There are several independent aspects here:
- Does the person have the knowledge which he/she claimed to have (e.g. certificate is outdated, but work experience is there)
- Did he/she commit fraud or falsify the document in the strict sense?
- Is there an (direct or indirect) regulation which actually requires you to have only people with this certificate on this position; (an example would be that your company established this as a requirement to fulfill legal requirements, and that the legal requirements require to take action in case of a - potentially self defined - non conformity)
If only the first point applies, then it depends on your relationship with the supplier and potentially the employee. I am a technical team lead and if something like this would happen, i would greatly appreciate if I get an informal notification from my customers in case something like this is discovered - could be anything from intentionally deceiving the employer to an administrative error (sending an old certification).
If you believe that the second point is true, revoke all access of the employee to critical systems immediately. If you trust the manager, call the manager first, if you don't trust her/him, revoke the access of all of the employers employees and ask the next level representative of the supplier to come in personally. Have your legal department involved immediately.
If you need to this to keep your own regulations, then seek for clarification and ask for the supplier delivering a valid certificate.