Vendor onboarding is where most payment fraud is set up, weeks before any money moves. A vendor record created from an emailed form with unverified bank details is a standing instruction to pay whoever supplied them. This vendor onboarding checklist puts tax, sanctions, and bank verification ahead of activation, and keeps the person who creates the record separate from the person who approves it. Pair it with our software category guides to see which tools fit your team. Once you have a shortlist, check the vendor profiles and the finance glossary for unfamiliar terms, then use our head-to-head comparisons before your first demo.
Built for: AP manager, Procurement lead, Controller
+1 more inside
Start from a request, not a form. Every new vendor begins with an internal request from a budget owner stating what is being bought and why a new vendor is needed. Check the vendor master for an existing record before creating one.
Collect documents through a controlled channel. Use a vendor portal or a known contact at the vendor. Do not accept bank details from the same email thread that introduced the vendor without independent verification.
Verify before you activate. Complete the TIN match, sanctions screen, and bank call-back before the record is active. Keep new records blocked for payment until every check in the verification section is ticked.
Approve in the system. A second person reviews the evidence and activates the record. The creator should not be able to activate their own vendor.
Here's a preview. Unlock the free download to get all 7 sections (6 more below).
More free templates finance teams use alongside this one.
Accounts payable fraud rarely looks like fraud at the time. It looks like a routine email from a known vendor asking to update bank details, or an urgent request from an executive who is travelling. This checklist covers the controls that stop the common schemes: independent verification of bank changes, red flags for business email compromise, duplicate payment checks, bank-side protections, and dual approval on payment release.
Most approval matrices fail in one of two ways: every invoice goes to the CFO, or nobody can say who approves a $40,000 software renewal. This approval matrix separates PO-backed invoices, where approval already happened at the purchase order, from non-PO spend, where the invoice is the only control point. It also names a backup for every approver so invoices do not sit in someone's inbox while they are on leave.
A procurement policy exists to answer one question before money is committed: has the right person agreed to this spend, at a fair price, on acceptable terms? This template ties quote requirements, purchase orders, and contract review to spend thresholds, so small purchases move quickly and large ones get the scrutiny they need.
At minimum a tax form (W-9 for US persons, W-8BEN or W-8BEN-E for foreign individuals or entities), remit-to details, verified bank details for electronic payment, and the contract or PO setting payment terms. Add a certificate of insurance where the vendor works on site or handles your data.
Call the vendor on a phone number from an independent source, such as the contract or the vendor's public website, and have them confirm the full account details. Never use a number supplied in the same email or document as the bank details.
It is an IRS e-Services program that lets payers of 1099-reportable income check whether a name and TIN combination matches IRS records. Running it at onboarding reduces B-notices and backup withholding problems later.
US persons are prohibited from dealing with parties on the OFAC Specially Designated Nationals list, so screening vendors at onboarding and periodically afterwards is standard practice. Document the result and escalate potential matches before activation.
