How to Verify a Subcontractor's Insurance: What UK Contractors Need to Know

Why a certificate isn't enough

A certificate of insurance is a summary document produced by or for the policyholder — not a direct statement from the insurer confirming the policy is in force today.

Certificates can be backdated, forged, or reference a policy that has since been cancelled or lapsed. Insurers are not automatically notified when a certificate is used to obtain a contract — meaning a subcontractor can circulate a certificate for a policy that no longer exists, and no alert is triggered.

If an uninsured subcontractor causes property damage, personal injury, or death on your site, the claim goes to your insurer first. If you cannot demonstrate that you verified the subcontractor's cover before work started, your insurer may pursue recovery against you personally.

Checking a subcontractor's insurance isn't itself a direct statutory requirement — it's commercial risk management, and often a contractual one. But on projects with more than one contractor, the Building Safety Act 2022 requires the client to appoint a Principal Contractor in writing, and that role carries responsibility for coordinating compliance across the supply chain. Where you hold that role, insurance verification is a sensible part of demonstrating the duty of care you carry for the whole project.

What is a Letter of Authority?

A Letter of Authority (LoA) is a signed document from the subcontractor that authorises their insurer to disclose policy details to you.

Why it's necessary: under UK GDPR (tailored by the Data Protection Act 2018), an insurer cannot disclose a policyholder's policy details to a third party without the policyholder's explicit consent. The LoA is that consent. Without it, most insurers will refuse to confirm policy details regardless of how the request is made — and regardless of how reasonable that request might appear.

What the LoA should include:

• The policyholder's name (the subcontractor's trading name or registered company name)
• The policy number, if known
• The name of the contractor requesting confirmation
• An authorisation statement — explicit wording confirming that the policyholder consents to the insurer disclosing policy details to the named contractor
• A date — the LoA should be dated close to the time it is used

Who signs it: the subcontractor, before work starts. Obtaining the LoA is part of your pre-commencement onboarding process — it should sit alongside the subcontractor agreement, not be chased after work has already begun.

Public Liability vs Employer's Liability — what to check

Not all insurance obligations are the same. Two policies are relevant for almost every subcontractor engagement, and they cover different risks.

Public Liability (PL) covers damage or injury caused to third parties — homeowners, passers-by, adjacent properties — as a result of the subcontractor's work. There's no law making PL cover compulsory, and no statutory minimum — but in practice it's expected of virtually every subcontractor, and most main contracts specify a minimum indemnity limit of £1M–£2M. Check your specific contract requirements and compare them against the subcontractor's indemnity limit before work starts.

Employer's Liability (EL) covers the subcontractor's own workers if they are injured during the course of their work. Under the Employers' Liability (Compulsory Insurance) Act 1969, EL is a legal requirement for any subcontractor who employs people — meaning any Limited Company with employees, or any sole trader who takes on labour. The statutory minimum for EL is £5 million.

What to look for on a certificate — even as a starting point before you obtain insurer confirmation:

• Policy period: is the certificate current? Check the expiry date explicitly.
• Indemnity limit: does it meet your contract minimum?
• Any exclusions: some policies exclude specific types of work — demolition, work at height, or work near live services. If the exclusion is relevant to what your subcontractor will be doing, the certificate is not adequate.

Type	Required for	Statutory minimum	What it covers
Public Liability	All subcontractors	None — check contract	Third-party injury or property damage
Employer's Liability	Subcontractors with employees	£5,000,000	The subcontractor's own workers

How to get written confirmation from the insurer

Written confirmation from the insurer — not from the subcontractor, and not from a broker acting as an intermediary — is the standard you are working towards. Here is how to get it.

1. Get the subcontractor to sign a Letter of Authority before work starts. This is non-negotiable. Without it, the insurer will not disclose policy details to you, and the process stops here.
2. The subcontractor emails their insurer with the LoA attached. The email should ask the insurer to confirm:
   • (a) that the policy is currently in force
   • (b) the policy type and indemnity limit
   • (c) the policy period (start and end dates)
   • (d) that there are no known exclusions affecting the type of work being carried out on your project

   The subcontractor's email should CC your records email address, so that the insurer's reply comes to you directly rather than being relayed through the subcontractor.

3. The insurer replies confirming these details. That reply, retained alongside the LoA and the subcontractor's original email, constitutes written insurer confirmation. Most insurers respond within 48–72 hours for straightforward policies. Some larger commercial policies — particularly those with multiple endorsements or unusual risk profiles — may take longer.

   What the reply needs to say: the confirmation must come from the insurer directly, not from a broker acting as an intermediary. It must reference the specific policy number and confirm that the policy was in force on the date of the request. Broker-issued confirmation letters are not equivalent.

What to do if the insurer doesn't respond

Non-response from an insurer is uncommon but not rare, particularly with smaller or less active policies. Here is a graduated response.

Chase once — a polite follow-up from the subcontractor to their insurer, with you CC'd, sent 72 hours after the original request. Most genuine non-responses are resolved at this stage.

Escalate to the subcontractor. Their insurer, their relationship. Ask them to call their insurer directly and request a written confirmation email be sent the same day. A policyholder calling their insurer typically gets a faster response than a third-party request.

Do not allow work to continue on site while insurance is unconfirmed. This is the point where many contractors make the mistake of letting work start "provisionally." There is no provisional insurance verification. The moment a subcontractor begins work on your site, the risk exposure begins — and if their insurance is not confirmed, that exposure is generally yours to carry, though the specifics will depend on your contract and circumstances.

Last resort only: if the subcontractor can demonstrate the policy is in force via direct documentary evidence — a current renewal notice from the insurer, for example, not a certificate they have produced themselves — you may choose to mark the insurance as "Document accepted" with a note explaining precisely what was reviewed and why normal insurer confirmation was not obtained. This is a reduced standard of verification and should be clearly noted as such in your audit trail. It does not give you the same protection as written insurer confirmation.

How long to keep insurance records

Keep the LoA, the subcontractor's email, and the insurer's confirmation for the project lifecycle plus six years.

Why six years: the standard limitation period for contractual claims in England and Wales is six years from the date the cause of action arose, under the Limitation Act 1980. A claim arising from a subcontractor's work — property damage that becomes apparent after the project completes, for example — could be brought up to six years after that damage occurred. You need the insurance verification record to show that you took reasonable steps to confirm cover at the time.

For claims involving personal injury: the limitation period under the Limitation Act 1980 is three years, but because the trigger date can vary (the date of knowledge may be later than the date of the incident), six years is the safer retention period as a general policy.

Digital storage with timestamps is the ideal format. A document management system or purpose-built compliance platform that records the date and time each document was added gives you an immutable audit trail. Physical photocopies are acceptable but are vulnerable to loss, deterioration, and difficulty in sharing quickly when a claim arises or an insurer requests documentation.