How to verify an URSSAF vigilance certificate

Updated 3 September 2026

The attestation de vigilance is the document by which URSSAF, the French social-security collector, certifies that a business declares and pays its social contributions. Any client must demand it from subcontractors above a certain contract value, and have it renewed: it is the client's protection against joint liability if the subcontractor turns out to use undeclared labour. For that very reason it gets forged — and it is one of the easiest documents to verify, thanks to the security code URSSAF prints on it.

Contents

1. What the certificate certifies, and what it contains
2. What the law requires of the client
3. The security code: the check that matters
4. Signs of a forgery in the document itself
5. Cross-check with the rest of the file
6. What a valid certificate does not prove

What the certificate certifies, and what it contains

URSSAF issues the certificate to a business or self-employed person that has paid its contributions when due, or holds and honours a payment plan, or formally disputes the amount. It is downloaded from the business's online account — urssaf.fr, or autoentrepreneur.urssaf.fr for a micro-entrepreneur — and is valid for six months.

The document identifies the business (name, SIRET, address), states its issue date and validity period and, for an employer, the number of employees and the total remuneration declared. It carries a fifteen-character security code: that code is what makes verification possible.

What the law requires of the client

For any contract worth at least €5,000 excluding VAT, the client must obtain the vigilance certificate at signature, then every six months until the work is complete (French labour code, articles L8222-1 and following, D8222-5). A proof of registration comes with it: a K or Kbis extract, proof of entry in the National Business Register, or a quote, advertising document or business letter showing the name, address and registration number.

The stakes are not administrative. If the subcontractor is convicted of undeclared labour and these checks were not made, the client is jointly liable for its unpaid taxes, contributions and wages. A forged certificate accepted without checking protects against nothing.

The security code: the check that matters

URSSAF runs a public certificate verification tool. Enter the security code exactly as printed — fifteen characters, no spaces. If URSSAF does not recognise it, it answers that the code matches no certificate currently in force: the code was miscopied, the certificate has expired, or it was altered or fabricated.

If the code is recognised, URSSAF displays the details of the certificate it actually issued: the company name ("identification du diffuseur"), the SIRET of each establishment, the document's certification date and the last period analysed. Compare them line by line with the document you received: a fraudster can paste another company's genuine code onto a certificate fabricated in their own name — the code passes, the comparison does not.

Signs of a forgery in the document itself

• A validity period that is not six months, an issue date later than the letter it came with, or an "up to date" certificate that is eight months old.
• An inconsistent headcount: the subcontractor promises thirty people on site, the certificate declares two employees.
• A SIRET with a wrong check digit, or one that does not match the Kbis and the invoices.
• A security code that is not fifteen characters, contains spaces, or appears identically on two certificates with different dates.
• Traces of PDF editing: a different font on a date or figure, a white rectangle, a revision added after creation, editor metadata — see the guide on modified PDFs.

Cross-check with the rest of the file

The certificate never comes alone. The SIRET must be the one on the Kbis extract and the invoices; the bank details must be in the same company name — supplier impersonation fraud often starts with a flawless onboarding file. And do not confuse the vigilance certificate with the tax-compliance certificate issued by the tax administration: two documents, two issuers, two checks.

What a valid certificate does not prove

That a business is up to date with its contributions today says nothing about its solvency tomorrow, nor about who is actually writing to you in its name. The certificate expires in six months: put the renewal in the contract's follow-up rather than relying on the subcontractor to remember. TrustyFile examines the file — revisions, edits, SIRET and VAT check digits; the security code is verified on urssaf.fr, and nothing replaces that step.

Free tools

More guides