Supplier onboarding: the checks to run before a new vendor gets its first order and first payment

Suppliers & risk · By the Buyer's Ledger editorial team · Published 2026-11-07

Two metal office filing cabinets side by side, one beige and one grey, with label holders on their drawers — Office filing cabinets. Every payment a buyer makes draws on one record: the supplier's entry in the vendor master.

The moment a supplier is created in the purchasing or finance system, it can receive orders and money. Everything that follows, from the purchase order to the invoice match and the bank transfer, trusts that record. Onboarding is the step where that trust should be earned: confirming that the company exists, that it is who it says it is, that the organisation is allowed to deal with it, and that payments will go to the right account. This guide sets out the checks, how deep to go for different suppliers, and who should do what.

Why onboarding is a control, not paperwork

Most organisations think of supplier set-up as an administrative form. In practice it is the gate behind several of the risks buyers worry about most:

Payment fraud. A fictitious supplier created by an insider, or a genuine supplier whose bank details have been changed by a fraudster, turns ordinary payment runs into a way of moving money out of the organisation.
Legal exposure. Paying a company owned or controlled by a sanctioned person can breach sanctions law, whatever the size of the order.
Tax and invoicing errors. A wrong legal name or tax number produces invoices that cannot be booked correctly or VAT that cannot be recovered.
Operational risk. A supplier without the insurance, certification or data protection terms the work requires creates a problem that only appears when something goes wrong.

Onboarding is the cheapest point to catch all of these. Once orders are open, every check is harder to enforce.

Step 1: collect the right data, once

Start with a standard request, ideally through a supplier portal so that the supplier enters its own data and uploads documents rather than emailing them. The core set is short:

Data	Why it matters	Verified against
Full legal name and legal form	Contracts, invoices and payments must name the same entity	Company register
Registration number and registered address	Distinguishes the entity from others with similar names	Company register
VAT or tax identification number	Correct invoicing, tax recovery and reporting	Tax authority checking service
Ultimate owners and directors	Sanctions, conflicts of interest, related parties	Ownership registers, declarations, screening
Bank account details	Where the money goes	Bank-issued evidence and a call-back or payee check
Contacts for orders, invoices and escalation	Gets documents to the right person	Confirmed with the supplier
Certificates, insurance, policies	Only those the purchase actually needs	Issuing body or insurer

Ask only for what you will use. Long questionnaires nobody reads only delay onboarding.

Step 2: confirm the company exists and is the one you think

Look the supplier up in the official company register of its country and compare the name, number, address and status (active, in liquidation, dissolved) with what it gave you. In the United Kingdom, the Companies House register is free to search and also shows directors, filing history and, for most companies, the people with significant control. Most countries have an equivalent, though access and cost vary.

Then check the tax number. For suppliers in the European Union, the Commission's VIES service confirms whether a VAT number is valid for cross-border transactions and, where the member state allows it, returns the registered name and address. A valid number registered to a different name is a reason to stop and ask. In the United States, suppliers usually provide their taxpayer identification number on IRS Form W-9, and payers that file information returns can use the IRS TIN Matching programme to check the name and number combination.

Step 3: screen for sanctions and ownership

Screen the supplier, and where you know them its owners and directors, against the sanctions lists that apply to your organisation: typically the European Union's consolidated financial sanctions list, the UK Sanctions List and, for anyone with a US connection, the US Treasury's Specially Designated Nationals list, which can be searched through OFAC's Sanctions List Search. Many organisations use a screening service that covers all of these and records the result.

Name screening alone is not enough. Sanctions regimes generally also reach entities owned or controlled by listed persons, so the ownership question from step 1 matters. Public ownership information differs between jurisdictions: the UK register of people with significant control is open to the public, while in the EU the Court of Justice ruled on 22 November 2022 that general public access to beneficial ownership registers was incompatible with fundamental rights, and access is now generally limited to those who can show a legitimate interest. Where registers are not available, a signed ownership declaration from the supplier is the usual fallback. Screening also has to be repeated, not done once, as our guide to geopolitics and supply chains explains.

Step 4: verify the bank details independently

This is the check that prevents the most direct losses. A fraudster does not need to create a fake supplier if they can persuade the organisation to change a real supplier's bank account, typically through an email that appears to come from the supplier's finance team. The defence is a simple rule: bank details are never accepted or changed on the strength of an email or a letter alone.

Ask for bank-issued evidence, such as a letter or a statement header, in the supplier's legal name.
Confirm the details by calling the supplier on a number taken from your own records or the company's official website, never from the message that requested the change.
Use the payee check your banking system offers. In the UK, Confirmation of Payee compares the account name with the name the payer enters. In the euro area, the Instant Payments Regulation (EU) 2024/886 has required payment service providers to offer a Verification of Payee check on credit transfers since 9 October 2025.
Treat a change of bank details as a fresh onboarding event, with the same checks and a second approver.

Step 5: match the depth of checks to the risk

Running the full process for a one-off purchase of office supplies wastes time; running a light process for a supplier that will hold personal data or produce a critical component is reckless. Most organisations define a few tiers, based on spend, criticality, data access and country, and attach checks to each:

Low risk: identity, tax number, sanctions screening and verified bank details. These apply to every supplier, however small.
Medium risk: add financial health (filed accounts, credit report), insurance certificates and the relevant policies, such as a code of conduct.
High risk or critical: add ownership verification, site or quality audits, information security review, a data processing agreement where the supplier will handle personal data on your behalf (required under Article 28 of the GDPR for processors), and a business continuity review as described in our supplier risk framework.

Write the tiers down, with the evidence each one needs, so that buyers can explain to suppliers why they are being asked for something and so that exceptions are visible.

Step 6: separate the duties

The same principle that makes the three-way match work applies here: no single person should be able to create a supplier, change its bank details and approve a payment to it. A common split is that buyers request a new supplier, a central master data team performs the checks and creates the record, and finance controls payment runs. Changes to sensitive fields, above all bank details, should need a second person's approval and leave a log that internal audit can review.

Keeping the vendor master clean

Onboarding does not end when the record is created. A vendor master that is never cleaned accumulates duplicates, suppliers nobody has used for years and records with outdated details, each of which is an opportunity for error or fraud. A few routines keep it healthy:

Block suppliers with no activity over a defined period, so they cannot be paid without being reviewed.
Run duplicate checks on name, tax number and bank account; two suppliers sharing one bank account always deserves an explanation.
Re-screen against sanctions lists automatically when lists change, not just at renewal.
Ask suppliers to confirm their data periodically through the portal, and track certificate and insurance expiry dates.

Supplier portals and master data tools can automate much of this; our overview of the e-procurement software landscape describes where they fit.

A one-page checklist

Legal name, number and address match the official register.
VAT or tax number validated with the tax authority's service.
Supplier, owners and directors screened against the applicable sanctions lists, with the result recorded.
Bank details backed by bank-issued evidence and confirmed by a call-back or payee check.
Risk tier assigned, and the evidence for that tier on file.
Supplier created by someone other than the requester, and bank details approved by a second person.
Re-screening, data confirmation and dormant-supplier blocking scheduled.

None of these checks is complicated. What makes onboarding work is doing them every time, before the first order, and refusing the shortcut when a supplier is needed urgently.