The short version
- On September 8, 2026, the Brooklyn DA indicted Redcode Inc. for selling SST and OSHA cards without delivering the training. DOB invalidated every SST certificate Redcode issued the same day.
- Roughly 2,000 workers hold Redcode-issued SST cards. More are affected through cards from other providers, Worker Wallet certifications, and OSHA cards.
- Affected cards remain active through Monday, December 7. On December 8 they are revoked.
- The provider name on a card does not tell you whether a worker is affected.
- SkillSignal has removed Redcode from the platform, flagged every SST card tied to it, and is sending affected clients a memo naming the workers.
What happened
Between April and July 2025, undercover investigators from the NYC Department of Investigation went to Redcode’s locations in Brooklyn and Queens posing as construction workers. According to the Brooklyn DA, Redcode’s owner and an associate agreed to sell them SST and OSHA cards for $500 each. The investigators signed attendance sheets for classes they never sat in. Redcode then reported the training as complete to DOB and to an OSHA training intermediary.
DOB had already caught something. During a July 2025 audit at the Hillside Avenue location in Queens, auditors arrived for a scheduled Drug and Alcohol Awareness course and the class did not happen. Redcode issued a completion certificate for it anyway. DOB refused to renew Redcode’s provider status in November 2025, and the company has not been allowed to issue cards since.
On September 8, 2026, the indictment came down. Redcode, its owner SM Lutfur Rahman, and an associate are charged with offering a false instrument for filing, receiving reward for official misconduct, and falsifying business records. They are due back in court November 4. An indictment is an accusation and the defendants are presumed innocent.
DOB did not wait for the court. All Redcode SST certificates were invalidated immediately, with a 90-day grace period for workers to retrain.
Redcode had been an approved provider since April 2021 and issued about 2,000 SST cards tied to more than 7,000 certificates.
Who is affected
DOB’s FAQ lists four groups. Only the first is visible by looking at the card.
- Workers whose SST card was issued by Redcode.
- Workers whose SST card was issued by a different registered provider, but where Redcode certificates were used to meet the training hours.
- Workers with a Redcode certificate behind a worker certification on their Worker Wallet card, or behind a DOB license requirement.
- Workers whose OSHA 10 or 30 card lists SM Lutfur Rahman as the instructor.
Group two is the one that gets missed. A worker took a few courses at Redcode, finished the rest somewhere else, and the second provider issued the card. The card carries the second provider’s name. Part of the training underneath it is Redcode.
The dates
| Date | What happens |
|---|---|
| September 8, 2026 | Redcode certificates invalidated. Grace period starts. |
| September 9 through December 7, 2026 | Affected SST cards, Worker Wallet certifications, and licensing certificates stay active on jobsites. |
| Monday, December 7, 2026 | Last day of the grace period. Last day a Redcode SST card is valid. |
| December 8, 2026 | Redcode SST cards revoked. Other providers’ cards revoked if they relied on Redcode certificates and the worker did not retrain. Redcode worker certifications removed from Worker Wallet cards. Redcode OSHA cards no longer count toward SST. |
Under Local Law 196, an untrained worker found on a site that requires SST carries a civil penalty of up to $5,000, issued separately to each of the site owner, the permit holder, and the worker’s employer. On December 8, a worker with a revoked card is an untrained worker. (More on what the NYC Department of Buildings requires on site.)
Why a card on file is not enough
This is the second time in two and a half years that DOB has pulled a provider. In April 2024 it was Valor Consulting, and about 17,000 active SST cards were deactivated. Redcode is smaller, but the mechanism is the same: the card was issued by a DOB-registered provider, it was valid on the day it was collected, and the status changed later.
Most contractors verify SST at onboarding. Someone takes a photo of the card, it goes into a folder, and the worker is cleared. That process cannot catch what happened here. Nothing in the folder changed when DOB invalidated the provider.
DOB’s answer to “how do I know if Redcode certificates are behind my card” is to contact a registered course provider and have them check. That is a per-worker question. On a project with 30 subs and 400 workers, somebody has to build that list and make those calls.
What a GC should do this week
- Pull your active workforce across every NYC project.
- Flag every worker whose SST card was issued by Redcode. Those cards are revoked December 8 regardless of what else is on them.
- For everyone else on an SST site, find out whether Redcode certificates sit behind the card. Ask your subs to check with a registered provider, or check yourself.
- Look at OSHA cards for the instructor name DOB lists.
- Notify each affected sub in writing, with worker names and the December 7 date.
- Get retraining booked now. Workers only retake the Redcode courses, not the full 40 hours, and any registered provider can deliver them. SBS offers the training free at 888-SBS-4NYC.
- Decide now what happens on December 8 for anyone still on the list.
What a trade contractor should do this week
Do not wait for the GC to ask. If your people work on SST-required sites, review them now. A worker whose card is valid today and who has not retrained is a worker you cannot send to that site on December 8, and the penalty of up to $5,000 lands on you as the employer.
A few things from DOB’s FAQ that make this less painful than it sounds:
- Workers do not need to go back to the provider that issued their current card. Any registered provider offering the missing course will do.
- A worker who replaces Redcode worker certifications keeps the same Worker Wallet card.
- A worker whose card came from another provider keeps that card if the missing training is done by December 7.
- Only Redcode-issued SST cards need to be physically replaced.
What SkillSignal is doing
SkillSignal was built for NYC Chapter 33 compliance before anything else, and this is the case the Digital Wallet was designed for.
Every worker’s SST card, certificates, and OSHA card live on their profile, and that profile follows them across every project and every contractor they work for. So when DOB pulls a provider, we do not open onboarding folders. We do this (see how certification management works):
- Redcode has been removed as a training provider from the platform.
- Every SST card in the system associated with Redcode has been flagged.
- Each affected client receives an individual memo from us listing the flagged workers by name, so they can get those workers retrained and carded before December 7.
We are working through client accounts now and will contact you if your workforce is affected.
DOB remains the authority on any individual worker’s status. What we give you is the list of who to ask about, so you are not building it by hand.
Frequently asked questions
Can a Redcode SST card still be used right now?
Yes, through December 7, 2026. It is revoked on December 8.
My worker’s SST card was issued by another provider. Is it affected?
It can be, if Redcode certificates were used toward the hours. A registered course provider can check which certificates sit behind the card. If the missing training is retaken by December 7, the worker keeps the card.
Does the worker have to retake all 40 hours?
No. Only the courses that came from Redcode. Other valid certificates stand.
Where can they retrain?
Any DOB-registered course provider authorized for the needed courses. The NYC Department of Small Business Services offers free SST training at 888-SBS-4NYC or nyc.gov/SST.
Do they need a new Worker Wallet card?
No. Replacing the certifications is enough. Unreplaced Redcode certifications are removed from the card on December 8.
What about an OSHA card with Redcode’s owner as instructor?
Starting December 8, DOB will not accept it toward SST requirements. The worker must retake OSHA training through a current OSHA training provider.
Official sources
- DOB SST Card Information page, which carries the Redcode notice
- DOB Redcode FAQ (PDF)
- DOB Registered Course Provider List
- Brooklyn DA press release, September 8, 2026
- ENR: “NYC Invalidates 2,000 Construction Safety Cards Tied to Alleged Training Fraud”
Questions about training requirements: DOB Course Provider Administration, TrainingProviders@buildings.nyc.gov or (212) 393-2729.
Want to know how many workers on your projects would show up on a list like this? Book 30 minutes with us. Book a demo
