diff --git a/proxies/live/apiproxy/policies/RaiseFault.401InvalidNHSNumber.xml b/proxies/live/apiproxy/policies/RaiseFault.401InvalidNHSNumber.xml
new file mode 100644
index 0000000..1cb9079
--- /dev/null
+++ b/proxies/live/apiproxy/policies/RaiseFault.401InvalidNHSNumber.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<RaiseFault async="false" continueOnError="false" enabled="true" name="RaiseFault.401InvalidNHSNumber">
+    <DisplayName>RaiseFault.401InvalidNHSNumber</DisplayName>
+    <Properties/>
+    <FaultResponse>
+        <Set>
+            <Payload contentType="application/json">{
+            "error" : "{validation.errorMessage}",
+            "error_description": "{validation.errorDescription}",
+             "message_id": "{messageid}"
+            }
+            </Payload>
+            <StatusCode>{validation.statusCode}</StatusCode>
+            <ReasonPhrase>{validation.reasonPhrase}</ReasonPhrase>
+        </Set>
+    </FaultResponse>
+    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
+</RaiseFault>
\ No newline at end of file
diff --git a/proxies/live/apiproxy/proxies/default.xml b/proxies/live/apiproxy/proxies/default.xml
index 3ea4ffc..16b4356 100644
--- a/proxies/live/apiproxy/proxies/default.xml
+++ b/proxies/live/apiproxy/proxies/default.xml
@@ -7,12 +7,20 @@
       <Step>
         <Name>AM-Enable-DelegatedAccess</Name>
       </Step>
+      <Step>
+        <Name>AM-Enable-DelegatedAccess</Name>
+      </Step>
       <Step>
         <Name>FlowCallout.CompositeTokenCheckOptIN</Name>
         <Condition>not (proxy.pathsuffix MatchesPath "/_ping" or proxy.pathsuffix MatchesPath "/_status")</Condition>
       </Step>
       <Step>
         <Name>JavaScript.ValidateNHSNumber</Name>
+        <Condition>not (proxy.pathsuffix MatchesPath "/_ping" or proxy.pathsuffix MatchesPath "/_status")</Condition>
+      </Step>
+      <Step>
+        <Name>RaiseFault.401InvalidNHSNumber</Name>
+        <Condition>(trigger.raiseNHSNumberFault = true)</Condition>
       </Step>
     </Request>
   </PreFlow>
diff --git a/proxies/live/apiproxy/resources/jsc/ValidateNHSNumber.js b/proxies/live/apiproxy/resources/jsc/ValidateNHSNumber.js
index e9ad9d5..8e742a7 100644
--- a/proxies/live/apiproxy/resources/jsc/ValidateNHSNumber.js
+++ b/proxies/live/apiproxy/resources/jsc/ValidateNHSNumber.js
@@ -1,40 +1,25 @@
-print("nhsd.actor.nhs_number NUM   : " + context.getVariable("nhsd.actor.nhs_number"));
-print("nhsd.subject.nhs_number NUM   : " + context.getVariable("nhsd.subject.nhs_number"));
+//print("nhsd.actor.nhs_number   : " + context.getVariable("nhsd.actor.nhs_number"));
+//print("nhsd.subject.nhs_number : " + context.getVariable("nhsd.subject.nhs_number"));
 
-var httpverb = context.getVariable("request.verb");
-var actorNHS = context.getVariable("nhsd.actor.nhs_number");
-if (httpverb == 'GET') {
-    var queryNHSNumber = context.getVariable("request.queryparam.patientNHSNumber");
-    print("queryNHSNumber :" +queryNHSNumber);
-    if (queryNHSNumber) {
-        if (queryNHSNumber !== actorNHS) {
-            print("NHS Number is not valid");
-        }
-    }
-    else {
-        var routeParamArray = context.getVariable("proxy.pathsuffix").split('/');
-        var routeNHSNumber = routeParamArray[routeParamArray.length - 1];
-        print("routeNHSNumber :" +routeNHSNumber);
-        if (routeNHSNumber && routeNHSNumber !== actorNHS){
-            print("NHS Number is not valid");
-        }    
-    }
-}
-else {
-    if(httpverb == 'POST') {
-        var reqContent = context.getVariable("request.content");
-        var jsonContent = JSON.parse(reqContent);
-        var postNHSnumber = null;
-        for (var i = 0; i < jsonContent.parameter.length; i++) {
-            var p = jsonContent.parameter[i];
-            if ( p.name === "patientNHSNumber" && p.valueIdentifier && p.valueIdentifier.value) {
-                postNHSnumber = p.valueIdentifier.value;
-                break;
-            }
-        }
-        print("postNHSnumber :" +postNHSnumber);
-        if (postNHSnumber && postNHSnumber !== actorNHS){
-            print("NHS Number is not valid");
+// ---- Subject NHS number (from composite ID shared flow) ----
+var subNHS = context.getVariable("nhsd.subject.nhs_number");
+
+//print(subNHS);
+if (subNHS) {
+    var requestNHS = null;
+    var pathSuffix = context.getVariable("proxy.pathsuffix");
+    if (pathSuffix) {
+        var parts = pathSuffix.split('/').filter(Boolean);
+        requestNHS = parts.length ? parts[parts.length - 1] : null;
+        //print("NHS from route: " + requestNHS);
+        requestNHS = requestNHS.trim();
+        if(requestNHS !== subNHS) {
+            context.setVariable('trigger.raiseNHSNumberFault', true);
+            var errorObject = { error: 'invalid_token', errorDescription: "NHS ID could not be validated", statusCode: 401, reasonPhrase: "Unauthorized" };
+            context.setVariable('validation.errorMessage', errorObject.error);
+            context.setVariable('validation.errorDescription', errorObject.errorDescription);
+            context.setVariable('validation.statusCode', errorObject.statusCode);
+            context.setVariable('validation.reasonPhrase', errorObject.reasonPhrase);
         }
     }
 }
\ No newline at end of file