ACORD 25 Certificate of Insurance: Everything Brokers Need to Know

The ACORD 25 certificate of insurance is the one-page document a broker issues to confirm that liability coverage exists on a commercial policy. It lists the carriers, policy numbers, coverage limits, effective dates, and endorsement flags that a third party needs to verify insurance. The form is not a contract. It does not grant coverage, modify the policy, or bind the insurer. It reports. Brokers who treat ACORD 25 as coverage documentation (instead of a snapshot of what the policy already says) create E&O exposure the first time a claim lands and the certificate representations do not match the underlying policy.

This guide covers the version history brokers need to know, the cancellation notice problem that most agencies handle incorrectly, field-by-field completion, and the patterns carriers use to distinguish authentic certificates from fraudulent copies.

Key Takeaways

• ACORD 25 has three active editions in the field: 2013/01, 2014/10, and 2016/03. The 2016/03 edition is the current version and the one most carriers require for new certificates.
• The pre-printed "endeavor to provide 30 days notice" language that used to appear on ACORD 25 was replaced in 2010. The current language is a best-efforts obligation that does not create a contractual promise.
• Only the authorized producer, broker, or carrier-designated issuer can sign the certificate. An ACORD 25 signed by an unauthorized party is legally a fraudulent certificate, even if the information is accurate.
• Common fraud indicators include font inconsistencies in policy numbers, pixelated carrier logos, missing producer code, and altered effective dates. IVANS transaction logs and carrier verification portals detect most of these within seconds.
• State insurance departments (including CA DOI and NY DFS) have disciplined producers for certificate alterations under producer licensing laws.
• BrokerageAudit's COI Manager reads ACORD 25 certificates at the field level and flags altered or mismatched fields before they reach the certificate holder.

What ACORD 25 Is (and the Exact Legal Status)

ACORD 25 is formally titled "Certificate of Liability Insurance." It is published by ACORD, a non-profit standards body that produces insurance industry forms. The current version (2016/03) has been in continuous use since March 2016.

The certificate summarizes coverage on one or more policies: general liability, automobile liability, umbrella, excess, workers' compensation, employers' liability. Each line is grouped by the type of insurance, with carrier name, policy number, effective and expiration dates, and limits.

The top of ACORD 25 contains a plainly worded disclaimer: the certificate is issued as a matter of information only, confers no rights upon the certificate holder, does not amend, extend, or alter the coverage afforded by the policies, and does not constitute a contract between the issuing insurer, authorized representative, producer, or certificate holder.

Courts in every US jurisdiction have upheld this disclaimer. Multiple state supreme courts have held that certificates do not modify the underlying policy and that certificate statements do not estop the insurer from denying coverage that is not in the policy.

The practical consequence is that the ACORD 25 reports what the policy says. It does not change what the policy says. A certificate showing blanket additional insured coverage does not create blanket additional insured coverage if the underlying endorsement is not on the policy.

Version History: 2013/01, 2014/10, and 2016/03

Three editions of ACORD 25 are actively used in the field. Brokers need to know which edition is in front of them because the cancellation notice language changed between editions, and subtle field layout changes affect certificate automation.

The version date appears in the bottom-right footer in small type, formatted as "ACORD 25 (2016/03)." If the version date is missing, the certificate is likely either a very old stock form or a fabrication. Carriers today generate certificates from software that automatically stamps the footer.

ACORD updates the form on an irregular schedule. The 2016/03 edition has remained current through April 2026. When a new version is released, major risk management systems (Origami, Riskonnect, Ventiv) roll out support within 60 to 90 days.

The certificate of property insurance equivalent is ACORD 24, and the two forms share most field conventions but differ on what coverage types are reported.

The 30-Day Notice of Cancellation Disclaimer Problem

Box 16 of ACORD 25 contains the Cancellation statement: "Should any of the above described policies be cancelled before the expiration date thereof, notice will be delivered in accordance with the policy provisions."

This language replaced the original pre-2010 text, which read that the issuing insurer would "endeavor to mail 30 days written notice to the certificate holder." The change was not cosmetic. It was a direct response to case law where certificate holders attempted to hold insurers liable for failure to provide notice based on the certificate.

ACORD rewrote the language to make clear that notice is not a separate obligation created by the certificate. Notice depends on the underlying policy. If the policy has no notice-to-certificate-holders endorsement, the certificate does not create one.

This is where most agencies make an expensive mistake. A landlord or lender reads the certificate, sees language about cancellation notice, and assumes they will get 30 days. The policy has no such endorsement. The policy cancels. The landlord gets no notice. The broker gets sued.

Three common responses from certificate holders create more E&O risk.

Crossing out the cancellation language. A certificate holder demands that the broker cross out the ACORD 25 cancellation disclaimer and write in "30 days written notice of cancellation." This is certificate modification without a corresponding policy endorsement. It is fraud. Carriers explicitly prohibit it and revoke producer authority when detected.

Typing "30 days notice" in the description of operations box. This is the cleaner version of the same fraud. The certificate now appears to promise 30 days notice, but the policy has no such obligation. The certificate holder later sues and wins against the broker.

Requiring a separate endorsement for notice of cancellation. The correct response. The broker orders an endorsement from the carrier (Hartford, Travelers, Liberty Mutual, and Chubb each have their own form number) that creates a direct contractual notice obligation to the scheduled certificate holder. The endorsement costs money. The policy coverage actually provides the notice.

The National Association of Insurance Commissioners (NAIC) has repeatedly warned that altered certificates expose brokers to criminal liability in some states. CA DOI and NY DFS have both issued producer disciplinary actions for ACORD 25 alterations in the past three years.

Field-by-Field Walkthrough

ACORD 25 has 18 distinct data zones in the 2016/03 edition. Each field has a specific purpose, and the absence of required information (or the presence of incorrect information) triggers either automated rejection by certificate holder systems or manual escalation by risk management teams.

Producer (Box 1). The name, address, phone, and email of the issuing agency. The producer code registered with each carrier typically appears here or in a carrier-specific sub-field. This field identifies who is vouching for the certificate.

Insured (Box 2). The first named insured as it appears on the declaration page. Exact match matters. "Acme Construction LLC" and "Acme Construction, LLC" are different entities to certificate verification systems.

Insurers affording coverage (Box 3). Each carrier's NAIC company code and legal entity name. Travelers is not a carrier. "Travelers Indemnity Company" (NAIC 25658) is. Certificate holders increasingly require the NAIC number to verify that the named entity is authorized in their state.

Coverages section (Box 4). A grid of policy types (GL, Auto, Umbrella, WC, Other), with flag columns for Additional Insured and Subrogation Waived, the policy number, effective and expiration dates, and limits. This is the core reporting section.

General liability detail. Occurrence or claims-made, each occurrence limit, damage to rented premises, medical expense, personal and advertising injury, general aggregate, products and completed operations aggregate. If the policy has a waiver of subrogation arrangement, the waiver box is checked.

Automobile liability detail. Any auto, owned autos only, hired autos only, non-owned autos, combined single limit or split limits. Symbol codes from the Business Auto Coverage Form (1 through 9, 19) tell the certificate holder which autos are covered.

Umbrella / Excess liability detail. Occurrence or claims-made, each occurrence limit, aggregate limit, retention, and a box indicating whether the umbrella is follow-form or has its own terms.

Workers compensation detail. Statutory limits, each accident, disease policy limit, disease each employee. The policy number, effective dates, and whether the proprietors, partners, or officers are excluded or included.

Description of operations (Box 16). Free-text field describing the operations to which the certificate applies, and listing specific additional insured status, primary and non-contributory, and waiver of subrogation flags. This is the most-used field for contract-specific details.

Certificate holder (Box 17). The third party receiving the certificate. Name, address, contact information. This is distribution data, not coverage data.

Authorized representative (Box 18). The signature of the producer or authorized representative issuing the certificate. This is the legal attestation that the certificate is authentic.

Fields left blank are as informative as fields filled in. A blank NAIC code in box 3, a blank symbol code on the auto line, or a blank producer code is typically a sign that the certificate was either issued quickly by an inexperienced staff member or fabricated by someone who did not know which fields matter.

Who Is Legally Authorized to Issue ACORD 25

Only three categories of people can legally issue an ACORD 25 certificate.

The producer (broker or agent) with binding authority from the carrier. Most certificates are issued by the producer of record on the underlying policy. The producer's agency agreement with the carrier typically includes certificate issuance authority.

An authorized service representative of the producing agency. The agency principal can delegate certificate issuance to CSRs, account managers, or certified insurance service representatives (CISRs). The delegation must be documented and the representative must operate under producer oversight.

The carrier's own certificate team. Some carriers (Chubb, Travelers, Liberty Mutual) operate centralized certificate issuance teams that take requests directly from insureds or from producers. The carrier is the direct issuer in these cases.

A common fraud pattern is a third party (not the producer, not the carrier) generating an ACORD 25 using a blank form downloaded online or a template scraped from a legitimate certificate. These fake certificates typically include real policy numbers (copied from prior legitimate certificates) and real carrier names, which makes them harder to detect by casual review.

Carriers distinguish authorized certificates from fraudulent ones through several signals.

Producer code. The authorized producer has a unique code assigned by each carrier. The code appears in the certificate software output and in the carrier's certificate verification system. Fraudulent certificates often have a missing producer code, a spoofed code from a different producer, or a producer code that does not match the agency name on the certificate.

Serial or reference number. Many agency management systems generate a unique certificate reference number. This number lives in the AMS and can be cross-referenced. Certificates without a reference number or with a number that does not exist in the AMS are fraudulent.

Carrier verification portals. Hartford, Travelers, Chubb, Liberty Mutual, and AIG all operate certificate verification portals where a certificate holder can enter the policy number and producer code to confirm the certificate was issued. These portals have become a standard control in large enterprise risk management.

IVANS transactions. For carriers using IVANS for data exchange, certificate issuance is logged in the IVANS transaction record. Mismatches between a physical certificate and the IVANS log are strong fraud indicators.

How Certificate Holders Verify Legitimacy

A certificate holder receiving an ACORD 25 has three verification paths of increasing rigor.

Visual inspection. The first check is the form itself. Is the 2016/03 edition in use? Does the carrier logo look right? Are there font inconsistencies between typed fields and pre-printed text? Altered certificates often show font changes (especially in policy numbers) because the fraudster typed over an existing certificate.

Pixelation in the carrier logo is another tell. Legitimate certificates are generated from vector graphics or high-resolution raster images. Fraudulent certificates often show jagged edges or artifacts from being copied from a low-resolution source.

Contact the producer. A verification call to the agency at the number listed on the certificate confirms the certificate was issued. This is the minimum standard of care for high-value contracts, leases, and government contracts.

Direct carrier verification. The highest rigor. The certificate holder contacts the carrier directly using a phone number from the carrier's official website (not the certificate). The carrier confirms the policy exists, the limits match, and the endorsements (additional insured, waiver of subrogation, primary and non-contributory) are actually on the policy.

For agencies processing many certificates, the reputational exposure from an incorrectly issued certificate is significant. One fraudulent certificate traced back to the agency (even if issued by a rogue employee or a third party using agency letterhead) results in carrier investigations and, in several documented cases, loss of appointment.

See our related coverage of COI verification protocols and the certificate holder vs additional insured distinction.

Using BrokerageAudit for ACORD 25 Workflow

We built the COI Manager because manual certificate issuance and verification are where most agencies lose hours each day and create the E&O exposure described above.

The system reads every ACORD 25 certificate at the field level, maps each representation to the underlying policy endorsements, and flags mismatches before the certificate leaves the agency. For incoming certificates from third parties, the system runs the fraud detection checks described above: footer version, producer code, fontography, logo integrity, and, where supported, direct carrier verification.

For agencies with more than 150 active certificates, the audit log creates the documentation trail needed in E&O litigation and carrier audit reviews.

Frequently Asked Questions

What is an ACORD 25 certificate?

ACORD 25, titled "Certificate of Liability Insurance," is a one-page form issued by a broker or carrier to confirm that liability coverage exists on a commercial policy. It reports the carriers, policy numbers, coverage limits, effective dates, and any additional insured, waiver of subrogation, or primary and non-contributory flags on the policy. The certificate is informational. It does not grant coverage, modify the policy, or bind the insurer. It is the most-used proof-of-insurance form in the US.

What information goes on an ACORD 25 certificate?

The form has 18 data zones. The core zones are: producer (the issuing agency), insured (the first named insured), carriers (with NAIC company codes), coverages (general liability, auto, umbrella, workers' compensation, other), policy numbers, effective and expiration dates, limits, description of operations (free-text field for contract-specific details), certificate holder (the receiving third party), and the authorized representative signature. The 2016/03 edition is the current standard.

Is an ACORD 25 certificate legally binding?

No. The disclaimer at the top of the form states that the certificate is issued as a matter of information only, confers no rights upon the certificate holder, and does not amend, extend, or alter the coverage afforded by the policies. Courts nationwide have upheld this language. Coverage is determined by the policy. The certificate reports what the policy says; it does not create what the certificate describes. A certificate showing additional insured status does not extend additional insured coverage if the corresponding policy endorsement is not in place.

How long is an ACORD 25 certificate valid?

The certificate itself has no fixed duration. It is valid as of the date issued and remains accurate as long as the underlying policies remain in force with the reported coverages. The effective and expiration dates of each policy appear on the certificate. A certificate issued in March 2026 for a policy with a January 2026 to January 2027 term is a current document until either the policy is canceled, endorsed to change coverage, or the expiration date passes. Most large certificate holders require renewed certificates 30 to 60 days before policy expiration.

Who can issue an ACORD 25 certificate?

Only three categories of people can legally issue ACORD 25: the producer (broker or agent) with binding authority from the carrier, an authorized service representative of the producing agency operating under documented producer oversight, or the carrier's own certificate team (common at Chubb, Travelers, Liberty Mutual). Certificates issued by any other party are unauthorized and legally fraudulent, even if the reported information happens to match the underlying policy. State insurance departments (including CA DOI and NY DFS) have disciplined producers for certificate alterations and for allowing certificate issuance by unauthorized parties.

How do I verify the legitimacy of an ACORD 25 certificate?

Three verification paths apply, in order of increasing rigor. Visual inspection: confirm the 2016/03 footer, check carrier logo integrity, watch for font inconsistencies in policy numbers or dates that suggest alteration. Producer verification: call the issuing agency at the number on the certificate to confirm the certificate was issued. Direct carrier verification: contact the carrier using a phone number from the carrier's official website to confirm the policy exists, the limits match, and the endorsements on the certificate (additional insured, waiver of subrogation, primary and non-contributory) are actually on the policy. Many carriers (Hartford, Travelers, Chubb, Liberty Mutual, AIG) operate online verification portals for this purpose.

Written by Javier Sanz, Founder of BrokerageAudit. Last updated April 2026.

Catch fraudulent and mismatched ACORD 25 certificates before they reach the certificate holder. BrokerageAudit's COI Manager reads every certificate at the field level, maps each representation to the underlying policy endorsements, and runs fraud detection checks on incoming certificates. Explore the COI Manager