What it means
Supplier onboarding is the process of approving a new vendor and setting it up for purchasing and payment. It gathers identity, contact, tax and bank information, then checks the risks relevant to the goods or services, with the aim of knowing who the company is buying from and preventing avoidable mistakes.
No checklist can guarantee that a supplier will perform or that fraud will never occur. Start with a business need and an accountable buyer, and verify the supplier's legal name, registration, trading address and main contact through suitable records, since a brand name may differ from the entity that signs and invoices.
If the purchase is regulated, check the licence or authorisation required for that work and keep copies or verification references with the supplier record. CIPS guidance on supplier selection discusses checking whether a supplier fits the buyer's requirements and risks, so a small, routine purchase may need basic identity and bank checks while a critical IT provider may need security, continuity and financial review, and an elaborate questionnaire with no one reviewing the answers adds delay without protection.
Bank details require independent verification. The US Secret Service's material on business email compromise describes payment-redirection risks from impersonated or compromised communications, so when a vendor sends new account details, call a number already verified through a separate route, not the number in the change email.
Record who checked and who approved the change, because the same control applies during initial onboarding. Tax data should be checked against the jurisdiction and supply: a UAE supplier might provide a trade licence and tax registration number, but not every supplier is VAT-registered, so do not invent a tax number to complete a form or assume no VAT solely because it is missing, and finance should decide invoice requirements and tax coding based on the actual transaction.
A supplier may need insurance, professional qualifications or product certifications, so check what the contract requires and when documents expire, since an expired certificate in a folder is not current assurance, and a business buying high-risk services may need to review subcontracting and safety procedures as well as the prime supplier. Sanctions or adverse-media checks can be appropriate for higher-risk counterparties and cross-border trade, using reliable screening and resolving possible name matches before rejecting someone, because a similar name is not proof of a prohibited person, and the source, date and decision should be recorded with personal data collected during the review protected.
Agree commercial terms before the first order where possible, specifying prices, delivery, acceptance, payment terms, returns, data access and the process for changes, since a verbal promise from a salesperson may not bind the invoicing entity. If a purchase is urgent, document any temporary exception and approval, then finish the necessary checks before sending money.
Create the vendor record with controlled fields and separate the person requesting the supplier from the person approving bank details and payment if the team is large enough, noting that in a small business an owner can provide an independent review, and restrict who may edit supplier master data and retain an audit log so a vendor record does not become a shared form anyone can overwrite. The first invoice is a test of the setup: match the invoice entity to the contract and purchase order, confirm delivery or service acceptance, and check bank details against the verified master record, rather than paying a personal account merely because an email signature claims it belongs to the supplier.
Escalate mismatches through a trusted contact route. A good process makes legitimate buying easier while reducing identity, tax, quality and payment risk, verifies facts through independent routes, uses controls proportionate to exposure and preserves evidence of decisions; if a supplier cannot provide a required document, assess the reason rather than automatically bypassing the control, because the purpose is informed approval, not a box ticked in software.
In practice
Real-world examples.
Example
A company verifies a supplier's bank details by phone. The finance team calls a number it already holds, not the one in the email that announced the change. The verified account is then recorded in the vendor master with the checker's name.
Example
A new supplier provides its VAT certificate. Accounts payable checks the registration number against the tax authority's records and notes the date. The invoice template is set up so tax is coded correctly from the first purchase.
Example
Procurement checks a supplier against sanctions lists. A possible name match appears, so the buyer compares addresses, ownership and registration details before deciding. The supplier is cleared and the screening record is saved.
Formula
Calculation
Average onboarding time = Total days to onboard suppliers / Number of suppliers onboarded
Worked example. 12 suppliers took 96 days in total.
- Average: 96 / 12 = 8 days.
- If 3 of the 12 were urgent and took 3 days each (9 days in total), the other 9 took 87 days, an average of 87 / 9 = about 9.7 days.
- A shorter average is not automatically better, so the team also checks that required verifications were completed for every supplier.Case study
Seen in the real world.
This illustrative and entirely fictional case follows Gulf Hospitality Group, an invented hotel group that finds a suspicious bank-detail change during onboarding. Accounts payable verifies the account through a previously established contact route and holds payment while the mismatch is investigated. The group improves its process; future fraud attempts are not assumed to be caught automatically.
The investigation finds that the email asking for the change came from a look-alike address, and the real supplier confirms its original account. Gulf Hospitality adds a second approver for any bank-detail change and records the call-back in the vendor file. The scenario is invented and does not describe a real business.
Watch out
Common mistakes.
- Accepting new bank details solely from an email or its listed callback number.
- Skipping all checks because the first order is urgent.
- Allowing the same person to create a vendor, alter payment data and release funds without review.
Questions
People also ask.
What is supplier onboarding?
The checks and system setup used to approve a new supplier.
What information is collected?
Legal identity, contacts, tax status, verified bank account and risk-specific evidence.
Why verify bank details?
Payment-redirection fraud can use forged or compromised messages with new account details.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%