Know Your Supplier

A company gets a quotation from a new supplier using a familiar-sounding name, and before approving payment, procurement checks the legal entity, registration and contact details against independent records. The process begins with basic identity, so confirm the registered name, address, relevant licence or registration and the person authorised to contract, because a polished website and an email signature are not proof that a business exists or can perform the work, and Australia's business.gov.au supplier guidance recommends researching potential providers, checking registration, references, reliability and other risks.

Match checks to exposure, since a stationery vendor may need basic verification, while a provider handling payroll data needs stronger security and confidentiality review, and a sole source for a critical component calls for resilience and capacity questions. Ownership matters when sanctions, conflicts of interest or other legal duties make it relevant, and FATF guidance explains why accurate beneficial ownership information helps identify who ultimately controls legal entities in its anti-money-laundering context, although not every small purchase requires the same ownership investigation as a regulated transaction.

Check applicable sanctions restrictions using current, authorised sources where the business has exposure, and resolve identity before making an accusation or blocking a legitimate provider, because name matches can be false positives, and seek specialist advice when legal obligations are unclear. Financial health and delivery capability can also matter, so ask for evidence suited to the contract, such as capacity, certifications or references, since a low quote from an unqualified provider can cost more through delays or defects.

Payment details are a separate fraud risk, so verify a new bank account or change through an independently known contact route, not merely by replying to the email that supplied the new details. Keep supplier records linked to the contract and approved contact, and if the invoice names a different legal entity, investigate before paying, because there may be a legitimate assignment or group company but it needs explanation and proper approval.

Avoid collecting sensitive information without purpose by defining what evidence is required, who can see it and how long it is kept. KYS does not stop at onboarding, because a merger, change of owners, new country of service or data access can change the risk profile, so review high-risk suppliers more often and trigger a fresh check when material facts change.

Assign responsibility across procurement, finance, legal and security, since procurement can verify performance, finance payment details and security system access, and a single approved tick should not conceal unresolved specialist checks. An illustrative completion measure is active suppliers with current required checks divided by active suppliers in scope, so if 180 of 200 qualify, the rate is 90%, though it does not reveal whether the 20 unchecked suppliers include the most critical provider.

Document exceptions, because emergency procurement may need an interim approval path but urgency should not erase basic identity or bank verification, and the record should show who accepted the risk and which checks must follow. Watch for conflicting signals and escalate facts calmly, since a registered business can still be unreliable, a new business may be legitimate despite little trading history, and repeated missed deliveries or unexplained account changes may justify review without every change being treated as fraud.

When ending the relationship, close access, settle genuine invoices and retain records under applicable requirements, because a former supplier with active system credentials can remain a risk even after purchasing stops. For a business owner, KYS asks three practical questions: who is the provider, can it safely deliver, and are the payment and compliance routes sound?

Do enough checking to answer them for the level of exposure, then revisit when circumstances change.