Contractor and Subcontractor Onboarding Checklist for the UK
This is what most UK businesses collect from a contractor or subcontractor before they start. Not every item applies to every job. A freelance bookkeeper and a groundworks subcontractor need different paperwork, so cut the list to suit the work.
Two things run through all of it. Check the person really is self-employed, and check what they give you against the official register, not just the piece of paper.
1. Check their employment status
Do this first, because the rest of the list assumes they are self-employed. GOV.UK defines it plainly: "a person is self-employed if they run their business for themselves and take responsibility for its success or failure." It also warns that HMRC may treat someone as self-employed for tax even where employment law sees them differently.
HMRC's Check employment status for tax tool (CEST) gives HMRC's view based on your answers. HMRC stands by the result if the information you enter is accurate.
If the contractor works through their own limited company, the off-payroll working rules (IR35) apply. A medium or large client decides the worker's status and issues a status determination statement. A small client outside the public sector leaves that decision to the contractor's company. IR35 and off-payroll working covers it in full.
2. A signed contract
The contract doesn't make someone self-employed, but it records the deal. At a minimum it should cover the scope of work, how and when you pay, who supplies tools and materials, the insurance you expect them to hold, and who owns what they produce.
Write it to match how the work will actually run. A contract that says the contractor decides how the work is done, next to a rota of fixed shifts, works against you on status.
3. Unique Taxpayer Reference (UTR)
A UTR is a 10-digit reference HMRC issues when someone registers for Self Assessment or sets up a limited company. A limited company has its own UTR, separate from the director's.
Outside construction you mostly need it for your records. Inside construction you need it to verify the subcontractor for CIS, which is the next item.
4. Construction Industry Scheme (CIS)
If you pay subcontractors for construction work, you must register as a CIS contractor before you take on your first subcontractor. A business outside construction must also register once its construction spend passes £3 million in the 12 months since its first payment.
Verify before you pay. Before you pay a new subcontractor, you verify them with HMRC. You need:
| Subcontractor | Details to give HMRC |
|---|---|
| Sole trader | Their UTR and National Insurance number (temporary numbers starting "TN" can't be verified) |
| Limited company | Company name, company UTR and company registration number |
| Partnership | Nominated partner's details, trading name and partnership UTR |
The details must match exactly what the subcontractor used to register with HMRC. You also need to verify a subcontractor you've used before if they haven't been on one of your CIS returns in the current or last 2 tax years.
HMRC tells you the deduction rate. The rates are:
| Subcontractor | Deduction |
|---|---|
| Registered for CIS | 20% |
| Not registered (or can't be matched) | 30% |
| Holds gross payment status | 0% |
You apply the rate after taking off VAT, materials they paid for directly, plant hire, fuel (except for travelling) and a few other costs. If you make deductions, you give the subcontractor a payment and deduction statement within 14 days of the end of each tax month.
5. Company registration number, checked on Companies House
If they trade as a limited company, ask for the company registration number and look the company up on Companies House. It's free. It shows the registered address, the date of incorporation, current and resigned officers, the filing history and any insolvency information.
Check that the company name matches the name on their invoices and contract, and that the person you're dealing with is someone you'd expect to be acting for it.
6. VAT number, checked with HMRC
If they say they're VAT registered, check the number with HMRC's Check a UK VAT number service. It confirms whether the number is valid and shows the name and address of the business it belongs to. You need the number itself: you can't search by business name.
A valid number for a different business is a reason to stop and ask, not to pay the VAT on the invoice.
7. Public liability and professional indemnity insurance
Neither is a general legal requirement, but most businesses make one or both a condition of the contract. Business.gov.uk says almost all businesses need public liability cover, which protects against claims that a member of the public was injured. Professional indemnity covers claims that their advice, work or services caused a client financial loss, so ask for it where they advise, design or certify.
Ask for the current certificate or policy schedule and note its expiry date. Check the insured name and the level of cover against what your contract asks for. A policy that lapses mid-job is the usual gap.
8. Employers' liability (if they have staff)
A business that employs people must hold employers' liability insurance from an authorised insurer, with cover of at least £5 million. Not having it can cost up to £2,500 for each day without cover. There are exceptions, for example a business that only employs close family members.
If your subcontractor brings their own staff, ask for their certificate and its expiry date. A sole trader working alone may have nothing to show you here.
9. Trade competence
Regulated trades have their own registers. The three you'll meet most:
| Trade | What to ask for | Check it |
|---|---|---|
| Construction site work | A CSCS card. It shows the holder has the training and qualifications for their job. CSCS says holding a card is not a legislative requirement, but most principal contractors require one | CSCS Smart Check |
| Gas work | A Gas Safe ID card. Anyone employed to work on gas appliances in domestic premises must be Gas Safe registered, and the back of the card lists the work they're qualified for | The licence number on the Gas Safe Register |
| Electrical work in homes | Membership of a competent person scheme such as NAPIT or Certsure, which lets them self-certify work under Building Regulations | The Electrical Competent Person register |
Collect a copy with its expiry date, then check it on the register. A photo of a card shows what the card says, not whether it is current today.
10. Site induction
On a construction project, the Construction (Design and Management) Regulations 2015 put the duty on the principal contractor to make sure a suitable site induction is provided. HSE puts it as ensuring all workers have site-specific inductions. Where the principal contractor hasn't provided one, each contractor must give it to the workers under their control.
A CSCS card is not a site induction. Cover the site rules, hazards, emergency procedures and who to report to, and record the date each person completed it.
11. Bank details
Account name, sort code and account number.
Payment diversion fraud targets exactly this. Someone poses as your contractor, often from a real or lookalike email address, and asks you to pay a new account. The government's Stop! Think Fraud campaign says it is rare for businesses to change bank accounts, and advises confirming both the old and new account details on a phone number you already hold, not one in the message. Put any change through a second person's sign-off before the next payment goes.
Treat account numbers as sensitive. They shouldn't sit in an inbox or a shared spreadsheet.
Rules depend on the work, the trade and the size of your business. Treat this as a starting point, not legal or tax advice, and check anything borderline with HMRC, HSE or your accountant. Taking on employees rather than contractors? See the new starter checklist, right to work checks and DBS checks.
What WorkZerk does and doesn't do
WorkZerk keeps the paperwork side of this in one place:
- Each contractor gets one private link and sends everything from their phone, with no account or password.
- They sign your contract on the same page, by typed name or drawn signature.
- Insurance certificates carry an expiry date, saved to the contractor's contact record so they are never asked twice.
- WorkZerk's AI check reads the expiry date on an upload and flags it when it differs from the date typed in. You approve every document.
- WorkZerk can email the contractor before a certificate expires and ask for the new one.
What it does not do: WorkZerk doesn't decide anyone's employment status, verify a subcontractor with HMRC for CIS, work out CIS deductions, look a company up on Companies House, check a VAT number, confirm cover with an insurer, check a card on the CSCS or Gas Safe register, or pay anyone. Those stay with you and your accountant.
Setting it up in WorkZerk
1. Turn on two-factor authentication
Asking people to upload documents needs two-factor authentication on your account. Set it up under Account, then Two-factor authentication (opens in WorkZerk in a new tab).
2. Add the UK contractor pack
Open Requests (opens in WorkZerk in a new tab), click Request packs, and open Start from a template. Pick United Kingdom and add Contractor onboarding (United Kingdom). It asks for:
- Unique Taxpayer Reference (UTR), optional, saved to a sensitive UTR field on the contact record.
- Company registration number and VAT number, both optional, for limited companies and VAT-registered contractors.
- Public liability insurance, required, with an expiry date.
- Professional indemnity insurance, optional, with an expiry date.
- Account name, sort code and account number, with the account number marked sensitive.
The two insurance uploads save to fields on the contact record, so they count across every portal. Starter request packs lists the full pack.
The pack doesn't ask for a National Insurance number. If you verify sole traders for CIS, add a sensitive custom contact field for it.
3. Add your contract
Write your contract in the Terms library (opens in WorkZerk in a new tab), then add a Terms request to the portal with a typed name or drawn signature. Each acceptance is tied to the version the contractor read. If your contract is already a PDF, use a Sign PDF request instead.
4. Add the cards and insurance your trades need
For a CSCS card, Gas Safe ID card or employers' liability certificate, add an Upload request with Require expiry on. Put trade-specific asks inside a Section limited to the people it applies to, so a bookkeeper isn't asked for a Gas Safe card. Add a Tasks request for the site induction. A contractor compliance walkthrough covers each piece.
5. Send the links and review
Add contractors to the portal and send each their link, or share a self-registration link. Uploads wait under Needs review on Requests (opens in WorkZerk in a new tab). Check each one, look the card or company up on the official register, verify CIS subcontractors with HMRC, then approve.
6. Switch on the expiry reminders
Open Automations (opens in WorkZerk in a new tab) and switch on Document expiring reminder and Document expired reminder. Both start switched off. The expiring reminder goes 30 days before expiry by default, and stops once the new certificate arrives. See Automations.
7. Check who is covered
Open Requests (opens in WorkZerk in a new tab) and click Document compliance. Each contractor shows as current, expiring, needs review, expired or missing for each document. Use Download CSV when a client or principal contractor asks for a register. See Document compliance.
Getting started
Start a free WorkZerk trial at workzerk.com, then work through the steps above. If you get stuck, the getting started guide walks through a first portal end to end, or email us at [email protected].