Why a Vetting Pass at Onboarding Decays Within Weeks

A scanned Air Operator Certificate can be valid on Monday and suspended by Friday, and the copy in the broker's folder will look identical on both days. That is the weakness in most charter operator vetting: it is a document-collection exercise, not a verification exercise.

The typical onboarding file holds an AOC copy, an insurance certificate, an audit badge and a signed trading agreement. Each records a fact as it stood on one date. None records what has happened since.

The underlying facts move quickly. Insurance policies renew annually, often on the first of a month, and a 24-hour gap is enough to leave a flight uncovered. Operations specifications change when an operator adds or retires a type. Aircraft are sold, re-registered or moved to a sister company's certificate, so a Gulfstream G650ER on one operator's AOC in March can be flying under another's by June.

The exposure is concrete. A Bombardier Global 7500 sector from Farnborough (EGLF) to Dubai (OMDB) typically prices at £75,000–£95,000 one way. A client paying that sum relies on the broker's judgement that the aircraft, the crew and the cover are what the quote says they are.

The compliance agent in villiersOS therefore treats these facts as perishable. It does not ask once whether an operator is approved. For each quote it asks whether this specific aircraft, on this date, on this sector, is certified and covered right now. The seven checks below answer that question, and one rule stops the quote when any of them fails.

Check One and Two: AOC Validity and Whether the Aircraft Is Actually on the Certificate

The first check reads the certificate against the register, not the operator's copy. The agent confirms the AOC number with the issuing authority, whether that is the UK CAA, the Malta Transport Authority or the Swiss FOCA, confirms the status is current, and checks that the expiry date falls after the return leg of the trip, not merely the outbound.

It then reads the scope. An AOC authorises commercial air transport, but the operations specifications attached to it limit which types, areas of operation and approvals apply. An operator with a valid certificate but no approval for the airspace in question cannot legitimately fly a Global 7500 from London to New York for a paying client, however clean its safety record.

Check two is the one most files miss: is the aircraft actually on the certificate? The agent matches the registration, for example a G-registered or 9H-registered tail, against the operator's current fleet list on the AOC. Brokers often quote a type, a Challenger 350 or a Dassault Falcon 8X, from a website fleet page. Those pages can list aircraft that are managed but sit on another holder's certificate, or aircraft that have been sold.

A failure here looks mundane. The agent finds that the registration offered by an operator's sales desk appears on a different certificate holder's fleet list. The quote is held, the sales desk is asked to confirm in writing which certificate holder will operate the flight, and the answer is re-verified from scratch.

The point is that neither failure announces itself. The operator has not lied; the sales desk is quoting what it believes it can source. Only a per-quote comparison of tail number against certificate catches the gap before a client does.

Check Three and Four: Insurance Limits, Expiry Dates and Third-Party Liability Against the Trip

Insurance is the fact that decays fastest, because a certificate is only a snapshot of a policy with a hard end date. Check three reads the certificate of insurance for the named aircraft and tests two things: that the policy period covers every day of the trip, and that the registration on the certificate matches the tail being quoted.

The agent also reads who is insured. A fleet policy may cover the operator's own certificate holdings but not a managed aircraft flown under a lease arrangement. A mismatch between insured party and operating party is treated as a failure, not a query.

Check four tests the limits against the trip. EU Regulation 785/2004 sets a legal floor of 250,000 SDR per passenger, and it scales third-party liability with maximum take-off mass. A floor is not a standard for a high-net-worth client. The villiersOS defaults, which are configurable, ask for a combined single limit of USD 100 million on light and midsize jets such as the Embraer Phenom 300E and the Challenger 350, and USD 200 million or more on large-cabin aircraft such as the Gulfstream G650ER and Global 7500.

Territory matters as much as the number. A policy can carry an adequate limit and still exclude, or sub-limit, war risks or specific regions. On a London–Singapore sector, which runs to roughly £190,000–£230,000 on a G650ER, the agent reads the territorial clauses against every overflown and landing state, not just the departure and destination.

A typical failure is an expiry date that falls mid-trip. A policy ending on the 14th does not cover a client returning on the 16th. The agent withholds the quote and asks the operator for the renewed certificate, which is then checked as a new document rather than assumed to follow the old one.

The discipline here is arithmetic, not judgement. The agent compares dates and limits as numbers and flags anything under threshold, which is exactly the work a human reviewer does worst at the end of a long day.

Check Five and Six: Third-Party Safety Audit Status and Wet-Lease or Sub-Charter Substitution Risk

An audit badge is a statement about a past inspection. Check five confirms the current status directly with the audit body, whether that is a Wyvern Wingman registration, an ARGUS rating or IS-BAO registration, and records the date of the last audit. A badge on a website that lapsed at the previous renewal looks exactly like a live one.

The agent treats audit status as a graded input, not a pass mark. A current audit with the last inspection 11 months old is weighted differently from one completed six weeks ago. Where the audit body publishes it, open findings are read as well.

Check six addresses the risk that brokers discuss least: the aircraft flying is not the aircraft sold. Wet-lease and sub-charter arrangements are legitimate and common when an operator's own aircraft is out of service. The danger lies in substitution that is neither declared nor re-vetted, because the substitute operator's certificate, insurance and audit status are then unchecked.

The agent asks every operator to declare the operating carrier at the point of quote, then compares it with the operator whose documents were verified. It also flags quotes for types that do not appear on the operator's own fleet list, since a Falcon 8X offered by an operator with no Falcon on its AOC is almost certainly a sub-charter.

In practice, a failure looks like this: an operator confirms a Global 7500, the agent finds the type is absent from its fleet list, and the operator then discloses a partner's aircraft. The partner is vetted as a new operator through checks one to five, and the quote proceeds only if it passes.

This is also why the check cannot be done once per operator. The same operator can be the direct carrier on Tuesday's quote and an intermediary on Thursday's.

Check Seven and the Withhold Rule: Crew Currency, Sector Fit and What Happens When a Check Fails Before the Client Sees a Price

The seventh check asks whether the crew and the aircraft can fly this particular sector. On crew, the agent requests confirmation of type ratings, medical validity and recent experience for the assigned pilots. On sector fit, it tests runway length, approvals and range against the route.

Some airfields make this concrete. London City (EGLC) has a 1,508 m runway and requires a 5.5-degree steep approach, which demands specific aircraft and crew approval. Courchevel (LFLJ) has a 525 m runway and its own training requirement. An aircraft that is perfectly vetted for a Farnborough–Nice run can still be wrong for either airfield.

Range is checked the same way. The G650ER's 7,500 nm range, quoted with four passengers, covers London–Singapore at about 5,900 nm with reserves. A shorter-range aircraft offered on the same route would fail the sector test before pricing was considered.

The withhold rule is deliberately blunt. If any of the seven checks fails, the quote is not delayed, softened or sent with a caveat. It is withheld, and the client sees nothing until the failure is resolved or a different aircraft passes. No price ever reaches a client that the system could not stand behind.

Each failure carries a recorded reason, such as an insurance expiry date or a tail missing from the certificate. A human reviewer sees the exact fact that stopped the quote and decides whether to request a fix from the operator or move to the next option.

The case for running this per quote rests on arithmetic. A full manual pack check takes an experienced analyst roughly 35 minutes, an illustrative assumption but a realistic one. At 300 quotes a week, that is 175 analyst hours, more than four full-time staff doing nothing else. Per-operator checks look cheaper, but they verify facts that no longer hold by the time a quote is sent.

The pattern is not specific to aviation. The same architecture could run for yacht charter, where flag-state certificates, crew qualifications and liability cover also lapse and where vessels also change hands between operators. The model applies equally to any sector in which a price is only as trustworthy as the certificates behind it, though villiersOS operates in private jet charter today.

For a client, the visible result is simple: every quote they receive has already passed seven checks against the specific aircraft and sector, because the ones that failed never arrived.