RedCode SST Cards Invalidated: What NYC Contractors and Subcontractors Need to Do Before December 7

Key takeaways

• On September 8, 2026, DOB invalidated every Site Safety Training certificate issued by RedCode Inc., after the company was indicted by the Brooklyn District Attorney's Office on fraud-related charges. About 2,000 workers hold active RedCode-issued SST cards.
• Affected cards keep working on jobsites through December 7, 2026. On December 8, RedCode-issued SST cards are revoked — and cards from other providers are revoked too if RedCode certificates were used to earn them and the training hasn't been retaken.
• The company name on a card doesn't settle it. A worker whose card came from another provider can still be affected. Free replacement training is available through SBS at 888-SBS-4NYC.

On September 8, 2026, the Department of Buildings and the Department of Small Business Services announced that RedCode Inc., a DOB-registered safety training course provider with locations at 529 McDonald Avenue in Brooklyn and 146-04 Hillside Avenue in Queens, had been indicted by the Brooklyn District Attorney's Office on fraud-related charges. Prosecutors allege that undercover investigators posing as construction workers were sold SST and OSHA cards for $500 each without completing any of the required training, and that workers signed attendance sheets for sessions they never attended.

DOB's response was immediate. RedCode is no longer an approved provider, every SST certificate it issued is invalid, and the roughly 2,000 workers who hold active RedCode-issued SST cards have until December 7 to retake the training and get a legitimate card. If you run projects in New York City, or you employ workers on them, the next 90 days include a piece of work that isn't on anyone's schedule yet.

What DOB Did, and When

Three things happened on September 8. RedCode was shut down as a course provider and can no longer operate in New York City or issue SST cards. Every SST certificate RedCode issued was invalidated. And DOB opened a 90-day grace period so affected workers can retake training through any registered course provider.

Two details from DOB's RedCode FAQ matter for how you read the rest of this. First, certificates and cards are different things: the certificates are invalid now, but affected SST cards, Worker Wallet certifications, and licensing certificates stay active during the grace period, and a RedCode card still scans as valid on a jobsite until December 7.

Second, DOB has been contacting workers with RedCode-issued cards since the announcement, and on September 14 its Course Provider Administration emailed affected workers a formal notice laying out the four cases and the Monday, December 7 deadline. Contractors started receiving forwarded copies from their workers the same day, and so did we. A worker who received that email is on DOB's list, which makes the email itself the fastest way to find out who's affected.

The scale of the program is worth holding next to this. Since Local Law 196 of 2017 made the 40-hour training mandatory in 2018, registered providers have issued SST cards to more than 450,000 people, representing more than 18 million hours of completed training, and building construction injuries fell from 759 in 2018 to 320 in the most recent year DOB reported — a decrease of almost 58 percent. RedCode itself had been an approved provider since April 2021 and issued about 2,000 SST cards tied to more than 7,000 certificates. DOB audits providers with undercover investigators and runs unannounced site inspections to check cards. This case came out of that.

Who Is Affected

DOB's FAQ defines four groups, and only the first is obvious from the card itself.

• Workers with an SST card issued by RedCode.
• Workers with an SST card issued by another registered course provider, where RedCode certificates were used to meet the training requirements.
• Workers with a RedCode certificate used for a worker certification on the Worker Wallet or for a DOB license requirement.
• Workers with an OSHA card that names SM Lutfur Rahman, RedCode's owner, as the instructor. After December 8 those OSHA cards no longer count toward SST requirements.

Group two is the one to worry about. A worker's SST card can carry another provider's name and still depend on RedCode training underneath it.

The Dates That Matter

The grace period is the window for retaking training, and the deadline falls on a Monday — so the last weekend before it is the one every affected worker will try to book.

On December 8, SST cards issued by RedCode are revoked and can't be used on jobsites. DOB's worker notice phrases this as "at the end of the grace period on December 7," and its FAQ as December 8. Same moment, and December 7 is the last day a RedCode card scans. SST cards from other providers that relied on RedCode certificates are revoked unless the training was retaken. RedCode worker certifications come off the Worker Wallet. RedCode certificates stop satisfying DOB licensing requirements. OSHA cards naming RedCode's owner as instructor stop counting toward SST.

Under Local Law 196, an untrained worker found on a site that requires SST carries a $5,000 civil penalty — assessed to the site owner, the permit holder, and the worker's employer each. On December 8, a worker with a revoked card is an untrained worker.

Why the Name on the Card Isn't Enough

Most contractors verify SST at onboarding by collecting a copy or a photo of the card. That was a defensible practice until this month. The RedCode action shows the problem with it: a document that was valid when it was uploaded tells you nothing about its status today, and DOB can act on a credential after the worker is already inside your workforce.

DOB has been moving credential verification to live data for exactly this reason. SST cards can be scanned with the DOB Training Connect app to confirm they're valid, and the Worker Wallet card consolidates a worker's qualifying certifications into one digitally verifiable card. The direction is one-way: verification against current DOB information, not against a photocopy in a folder.

For RedCode specifically, DOB's FAQ says the way to find out which certificates behind a card came from RedCode — including a card another provider issued — is to contact a registered course provider, who can determine what's missing. That's a per-worker inquiry, and on a project with 40 subcontractors it's a list somebody has to build.

What General Contractors Should Do This Week

• Pull the active workforce across every project, not just the ones with a RedCode name on a card.
• Ask every subcontractor to collect DOB's September 14 notice from any worker who received it. Those workers are on DOB's list, whatever the name on their card says.
• Flag every worker with a RedCode-issued SST card. Those cards are revoked on December 8 no matter what else is on them.
• For every other worker, find out whether RedCode certificates sit behind the card, the Worker Wallet certifications, or a DOB license. DOB's FAQ points you to a registered course provider for that determination.
• Check OSHA cards for the instructor name DOB lists.
• Tell each affected subcontractor which of its workers are on the list, in writing, with the December 7 date.
• Put replacement training on the calendar now. DOB says workers only retake the RedCode training, not everything, and any registered provider can deliver it. SBS offers it free.
• Decide what happens at your gate on December 8 for anyone still on the list.

What Subcontractors Should Do This Week

The grace period is easy to misread. A worker whose card still scans today can enter your project today and be an untrained worker on December 8. If your employees work on SST-required sites, review them now, without waiting for the GC to ask. Workers with affected training should book replacement courses as soon as possible, through any registered course provider, and the free program through SBS is at 888-SBS-4NYC or nyc.gov/sst.

A worker who replaces RedCode worker certifications keeps the same Worker Wallet card. A worker whose SST card came from another provider keeps that card if all the required training is retaken by December 7. A worker with a RedCode-issued card needs a new card from a registered provider.

What SafetyClerk Is Doing for Clients

SafetyClerk was built around live worker compliance rather than document storage, which is the difference this case turns on. When a worker onboards, they tap or scan their SST card or Worker Wallet, and the platform's integration with DOB Training Connect associates the worker's available training and credential information with their digital profile, per company and per project.

Because that information sits on the profile, we're reviewing available training data for our clients now to identify workers whose records indicate potential exposure to the RedCode action, and notifying affected clients so they can start remediation well ahead of December 7.

If you're a SafetyClerk client and you receive an alert, review the workers on it and coordinate replacement training with the subcontractor. If you don't receive one, your records didn't show exposure in the data available to us, and DOB remains the authority for any individual worker.

The larger point outlasts RedCode. Collecting a card is a snapshot. Compliance is continuous: worker, verified identity, current training, current credentials, project requirements, and someone who finds out when any link in that chain changes. That's what contractor tracking in SafetyClerk is for: a worker's credentials sit on their profile with their expiration dates, and cards can be validated from both the app and the web instead of trusting whatever was filed at onboarding.

Frequently Asked Questions

How do I know which of my workers are affected?

Start with DOB's September 14 email. It went to workers whose records include RedCode training, so anyone who received it is affected in one of the four ways above. For everyone else, a registered course provider can tell you which certificates behind a card came from RedCode.

Can a worker keep using a RedCode SST card right now?

Yes, through December 7, 2026. Affected cards remain active on jobsites during the grace period. On December 8, RedCode-issued cards are revoked.

My worker's SST card was issued by another provider. Is it affected?

It can be, if RedCode certificates were used to meet the training requirements for that card. DOB's FAQ says a registered course provider can determine which certificates behind a card came from RedCode. If the required training is retaken by December 7, the worker keeps that card.

Does the worker need to retake all 40 hours?

No. DOB says workers only retake the training associated with the RedCode certificates. Other valid certificates stand.

Where can the worker get the replacement training?

Any DOB-registered course provider authorized to offer the needed courses — the worker doesn't have to return to the provider that issued the current card. The NYC Department of Small Business Services offers free SST training and cards through the Construction Site Safety Training Program, at 888-SBS-4NYC or nyc.gov/sst.

Does a worker need a new Worker Wallet after replacing RedCode certifications?

No. Replacing the certifications is enough. The RedCode certifications are removed from the card on December 8 if they haven't been replaced.

What happens to an OSHA card that lists RedCode's owner as the instructor?

From December 8, DOB no longer accepts it toward SST requirements. The worker must retake OSHA training through a current OSHA training provider.

Official DOB Resources

DOB is the authoritative source on this action and on any individual worker's status.

• DOB SST Card Information — carries the RedCode notice
• DOB RedCode FAQs (PDF) — the 20 questions this article works from
• DOB Registered Course Provider List — where replacement training comes from
• Brooklyn District Attorney's announcement — the September 8 indictment

For questions about training requirements, contact a registered course provider or DOB Course Provider Administration at TrainingProviders@buildings.nyc.gov or (212) 393-2729. For free training, SBS at 888-SBS-4NYC or nyc.gov/sst.

Don't Just Collect Credentials. Know Their Status.

If you want to see how many workers on your projects would show up on a list like this, and how the gate handles it on December 8, a demo takes 30 minutes.

→ Book a demo