Every subcontractor who works on your site can trigger several legal and risk-management obligations — from Right to Work (in the situations where it applies) through to CIS verification, CSCS and insurance checks. Most of these should be satisfied before work starts, not after. This guide sets out a practical sequence, what each check involves, and what evidence you need to retain. Use it as a reference before every new engagement.
Not legal or tax advice
This article provides general information only and is not legal or tax advice. Rules depend on the specific facts of your situation. Always confirm your specific obligations with a qualified solicitor or accountant before relying on this guidance.
Before you onboard — what the law requires
Where they apply, these checks are not optional and cannot be contracted away. If you are the client-appointed Principal Contractor — a role triggered where a project involves more than one contractor — your duty to verify competence and legal status for the checks that apply to your project is a statutory obligation under multiple pieces of legislation, not a contractual choice. No subcontract clause, no letter of engagement, and no terms-and-conditions document can remove or transfer these obligations. They sit with you, as the party in control of the site.
The obligations come from different legal sources, and each one is independent of the others. Right to Work derives from the Immigration, Asylum and Nationality Act 2006 and the Immigration Act 2016. Competence requirements are anchored in the Building Safety Act 2022 and the Building Regulations etc. (Amendment) (England) Regulations 2023; CSCS cards are not themselves a legal requirement, but they're a widely used, commonly contractual way of evidencing that competence. Insurance obligations arise from the Employers' Liability (Compulsory Insurance) Act 1969 for EL cover, and from your own contractual risk management requirements for Public Liability. CIS deductions are governed by the Finance Act provisions that established and continue to govern the Construction Industry Scheme.
The sequence matters. Some checks must happen before the subcontractor sets foot on site; others must happen before the first payment. Carrying out checks in the wrong order, or retrospectively, significantly reduces or eliminates your legal protection. A Right to Work check carried out after work has already started does not provide a statutory excuse — it provides a record that the check was late. The purpose of each check is prevention and verification in advance, not documentation after the fact.
A checklist is only as useful as the records it generates. In practical and often in legal terms, completing a check and not recording it can amount to much the same position as not completing the check at all. Every step in this guide produces evidence — a document copy, a screenshot, a written confirmation, a reference number — and that evidence generally needs to be retained for the required period. When a regulator, an insurer, or a client asks for proof of compliance, the record is the proof. If you cannot produce it, the check may carry little practical weight.
The order of the checks
Where they apply, Right to Work, CSCS, and Insurance should all be confirmed before the subcontractor starts work. CIS verification must be completed before the first payment. Right to Work has a direct statutory basis for most engagements (see the carve-outs in Step 1 below); CSCS and insurance checks are best-practice and commonly contractual rather than standalone legal requirements. A subcontractor could potentially start on site while CIS is in progress, though this is not recommended.
Step 1 — Right to Work (before site access)
Where a Right to Work check is required, it must be confirmed before the subcontractor starts any work on site: retrospective checks, carried out after work has already begun, provide no statutory excuse under the Immigration, Asylum and Nationality Act 2006 or the Immigration Act 2016. Home Office guidance confirms that a Right to Work check is not required to establish a statutory excuse for someone who is genuinely self-employed under a contract for services, except where sponsorship, labour-supply or agency arrangements, or umbrella companies are involved, or where the "self-employed" label doesn't reflect the genuine substance of the relationship. Where the check does apply, timing is the foundation of your legal protection: a check completed on the first day of work is a check completed too late.
UK and Irish nationals: See the original passport or birth certificate, together with proof of their National Insurance number (a P60, payslip, or letter from HMRC). Take a clear copy. Note the date of the check and the name of the person who carried it out. You are not required to verify the document's authenticity beyond visual inspection, but you must be able to demonstrate that you checked an original document rather than a copy.
EU, EEA, and Swiss nationals (post-Brexit): The physical EU passport or ID card is no longer sufficient on its own for Right to Work purposes. Obtain a share code from the subcontractor — they generate this via the Home Office online service. Check it at gov.uk/view-right-to-work using the share code and their date of birth. The result page shows their name, the types of work they are permitted to carry out, and any time limit on their right to work. Screenshot the result page in full, including the date and the subcontractor's name as displayed.
All other nationals: Check their Biometric Residence Permit or other List A or List B document. List A documents provide an indefinite right to work — a single check is sufficient for the duration of the engagement. List B documents are time-limited: note the expiry date explicitly and set a calendar reminder to re-check before that date if the engagement is ongoing.
Retain: a copy of the document (or a full screenshot of the share code result), the date of the check, and the name of the person who carried it out. Retention period: for the duration of the engagement plus two years from the date the engagement ends.
See the full guide: Right to Work Checks for Subcontractors.
Step 2 — CSCS card (before site access)
Checking a CSCS card means checking it on the CSCS Smart Check register at cscs.uk.com — not simply looking at the physical card the subcontractor presents. A physical card can be expired, suspended, or not registered to the person holding it. The register is the primary source to rely on; the card is a prompt to check it.
You need the registration number printed on the card. Enter it together with the subcontractor's surname on the Smart Check page. The register returns the card type, the expiry date, and the current registration status. This takes less than a minute and provides the only reliable evidence that the card is current and valid.
Two things must be confirmed: first, that the card is registered and not expired; second, that the card type matches the role the subcontractor will perform on your site. CSCS card types correspond to occupational qualifications and levels of competence — a labourer's card does not authorise the holder to carry out skilled trades work. If the card type does not correspond to the work being engaged, the check has failed regardless of whether the card itself is current.
Screenshot the register result. That screenshot — showing the registration number, the name, the card type, the expiry date, and the status — is your evidence file. A verbal confirmation from the subcontractor that their card is valid is not evidence.
Expired cards: Do not allow site access until the card has been renewed and confirmed as current on the CITB register. This applies even if the subcontractor states that a renewal application is in progress.
Card type mismatch: Do not allow the specific work to proceed until a card of the appropriate type is confirmed. The subcontractor may have other valid cards for other trade types — check each relevant card for each trade role.
Retain: screenshot of the CITB register result, with the date of check recorded. Retain for the duration of the project.
See the full guide: CSCS Card Check Guide.
Step 3 — Insurance (before site access)
Insurance verification isn't a direct statutory requirement in the way Right to Work or CIS are, but it's core commercial risk management, and for Employer's Liability, checking that a subcontractor with employees actually holds current cover is how you confirm they're meeting their own statutory obligation. Best practice is to complete verification before work starts, not after. Ask the subcontractor to sign a Letter of Authority (LoA) before they are engaged on the project. The LoA authorises their insurer to communicate directly with you about the policy and to confirm cover details in writing. Without it, an insurer will typically decline to discuss a policy with a third party.
The process: the subcontractor emails their insurer with the signed LoA attached, copying your records address into the email. The email requests written confirmation of the following: that the policy is currently in force; the type of cover and the indemnity limit; the policy period (start and expiry dates); and any relevant exclusions that could affect your project.
Wait for written confirmation from the insurer before allowing work to start. The confirmation must come directly from the insurer or broker — not from the subcontractor relaying what their insurer told them. The chain of documentation must be insurer to you, or insurer copied into the subcontractor's email to you.
Public Liability (PL): Not a statutory requirement, but commonly required by main contracts and standard risk-management practice for any subcontractor. PL covers third-party claims for property damage or personal injury caused by the subcontractor's work. Check the indemnity limit against your contract requirements — many main contracts specify a minimum PL level, commonly £2M, £5M, or £10M per occurrence.
Employer's Liability (EL): Required for limited company subcontractors who have employees. EL is a statutory requirement under the Employers' Liability (Compulsory Insurance) Act 1969, with a statutory minimum indemnity of £5M. Sole traders with no employees are not required to hold EL, but you should confirm that status explicitly rather than assume it.
Do not accept a certificate alone as evidence of cover. Insurance certificates confirm that cover existed at the point of issue — they do not confirm that it remains in force, has not been cancelled, or applies to the type of work on your site. Insurer confirmation in writing is the required standard.
Retain: the signed LoA, the subcontractor's email to the insurer, and the insurer's written confirmation. Retention period: for the duration of the project plus six years from practical completion.
See the full guide: How to Verify Subcontractor Insurance.
Step 4 — HMRC CIS verification (before first payment)
CIS verification must be completed before you make the first payment to a subcontractor. Unlike Right to Work, CSCS, and Insurance — which must be in place before work starts — CIS verification is required before the first payment, not before the first day on site. However, best practice is to complete it as part of onboarding so that the deduction rate is confirmed before payment is ever due.
Log in to HMRC's Government Gateway and run the verification using the subcontractor's Unique Taxpayer Reference (UTR) and National Insurance number. For limited company subcontractors, use their Company Registration Number (CRN) in place of a NI number. HMRC's system matches the subcontractor against its records and returns a verification number together with the deduction rate that applies.
Three deduction rates can be returned: Gross (0%), meaning the subcontractor is registered and meets HMRC's compliance criteria and you make no deduction; Standard (20%), meaning the subcontractor is registered but not at Gross status and you deduct 20% from their labour costs; or Higher (30%), meaning HMRC cannot match the subcontractor against its records, which is the default risk rate applied when verification has not been completed or cannot be matched.
Apply the rate HMRC confirms — not the rate the subcontractor claims or tells you they are entitled to. A subcontractor asserting that they are Gross registered is not, on its own, verification. HMRC treats a verification number as the standard evidence of verification under the scheme. If you pay at a lower rate than HMRC has confirmed, HMRC's guidance indicates the liability for the shortfall generally sits with you as the contractor rather than the subcontractor — confirm your specific position with HMRC or a qualified adviser.
Retain: the verification number, the date verification was carried out, the deduction status confirmed by HMRC, and the deduction amounts applied to each subsequent payment. Retention period: three years from the end of the relevant tax year.
HMRC guidance treats reverification as generally unnecessary if the subcontractor appeared on one of your CIS returns in the current tax year or either of the two previous tax years, but if that's not the case, or you're in any doubt, re-verify before paying them. CIS status is not permanent: a subcontractor can lose Gross status if they fall behind on filings or tax payments, so treat verification as a check to repeat whenever it's actually required, not just a box ticked once.
The April 2026 rule change
From April 2026, HMRC's "Knew or Should Have Known" standard targets payments connected to fraud: it is not triggered simply by failing to verify a subcontractor's status. But if a payment does turn out to be connected to fraud, having failed to verify (and relying only on the subcontractor's word) makes it much harder to show you didn't know and couldn't reasonably have known. Under HMRC's guidance, holding a HMRC verification number is generally the strongest protection available, though your specific position should be confirmed with HMRC or a qualified adviser. See the full CIS guide for details: HMRC CIS Subcontractor Verification Guide.
See the full guide: HMRC CIS Subcontractor Verification Guide.
Step 5 — Trade registrations (where applicable)
Several trades carry their own statutory or scheme-based registration requirements that operate alongside the standard onboarding checks. These checks are conditional — they apply only when the trade type requires them. A groundworker does not need a Gas Safe registration. A subcontractor engaged for gas work requires nothing less.
Gas work — Gas Safe Register: All work on gas installations must be carried out by a Gas Safe registered engineer. This is a legal requirement, not a contractual preference. Check the register at gassaferegister.co.uk using the engineer's Gas Safe licence number. The register confirms the engineer's name, their licence number, the licenced business they work for, and — critically — which specific gas work types they are registered and competent to carry out. A registration for domestic gas appliances does not authorise the engineer to work on commercial boiler plant. Match the registered work types to the work on your site before allowing any gas work to commence.
Electrical work — NICEIC, NAPIT, or ECS: Check the relevant scheme's register using the engineer's registration number. For Part P notifiable work — domestic electrical installations — the installer must be registered with a competent person scheme, such as NICEIC or NAPIT. Unregistered Part P work is a building regulations offence and creates significant liability for the party who engaged the installer. For commercial electrical work, ECS (Electrotechnical Certification Scheme) card registration provides evidence of relevant competence; verify it on the ECS register in the same way as a CSCS check.
CHAS, Constructionline, SafeContractor: These accreditation schemes are not statutory requirements, but they are frequently specified in main contracts as a condition of engaging subcontractors. Check your main contract requirements before engaging any subcontractor who lacks the specified accreditation. If the main contract requires Constructionline Gold and you engage a subcontractor with Silver, you may be in breach of your own obligations to the client — even if the subcontractor is fully compliant in every other respect.
For all trade registration checks: screenshot the register result, note the date of the check, and retain it in the project file for the duration of the relevant work. As with all compliance records, the screenshot is the evidence — a verbal confirmation from the subcontractor that their registration is current is not.
After onboarding — staying compliant
Completing the onboarding checks is not the end of your compliance obligation — it is the beginning of it. Several checks have expiry dates that trigger follow-up requirements, and a project that runs for more than a few months will almost certainly require at least some renewals and re-verifications before completion.
CSCS cards are typically valid for five years. Set a renewal reminder at the point of the original check. A subcontractor who was CSCS-verified and cleared for site on a previous project may have an expired card by the time you engage them again. Never carry a previous check forward to a new project — always run a fresh CITB register check at the start of each engagement.
Insurance renews annually in most cases. If your project runs longer than twelve months, re-confirm cover at the subcontractor's annual renewal point. Ask for the same insurer confirmation letter that you obtained at onboarding. A gap in cover mid-project — even a brief administrative lapse during renewal — can have significant implications for any claim that falls in that window.
CIS status should be re-verified when you engage a subcontractor on a new project if they haven't appeared on one of your CIS returns in the current tax year or either of the two previous tax years. HMRC guidance treats reverification as unnecessary outside that window, but status can still change (a subcontractor can lose Gross status if they fall behind on filings or tax payments), so check again whenever you're not confident the position is current.
Right to Work — List B documents are time-limited. At the point of the initial check, note the document's expiry date explicitly. If the engagement continues beyond that date, you must re-check before expiry. Failing to do so converts what was a valid check into a lapsed one — and from the point of expiry onwards, you are working without a current Right to Work check in place.
Keep your records updated throughout the project. If a credential changes mid-project — a card is renewed, cover is extended, CIS status changes — update the project record at the time. An audit trail that captures onboarding but goes dark after day one is only partially useful: it shows you started correctly, but it cannot demonstrate that you stayed compliant.
The onboarding checklist at a glance
Use this table as a quick reference before every new subcontractor engagement. Some rows are direct legal obligations; others (CSCS, insurance checks) are best-practice and commonly contractual rather than standalone legal requirements, but all are worth treating as non-negotiable on a professionally run site.
| Check | When | Evidence to keep | Retention period |
|---|---|---|---|
| Right to Work | Before work starts | Document copy or share code screenshot + date + checker name | Duration of engagement + 2 years |
| CSCS card | Before work starts | CITB register screenshot + date | Duration of project |
| Insurance (PL) | Before work starts | LoA + insurer written confirmation | Project + 6 years |
| Insurance (EL) | Before work starts (Ltd Co with employees) | LoA + insurer written confirmation | Project + 6 years |
| HMRC CIS | Before first payment | Verification number + date + deduction status | 3 years from end of tax year |
| Gas Safe | Before gas work starts | Register screenshot + date | Duration of relevant work |
| Electrical scheme | Before electrical work starts | Register screenshot + date | Duration of relevant work |
Subchecked automates steps 1–4
Right to Work, CSCS, Insurance, and CIS all managed in one place. Every check timestamped and stored. Every record produced instantly when a regulator asks.
Reminder
This guide is general information, not legal or tax advice. Confirm your specific obligations with a qualified solicitor or accountant.