The subcontractor payment gate: check before the money leaves, not after the fine arrives
No subcontractor gets paid until their papers are in date and the official check has been run today, and every check is stamped so you can prove it
Version history
Two rulebooks moved in 2026 and both landed on the same sentence: check the subcontractor at every payment, not once when you signed them up. Nobody does that by hand. So build the gate into the payment run and let it stamp its own homework.
The architecture
the same flow as text
│ │
└────────┬─────────┘
▼
[ n8n — intake ]
├─ Docling: certificate PDF → plain text
└─ local model: insurer, policy no., cover, valid-until
▼
[ the subcontractor file — NocoDB ] one row per company
│ company no. · VAT · cover · valid-until · check log
▼
[ THE GATE ] runs on the day you pay, per invoice
├─ was cover in date on the work date?
├─ official withholding / CIS check run TODAY?
└─ bank account matches the one on file?
▼
CLEAR → payment run · HOLD → named person, named reason
WITHHOLD → amount + structured payment reference
[ n8n — the renewal clock ] nightly
└─ 45 / 30 / 14 days before valid-until → ask for the new one
[ n8n — the refresh ] monthly, on the published update day
Four jobs, cleanly separated. The file holds the truth. The clock keeps the paperwork alive. The gate runs once per invoice on the day the money moves. And every answer the gate got is written back into the file with its date, because the answer is worth less than the proof you asked.
The problem
You've used the same three subcontractors for years. Their invoices come in, they go in the payment run on the 30th, and nobody opens a drawer. Somewhere in that drawer is a public liability certificate that ran out in March, and somewhere in a database you've never logged into is a note that this company has overdue social contributions. Neither of those is your fault. Both of them become your bill.
In Belgium, since 1 May 2026, a professional client or contractor having works in immovable property carried out in the construction and cleaning sectors has to withhold 15% of the invoice amount excluding VAT when the contractor or subcontractor has overdue social debts under the self-employed regime, and pay it to the RSVZ. The trigger is overdue debts above €2,647.00 (2026). Miss it and the fine is 15% of the invoice excluding VAT, capped at €10,578.23 (2026). This sits on top of the withholding that already existed: 35% for RSZ debts and 15% for tax debts. The check has to happen at payment, not at signature.
In the UK, contractors have to verify every subcontractor through HMRC's CIS service before each payment, and cannot lean on a verification from a previous tax year. Get it wrong and you deduct 30% instead of 20%, which is a conversation nobody enjoys. From 6 April 2026 HMRC can also revoke Gross Payment Status immediately where it decides a business knew or should have known a transaction was connected to fraudulent tax evasion, with no notice period first, and the wait to reapply went from one year to five. Monthly nil returns became mandatory, with a £100 fixed penalty for missing one.
In the US the shape is different but the discipline is the same: a W-9 on file before the first payment, 24% backup withholding if the TIN never shows up, and from the 2026 tax year the 1099-NEC reporting threshold rose from $600 to $2,000 under the One Big Beautiful Bill Act signed in July 2025, indexed for inflation after that. A higher threshold is not a lower duty. You still have to know which contractors crossed it, which means you still have to be counting.
And underneath all of it sits the boring one that costs the most: an uninsured subcontractor damages a customer's property, and the customer's letter is addressed to you.
Tool choices — and why
retainmentObligations/search for a list of companies and paymentPreparations for the payment side. It also accepts an intra-community VAT number or another foreign official identification, which is the part that matters if you use subcontractors from outside Belgium. Be realistic about the setup: you need a Chaman channel and an X.509 certificate on the company's name, either bought from GlobalSign or self-signed to their spec (RSA 2048/3072/4096 or EC P-384/P-521, SHA-256 or better, Key Usage Digital Signature). That is a morning of admin, not a line of code, and the contact address is billretainment30bis@rsz.fgov.be. In the UK it is the HMRC CIS online service, and the same rule applies: it is theirs, you call it, you record what it said.Setup outline
1. Write the list of papers you actually require, per type of subcontractor. Keep it short and keep it real: liability cover with a minimum amount, the registration number, the bank account, and whatever your sector adds on top.
2. Build the file: one row per subcontractor, with company number, VAT number, bank account, cover amount, valid-until, and a child table for checks with date, what was checked, what came back, and who ran it.
3. Publish the form view as the upload page and send it to every subcontractor once. Their new certificate goes in there, not into somebody's personal inbox.
4. Add the reading step: Docling to text, then the local model with a fixed list of four fields and permission to return UNKNOWN. Everything it reads gets shown next to the original PDF before it's accepted the first time.
5. Build the clock: nightly job at 45, 30 and 14 days before valid-until, mailing the subcontractor and copying whoever owns the relationship. Three nudges, then it becomes a person's problem, not the machine's.
6. Build the gate as a step in your payment run, not as a separate ritual. It reads the invoice, finds the row, and answers CLEAR, HOLD or WITHHOLD with a reason in plain words.
7. Wire the official check in whichever way suits your volume, manual or webservice, and write the result back into the check log with today's date every single time.
8. Add the monthly refresh. In Belgium the authorities' withholding decisions are updated on the Friday after the last Thursday of the month, so schedule a full re-check of your active subcontractors for that morning and you'll be current for the whole month.
9. Run the gate in report-only mode over last quarter's payments before you let it block anything. You'll find out how bad it was, and you'll find the false alarms while they're free.
10. Then turn on blocking, and decide who is allowed to override it. Somebody must be, and it should be one named person, and the override should also be logged.
Pitfalls — the real ones
A check from last month is not a check. This is the single mistake the whole build exists to prevent. The Belgian rule attaches to the moment of payment, and the UK guidance is explicit that a verification from a previous tax year doesn't carry over. If your gate reads a cached answer without a date on it, you have built a machine that reassures you.
The insurance date that matters is the work date, not today. Cover that lapsed in March doesn't help you on a job done in February and invoiced in April. Check the certificate against when the work happened, which means your file has to know when the work happened.
A certificate is not the same as cover. It says a policy existed on the day it was issued. It doesn't say the premium got paid in month four. For anything that could genuinely ruin you, ask for confirmation direct from the insurer rather than a PDF forwarded by the person you're checking.
Don't build the official database yourself. Every jurisdiction here has a lookup, and every lookup is the only answer that counts. Your job is to call it, record it and act on it, and to resist the urge to keep a clever local copy that quietly drifts.
Withholding and paying are two steps, and people forget the second. Holding 15% back and leaving it in your own account isn't compliance, it's a different problem. Use the structured payment reference the lookup gives you, and treat the onward payment as part of the same workflow.
The gate will block a payment on a Friday afternoon. If there's no override path, someone will bypass the whole system within a month. Build the override, name the person, log it, and review the overrides quarterly. That review is where you find out which subcontractor is always the exception.
Foreign subcontractors are where the rules bite hardest and your data is thinnest. The Belgian webservice takes an intra-community VAT number or another foreign identification precisely because that's the gap. Make sure your file has somewhere to put those numbers before you need them.
This is a build guide, not legal or tax advice, and the amounts and dates here are the 2026 figures for the specific rules named. Percentages, thresholds and indexed caps change every year — check the position where you actually trade, and take advice before you rely on any number on this page.
Verified repos
NocoDB — Sustainable Use License (changed from AGPL 29/01/2026), 64.6k stars, release 2026.08.1 (19/08/2026)
Baserow — MIT open-source core, premium/enterprise dirs separate, 5.6k stars, 2.3.3 (21/07/2026)
n8n — Sustainable Use License (free internal business use), 201.4k stars, 2.35.5 (20/08/2026)
Docling — MIT, 65.3k stars, v2.121.0 (20/08/2026)
Ollama — MIT, 179.1k stars, v0.32.15 (19/08/2026)
Paperless-ngx — GPL-3.0, 44.4k stars, v3.0.5 (01/08/2026)
All figures checked against the GitHub API on 21/08/2026. The official lookups (checkinhoudingsplicht.be, the RSZ billRetainment REST webservice, HMRC's CIS online service) are government services, not repos.