Vendor Onboarding: Process, Checklist and Best Practices

Vendor onboarding, also called supplier onboarding, is the process of getting a new supplier ready to be ordered from and paid. You vet the supplier, collect its tax, bank, insurance and compliance details, approve it and set it up in your purchasing and payment systems. Done well, onboarding also records the contract terms the supplier will be measured against.

In the nine steps of the procurement cycle, onboarding falls between choosing a supplier (step 4) and the first purchase order (step 6). This guide covers the process step by step and a checklist of documents and checks. It also covers the extra rules for universities and other public bodies, and ways to onboard suppliers faster without weakening controls.

The vendor onboarding process, step by step

Most vendor onboarding processes follow the same seven steps. How deep each step goes depends on the vendor's risk. A one-off furniture order needs less checking than a vendor that will hold your data or work on your premises.

1. Request and pre-screen the vendor

Onboarding starts with a request from the person who needs the vendor. The request states the business need, the expected annual spend, what the vendor will supply and whether it will have access to your systems, data or sites.

Before anyone contacts the vendor, procurement checks two things. The first is whether a contract or an approved supplier already covers the need. A second supplier for the same thing splits your volume and weakens your prices.

The second is the vendor's risk tier, which decides how much of steps 3 and 4 applies. A three-tier model of low, medium and high is simple to run; step 4 shows what each tier adds.

2. Collect vendor information and documents

Collect vendor information through one form that gathers everything at once, and accept documents only through that channel. Documents scattered across email threads slow approval and invite fraud. For a US vendor, the core set is:

• Form W-9, with the vendor's legal name and taxpayer identification number (TIN). Vendors use it to give their TIN "to the person who is required to file an information return" (IRS, About Form W-9). A foreign vendor gives you a Form W-8 instead, such as Form W-8BEN-E for a foreign entity.
• Bank details for electronic payment, on the vendor's letterhead or a letter from its bank.
• A certificate of insurance showing the coverage your contract requires.
• Business registration and any licenses the work needs.
• Contacts for orders, invoices and escalations.

The checklist further down gives the full list and shows which items apply to which vendors.

3. Verify the tax ID, bank details and sanctions status

Verification catches the costly errors before the first payment. Run these checks before the vendor is approved:

• Tax ID. If you file information returns such as Forms 1099, you may be eligible to use the IRS TIN Matching service. It lets you "validate TIN and name combinations before submitting an information return" (IRS, TIN Matching). If a vendor whose payments you report on Form 1099 fails to give you a correct TIN, you may be required to withhold 24% of its future payments. This is called backup withholding (IRS, Backup withholding).
• Bank details. Confirm them by calling the vendor on a number you already hold, not one given in the email or letter that sent them. Do the same for every later change.
• Sanctions. Screen the vendor against the Specially Designated Nationals (SDN) list published by the Treasury Department's Office of Foreign Assets Control (OFAC). OFAC says of the people and companies on it: "Their assets are blocked and U.S. persons are generally prohibited from dealing with them" (OFAC FAQ 18).
• Federal exclusions. For purchases paid with federal grant money, also check that the vendor isn't excluded from federal work (see universities and public bodies below).

The bank-detail check matters because of business email compromise (BEC). The FBI describes BEC as a scam targeting businesses and individuals that work with suppliers or regularly pay by wire, carried out by compromising email and other communications. Its Internet Crime Complaint Center received 24,768 BEC complaints in 2025, with reported losses of about $3.05 billion (FBI, 2025 Internet Crime Report). Among the FBI's prevention tips: "Use secondary channels and/or two-factor authentication to verify requests for changes in account information" (FBI IC3, September 11, 2024).

The checks above summarize IRS, Treasury and FBI guidance and aren't tax or legal advice.

4. Assess the risk by tier

The risk assessment scales with the tier set in step 1. Each tier adds checks to the core documents from steps 2 and 3.

Ask every vendor to sign your supplier code of conduct and to disclose any relationship with your employees. A conflict found during onboarding is easy to deal with. One found after the award is not.

5. Agree the commercial terms

The commercial terms the vendor will be held to should be signed before it goes live:

• unit prices or a price list, and how and when prices can change
• payment terms
• rebates and volume discounts
• delivery times
• service levels, and the credits owed when they're missed

Payment terms deserve a deliberate choice at this point. Our guide to negotiating supplier payment terms covers the trade-offs.

Keep the signed price list where the people who set up vendors and check invoices can find it. The next two steps depend on it.

6. Set up the vendor record

Create the vendor record from the verified documents only, never from details in an email. Then load the contract prices into the catalog or price file and the payment terms into the vendor record, so purchase orders carry the agreed prices. A purchase order raised at the wrong price still passes the three-way match of order, receipt and invoice, so the price file is what protects the contract. Every order, receipt and payment in the procure-to-pay process that follows uses this record.

7. Kick off and set the performance baseline

The kickoff tells the vendor how to work with you. Cover how orders arrive, which purchase order number goes on each invoice, where invoices go, who to call with problems and which service levels apply. The kickoff is also the moment to agree how the vendor will be measured. For most contracts that means on-time and complete delivery, invoice prices against the contract, rebates earned and paid, and service levels with any credits owed.

Check the first few invoices line by line against the contract. A pricing error caught on the first invoice costs little to fix, while the same error repeated for a year becomes a recovery project.

Vendor onboarding checklist

Use this vendor onboarding checklist as a starting point and adjust it to your policy. "All" means every new vendor. "Higher risk" means the medium and high tiers in step 4.

The same list works as a supplier onboarding checklist for goods and for services.

What goes on a vendor onboarding form

A vendor onboarding form, also called a vendor registration or new vendor setup form, should collect in one pass:

• Legal and trading names, address and type of entity
• Tax ID, with the W-9 or W-8 attached
• Remit-to address and bank details for electronic payment
• Contacts for sales, orders, invoices and escalations
• What the vendor will supply, and whether it needs access to your systems, data or sites
• Certifications you track, such as small or diverse business status
• Signatures on the code of conduct, the conflict-of-interest disclosure and a statement that the information is correct

The internal details come from the requester, not the vendor: the business need, the budget owner and the expected annual spend.

Vendor onboarding at universities and other public bodies

Universities, hospitals and local governments that spend federal grant money follow federal rules for purchases charged to those awards, on top of their own policies. Four points matter most at onboarding.

• Excluded parties. Before entering a covered transaction with a vendor, you "must verify that the person with whom you intend to do business is not excluded or disqualified." You can check SAM.gov Exclusions, collect a certification from the vendor or add a clause or condition to the transaction (2 CFR 180.300).
• Which contracts are covered. Under a federal grant, a contract for goods or services is usually a covered transaction when it's expected to equal or exceed $25,000. A few are covered at any amount, such as a contract that needs a federal official's consent (2 CFR 180.220).
• Conflicts of interest. People with a real or apparent conflict of interest can't take part in selecting, awarding or administering a contract supported by the award. The rule covers employees, officers, agents and board members (2 CFR 200.318(c)(1)). A disclosure on the vendor form helps surface conflicts early.
• Responsible contractors. Contracts may go only to "responsible contractors that possess the ability to perform successfully under the terms and conditions of a proposed contract." The rule lists what to consider: contractor integrity, public policy compliance, proper classification of employees, past performance record, and financial and technical resources (2 CFR 200.318(h)).

The conflict-of-interest and responsible-contractor rules apply to recipients that follow 2 CFR 200.318 to 200.327. A public university that counts as part of its state usually follows the state's own procurement policies instead. Our higher education procurement guide explains the difference.

State law and institutional policy often add requirements of their own. Our higher education page explains how we work with universities.

How long vendor onboarding takes, and how to speed it up

Vendor onboarding takes as long as its slowest approval. A low-risk vendor with complete paperwork can be set up quickly. A high-risk vendor waits for security, legal and insurance reviews, which often run one after another. Delays usually come from incomplete forms, documents sent by email and reviews that wait for each other.

To onboard suppliers faster without weakening the checks:

• Use one intake form and one channel for documents.
• Tier vendors, so low-risk ones skip checks they don't need.
• Run the security, legal and finance reviews at the same time, not in sequence.
• Pre-approve standard contract terms, so legal reviews only the exceptions.
• Search the vendor file before creating a new vendor, to avoid duplicates.
• Track two numbers: the time from request to active vendor, and the share of requests that arrive complete. Together they show where the time goes.

Vendor onboarding best practices

Six vendor onboarding best practices keep the process consistent once it's running:

1. Write a vendor onboarding policy. The policy should say who can request a vendor, what each risk tier requires, who approves, and how changes to vendor records are verified.
2. Keep one front door. A vendor set up outside the process skips every check above.
3. Separate duties. Different people should create or change vendor records, approve invoices and release payments.
4. Re-verify on change and on a schedule. Insurance certificates expire, and bank details and owners change. Re-verify a vendor whenever it reports a change, and recheck high-risk vendors at least once a year.
5. Clean the vendor file. Deactivate vendors you haven't paid in a set period and merge duplicate records. Dormant and duplicate records make fraud and duplicate payments easier.
6. Measure the supplier, not only the onboarding. Onboarding ends when the vendor is active, and measuring it against the contract starts there. If suppliers were set up without their contract prices, a contract compliance audit shows what was billed against what was agreed.

Vendor onboarding vs. vendor management and SRM

Vendor onboarding is a one-time process that ends when the vendor is approved and active. What comes after it goes by several names, and the terms overlap.

In a strategic sourcing project, we manage the switchover, including supplier onboarding and loading the new pricing correctly.

Common questions

Whose approval is required for new vendor onboarding?

New vendor onboarding usually needs approval from the requester's budget holder and from procurement, which confirms the need and sets the risk tier. Accounts payable approves the tax and bank details before the vendor record goes live. Higher-risk vendors also need sign-off from IT security, legal or risk management. The person who sets up the vendor shouldn't approve its payments.

What documents are needed for vendor onboarding?

Vendor onboarding usually needs a Form W-9, or a Form W-8 for a foreign vendor, and bank details for payment. The usual set also includes a certificate of insurance, business registration, any licenses the work requires and a signed code of conduct. Vendors with access to your data or sites also provide a security review.

How is supplier onboarding different from supplier selection?

Supplier selection chooses the supplier: defining the need, finding candidates, requesting quotes or proposals, evaluating them and making the award. Supplier onboarding starts once that decision is made and prepares the chosen supplier to be ordered from, paid and measured. Our guide to procurement methods explains how suppliers are selected.

How often should vendor information be re-verified?

Vendor information should be re-verified whenever a vendor reports a change to its name, ownership, tax ID or bank details, and on a schedule otherwise. A sensible schedule rechecks high-risk vendors every year, tracks insurance expiry dates and deactivates vendors that haven't been paid in 12 months or more.

Related service: Strategic Sourcing →