Vendor onboarding checklist: documents, bank-detail checks and approvals before the first payment

A vendor onboarding checklist lists everything you collect, verify and approve before a new supplier is set up in your ERP and paid for the first time. The core items are a signed tax form, bank details verified by callback, a sanctions check, duplicate-vendor detection and a named approver. Automate the collecting, checking and chasing. Keep the bank-detail callback and the approval decision with people.

#Why the first payment is the risky one

A new vendor record is the cheapest place to stop a bad payment. Once it exists, invoices flow against it and nobody looks twice. A duplicate vendor gets paid twice. A fraudulent bank account can cost money you never get back. Wrong tax details only show up at reporting time.

The FBI's Internet Crime Complaint Center describes business email compromise as a scam that targets businesses making legitimate transfers of funds, and its public service announcement tells organizations to use secondary channels or two-factor authentication to verify requests for changes in account information (IC3 PSA240911 (opens in a new tab)). That is the reason the checklist below insists on a callback to a number you already trust.

This post covers one step in the purchasing chain. The whole chain, from requisition to payment, is in our procure to pay process guide.

#The checklist by phase

Copy the tables, delete what does not apply in your jurisdiction and add whatever your auditors ask for. The "Automate?" column marks where software usually pays off.

#Phase 1: Request and intake

#Phase 2: Documents

On tax forms: the IRS says Form W-9 is used to provide your correct taxpayer identification number to the person who must file an information return (IRS (opens in a new tab)). Foreign vendors generally provide a Form W-8 instead, such as the W-8BEN-E for foreign entities (IRS instructions (opens in a new tab)). Which form applies depends on the vendor's status, so route unusual cases to your tax team.

#Phase 3: Verification

On screening: in the US, OFAC says all US persons must comply with its sanctions, and entities owned 50 percent or more by blocked persons are themselves blocked even if they are not named on the SDN list (OFAC FAQs (opens in a new tab)). OFAC publishes a Sanctions List Search tool for checking names. Name matching produces false positives, so a person should clear every hit. Other jurisdictions have their own lists and your policy decides which apply.

#Phase 4: Approval and ERP setup

#Phase 5: First 90 days and ongoing

#Vendor master data is the asset

Everything above exists to protect your vendor master, so keep it tidy.

• One record per legal entity, with a rule for how names are written.
• Tax ID, address and bank account stored in structured fields, not free text.
• A record of who created, approved and last changed each vendor.
• A policy for merging duplicates and retiring dormant vendors.
• Bank detail changes treated as a new onboarding event.

Duplicate vendors are the quiet cost here. "ACME Ltd," "Acme Limited" and "ACME LTD." get three records, and a payment run can pay the same invoice twice under different names. A match on tax ID and bank account catches the pair that name matching misses. We cover that detection in catching duplicate invoices and bank detail changes.

Key point: Verify bank details by calling a number you already trust, and have someone other than the person who created the vendor approve it. Everything else on the checklist can be automated, and these two controls should not be.

#What to automate first

Start with the steps that repeat most and are easiest to measure.

1. The information request and the chasing. Vendors fill in one form, and the system sends reminders so your team does not.
2. Duplicate and existing-vendor checks at intake.
3. Document reading: extract the name, tax ID, bank details and dates from the files, and compare them to what the vendor typed.
4. Approval routing with the evidence attached.
5. ERP creation and the first-payment flag.

Our vendor onboarding with document checks shows how this runs as a single workflow. For the connected system around it, see the procure-to-pay blueprint.

For an illustration, take a company that onboards 15 vendors a month and spends 45 minutes per vendor on emails and re-keying. That is about 11 hours a month. Halve it and you save roughly 5 hours. The bigger gain is that every record now arrives with checks attached. Time your current process before you estimate.

A language model is useful for reading documents and flagging a mismatch between a bank letter and a form. It should never decide a vendor is safe, clear a sanctions hit or verify a bank account. A person has to own those calls.

#Common mistakes

• Verifying bank details with the phone number or email on the same document.
• Letting the buyer who wants the vendor also approve the vendor.
• Treating a bank-detail change as a routine update.
• Collecting documents but never reading their expiry dates.
• Screening only at onboarding and never again.
• Building a long form that vendors abandon, so the team collects the details by email anyway.

The same shape works for customers. Our customer onboarding checklist covers the sell-side version.

#Talk to us

If vendor setup is slow or your master data has drifted, book a strategy call. Bring your current form and a few recent vendor files, and we will show which steps to automate and which controls to keep manual.

#Frequently asked questions

#What should a vendor onboarding checklist include?

At minimum: an intake request with business reason, legal name and address, a tax form, verified bank details, a sanctions check, a duplicate check, approvals from two people and a flag on the first payment. Add insurance, contract and security reviews as your policy requires.

#How do you verify vendor bank details?

Call the vendor on a phone number you already hold, from your records or an independent source, never from the email or form that supplied the new details. Confirm the account name and number, log the call and have someone other than the requester approve. Any later change repeats the check.

#What tax form do I need from a new vendor?

In the US, a Form W-9 from US vendors and generally a Form W-8 from foreign vendors. Other countries have their own requirements. Ask your tax adviser which forms and validations apply to your vendors.

#Should vendors be screened against sanctions lists?

Many organizations do, and US persons must comply with OFAC sanctions. Screen the name and, where your policy requires, the owners. A person should review every potential match, because name matching produces false positives.

#Can vendor onboarding be fully automated?

Not responsibly. Collection, document reading, format checks, duplicate detection, routing and ERP creation can be automated. Bank-detail verification, sanctions-hit review and the approval decision should have a named person.