Subcontractor Insurance Gaps: What Main Contractors Must Verify Before Site Entry

Subcontractor insurance verification in Malaysia is the pre-site-entry process by which a main contractor confirms that each subcontractor carries valid and sufficient insurance for the work they will perform. The typical set is SOCSO registration, public liability or contractors' general liability, CIDB Green Card registration, and where design work is involved, professional indemnity. It is the main contractor's primary control for downstream exposures created by Section 19 of the Workmen's Compensation Act 1952, third-party liability, and CIDB Act 520.

Most main contractors ask for a certificate, file it, and assume the job's done. Then a subbie's welder drops a torch, a fire rips through RM800,000 of stock, and everyone finds out the policy excluded hot work. By then you're the principal on the project and the claim lands on your books.

Before any subcontractor enters site, you need to verify four things: what coverage they carry, whether the policy actually responds to their scope, whether you're protected if their cover fails, and whether your contract puts the exposure back on them when it does.

This is the verification checklist. What documents to request, what to read on them, what gaps to flag, and where your own insurance needs to sit behind the subcontractor's in case it doesn't respond.

Why the Main Contractor Carries the Financial Risk

Malaysian law pushes liability upward. Under Section 19 of the Workmen's Compensation Act 1952, where a principal contracts any part of their work to a contractor and a workman of that contractor is injured in the course of that work, the principal is liable to pay compensation as if the workman had been directly employed by the principal. The principal can recover the amount from the contractor, but the initial liability sits at the top.

SOCSO tightens this further for local workers. Under the Employees' Social Security Act 1969, all private-sector employees must be registered with PERKESO regardless of salary, with contributions capped at the RM6,000 monthly wage ceiling from 1 October 2024. If a subcontractor has not registered their workers, the injured worker can still claim — and questions about who engaged them land at the main contractor's door.

Then there's common law negligence. If a subcontractor's act damages a third party — a neighbour's building, a member of the public, a fellow contractor's plant — both the subcontractor and the main contractor can be sued. The claimant chooses who to pursue, and they usually pursue whoever has money and a visible insurance policy. That's you.

Three exposure layers you need to cover

Exposure	Who Pays First	Fallback
Subcontractor worker injury	Subcontractor's WC / SOCSO	Main contractor under WCA s.19, recovery right against subbie
Damage to contract works caused by subbie	Project CAR/EAR (if subbie is named)	Main contractor's CAR, then contract indemnity
Third-party bodily injury or property damage	Subcontractor's public liability / CGL	Main contractor's CGL, vicarious liability claim

Each of these three exposures has a different policy wording, a different certificate, and a different set of ways it can fail. Verifying them takes more than confirming the policy exists.

The Four Documents to Request Before Site Entry

A valid insurance pack from a subcontractor isn't one certificate. It's a set. Before you issue a site-entry pass, you want all four in hand and checked against the subbie's actual scope on your project.

1. Workmen's Compensation / SOCSO evidence

For local workers, the subcontractor should provide evidence of PERKESO registration and current contribution payments — typically the latest Lampiran A or contribution statement. Since 1 January 2019, foreign workers are also covered under SOCSO's Employment Injury Scheme (this replaced the earlier Foreign Workers' Compensation Scheme for work-injury protection), so the subcontractor should equally produce SOCSO registration evidence for each foreign worker on your site. Some employers also maintain a separate employer liability or common law extension — ask for those schedules where they exist, not just a certificate.

Check that the policy period spans your project timeline. A certificate issued in January for a policy ending in June doesn't cover a worker injured in August. Also check that the number of insured workers matches the actual head count the subcontractor plans to put on your site.

2. Public liability or Contractors' CGL

Public liability or contractors' general liability protects against third-party bodily injury and property damage caused by the subcontractor's operations. The certificate should state the policy limit, the policy period, and the scope of work insured.

The scope of work line matters more than the limit. A public liability policy for "general electrical works" will not respond to a claim arising from hot work or confined space entry unless those scopes are specifically insured. If the subcontractor's work involves welding, working at height, confined space, hot work, or live electrical work, read the policy schedule or ask for a copy — the certificate alone doesn't prove these are covered.

3. Construction personnel / CIDB Green Card

Under CIDB Act 520 Section 33, no construction personnel may work on a registered construction site in Malaysia without being registered with CIDB and holding a valid Green Card. Section 33A adds further requirements for site supervisors and skilled construction workers, who must be accredited and certified. The Green Card carries a Construction Personnel Protection Plan (a takaful-based personal accident scheme) for the registered worker.

Request the Green Card numbers and expiry dates for every worker the subcontractor intends to deploy. Verify them via CIDB's CIMS system or the CIDB Malaysia app before site entry. An expired Green Card means the worker is legally barred from site and the protection plan is void. Engaging an unregistered worker on a construction site covered by Act 520 is an offence, with penalties that can apply to both the employer and the main contractor who allowed entry.

4. Professional indemnity (if design or professional work is involved)

Only relevant if the subcontractor is taking on design responsibility, specialist engineering, or any professional service. If your subbie is a design-and-build specialist — MEP design, structural specialist, specialist fire protection designer — ask for current professional indemnity cover. Physical damage CAR will not respond to a loss caused by defective design. That's a PI claim, and if the subbie doesn't have PI, the main contractor is the next name on the suit.

What to Read on the Certificate and Policy Schedule

A certificate of insurance is a one-page summary produced by the broker or insurer. It tells you a policy exists. It doesn't tell you the policy will pay the claim you're worried about. Four checks separate a useful certificate from a useless one.

What to Check	Why It Matters	Red Flag
Policy period covers full project timeline	An expiring policy mid-project can lapse if the subbie forgets to renew	Policy expires before practical completion or maintenance period
Named insured matches the contracting entity	Policy in a parent or sister company's name may not respond to claims against the subbie you contracted	Certificate in a different company name or trading name
Scope of work / nature of business on the certificate	Claims outside the insured scope are commonly declined	Generic scope that doesn't match what the subbie is doing on your site
You are named as principal / additional insured	Gives you rights under the policy directly, not just a recovery claim later	Certificate lists only the subcontractor with no principal extension

The scope of work check is where most verification fails. A certificate can correctly show RM1 million public liability and a valid policy period, and still exclude the exact activity that caused the loss. "Electrical installation works" is not the same as "hot work." "General building works" is not the same as "demolition" or "working at height." If the subbie's scope on your project includes any higher-risk activity, ask for the underlying policy wording and confirm the activity is not excluded.

Additional insured status and cross-liability

Being named as an additional insured on the subcontractor's policy gives you direct access to that policy if a claim is made against you for something the subcontractor did. It's the strongest form of upstream protection available on a subbie's policy.

But it comes with a catch. Most liability policies contain a cross-liability or separation of insureds clause which allows one insured to sue another under the same policy. Without that clause, if you're both named and the subbie injures your employee, the insurer may refuse cover because the claim is between insureds. When you accept additional insured status, also ask whether the policy includes cross-liability. If it doesn't, the "protection" evaporates the moment you actually need it.

Contract Clauses That Decide Who Pays When Cover Fails

Verification tells you what cover exists today. Contract clauses decide what happens when that cover doesn't respond. This is the part most main contractors leave to a standard template and never read again until a loss happens.

Minimum insurance requirement clause

State in the subcontract the exact types of cover the subbie must carry, the minimum limit for each, the requirement that the policy period cover the entire contract period including the maintenance period, and the requirement that you be named as principal or additional insured where available. Then require the subbie to provide the certificate and not just promise it exists. No certificate, no site entry. Treat this as hard as you treat Green Card verification.

Indemnity clause

The indemnity clause makes the subbie liable to indemnify you for losses arising from their acts, omissions, or negligence. A strong clause extends to legal costs, damages, and any amounts you pay under WCA Section 19 that should have been the subbie's liability.

The weakness of indemnity clauses: they're only as valuable as the subbie's ability to pay. A small subbie with a RM50,000 paid-up capital and no CGL cannot indemnify you for a RM2 million third-party claim. This is why a strong indemnity sits beside strong insurance requirements, not instead of them.

Insurance maintenance and notification clause

Require the subbie to maintain all insurances throughout the contract period and to notify you of any cancellation, non-renewal, or material change at least a set number of days in advance. If they don't, you need the right to suspend site entry and, if necessary, take out replacement cover at the subbie's cost — a mechanism common in standard international contract forms and worth mirroring in Malaysian subcontracts.

Principal's step-in right for insurance

If the subcontractor fails to effect or maintain required insurance, the main contractor can arrange the insurance at the subcontractor's expense, recovering the cost by deduction from payments due. This is the backstop when a subbie lets a policy lapse mid-project. Worth including because the alternative — finding out mid-claim that there's no policy — is far more expensive.

Common Verification Failures and How They Bite

What Happened	Why the Cover Failed	Who Paid
Subcontractor's welder caused fire in adjacent unit	Public liability policy excluded hot work	Main contractor's CGL and CAR after indemnity fight
Foreign worker injured, SOCSO registration was under a different company name	Named employer mismatch at registration	Main contractor under WCA s.19 principal liability
Policy lapsed two weeks before an incident mid-project	No renewal notification, no certificate update check	Main contractor's own policies, reduced by failure to ensure downstream cover
Specialist designer's drawing caused structural defect	Subbie had no PI cover; CAR excluded defective design	Main contractor absorbed the remedial cost
CIDB Green Cards expired for three workers on a piling subbie's team	Protection plan void; workers unregistered under Act 520	Main contractor faced CIDB enforcement and paid compensation directly

These are the patterns that show up in Malaysian construction claims. Each one is catchable at pre-site-entry verification if you know what to look for. Each one is catastrophically expensive if you don't.

Illustrative examples — not specific client cases.

Your Insurance Sitting Behind the Subcontractor's

Even with perfect verification, some losses will still fall back to the main contractor. A subbie's policy limit may be exhausted. A specific claim may fall into a gap. The subbie may simply disappear before the claim is paid. Your own insurance program has to be built assuming subcontractor cover will fail.

Project CAR/EAR with named subcontractors

A Contractors' All Risks (or Erection All Risks for mechanical and electrical installation) policy normally names the employer and main contractor as joint insureds. It can extend to named subcontractors, and the cross-liability clause lets each insured party claim against the others as if a separate policy had been issued. Damage to the contract works caused by a named subbie is covered; liability between insureds is preserved by the cross-liability extension.

Check your CAR schedule for two things. First, that the list of named subcontractors is current — adding a new subbie mid-project without updating the schedule leaves them outside cover. Second, that the cross-liability clause is in place and has not been struck out by endorsement.

Contractors' CGL for third-party and vicarious exposure

Comprehensive general liability cover for a main contractor should include cover for vicarious liability arising from subcontractors' acts, within stated limits and subject to the subbie meeting agreed standards. This is the layer that responds when a claimant sues you for what a subbie did, and the subbie's own policy doesn't reach.

Workmen's compensation at every tier

Your own Workmen Compensation insurance covers your employees under the statutory and common law exposure that sits above SOCSO. It does not cover the subcontractor's employees. But Section 19 of WCA 1952 can make you pay for their injuries anyway, after which you recover from the subbie. A WC policy with a principal's liability extension specifically addresses this recovery risk — check whether yours includes it, because not all standard WC policies do.

Pre-Site-Entry Verification Checklist

Item	Status
Subcontract executed with insurance, indemnity, and notification clauses	☐
Public liability / CGL certificate received, limit and scope verified against site activity	☐
SOCSO registration evidence received for every local and foreign worker deployed	☐
PI certificate received (if subbie has any design or professional role)	☐
Main contractor named as principal or additional insured where applicable	☐
Cross-liability clause confirmed on additional-insured policies	☐
All policy periods span the full contract period including maintenance	☐
CIDB Green Cards verified on CIMS for every worker on site	☐
Subbie named on project CAR/EAR schedule (if applicable)	☐
Renewal and notification reminder set for policies expiring during contract period	☐

Run this before issuing a site-entry pass. The time cost is measured in hours. The alternative is measured in weeks of claim negotiation and sometimes years of litigation.

FAQ

What happens if my subcontractor's insurance lapses mid-project?

Your exposure widens immediately. If a loss occurs during the lapse, the subbie has no policy to respond, so any claim that would have hit their cover now looks to your contract indemnity (which depends on the subbie's ability to pay) and then to your own insurance. This is why a notification clause and the right to effect replacement insurance at the subbie's cost are useful — they give you a mechanism to act before the lapse causes a claim.

Does naming me as an additional insured on the subcontractor's policy protect me fully?

Only if the policy also has a cross-liability or separation of insureds clause. Without that clause, insurers can decline a claim made by one insured against another under the same policy. Additional insured status without cross-liability is weaker than most main contractors assume.

If my subcontractor has Green Cards for all workers, do I still need to check their WC or SOCSO?

Yes. The CIDB Construction Personnel Protection Plan bundled with the Green Card is a limited personal accident benefit, not a substitute for employer liability. WC and SOCSO provide broader compensation for work injury, including long-term disablement and dependants' benefits, and are separately required by law. The Green Card is one layer. It's not the whole stack.

Can I rely on my project CAR/EAR policy to cover everything my subcontractors do?

Physical loss or damage to the contract works, yes, provided the subbie is named on the policy schedule and the cause of loss isn't excluded. But CAR policies do not cover the subbie's employees (that's WC), do not cover third-party claims beyond the TPL section limit, and typically exclude losses arising from defective design. You still need the subbie to carry their own employer liability, public liability, and where relevant, professional indemnity.

What's the difference between public liability and contractors' CGL for a subcontractor?

Public liability is the baseline third-party cover — bodily injury and property damage to third parties arising from operations. Contractors' CGL is broader, adding completed operations liability, contractual liability, and in some wordings, cross-liability between insured parties. For higher-risk subbies, CGL is the safer requirement. For low-risk trades, a well-scoped public liability policy may be enough.

How do I verify a CIDB Green Card before site entry?

Use the CIDB Malaysia app or the CIMS Construction Personnel Search on the CIDB website. Enter the worker's identification, passport, or IMM13P number. The system returns registration status and expiry date. Do not rely on physical card inspection alone — cards can look valid and still be expired or cancelled.

What if the subcontractor says they're "covered under the main contractor's policy"?

Ask which policy, ask to see the schedule, and verify the subbie is actually named. A vague statement that "the main contractor has insurance" is not a substitute for the subbie carrying their own employer liability and public liability cover. The main contractor's CAR may cover the works; it does not cover the subbie's employees or their third-party operational risk.

Foundation Conclusion

Subcontractor insurance verification is the cheapest risk control a main contractor has — and the one most often treated as paperwork. A subbie's certificate is the start of the check, not the end of it.

The main contractor's own insurance program has to assume some subcontractor cover will fail. That means a project CAR/EAR that names subs and carries cross-liability, CGL that responds to vicarious liability, and WC with a principal's liability extension. These aren't nice-to-haves. They're the backstop that makes verification survivable when it misses something.

Talk to our risk specialists about structuring project cover that sits behind your subcontractors

Disclaimer: This article provides general guidance based on the Workmen's Compensation Act 1952, Employees' Social Security Act 1969, CIDB Act 520, and insurance coverage available in the Malaysian market as of April 2026. Regulations may be amended and policy terms vary by insurer. Always verify requirements with PERKESO, CIDB, or qualified insurance and legal professionals before making decisions. Foundation is a specialist property and engineering insurance broker. We do not provide registration, certification, or training services. We help you insure the risks that compliance is designed to manage.