How to Onboard a New Vendor: The 6 Steps, in the Right Order

To onboard a new vendor, approve the spend internally before you request anything, collect a completed Form W-9 with the legal name and taxpayer identification number, verify the business genuinely exists, collect a certificate of insurance if the work carries risk, agree payment terms in writing, then verify bank details by calling a number you looked up yourself rather than one supplied in an email. Set the vendor up in your accounting system, file every document against that record, and only then release the first payment. Paying before the file is complete is what turns a two-day setup into a three-week chase.

Most accounts payable teams know the steps. What separates a clean vendor file from the usual mess is the order they happen in, and the fact that payment sits at the end rather than in the middle. Below is the sequence that works, why each step exists, and the two places it reliably falls apart.

Step 1: Approve the spend before you request paperwork

Vendor onboarding starts inside your own company, not with an email to the supplier. Someone should state what the vendor is for, roughly what the annual spend will be, and why this vendor rather than one you already use. The approver for that spend level signs off before anyone asks the vendor for a single document.

The check that saves the most future pain here is the dullest one: search your existing vendor list first. Duplicate vendor records are the most common defect in an accounts payable file, and they are quietly expensive. The same supplier set up twice under slightly different names means your spend with them is invisible, so you never notice you are past the discount tier, and the two records drift onto different payment terms. Five minutes of searching at the start prevents a cleanup project later.

Step 2: Collect the tax paperwork first, not last

Form W-9 is the foundation of the file. The IRS describes its purpose directly: use it "to provide your correct Taxpayer Identification Number (TIN) to the person who is required to file an information return with the IRS." You are the person required to file, which is why collecting it is your job rather than a favor the vendor does you.

Two numbers explain the urgency. If a vendor has not given you a correct TIN, the IRS requires backup withholding at 24 percent, meaning you are obliged to hold back a quarter of the payment and remit it. And the reporting threshold has just moved in a way most checklists have not caught up with. For payments made in calendar year 2026, the Form 1099-NEC threshold is $2,000 or more, raised by the One Big Beautiful Bill Act from the $600 level that the IRS notes had been in place since 1954 without inflation indexing. It is adjusted for inflation in calendar years after 2026. If a template still tells you the number is $600, it was written before this change.

The practical rule does not change though: collect a W-9 from every vendor at setup, because you cannot predict in March which suppliers will cross $2,000 by December. Form 1099-NEC is due to both the IRS and the recipient by January 31, and if you file 10 or more information returns in aggregate across all types you have to file electronically, a threshold that dropped from 250 to 10 at the start of 2024.

For a vendor that is not a US person, you collect a Form W-8 instead: W-8BEN for a foreign individual, W-8BEN-E for a foreign entity. The withholding rules that follow are genuinely different, so a first foreign supplier is a conversation with your accountant rather than a box to tick.

Step 3: Verify the vendor is a real business

This step is skipped constantly, usually because the vendor came through a referral and feels obviously legitimate. It takes about ten minutes. Check the state entity registration for the legal name they gave you. Confirm there is a working business phone and a physical address that is not a mailbox service. Look at whether the website predates last month. Match the legal name on the W-9 against the entity you are about to pay, since a mismatch there is both a fraud signal and a filing problem.

Where the work carries any liability, ask for a certificate of insurance showing the coverages and limits your contract requires, with your company named as certificate holder and as an additional insured if the contract says so. The important detail is the expiry date. A certificate collected once and filed forever is a document that silently stops being true, and nobody discovers a lapsed policy at a convenient moment. Diary the renewal at onboarding, or use something that will track certificates of insurance and chase them before they expire, because a manual reminder set eleven months out is a reminder that will not survive a change of staff.

Step 4: Agree terms in writing before the first invoice

Get the contract, master services agreement, or accepted quote signed, with scope, pricing, and term stated. Agree the payment terms explicitly and make sure the terms you entered in the accounting system match the terms in the document, because a mismatch between the two is how a supplier ends up chasing you for an invoice your system thinks is not due for another fortnight.

Record the renewal and cancellation dates somewhere that will actually be looked at. Auto-renewing service contracts with a 60 or 90 day notice window are the standard way companies pay for another full year of something they decided to cancel. The moment to capture that date is now, while you are reading the contract anyway.

Step 5: Verify bank details by phone, every time

If you do only one thing on this list properly, do this one. Business email compromise aimed at accounts payable follows a reliable script: an email arrives that appears to come from a genuine vendor you genuinely owe money to, explaining that banking details have changed and asking for the next payment to go to a new account. The writing is professional, the invoice attached is real, and everything looks ordinary. Once the payment clears, getting it back is difficult.

The control is procedural. When bank details are supplied or changed, confirm them by calling the vendor on a number you sourced yourself, from the signed contract or the company's own website, never a number that appears in the email or the attachment. Note who confirmed it and when. Treat a change of bank details on an existing vendor as higher risk than the original setup, because established relationships are exactly what attackers target.

Two rules keep this from eroding. Apply it to urgent requests without exception, since manufactured urgency is the entire technique. And separate the duties, so the person who can change bank details is not also the person who approves payments. In a small office where one person genuinely does both, have a second named person review every bank detail change, even if that person is the owner.

Step 6: File everything, then activate

Onboarding is complete when the next person can find the file, not when you personally know where things are. The W-9, the signed contract, the insurance certificate, and a note of the bank verification callback all belong attached to the vendor record in your system, not in the inbox of whoever handled the setup. The test is simple: if the person who did this onboarding were out for two weeks, could a colleague answer a question about this vendor without calling them?

Then tell the requester the vendor is live and what the approval process is going forward. If you use purchase orders, this is the point to say so, because a supplier who invoices without a PO number creates a matching problem that lands back on accounts payable. Our purchase order template covers the numbering scheme and the three-way match that follows, and both only work if the vendor record you just created is clean.

How long should this take?

A straightforward vendor can be fully onboarded in two to five business days. When it takes three weeks, the cause is almost never the checks themselves. It is a document request sent in pieces over a fortnight, a W-9 that nobody chased after the first email, and a verification callback that kept getting postponed because it was always the least urgent thing on someone's list.

That is the honest diagnosis of most slow vendor setup: it is not a hard process, it is an unowned one. Every item needs a single named owner and a date, exactly like the client onboarding checklist on the other side of the business. Items owned by "the team" do not get chased, because nobody is specifically waiting on them.

Speed matters more than it looks, too. When vendor setup is slow, people route around it. They buy on a personal card and submit an expense report, which means the spend arrives with no contract, no insurance certificate, and no W-9, and the control you built the process for never applied at all. Slow onboarding does not stop the purchase; it just moves it somewhere you cannot see.

The short version

Approve internally and check for duplicates. Collect the W-9 before any payment, remembering the 2026 threshold is $2,000 and backup withholding is 24 percent. Verify the business is real and insured, with the certificate expiry diarized. Sign terms and record the renewal date. Verify bank details by independent callback, with duties separated. File everything against the vendor record and activate.

The full phase-by-phase version, including the new vendor setup form to send and the security review for suppliers who touch your systems or data, is on our vendor onboarding checklist. If the chasing is what makes this slow at your company, the coordination side of it (sending the document request, following up on what has not come back, filing the returned paperwork, and putting the insurance expiry on the calendar) is exactly the work Officeagent handles, with every message waiting on a human approval before it goes.