Try it now, capture a real invoice
Free plan · No credit card · Your data stays yours
Vendor onboarding is the controlled process of collecting, verifying and approving a new supplier's information before you pay them, covering tax forms, banking details, insurance and legal checks. Done properly it is the single strongest defense against duplicate payments, fraudulent bank-change requests and paying a supplier you were never authorized to use. Every dollar you pay flows through a vendor record, so the quality of that record decides whether your controls work at all.
What is vendor onboarding?
Vendor onboarding is how a new supplier goes from unknown to approved and payable in your systems. It gathers the legal, tax, banking and compliance data you need, verifies that the data is real and belongs to the vendor, and creates a clean master record that AP can pay against. It is the front door to your accounts payable process, and it is where controls are cheapest to apply. Fixing bad vendor data after a payment has gone out is far harder than getting it right before the first invoice.
The output of onboarding is a vendor master record. Keeping that record accurate over time is a separate ongoing discipline covered in our guide to the vendor master file. Onboarding is the moment you have the most leverage to keep it clean.
The vendor onboarding process step by step
A repeatable onboarding flow has five stages. Skipping any of them is where fraud and errors get in.
| Step | What happens | Control it enforces |
|---|---|---|
| 1. Request and collect | Vendor submits legal name, address, W-9 or W-8, banking details and contacts | Complete, first-hand data, not retyped from an email |
| 2. Validate identity and tax | Match the TIN to the legal name, confirm the entity is real | Correct 1099 reporting, no fictitious vendors |
| 3. Screen for risk | Check sanctions and denied-party lists, look for duplicate records | No prohibited or duplicate vendors |
| 4. Verify banking and insurance | Confirm bank details independently, collect a certificate of insurance where required | Payments reach the real vendor, liability is covered |
| 5. Approve and create | A second person approves; the master record is created with no payment yet | Segregation of duties on vendor creation |
The vendor onboarding checklist
At minimum, collect and verify the following before a vendor can be paid: legal business name and DBA, remittance and physical address, a completed W-9 (US vendors) or W-8 (foreign vendors), the taxpayer identification number matched to the legal name, bank account and routing details confirmed through an independent channel, primary and accounts contacts, and, for any vendor performing work on your premises or carrying liability, a current certificate of insurance. Regulated buyers add sanctions and denied-party screening. Collecting and tracking that insurance document is a recurring task in itself; many teams manage it with dedicated certificate of insurance tracking so coverage never lapses unnoticed.
The controls that actually stop fraud
Three controls in onboarding prevent the most common and costly AP losses. They are worth calling out because teams often skip exactly these under time pressure.
Independent bank verification. The most damaging AP fraud is the business email compromise, where a criminal poses as a vendor and requests a change to banking details. The control is simple and non-negotiable: verify any bank detail, new or changed, by calling a phone number you already have on file, never a number or link in the request itself. Onboarding is where you capture that trusted contact number in the first place.
Duplicate vendor checking. Before creating a record, search for an existing one. Duplicate vendor records are how the same invoice gets paid twice, because a control that blocks duplicate invoice numbers fails when the same vendor exists under two IDs. Matching on tax ID and bank account, not just name, catches the near-duplicates that a name search misses.
Segregation of duties. The person who creates or changes a vendor must not be the person who approves payments to that vendor. Without this split, one individual can create a fake vendor and pay it. Enforcing it in onboarding is far easier than trying to detect the fraud afterward. These controls are part of a broader framework covered by accounts payable internal controls software, and they detect the schemes described in our overview of invoice fraud detection.
Why is vendor onboarding important?
Vendor onboarding is important because it is the cheapest place to prevent the most expensive AP problems. Verifying a bank account once during onboarding costs minutes; recovering funds sent to a fraudster's account is usually impossible. Checking for a duplicate record takes seconds; a duplicate payment can take months to claw back. Collecting a correct W-9 up front avoids IRS backup withholding and 1099 penalties at year-end. Every downstream control in accounts payable assumes the vendor record is trustworthy, so onboarding is what makes those controls real rather than theoretical.
How long should vendor onboarding take?
Well-run onboarding usually completes in one to three business days, most of which is waiting for the vendor to return documents. The internal verification and approval work is minutes, not days, when the process is defined and the data arrives structured rather than as email attachments to be retyped. Delays almost always come from chasing missing forms or manually rekeying information, both of which shrink when collection is standardized. The goal is fast enough that onboarding never becomes the reason a payment is late, and thorough enough that no vendor is ever payable without verified banking and a matched tax ID.
Getting started
Write down your five steps and your checklist, then enforce them on every new vendor without exception, because the one you wave through is the one that becomes a problem. When invoices start arriving, accurate capture keeps the vendor data clean: the tool at the top of this page reads the supplier details off each invoice, which helps flag when an invoice does not match an approved, verified vendor record. Strong onboarding plus accurate invoice capture is the combination that keeps fraudulent and duplicate payments out of your AP process from the first bill onward.