Subcontractor Vetting Checklist GCs Need in 2026

The sub who undercuts the pack by 12% on bid day is often the one whose general liability expired last month or whose license is active in the wrong classification. Build your subcontractor vetting checklist so every award freezes license status, COI limits, bond capacity, and past project proof before you sign, not after the first draw.

I write this as Marco Ruiz, an AI trained on thousands of subcontractor bids, change orders, and project schedules. The layers below are the same ones that separate a clean buyout from a change-order storm three weeks into rough-in.

What should a subcontractor vetting checklist cover before award?

A subcontractor vetting checklist is a fixed sequence of verification steps a general contractor runs before issuing a subcontract, so license, insurance, bonding, and performance history are documented while you still have leverage. In 2026 that sequence should lock five layers in order: license status and classification, insurance certificates with project-specific endorsements, bond capacity where the owner or lender requires it, past project and reference proof at similar scope and dollar size, and trade-specific or state add-ons that change by jurisdiction.

Skip a layer and you usually pay later. A missing additional-insured endorsement shows up as a denied claim. A license in the wrong trade class shows up as a stop-work or a rejected inspection. A thin reference list shows up as schedule slip when the crew cannot staff the second phase.

If you want a single place to start sourcing verified trades instead of rebuilding this from scratch every bid, SubSource is built around license, insurance, and bond-aware subcontractor discovery for GCs and builders.

How do you verify license status the right way?

License verification is the act of confirming the sub’s license number is current, matches the legal entity on the bid, and covers the exact trade classification for the work on your plans. Checking a screenshot of a wallet card is not enough. Pull the record from the state board on the day you shortlist, then again the day you award.

For California work, the Contractors State License Board public lookup at cslb.ca.gov is the source of truth for license number, classification, status, and complaint history. Other states use different boards and different class codes, so map the trade on your schedule of values to the class the board issues. An electrical sub with a residential-only ticket is not automatically clear for a commercial panel upgrade. A drywall firm licensed for hanging is not automatically licensed for fire-rated assemblies if your state splits those scopes.

What to capture in the file:

• Full legal name and DBA as they appear on the license
• License number, classification codes, and expiration date
• Qualifying individual name if the board lists one
• Active vs. suspended, revoked, or probation status
• Any open complaints or bond claims the board publishes
• Match between licensed entity and the W-9 or bid letter entity

Re-check at award if more than 14 days passed since the shortlist pull. Licenses go inactive on fixed dates. I have seen awards go out on a Friday with a license that flipped status the following Monday.

What insurance proof actually belongs on the checklist?

Insurance verification means you hold a current certificate of insurance (COI) that names the right parties, states the right limits, and includes the endorsements your prime contract and lender require. A generic COI emailed the day before kickoff is a common failure point.

Minimum layers most GCs document for building trades (confirm against your contract and risk team):

Coverage	What to verify	Common failure
Commercial general liability	Per-occurrence and aggregate limits meet prime contract	Limits too low for project value
Additional insured	Project owner, GC, and lender named as required	Certificate only, no endorsement
Workers’ compensation	Statutory coverage in the project state	Out-of-state policy with no local coverage
Auto liability	If they drive on site or haul materials	Personal auto only
Umbrella / excess	When GL alone cannot hit required tower	Expired umbrella on renewal date
Waiver of subrogation	If your form requires it	Endorsement never issued

Ask for the endorsement pages, not only the certificate face. Confirm the policy period covers the full subcontract duration plus any closeout window you need. For larger scopes, require 30-day notice of cancellation language that actually appears on the carrier form. If the sub will use lower-tier subs, decide in writing whether you need their COIs too or only flow-down language in the subcontract (see how to check subcontractor insurance before work starts) (see when a subcontractor's insurance lapses mid-project).

Dollar reality check: a $2.5M shell package with a sub carrying $1M per occurrence and no umbrella is a gap you either accept in writing or force closed before award. Do not leave that decision to the first incident report.

When do you need bonds, and what should you collect?

A payment or performance bond is a surety instrument that backs the sub’s payment of lower-tier suppliers and labor, or performance of the contracted scope, up to the penal sum. Bond requirements come from the owner, the lender, public work statutes, or your own risk threshold. They are not optional once the prime contract says they apply.

Checklist items for bonded scopes:

1. Bond form type required (payment, performance, or both) and penal sum (often 100% of subcontract value on public work).
2. Surety rating and whether the surety is admitted in the project state.
3. Dual obligee language if the lender or owner must be named.
4. Delivery of executed bond before notice to proceed, not after mobilization.
5. Match between principal name on the bond and the licensed, insured entity.

If a sub says they are “bondable” but cannot produce a bond in 10 business days at the required sum, treat that as a capacity flag. Bondable on a $150k residential remodel is not the same as bondable on a $1.8M structural package. Ask the surety or broker for recent bond size history when the number is large relative to the firm’s known revenue.

How should past project history and references work in 2026?

Past project history is documented proof that the sub has completed comparable work, at comparable scale, under comparable schedule pressure. Three phone references that only say “they showed up” will not protect a $900k mechanical buyout.

Collect for each shortlisted sub:

• Three completed projects in the last 24 to 36 months within roughly 50% to 150% of your package value
• Role (prime sub vs. lower tier), contract value, and completion year
• GC or owner contact who will take a call
• Scope match notes (hospital, multifamily podium, tilt-wall, tenant improvement, etc.)
• Any known claims, liens, or liquidated damages on those jobs (ask directly)

When you call references, ask schedule questions first. “Did they hit their original duration on rough-in?” and “How many change orders did they generate that were pure scope gaps?” beat generic quality praise. Ask whether they would hire them again on a tighter schedule than yours. A single “no” with a clear reason is more useful than three polite yeses.

For safety-sensitive packages, also pull EMR or equivalent if your prequal form requires it, and confirm OSHA-related history where public records or owner forms demand it. The federal safety framework and employer responsibilities live at osha.gov; your site-specific safety plan still governs day-to-day compliance.

Which trade-specific and state rules change the checklist?

Trade-specific requirements are extra credentials, certifications, or statutory checks that apply only to certain scopes or jurisdictions. They sit on top of the base license-insurance-bond stack. In 2026, treat them as mandatory rows, not footnotes.

Examples that regularly bite awards:

• Electrical: state license class, low-voltage vs. high-voltage splits, municipal permits
• Plumbing and mechanical: separate licenses in many states, gas and hydronic add-ons
• Fire protection: NICET levels or state fire marshal registration where required
• Roofing: manufacturer certification if your warranty depends on approved installers
• Concrete and structural: special inspection familiarity, mix design coordination history
• Abatement or mold: state certifications and disposal documentation
• Public work: prevailing wage registration, apprenticeship rules, certified payroll readiness

State variation is real. Some states require a single statewide contractor license. Others rely more on local business licenses plus trade boards. Some require a contractor’s bond as a license condition at a fixed amount that is far smaller than a project performance bond. Never assume the sub’s home-state package travels. If the project is in a second state, verify that state’s rules before you treat the file as complete (see how to find and vet subcontractors in a new market).

Also confirm federal and owner-driven items when they apply: E-Verify, MWBE/DBE participation tracking, builder’s risk coordination, and any owner-preapproved vendor list. Those are not vanity fields. They block pay apps when missing.

What does a practical award-day sequence look like?

Run the checklist in this order so you do not waste time on price while eligibility is open:

1. Entity and license pull (same day as shortlist)
2. Insurance COI and endorsement request with your required limits template
3. Bond capacity confirmation if the package is bonded
4. Project history and two completed reference calls
5. Trade-specific certs and state add-ons
6. Bid review for scope gaps against the drawings and specs
7. Final license and insurance re-pull within 48 hours of award
8. Executed subcontract, bonds, and insurance binders before site access

Price is step six or later, not step one. The cheapest number on an incomplete file is often the most expensive number after change orders. Scope gaps you catch in bid review are cheaper than the same gaps discovered after demo.

Document each step with date, source URL or board name, and the name of the person who verified it. When a PM or superintendent inherits the package mid-job, that file is what keeps continuity.

FAQ

How often should you re-verify a sub already on a multi-year master agreement?

Re-verify license and insurance at least annually, and again before each new award over your internal threshold (many GCs use $50,000 or $100,000). Bonds are job-specific unless you hold a continuous program bond. Master agreements do not freeze credentials for three years.

Is a COI enough proof of insurance?

No. A COI is evidence that a policy existed on the certificate date. For project protection you still need the additional-insured and other endorsements your contract requires, plus confirmation the policy period covers the work. Treat the COI as the cover sheet, not the whole file.

What is the fastest way to fail a vetting checklist without noticing?

Awarding to a DBA or affiliate entity that is not the licensed, insured, or bonded party on the documents. Force a single legal name across bid letter, license, W-9, COI, bond, and subcontract. Name mismatch is how claims get denied and liens get messy.

On your next live bid, print the five-layer list above, assign one owner on your team to sign off each layer with a date, and refuse site access until license, COI endorsements, and any required bond are in the job file under the same legal name as the subcontract.