Business Insurance Terms

Certificate of Insurance (COI / ACORD 25)

A Certificate of Insurance — universally referred to as a COI, and almost always printed on the standardized ACORD 25 form in United States commercial lines — is a single-page, machine-generated summary document that proves a person or business (the "Named Insured") currently holds active insurance policies. General contractors, property managers, clients, and commercial landlords universally require subcontractors, tenants, and vendors to supply a valid COI *before* they step foot on a job site, sign a lease, or begin performing work under a contract. The COI is not the actual insurance policy — think of it as a certified summary report card issued by the agent or carrier, describing the policies, limits, and dates currently on file.

Definition maintained by the InsurTool Editorial Team. Last reviewed .

What is a Certificate of Insurance (COI)?

In plain English: If your business insurance policy is your driver’s license, a COI is the photocopy of your license you give to the rental car company. It’s not the license itself, but it’s proof (when verified) that you have one — and critically, it spells out exactly what endorsements the hiring party gets (Additional Insured, Waiver of Subrogation) when they require them. I can’t tell you how many times I’ve seen a GC accept a COI at face value only to find out after a $200K jobsite injury that the sub’s policy had canceled for non-payment 3 weeks earlier.

Key Takeaways

  • 98%+ of US commercial COIs use the ACORD 25 Certificate of Liability Insurance form
  • COI is a point-in-time snapshot — it does NOT guarantee continuous coverage after issuance date
  • Being listed as “Certificate Holder” gives you ZERO rights under the policy — ask for “Additional Insured” status via endorsement
  • Always verify COIs directly with the issuing producer agency, never from the contractor’s PDF alone
  • Fraudulent / photoshopped COIs are rampant — 6 common red flags listed later in this article

The 6 Core ACORD 25 Data Points You Must Audit on Every COI

The ACORD 25 looks intimidating at first (4 sections, 20-some fields), but for risk and procurement purposes you only need to laser-verify these 6 non-negotiable components. If any one of them is wrong, wrong-name, or missing — reject the COI immediately and request a corrected version before allowing any work.

# ACORD 25 Field What It Should Show — Audit Checklist Why It Matters If It’s Wrong
1 NAMED INSURED (top left, box 2) Exact LEGAL business name (LLC, Inc., Corp.) as registered with SOS + physical mailing address. No DBA-only listings. If a sub submits “John Smith dba Smith Construction” without the actual LLC name, the COI applies to John Smith the individual — not the contracting entity you’re hiring. Wrong entity = wrong insured. If you sue Smith Construction LLC after an accident and the COI is actually issued to John Smith individually, the carrier will disclaim coverage entirely. Zero payout.
2 PRODUCER / AGENCY (top left, box 1) Full agency name, physical street address (no PO boxes), phone number, email, and state producer license numbers. Legitimate agencies use AMS systems (Applied Epic, Hawksoft, Vertafore) that stamp this info automatically. Scanned forms with blank agency info = 90% fraud. You must call the agency DIRECTLY to verify coverage is active. If the producer isn’t listed or is a fake address, there’s no way to independently verify legitimacy.
3 INSURERS AFFORDING COVERAGE (center box 3 — Insurer A through F) Full legal carrier names + correct NAIC (National Association of Insurance Commissioners) numbers. AM Best rating column filled. “Surplus Lines” carrier should be explicitly marked, and broker-of-record listed. Typos here usually indicate a template-printed fake COI. Example: “State Farm Mutual” with no NAIC number, or misspelling “Travelers” as “Travelors” — dead giveaways of a PDF created in Canva by the contractor themselves.
4 COVERAGES / POLICY TYPES (main middle table — General Liability, Automobile, Umbrella, Workers Comp, etc.) For each required coverage line: check the box, show the correct policy number (carrier-specific format, never sequential 123456), policy EFFECTIVE date and EXPIRATION date, and the correct letter (A–F) cross-referencing to the carrier in box 3. If Workers Comp is checked but there’s no policy number or carrier letter → they don’t actually have WC, they just checked the box. If effective date is 3 days from now → they haven’t bound the policy yet, it’s a quote, not a COI.
5 LIMITS OF LIABILITY (right-hand column of coverage table) Real dollar amounts matching the contract requirements. “$1,000,000 each occurrence / $2,000,000 aggregate” for CGL is standard. Never accept: “As per contract,” “per agreement,” or “TBD” in the limits column. If limits say “per contract” and the contract requires $1M/$2M but the actual policy only has $500K/$1M, you have a shortfall. The carrier pays policy limits, not “whatever the contract says.”
6 DESCRIPTION OF OPERATIONS / REMARKS (bottom large box, often blank by default) This is where the magic happens for hiring parties. A valid COI for a contract MUST explicitly state here: (a) “[Hiring Party Name], its officers, directors, employees are ADDITIONAL INSURED on CGL per ISO CG 20 10 or CG 20 37 endorsement,” (b) “Waiver of Transfer of Rights of Recovery Against Others to Us (Subrogation) granted to Additional Insureds,” and (c) “30-day cancellation notice per endorsement.” If the box is blank → no AI, no waiver, no cancellation notice. If the remarks box is blank, you are ONLY Certificate Holder — even if the top-right Certificate Holder box has your name. Certificate Holder = informational copy only, no coverage, no notice. The description of operations box is where the legal rights are.

Additional Insured vs. Certificate Holder — The Most Dangerous Confusion in Commercial Insurance

I’ve personally watched this single confusion cost property owners and GCs over $1.4M in uninsured losses in my career. The two boxes on an ACORD 25 (Certificate Holder in the top right, and any Additional Insured language in the Description of Operations / Remarks box) sound almost identical to non-insurance professionals — but they are legally night and day.

Rights & Benefits Certificate Holder (Top Right Box) Additional Insured (Via Endorsement + Remarks Box)
Receives a copy of the COI ✅ Yes — that’s literally the only purpose of this box ✅ Yes — they usually also get a copy of the COI
Can TENDER A CLAIM / receive defense & indemnity from the policy ❌ NO. Zero coverage rights. Cannot file a claim on this policy. ✅ YES. Can be named in a suit and defended by the carrier, with claims paid up to policy limits for covered occurrences arising from Named Insured’s work.
Receives NOTICE if policy cancels, non-renews, or materially changes ❌ NO. Carrier is under no obligation. Most carriers will not waste postage sending cancellation letters to mere Certificate Holders. ✅ YES — 30-day advance cancellation notice is required in 47 states when AI endorsement includes that provision (always require it; ISO CG 20 10 10 01 includes it by default).
Can sue the carrier for bad-faith claims handling ❌ NO. No contractual privity, no standing to sue. ✅ YES. Has full standing as a party to the insurance contract (via endorsement).
Waiver of Subrogation protection ❌ NO. Carrier can subrogate (step into your shoes to sue to recover payout). ✅ YES — if waived in endorsement and remarked on COI. Carrier waives right to sue you after paying a claim.
Cost to Named Insured to grant this status $0.00 — free, just a box on the form. $50–$350/year per AI, or Blanket AI endorsement $150–$1,200/year (all contracts auto-covered).

Real-World Scenario: A property management company (“PM Co.”) hires a pressure-washing contractor. Contractor submits ACORD 25 with PM Co. listed in the Certificate Holder box. PM Co. does not verify and skips requiring AI. Week 3, contractor ladders falls on a tenant’s car ($22K damage) and breaks the tenant’s wrist ($110K medical + lost wages). Tenant sues BOTH the contractor AND PM Co. for premises liability. The contractor’s CGL defends the contractor — but REFUSES to defend PM Co., because PM Co. is only a Certificate Holder with no coverage rights. PM Co. has to hire their own defense counsel ($85K) and eventually settles for $110K out of pocket. Total uninsured loss: $195,000 — on a $68K pressure-washing contract. If they’d required AI + 30-day cancellation notice? Every dollar would have been covered by the contractor’s CGL.

Common COI Scams in 2026 — How to Spot a Fraudulent Certificate

COI forgery exploded after 2022 with template websites selling “printable ACORD 25 certificates” for $19.99, and the 2024–2026 hard market (skyrocketing work comp and CGL premiums) only made the incentive worse. Unlicensed contractors can’t afford real insurance, so they download a template and fill in the blanks. Here are the 6 red flags that make a COI presumptively fraudulent — if you see even ONE, move directly to verification and refuse work until confirmed.

  • Red Flag #1 — Editable-Field PDFs / Poor-Quality Fonts. Open the PDF in Acrobat and check File → Properties → Application. If it says “Canva,” “Microsoft Word,” “Print to PDF from Chrome,” or any generic PDF tool instead of “Applied TAM,” “Hawksoft,” “Vertafore AMS360,” or “EZLynx” → it was printed by the contractor from a template, not exported from a real agency management system. 95%+ fraud indicator.
  • Red Flag #2 — No NAIC Numbers / Misspelled Carrier Names. If the Insurer A box says “CNA INSURANCE” but the NAIC column is blank, or says “General Casualty” instead of the correct “CNA Casualty” NAIC 17123 → template fake. You can look up NAIC numbers instantly via NAIC.org Consumer Insurance Search.
  • Red Flag #3 — Generic Sequential Policy Numbers. If every policy number on the COI is GLI-10001 or POL-123456 or 99999 → fake. Real carriers use real policy number formats (e.g., Travelers CGL is 2 letters + 7 digits; Hiscox is HL- followed by 9 digits; Progressive BAP is 6 letters then 6 digits).
  • Red Flag #4 — Suspiciously-Timed Expiration Dates (or “Same-Day Binds”). If you ask for a COI on Monday and receive one Monday afternoon with effective date TODAY and expiration date exactly 3 days from now → it’s a “same-day bind for certificate purposes” that will cancel non-payment Wednesday night after they get their first progress payment. Always require at least 30 days of remaining coverage on first submission; for a 6-month project, require a minimum 9-month remaining term at COI submission.
  • Red Flag #5 — “Per Contract” Limits in the Limit Column. Legitimate COIs list actual dollar amounts: $1,000,000 EACH OCCUR / $2,000,000 AGG. Fake COIs often say “Per Contract Requirements” or “As Per MSA Dated [X]” in the limits column. What this means: the policy has whatever limits it has (could be $300K or zero), not the $2M your contract requires. Always require actual numeric limits.
  • Red Flag #6 — Call-Back Verification Fail. Call the producer’s agency phone — but look up the agency’s number on the state insurance department’s license lookup (e.g., California DOI License Check, Texas TDI Agent Lookup) or the carrier’s Find-an-Agent page. Never call the number printed on the COI itself — scammers list their buddy’s burner phone and a scripted “yes this is XYZ Insurance the cert is valid” response. If the real agency has no record of that Named Insured or policy number → 100% fake.

How to Actually Verify a COI Is In Force Today

Step-by-step verification process that I use for every sub/vendor COI above $25K contract value. Skipping Step 4 is the #1 mistake property managers make.

Step 1 — Initial Format Audit: Run through the 6-field ACORD 25 checklist above. If any field fails format audit, reject and request revision before calling anyone.

Step 2 — Third-Party Phone Lookup: Go to the state insurance department’s license lookup tool. Search the Producer/Agency name as shown on the COI. Pull their DIRECT phone number and email from the state record — NOT the COI. Cross-reference carrier names against NAIC database numbers.

Step 3 — Call and Speak to a Licensed CSR (Customer Service Rep): “Hi, my name is [X] with [Company]. I’d like to verify a commercial lines certificate of insurance. The Named Insured is [Legal Entity Name], the Producer of Record is [Agency Name], the CGL policy number is [#], Effective [date], Expiration [date]. Can you please confirm, for the record, that this policy is currently active and in force TODAY, that there are no pending cancellation notices, and that the limits shown ($1M each occ / $2M agg) are correct?”

Step 4 — Written Confirmation via Email (CYA): Ask the CSR “Can you please send me a written confirmation of this verification to my email [your procurement address] for our compliance records?” If the agency pushes back (“we don’t do that”), offer to send a written authorization from the Named Insured authorizing disclosure. If they still refuse → red flag. Legitimate agencies verify coverage for certificate holders daily.

Step 5 — Direct Cert for High-Value Contracts (>$250K): For projects above $250K, skip the contractor-supplied COI entirely. Instead, include in your MSA: “Contractor shall instruct their Producer of Record to issue a Certificate of Insurance DIRECTLY to [Hiring Party] via email from the agency’s authorized email domain, cc: [[email protected]], no later than 10 business days prior to commencement. Contractor-supplied COIs are not acceptable under this agreement.” This eliminates 99% of forgery risk at the source.

Frequently Asked Questions (FAQ)

How long is a COI valid for? Do I need to request new ones?

A COI itself never “expires” per se — the policy it describes has an expiration date. But COIs are point-in-time. If the policy cancels tomorrow due to non-payment, the COI you received today is instantly obsolete. Best practice for procurement: (1) Require 30-day cancellation notice + AI status so you hear directly about cancellations, (2) Automatically request a new COI every 6 months or 45 days before the listed expiration date, whichever comes first, and (3) For long-term contracts (>1 year), set up an automated vendor compliance system that requests re-certs on a schedule and blocks payment if one is not received.

Should I keep copies of every COI I receive? For how long?

Absolutely — and store them in a secure records system (not just email inboxes) that is searchable by vendor name, contract number, and expiration date. The minimum retention period is 10 YEARS after contract completion, and many states allow construction-defect claims for 10–15 years after substantial completion. If a claim is filed 8 years after the project and you can’t produce the COI + AI endorsement proving you had coverage from the sub, you’re on the hook.

Can I accept a “Bracker Certificate” or agency-generated cert instead of ACORD 25?

Only as a temporary measure. ACORD 25 is the industry standard because every carrier, agent, lawyer, and judge recognizes it — the sections are standardized, the meanings are interpreted consistently in 50 states. Agency-generated “bracketed certs” are not standardized and often contain hidden language (“for informational purposes only — no third-party reliance”) that invalidates them in court. If a sub provides an agency cert, accept it as proof of bind but require a formal ACORD 25 with all remarks filled in prior to start date.

What is a “Direct Primary & Noncontributory” AI endorsement and should I require it?

Yes — always require it on large contracts. “Primary” means the sub’s policy pays FIRST (100% up to its limits) before your own policy is asked to contribute. “Noncontributory” means your policy cannot be forced to contribute proportionally to a loss that should be 100% the sub’s responsibility. Without this language, a carrier can bring a “contribution” action against your own policy, eroding your limits even though the sub was 100% at fault. Require: “Additional Insured status is granted on a Primary & Noncontributory basis per ISO CG 20 10 10 01 or equivalent endorsement” in the remarks box.

If a sub’s policy cancels, will I as the Certificate Holder get notified?

No. NEVER — unless you are Additional Insured via endorsement granting 30-day cancellation notice. Being Certificate Holder only means someone sent you a PDF. The carrier has zero legal obligation to ever contact you again. This is the single most-asked question I get about COIs and the answer is a hard, non-negotiable NO. If you require notification, you must require Additional Insured status with cancellation notice provision. Period.

Sources & References

General Liability (CGL) Business Owners Policy (BOP) Workers’ Compensation Insurance Commercial Umbrella Liability Commercial Property Insurance Professional Liability / E&O

About this definition

Written and checked against the primary sources linked on this page by the InsurTool Editorial Team. Definitions describe how these terms are used in the United States; policy wording differs between insurers, and state law changes the meaning of some terms. Your own policy document is the authority for your coverage.

Found something wrong? Tell us — corrections are checked at the source and recorded. Read our editorial policy.

InsurTool·Reviewed by Alice Zhang

Figures on this page are compiled by the InsurTool editorial team from NAIC and state Department of Insurance publications, the Insurance Information Institute, and carrier methodology disclosures. Every figure is checked against its cited source before publication; anything unverified is labelled as an estimate or left out. InsurTool is an educational resource — not insurance, brokerage, or financial advice.