diff --git a/pkg/innerring/processors/netmap/nodevalidation/subnet/calls.go b/pkg/innerring/processors/netmap/nodevalidation/subnet/calls.go
new file mode 100644
index 0000000000..d9ef791197
--- /dev/null
+++ b/pkg/innerring/processors/netmap/nodevalidation/subnet/calls.go
@@ -0,0 +1,41 @@
+package subnet
+
+import (
+	"fmt"
+
+	morphsubnet "github.com/nspcc-dev/neofs-node/pkg/morph/client/subnet"
+	"github.com/nspcc-dev/neofs-sdk-go/netmap"
+	subnetid "github.com/nspcc-dev/neofs-sdk-go/subnet/id"
+)
+
+// VerifyAndUpdate calls subnet contract's `NodeAllowed` method.
+// Removes subnets that have not been approved by the contract.
+func (v *Validator) VerifyAndUpdate(n *netmap.NodeInfo) error {
+	prm := morphsubnet.NodeAllowedPrm{}
+
+	err := n.IterateSubnets(func(id subnetid.ID) error {
+		rawSubnetID, err := id.Marshal()
+		if err != nil {
+			return fmt.Errorf("could not marshal subnetwork ID: %w", err)
+		}
+
+		prm.SetID(rawSubnetID)
+		prm.SetNode(n.PublicKey())
+
+		res, err := v.subnetClient.NodeAllowed(prm)
+		if err != nil {
+			return fmt.Errorf("could not call `NodeAllowed` contract method: %w", err)
+		}
+
+		if !res.Allowed() {
+			return netmap.ErrRemoveSubnet
+		}
+
+		return nil
+	})
+	if err != nil {
+		return fmt.Errorf("could not verify subnet entrance of the node: %w", err)
+	}
+
+	return nil
+}
diff --git a/pkg/innerring/processors/netmap/nodevalidation/subnet/validator.go b/pkg/innerring/processors/netmap/nodevalidation/subnet/validator.go
new file mode 100644
index 0000000000..7d6fb75608
--- /dev/null
+++ b/pkg/innerring/processors/netmap/nodevalidation/subnet/validator.go
@@ -0,0 +1,41 @@
+package subnet
+
+import (
+	"errors"
+
+	morphsubnet "github.com/nspcc-dev/neofs-node/pkg/morph/client/subnet"
+)
+
+// Validator is an utility that verifies node subnet
+// allowance.
+//
+// For correct operation, Validator must be created
+// using the constructor (New). After successful creation,
+// the Validator is immediately ready to work through API.
+type Validator struct {
+	subnetClient *morphsubnet.Client
+}
+
+// Prm groups the required parameters of the Validator's constructor.
+//
+// All values must comply with the requirements imposed on them.
+// Passing incorrect parameter values will result in constructor
+// failure (error or panic depending on the implementation).
+type Prm struct {
+	SubnetClient *morphsubnet.Client
+}
+
+// New creates a new instance of the Validator.
+//
+// The created Validator does not require additional
+// initialization and is completely ready for work.
+func New(prm Prm) (*Validator, error) {
+	switch {
+	case prm.SubnetClient == nil:
+		return nil, errors.New("ir/nodeValidator: subnet client is not set")
+	}
+
+	return &Validator{
+		subnetClient: prm.SubnetClient,
+	}, nil
+}