Vendor Onboarding Checklist, Process, Forms, and Documents to Collect

The vendor onboarding checklist

Copy this and cut what does not apply to your business. A one-off supplier of office furniture does not need the same diligence as a payroll processor with access to employee data. The phase order is what matters: each phase exists to unblock the next, and payment is deliberately last.

PHASE 1. REQUEST AND APPROVAL
Someone states what the vendor is for, the expected annual spend, and why this vendor rather than an existing one. · The approver for that spend level signs off before any paperwork is requested. · Check first whether an approved vendor already covers this. Duplicate vendor records are the single most common mess in an accounts payable file.

PHASE 2. IDENTITY AND TAX PAPERWORK
Completed Form W-9 with legal name, business structure, and taxpayer identification number, or the correct Form W-8 series for a foreign vendor. · Confirm the legal entity name matches the TIN, and that it matches the name you will actually pay. · Business address, remittance address, and the accounts receivable contact.

PHASE 3. VERIFICATION AND RISK
Confirm the business exists independently of what the vendor told you: state entity registration, a real website and business phone, and a physical address that is not a mail drop. · Certificate of insurance if the work carries any liability, naming your company where your contract requires it. · Licenses or certifications the work legally requires. · For vendors touching your systems or data, the security review (see below).

PHASE 4. COMMERCIAL TERMS
Signed contract, master services agreement, or accepted quote, with scope, pricing, and term. · Payment terms agreed in writing and matched to what you will enter in the system. · Whether purchase orders are required, and the approval thresholds. · Renewal and cancellation dates recorded somewhere that will actually be looked at.

PHASE 5. BANKING AND SYSTEM SETUP
Bank details collected, then verified by calling the vendor on a number you looked up independently, never a number in the email that supplied the details. · Vendor record created in the accounting system with terms, tax status, default expense account, and the W-9 attached. · Confirm who internally is allowed to change those bank details later.

PHASE 6. FILE AND ACTIVATE
Every document filed against the vendor record, not in one person's inbox. · Requester told the vendor is live and what the PO or approval process is. · Diary the insurance expiry and contract renewal now. · First invoice matched against the agreed terms before it is paid.

One rule holds the whole sequence together, and it is the same rule that holds together every other operations checklist: no payment before the file is complete. The moment you make an exception "just for this one urgent invoice," the paperwork never arrives, because the only leverage you had was the payment.

The vendor onboarding documents and forms to collect

This is the part people search for, so here is the specific US list and the reason each item exists.

Form W-9. The IRS states its purpose plainly: "Use Form W-9 to provide your correct Taxpayer Identification Number (TIN) to the person who is required to file an information return with the IRS." You are the person required to file, so you collect it. Get it before the first payment, not in January. Two numbers make this worth doing properly. If a vendor has not given you a correct TIN, the IRS requires backup withholding at 24 percent, which means you are legally obliged to hold back a quarter of the payment and remit it. And the threshold that decides whether you file at all has just moved.

The 1099-NEC threshold changed for 2026, and most checklists you will find are out of date. The reporting threshold for nonemployee compensation on Form 1099-NEC is now $2,000 or more in a calendar year, for payments made after December 31, 2025, under the statutory amendments in the One Big Beautiful Bill Act. The old figure was $600, a level the IRS notes had been in place since 1954 without being indexed to inflation. The new threshold is adjusted for inflation in calendar years after 2026. The IRS and Treasury estimated that for tax year 2024, around 3.3 million payors filed 18.8 million Forms 1099-NEC for amounts between $600 and $2,000, so this change removes a large volume of small filings. Two practical consequences: collect the W-9 from every vendor anyway, because you cannot reliably predict at setup which ones will cross $2,000 by December, and if a page or a template still tells you the threshold is $600, it has not been updated for 2026.

Filing dates and format. Form 1099-NEC is due to the IRS and to the recipient by January 31. If you file 10 or more information returns in aggregate across all types, you must file electronically; that threshold dropped from 250 to 10 as of January 1, 2024 under Treasury Decision 9972. Aggregate is the word that catches people out, because it counts all your information returns together rather than 10 of any single form.

Foreign vendors. A vendor that is not a US person does not give you a W-9. You collect the appropriate Form W-8 instead: Form W-8BEN for a foreign individual, Form W-8BEN-E for a foreign entity. The withholding and reporting rules that follow are genuinely different from the domestic ones, so if you are onboarding your first foreign supplier, that is a question for your accountant rather than a checklist item to guess at. Our guide to W-9 versus W-8BEN covers which vendor needs which form and when each one expires.

Certificate of insurance. For any vendor whose work could cause loss, damage, or injury, ask for a certificate of insurance showing the coverages and limits your contract requires, with your company named as certificate holder and, where the contract calls for it, as an additional insured. The certificate carries an expiry date, which is the point: an insurance certificate collected once and never re-checked is a document that quietly stops being true. Diary the renewal at onboarding, because nobody discovers a lapsed policy at a convenient moment.

Everything else. The signed contract or accepted quote. Bank details, verified as described below. The remittance email address, which is often different from the sales contact. Any license or certification the trade legally requires. And, for regulated or higher-risk purchases, whatever screening your own compliance obligations impose.

• Form W-9 from every US vendor, before the first payment, not at year end
• Form W-8BEN or W-8BEN-E for foreign individuals and entities
• Certificate of insurance with the expiry date diarized for renewal
• Signed contract or accepted quote with payment terms that match the system
• Bank details verified by callback to an independently sourced number
• W-9, contract, and certificate filed against the vendor record, not in an inbox

The bank detail check that stops vendor payment fraud

This is the single highest-value step in vendor onboarding, and it takes about four minutes. Business email compromise targeting accounts payable follows a consistent script: an email arrives that looks like it comes from a real vendor you really owe money to, saying the banking details have changed and asking for the next payment to go to a new account. The email is well written, the invoice attached is a genuine one, and the details are plausible. Payment goes out, and recovering it is difficult once it clears.

The control is procedural, not technical, and it works because it breaks the channel the attacker controls. When bank details are supplied or changed, verify them by calling the vendor on a phone number you looked up yourself, from the contract or the company's own website, and never a number that appears in the email or the attachment. Speak to a person you can name and note who confirmed it and when. Treat a change of bank details on an existing vendor as a higher-risk event than the original setup, because that is the one attackers actually target.

Two more rules make this hold up under pressure. First, apply it without exception to urgent requests, because manufactured urgency is the whole technique. Second, separate the duties: the person who can change a vendor's bank details should not also be the person who approves the payment. In a small office where the same person genuinely does both, the compensating control is that a second named person reviews bank detail changes, even if that person is the owner.

The new vendor setup form: what to actually ask

A vendor onboarding form, sometimes called a new vendor setup form or a vendor onboarding questionnaire, exists to collect the whole list in one pass rather than in six emails over three weeks. Keep it short and ask only for what changes something you do. Every extra field is a reason for the form to come back late or half completed.

Ask for: legal business name exactly as registered, and the trading name if it differs. Business structure and taxpayer identification number, which the W-9 covers, so attach the W-9 rather than duplicating the fields. Business address and remittance address. Three contacts, because they are usually three different people: the sales or account contact, the accounts receivable contact for invoice questions, and someone for escalation. Bank details for payment, marked as subject to verification. Insurance carrier and policy expiry, if applicable. What they supply, described in your categories rather than theirs, so the spend lands in the right account. Payment terms proposed. Any required licenses or certifications. And a single yes or no on whether they will handle your data or access your systems, which is what routes the vendor into the security review below.

Send it as one complete request with a stated deadline and a short line on why you need each awkward item. The reason vendor setup drags is almost never that the vendor is unwilling; it is that the request arrived in pieces and nobody on their side ever saw the full list.

IT and security vendor onboarding: the extra review

If a vendor will hold your data, connect to your systems, or handle payments on your behalf, the standard checklist is not enough and a security review belongs in phase 3. This is where vendor onboarding overlaps with third-party risk management, and the depth should scale with what the vendor can actually reach.

For most small and mid-sized US companies the proportionate version is short. Ask what data the vendor will store or process and where. Ask for a current SOC 2 Type II report or equivalent independent audit if they hold anything sensitive, and read the exceptions section rather than just noting that the report exists. Confirm they support single sign-on and multi-factor authentication for your users. Get their breach notification commitment in writing, with a timeframe. Sign a data processing agreement where the data warrants it. Record which internal system the vendor connects to and who owns the relationship, so that when someone leaves, the connection is not orphaned.

Then diary the review. A security assessment done once at onboarding is a snapshot of a company that will change, so tie the re-review to the contract renewal date you already recorded in phase 4 rather than creating a separate calendar nobody maintains. Onboarding is only the second stage of the vendor management process, and the monitoring that follows it is where a vendor approved two years ago stops resembling the one you assessed.

Where vendor onboarding actually goes wrong

The failure modes are consistent across every accounts payable function, and none of them are exotic.

• Payment released before the file is complete: the leverage to collect the W-9 disappears the moment the invoice is paid
• Bank details accepted by email without a callback: the one failure that costs real money
• Duplicate vendor records: the same supplier set up three times, so spend is invisible and terms are inconsistent
• Insurance certificates collected once and never re-checked: the policy expires quietly and nobody knows until a claim
• Documents living in one person's inbox: onboarding is complete only when the next person can find the file
• Renewal dates nowhere: auto-renewing contracts pass their notice window and lock in another year

Running vendor onboarding without it eating the week

Look at what the checklist above actually consists of. A small number of real decisions (is this vendor the right choice, is the spend approved, is the security posture acceptable) and a long tail of coordination: sending the same document request, chasing the W-9 that did not come back, confirming the certificate of insurance arrived and reading the expiry off it, writing the callback confirmation down somewhere durable, filing five documents against the right record, and remembering in eleven months that a policy lapses and a contract renews. The decisions are the work. The coordination is what makes vendor setup take three weeks.

That coordination layer is what Officeagent runs. It drafts and sends the vendor document request from your standard list, chases the items that have not come back without anyone having to remember, files the returned W-9, contract, and insurance certificate against the vendor record where the next person will look for them, turns the open items into tracked tasks with one owner and a due date, and puts the insurance expiry and contract renewal on the calendar at setup rather than at the point they become a problem. Every message it drafts and every document it files waits for a human approval first, which is the control you want anywhere near payment paperwork.

It is worth connecting this to the two documents that sit either side of it, and to the process that runs on top of them: a clean vendor record is the foundation the whole accounts payable process depends on. A purchase order is what you raise against a vendor once they are onboarded, and the three-way match that follows only works if the vendor record is clean. An expense report is what you get instead when someone bypasses the process and buys on a personal card, which is usually a symptom of vendor setup being slow enough that people route around it. Fix the onboarding time and a surprising amount of expense reimbursement disappears with it.