By Patrick Turcotte, COO, Docutrax. Last reviewed: 23 October 2026.

Verifying a certificate of insurance means confirming, against sources other than the certificate, that what it reports is true: that the producer is licensed, that the insurer is authorized where the work is happening, that the certificate form is an approved form, that the endorsements your contract requires exist on the policy, that the limits shown are the policy's limits, and that the named insured is the entity you contracted with. Six confirmations, six sources, and the certificate is not one of them.

Below is each confirmation, where the answer comes from, how long it takes, and what to do when one of them fails.

What a certificate is

The form says so on its face. The current ACORD 25 carries this at the top:

THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THIS CERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND, EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES BELOW. THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S), AUTHORIZED REPRESENTATIVE OR PRODUCER, AND THE CERTIFICATE HOLDER.

That is not boilerplate the industry added for comfort. Most states regulate certificates directly, and the rules bind the people who issue them. A producer who shows coverage the policy does not carry faces discipline up to the loss of a license, and in several states the certificate has to be issued on a filed, approved form that nobody is permitted to alter.

Texas marks the outer edge of what a certificate does establish. A properly executed approved certificate confirms that the policy was issued or that coverage was bound, whether or not the form carries the words "for information purposes only." It confirms a policy exists and tells you nothing reliable about what is in it.

Sources: Tex. Ins. Code ch. 1811 · Oregon DFR, certificates cannot vary from contract · Ga. Code § 33-24-19.1 · Georgia OCI Bulletin 21-EX-5

The six confirmations, in order

The first three you can run yourself in under five minutes. The next two require a request and take days. The last takes a minute against the contract and catches the defect most likely to survive everything else.

1. Confirm the producer

The signature block reads AUTHORIZED REPRESENTATIVE, and in almost every case that representative is the producer's, not the carrier's. It carries a name. A National Producer Number is a unique identifier assigned at licensing, and NIPR runs a public lookup; your state department of insurance also publishes a licensee search.

About two minutes. Establishes that the signature belongs to a real, licensed producer. Tells you nothing about the policy.

2. Confirm the carrier

Your state department of insurance company lookup shows whether the carrier is admitted in that state. If it does not appear, that is not automatically a problem: surplus lines carriers are not licensed in the states where they write, and their eligibility is confirmed on the state's surplus lines eligibility list instead. Add the NAIC Consumer Insurance Search for financial condition and three years of complaint history, and an AM Best rating for an independent opinion of the carrier's ability to pay.

About three minutes. Establishes who you are dealing with and whether they can pay. Tells you nothing about this policy's terms.

3. Confirm the form

Where a state publishes its approved certificate forms, you can look up whether this form was ever approved instead of guessing. Texas requires certificate forms to be filed and approved, with ACORD, AAIS and ISO standard forms deemed approved on the date they are filed, and the Texas Department of Insurance publishes a complete listing giving the filer, the form name and number, the approval date, and a filing number linking to the form itself.

Most states publish no such listing. There, check the form against its own markings: the ACORD number and edition date sit at the bottom of the form, and the current liability certificate is ACORD 25. A certificate that arrives on something carrying a company's own branding and layout, or on a form with no edition marking at all, is worth a question.

Thirty seconds. Establishes that the document is a filed form and not a construction of someone's word processor. Tells you nothing about the coverage described on it.

4. Get the endorsement pages

The ADDL INSD and SUBR WVD columns are representations, not proof. Request the endorsement pages from the third party's policy, or the policy provision granting the status where there is no separate endorsement, and name the form numbers your contract calls for. The section below covers what to ask for and how.

Days to weeks. Establishes whether the grant exists, in which form, and on what terms. Does not tell you whether other policy language limits it.

5. Read the declarations page

The limits column reports. The declarations page is where the policy's limits live. Request it, or get written confirmation of the limits from the producer.

Days. Establishes what the policy carries. Does not tell you what remains after paid claims.

6. Match the named insured to the contracting entity

Character for character, against the contract. An entity mismatch is the defect most likely to survive every other check and surface at tender, because every other confirmation can come back clean on a policy issued to the wrong company. Operating names, parent entities and single-purpose entities are where this goes wrong.

About a minute. Establishes that the coverage belongs to the party you contracted with.

One rule applies to all six. Each confirmation establishes status on the day you made it and nothing beyond it, so re-confirm at renewal and whenever the scope, the contracting entity or the requirement set changes.

The limits column changed in December 2025, and what it establishes changed with it

This is the part most published guidance has not caught up with. ACORD released a new edition of the certificate, ACORD 25 (2025/12), and it is already in circulation. The asterisked note governing the limits column now reads:

*LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS. LIMITS SHOWN ARE INCLUSIVE OF AMOUNTS REQUESTED BY THE CERTIFICATE HOLDER AND MAY NOT REFLECT POLICY LIMIT AMOUNTS IN EXCESS OF THOSE REQUESTED.

The first sentence was already there. The second is new, and it discloses that the limits column may show the amount someone asked to see. The policy may carry more, or less. If your requirement is $1,000,000 and the certificate shows $1,000,000, the form now tells you on its face that this may be a reflection of your own request. The form marks the note as not applicable in Wyoming.

ACORD says the sentence clarifies existing practice and does not change a producer's standard of care or permit anyone to show less than the policy's limits. Agent associations have answered that showing the policy's limits regardless of what a contract requires is the safer practice. Either way, the limits column is now expressly a reported figure. It may understate what the policy carries, and it may overstate what is left after paid claims. The declarations page is the only way to know which.

Two editions will be circulating for some time, and the edition marking sits at the bottom of the form. Reading it is now part of reading the certificate, because it tells you which disclosure regime the document is operating under.

Sources: ACORD 25 (2025/12), as posted by NY DFS · Input from ACORD regarding recent changes to the ACORD 25, Big "I" Virtual University · ACORD changes limits wording on certificate of insurance, Big I New York

What the ADDL INSD and SUBR WVD columns are telling you

These are two of the most consequential fields on the form and two of the least conclusive. The form sets out the position itself:

If the certificate holder is an ADDITIONAL INSURED, the policy(ies) must have ADDITIONAL INSURED provisions or be endorsed. If SUBROGATION IS WAIVED, subject to the terms and conditions of the policy, certain policies may require an endorsement. A statement on this certificate does not confer rights to the certificate holder in lieu of such endorsement(s).

A tick in that column tells you what the producer understands the policy to contain. Additional insured status arises from an endorsement on the third party's policy, or from an additional insured provision written into the policy form itself. A waiver of subrogation is likewise an endorsement on the third party's policy, under which that party's insurer gives up its right to recover from your organization after paying a claim, and the general liability and workers compensation waivers are separate endorsements on separate policies. None of it happens because a box was ticked.

Which endorsement was issued matters as much as whether one was, because ongoing operations and completed operations are addressed by different forms. A certificate reading "Blanket AI per form on file" has told you a form exists somewhere.

So ask by form number, and ask at first submission. Something like this:

"Please send the additional insured and waiver of subrogation endorsement pages from the policy, along with the declarations page. We need the endorsement documents themselves, not a certificate reference, and please confirm the form number and edition date of each. Our contract requires additional insured status for ongoing and completed operations, which on ISO forms is CG 20 10 and CG 20 37 respectively."

Check those form numbers against your own contract before sending; the point is that a request naming forms gets you documents, and a request describing outcomes gets you another certificate.

Never call the number printed on the certificate

Look up the agency and the carrier yourself, and call the numbers you find. A certificate that has been altered carries whatever phone number and email address the person who altered it chose to put on it, and the confirmation you get back will be as fabricated as the document. Great American's loss control guidance says the same, telling you to "Call the insurance company, or broker, listed on the form using publicly available information" to confirm that the information is accurate.

This is also why the producer check in step 1 is worth its two minutes. The name in the signature block either resolves to a licensed producer at that agency or it does not.

Sources: How to spot a fake certificate of insurance, Great American

What to do when a confirmation fails

Most guidance stops at the checks. Here is the part nobody writes down.

The producer does not resolve. Call the agency on a number you looked up and ask who issued the certificate. A name that nobody at the agency recognizes is a fraud indicator and belongs with your risk or legal people immediately, not in an email to the third party.

The carrier is not admitted and not on the surplus lines list. Ask the third party's broker to identify the paper in writing. Non-admitted does not mean inadequate, and surplus lines is common in construction, but a carrier that appears on neither list is a different problem. Note that surplus lines sits outside state guaranty funds, which is a question for whoever sets your requirements.

The endorsement does not arrive. Date your request and ask again through the third party, copying their broker. The usual cause is that nobody has asked the broker for it, because the broker issued a certificate and considered the job done.

The endorsement arrives and does not match. The common failures are the wrong form edition, a named schedule that omits your entity, ongoing operations only where your contract requires completed operations too, and a manuscript endorsement that matches no standard form. Each is a specific question back to the broker, and each is worth putting in writing because the answer becomes part of your file.

The limits come in below requirement. This is a contract question before it is an insurance one. Confirm the actual limits from the declarations page, then put the gap in front of whoever owns the contract.

The named insured does not match. Stop and resolve this one before anything else, because every other confirmation is describing a policy belonging to someone else.

In every one of these, your job is to establish what the documents do and do not show, document it, and put the decision in front of the person who owns it. Whether non-compliant work proceeds, whether a payment releases, whether a deviation is accepted: those are decisions for your organization, and they are better made against a clear record than at the gate under pressure.

In-force status, and why verification repeats

The cancellation paragraph on the current form reads in full:

SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORE THE EXPIRATION DATE THEREOF, NOTICE WILL BE DELIVERED IN ACCORDANCE WITH THE POLICY PROVISIONS.

In accordance with the policy provisions means in accordance with the obligations the insurer already owes to its own insured. It commits the insurer to nothing in favor of the certificate holder. Notice reaches you only if the policy carries a notice of cancellation endorsement naming your organization, or the contract obligates the third party to tell you.

Coverage can be removed the week after your file was completed, and the document in that file will look exactly as valid as it did the day it arrived.

What a certificate cannot show, whatever you confirm

Every step above confirms something real. None of them reaches the questions that decide whether coverage responds.

The current form's coverages grid carries eight columns: INSR LTR, TYPE OF INSURANCE, ADDL INSD, SUBR WVD, POLICY NUMBER, POLICY EFF, POLICY EXP and LIMITS. There is no field for exclusions. There is no endorsement schedule. There is no schedule of underlying insurance, which is why a certificate cannot establish what an umbrella or excess layer actually attaches over. And the limits shown are the figures reported at issuance, which the current edition allows to be the amount requested, and which in either case sit before whatever prior claims have already eroded the aggregate.

What this costs to run

Four rules follow from the chain above.

1. Name endorsement forms by number in your requirements. "Additional insured status including completed operations" is not a document anyone can send you. CG 20 10 and CG 20 37 are.

2. Ask for the endorsement pages with the certificate at first submission. Asking later means asking twice and waiting twice.

3. Match the named insured to the contracting entity, character for character. An entity mismatch survives every other check and surfaces at tender.

4. Re-confirm at renewal, and whenever the scope, the contracting entity or the requirement set changes. Keep what you confirmed, because completed-operations claims arrive years after the file was closed. A retained confirmation holds the certificate, the endorsement pages, the declarations page, the lookup results with the dates you ran them, and the correspondence.

What that costs in practice is worth being honest about. Six confirmations across a population of several hundred third parties is a real workload, and most of it lands on whoever already has another job. If your population is small and uniform and certificates are the right depth, a spreadsheet with a diary date will carry you. The apparatus earns its keep when the requirement sets vary and the exposure justifies going past the certificate.

Where Docutrax fits

Docutrax runs all six of these confirmations as a managed operation. Licensed property and casualty professionals do the checking, with CRIS-certified Account Managers on construction risk work, and the team gets involved with the third party and their brokers and agents to resolve what falls short. More than 2,000,000 certificates, endorsements and policies have been through that review since 2012.

You set the requirements and the escalation rules, and you make the compliance decisions. Docutrax surfaces what the documents establish and what they do not.