Vendor Onboarding Checklist: What to Collect and Verify Before the First Payment
A practical vendor onboarding checklist for small businesses: identity, tax details, bank verification, terms, documents and the controls that stop invoice fraud.
The moment a new supplier is added to your system is the cheapest moment to get it right. Bank details checked now cost a phone call; bank details discovered to be wrong after a payment cost the payment. A short, consistent onboarding checklist is also one of the most effective controls a small business has against invoice fraud.
What vendor onboarding is
Vendor onboarding (or supplier onboarding) is the process of collecting, verifying and recording a new supplier's details before you place an order with them or pay them. It ends with an approved record in your vendor master, the list your purchasing and accounts payable systems pay from.
It is different from vendor selection, which decides whether to work with a supplier at all, and from ongoing vendor management, which looks after the relationship afterwards. Onboarding is the administrative and control step in between.
The checklist
1. Confirm there is a business need, and no existing supplier
- Who is requesting the new supplier, for which purchases, and roughly how much spend.
- Whether an existing supplier already covers it. Most vendor masters contain the same company two or three times, entered under slightly different names. Search before you add.
2. Legal identity
- Full registered legal name and any trading name. The name on the bank account should match one of them.
- Company registration number and country of registration.
- Registered address and, if different, the address they invoice from and ship from.
3. Tax details
- VAT or sales tax registration number, where the supplier is registered. In the EU, check it against the European Commission's VIES service: a correct format is not the same as a valid registration.
- In the US, a completed Form W-9 with the supplier's taxpayer identification number, needed for 1099 reporting.
- Whether the supplier charges tax, and at what rate, so invoices can be checked against it.
4. Bank details, verified independently
This is the step that matters most. Request bank details on the supplier's letterhead or through a supplier portal, then confirm them by phone using a number you found independently, such as the company's website or a previous contract, never a number given in the same email as the bank details. Where your bank offers account name checking (Confirmation of Payee in the UK, Verification of Payee in the EU), use it.
- Account holder name, IBAN or account number, BIC/SWIFT or sort code, bank name and address.
- Who verified them, when, and how. Record it on the vendor record.
5. Commercial terms
- Payment terms (for example 30 days from invoice) and any early payment discount.
- Currency, delivery terms (Incoterms for international suppliers) and minimum order quantities.
- The contract, price list or quote the first orders will be placed against.
6. Contacts
- An ordering contact, a contact for invoices and remittances, and an escalation contact.
- The email address the supplier will send invoices from. Invoices arriving from anywhere else deserve a second look.
7. Documents and compliance, in proportion to the risk
- Certificate of insurance (public and product liability, professional indemnity for service providers), with its expiry date.
- Industry certifications you rely on, such as ISO 9001 for quality or food safety certificates.
- Sanctions screening for overseas suppliers, and a data processing agreement for any supplier that will handle personal data.
- Signed acceptance of your supplier code of conduct or purchase order terms, if you have them.
Not every supplier needs all of this. A one-off stationery supplier and a subcontractor working on a client site carry very different risks. Decide the tiers in advance so nobody has to decide case by case.
8. Approval and segregation of duties
- Someone other than the requester approves the new supplier.
- Someone other than the person who pays invoices can create or change vendor bank details. This one rule blocks most internal payment fraud.
The same separation applies to purchase orders themselves; see designing a purchase order approval workflow for how to split requesting, approving and paying in a small team.
9. Set up the record and introduce your process
- Create the vendor with a supplier code and the category it belongs to, so its spend is reportable from day one.
- Tell the supplier how you buy: every invoice must quote a purchase order number, where to send invoices and when they will be paid. Suppliers who know the rules on day one rarely need chasing later.
After onboarding: changes are the real risk
Most supplier payment fraud does not involve a fake supplier. It involves a real one whose bank details are "updated" by an email that did not come from them. Treat every change of bank details as a new onboarding of that field: verify by phone on an independently sourced number, have a second person approve the change, and keep a record of who changed what and when.
Review the vendor master at least once a year. Deactivate suppliers with no activity in the past twelve to eighteen months, merge duplicates, and renew expired insurance certificates. A shorter vendor list is easier to protect.
Where Foxpedite helps
In Foxpedite you can invite a supplier contact to their own supplier portal from the vendor's page, where they see the purchase orders you send them and the documents they share with you. The vendor record holds the VAT number (checked for the right format for its country, which is not the same as verification), bank details, payment terms, documents and a per-supplier invoice tolerance. A possible duplicates view finds the same company entered twice and merges the records without losing their history.
Common questions
How long should vendor onboarding take?
For a low-risk supplier, a day or less once the supplier has sent its details. Long onboarding is a common cause of maverick spend: if adding a supplier takes two weeks, people will buy from them without adding them.
Who should own vendor onboarding?
Usually procurement or accounts payable owns the process, with the requester supplying the business case and finance controlling bank details. In a small business the owner can be one person, as long as the person who approves the supplier is not the only person who pays it.
What is the most important check?
Verifying bank details through an independent channel. Most of the other checks protect against poor quality or compliance gaps; this one protects against paying money to the wrong account, which is rarely recovered.
Do we need to onboard a supplier for a one-off purchase?
Yes, but a lighter version: legal name, tax details and verified bank details are the minimum for anyone you pay by bank transfer. Card purchases from established retailers carry less risk and can use a simplified route.
The short version
Check that the supplier is needed and not already on file, collect legal identity, tax details and payment terms, and verify bank details by phone on a number you found yourself. Scale the compliance documents to the risk, have someone other than the requester approve, keep bank detail changes under the same controls as new suppliers, and tell every new supplier how you buy.