete on day sixty.