Subcontracting security: the client's joint and several liability

The principle: the duty of vigilance

Articles L.8222-1 et seq. of the Labour Code require every client — company, local authority, association, even a private individual — to check that its contractor is meeting its obligations to declare and pay staff, for any transaction worth at least €5,000 excl. VAT. The check is made by obtaining documents, when the contract is signed and then every six months until it ends:

• an attestation de vigilance issued by URSSAF, confirming that the company is up to date with its social security filings and payments, and stating the number of employees and payroll declared;
• proof of registration (an extract from the trade register or equivalent);
• where relevant, the named list of foreign employees who need a work permit.

The €5,000 threshold is assessed across the whole transaction, even if it is split across several quotes or invoices. An annual patrol contract, a season of extra staffing, a festival deployment: the threshold is reached very quickly.

What you risk if you do not do this

If your provider is fined for undeclared work and you did not carry out the checks, you are held jointly and severally liable with it for the taxes, duties and compulsory contributions, penalties and surcharges, and the wages and allowances owed to staff, in proportion to the value of the work or services carried out for you. This is not a penalty for fault: it is automatic joint liability wherever the duty of vigilance has not been met. In serious cases, this can extend to repaying public subsidies received and prosecution for complicity where the use of undeclared work was known about.

In private security, this financial risk comes with an operational one: an undeclared guard is almost always a guard without a CNAPS professional licence, so untrained, and precisely the kind who oversteps their powers or walks off post. And the provider's insurer, like your own, will not be keen to cover an incident that happens under these conditions.

What is specific to private security

• The operating authorisation. Contracting with a company that is not authorised by CNAPS (France's private-security regulator) is an offence in itself. The authorisation number must appear on the quote and the invoice, along with the wording required by article L.612-14 of the French Internal Security Code (Code de la sécurité intérieure).
• The professional licence. Every guard must hold it and wear it. A well-informed client asks for the list of guards and checks their licences on CNAPS's online verification service.
• Regulated subcontracting. Since the law of 25 May 2021, the provider must tell the client when it subcontracts all or part of the service, and subcontracting in a chain is strictly limited. In practice: you need to know which company employs the guards on your premises, and apply the same checks to it.

This last point is often the Achilles' heel of event deployments: a well-regarded provider that, short of staff, 'tops up' with guards from a third-party company that nobody has checked.

Local authorities and public contracts

Public buyers are subject to the same duty of vigilance, with the same documents, required at the time of award and then every six months during the life of the contract. Private security tenders also call for the operating authorisation, insurance certificates and a technical statement describing the deployment and the qualifications of the guards assigned. A bidder that supplies incomplete or out-of-date documents must be excluded; this also protects the elected official and the public officer who sign off on it.

The procedure in practice

1. Before signing: an attestation de vigilance less than six months old, a registration extract less than three months old, the CNAPS operating authorisation, and a professional liability insurance certificate.
2. Check the authenticity of the attestation de vigilance using the security code it carries, on the URSSAF website; confirm that the company name and SIREN number match the entity that is invoicing you.
3. During the contract: renew the request every six months, without waiting for the provider to think of it. A shared calendar is enough.
4. If there is subcontracting: demand written notice and the same documents from the subcontractor.
5. Keep all the supporting documents for the whole of the relationship and beyond, for as long as the statute of limitations runs.

A provider that is properly compliant sends these documents without being asked: that is what we do, whatever the amount, including below the legal threshold. The checks are covered in detail in our guide how to check that a security company is properly licensed.

The warning signs that should stop you

• An attestation de vigilance that has been 'being requested' for several weeks.
• A declared headcount that bears no relation to the number of guards proposed for your deployment.
• An invoice issued by a different company from the one on the quote.
• A price well below the market rate: the cost of a guard is almost entirely loaded wages, so the margin does not allow for a big gap. See our price guide.
• Guards who change every day and do not wear a licence.