Keeping your cleaning provider’s compliance file current

The short answer

Build the file in three layers. At onboarding: registry enrollment, the contract with appendices, and initial compliance opinions. Monthly: valid opinions and evidence that on-site staffing matches the contract. Every four months and annually: acknowledgments of the provider’s reports to IMSS and Infonavit, a registry lookup, and a review of the contract scope. Record who reviews each document and what evidence is retained. For REPSE verification itself, see the REPSE verification guide; here, we focus on keeping the file current.

Legal requirements and internal controls: two different things

Separate the provider’s obligations, the client’s tax requirements, and internal controls. Tax documentation is not always optional: Article 27, section V, of the Income Tax Law and Article 5, section II, of the VAT Law establish documentation requirements for deductions and credits involving specialized services. Your tax team must determine which apply and how documents are obtained and retained.

• What the law requires of the provider. The LFT (Federal Labor Law) requires specialized service providers to register with STPS, renew their registration every three years, and demonstrate that they are current on tax and social security obligations (Art. 15). It also requires a written contract stating the purpose of the service and the approximate number of workers (Art. 14). The Social Security Law and IMSS guidelines require providers to report their contracts every four months; Infonavit publishes an equivalent obligation through SISUB.
• What you choose to request. Opinions, acknowledgments, and lists can be part of your internal controls; they do not replace the supporting documents the client must obtain when seeking income tax deductions or VAT credits. Defining additional reviews is a sound control practice, useful because Article 14 of the LFT provides for joint and several liability if the contractor fails to meet its obligations to its workers, and because Article 15-D of the CFF (Federal Tax Code) makes the tax treatment of these payments conditional on the contractor meeting certain requirements. Your legal and tax teams determine how this applies to your company.

In the calendar table, the “Basis” column distinguishes the two cases.

At onboarding: the baseline file

Request these documents before signing and retain complete copies.

1. Enrollment in the STPS registry (your own lookup, with a dated screenshot). The REPSE guide explains how to verify it; here, simply file the evidence and record the three-year expiration date.
2. Contract and appendices. In writing, with the purpose of the service and approximate number of workers. Recommended appendices: scope by facility, schedules, service frequency, and staff assigned per shift.
3. Compliance opinions from SAT, IMSS, and Infonavit with visible issue dates (details in the next section).
4. List of assigned staff, including name, position, and shift. If you receive it, determine with your legal team which personal data to retain and how to protect it.
5. Insurance and policies, if applicable. Liability insurance or other coverage depends on your procurement policy and facility risks; we have not identified a general legal requirement for it in this type of contract, so it is presented as a control.
6. Training for assigned staff, if your site requires it (for example, chemical handling or access rules for the CEDIS (distribution center)). It becomes a contractual requirement if included in the contract; confirm with Legal which health and safety regulations apply to your situation.

Monthly: the brief review

An organized file makes monthly review easier; the time required depends on the scope and documents to be reconciled.

Compliance opinions. These are snapshots as of the issue date, which is why dated documents are requested.

• Infonavit. The certificate of tax status regarding employer contributions and remittance of deductions is valid for 30 calendar days from issuance, according to the Infonavit portal. A third party can validate it using the reference number, issue date, and RFC, or the document’s QR code. The rules amended in 2024 provide four results: no outstanding balance or secured balance, outstanding balance, outstanding balance with a payment agreement, and no record. Read the result, rather than simply checking that a file exists.
• IMSS. Rule Nine of the agreement published on September 22, 2022 establishes validity on the day of issuance. The 2025 amendment establishes Buzón IMSS as the channel for obtaining it and provides specific time frames for formalizing certain public contracts: do not apply these generally to private contracts. Verify the document based on its intended use; an internal monthly review does not extend its validity.
• SAT. The compliance opinion is based on Article 32-D of the CFF and the applicable rule in the current Miscellaneous Tax Resolution. Confirm its validity based on its intended use and the current tax rule on the SAT portal; an internal monthly schedule is no substitute for that validation.

On-site staff. Operations compares actual staffing with the contract and the provider’s list. A discrepancy is a reason to ask questions, not a conclusion.

Contribution, payroll, and VAT payments. Do not treat these as a mere courtesy: when the specialized services tax regime applies, review with your tax team the payroll CFDI and evidence of withholdings, IMSS contributions, Infonavit contributions, and VAT filing and payment required by the Income Tax Law and VAT Law. Define dates, reconciliation, and limited retention of personal data.

Every four months and annually

Provider reports to IMSS and Infonavit. The IMSS guidelines for ICSOE and the Infonavit SISUB page establish three annual windows, from the 1st through the 17th of May (January–April), September (May–August), and January of the following year (September–December). If the 17th is not a business day, the deadline moves to the next business day. The provider files the reports. The following serve as supplementary evidence for the client:

• The SISUB receipt acknowledgment (the obligation is considered fulfilled upon acknowledgment of an accepted filing) and the ICSOE acknowledgment.
• The IMSS public contract listing, which includes the reference number, service, dates, and number of assigned workers and is updated at least monthly. The provider can also authorize you through Buzón IMSS to view contract details.

Requesting these acknowledgments is your own control practice; the law requires the provider to report, not you to review.

Annually. Check the STPS registry, review validity and authorized services, and review the contract: scope, facilities, and number of workers. If the provider’s registration expires during the contract, schedule renewal verification in advance.

Review calendar

Common mistakes

1. Filing without reading. An opinion showing an outstanding balance or payment agreement is not equivalent to one showing no outstanding balance.
2. Requesting everything only once. Opinions are one-day snapshots; registry entries and contracts change.
3. Presenting a control as a legal obligation. If your policy requires a document, state it in the contract; do not attribute it to the law.
4. No assigned owner. If everyone reviews, no one reviews: assign a name and date.
5. Ignoring on-site staff. The best reality check against the paperwork is what Operations sees.

Cautions

Compliance file checklist (downloadable)

*How to use: complete at contracting and update using the calendar above.*