Required compliance docs — W-9, COI, Workers Comp, License, EIN reg

The Vendor Compliance Registry tracks five kinds of compliance document. Each kind has its own verification rules and propagation behavior.

**W-9** (`w9`)
• What it is: IRS Form W-9 — the contractor's taxpayer identification and certification
• Verification: parsed for EIN + legal name + signature presence; Turtini staff reviews flagged uploads
• Propagation: sensitive (consent required per-org)
• Why orgs care: needed before issuing 1099-NEC at year end. Filing a 1099 without a W-9 on file is a paperwork mess.

**Certificate of Insurance** (`coi`)
• What it is: proof of general liability + (often) auto + (sometimes) professional liability insurance
• Verification: COI captures carrier, coverage limit (e.g. $1M per occurrence / $2M aggregate), policy number, expiration date
• Propagation: sensitive (consent required)
• Why orgs care: liability waterfall — if a contractor causes damage, the org's insurer wants the contractor's insurer to pay first.

**Workers' Compensation** (`wc`)
• What it is: state workers' comp insurance certificate, or a waiver if the contractor has no employees and is exempt
• Verification: carrier + state coverage + expiration
• Propagation: sensitive (consent required)
• Why orgs care: if a contractor's worker is hurt on your property, the WC carrier pays. Without it, the orgs's WC may pay AND the org may face state penalties.

**Contractor License** (`license`)
• What it is: state-issued contractor license (electrician, plumber, general contractor, etc.) — license number, jurisdiction, class, expiration
• Verification: AUTOMATED via state licensing board lookup. Provider abstraction supports stub (free) or Accurate ($0.75/check). Cost flows to the requesting org at +15% chargeback.
• Propagation: **public-record** — propagates freely, no consent required (the license itself is already public)
• Why orgs care: many jurisdictions require licensed contractors for certain work. Hiring an unlicensed contractor for licensed work can void insurance and trigger fines.

**EIN Registration** (`ein-reg`)
• What it is: proof the contractor is a registered business entity (IRS EIN confirmation letter, articles of incorporation, etc.)
• Verification: cross-checked against IRS EIN database
• Propagation: **public-record** — propagates freely
• Why orgs care: separates a legitimate business from a shell — useful for fraud screening before signing a contract.

If a doc is rejected (parsing failed, info doesn't match, expired) it goes back to the vendor with a clear reason. Re-upload to fix.

If a doc is expired but a new version is on file, the new one wins automatically — no admin action needed.