---
title: "Vendor onboarding checklist: a fraud-safe process for AP"
description: "A step-by-step vendor onboarding process and checklist for AP teams: what to collect, how to verify bank details, who approves, and what to log for audit."
url: https://realpayee.com/blog/vendor-onboarding-checklist
canonical: https://realpayee.com/blog/vendor-onboarding-checklist
date_published: 2026-10-05
date_modified: 2026-10-05
updated: 2026-10-05
author: "RealPayee"
site: RealPayee
---

# Vendor onboarding checklist: a fraud-safe process for AP teams

> A fraud-safe vendor onboarding process confirms three things before the first payment: the business is real, the person you are dealing with works there, and the bank account belongs to that business. Collect a W-9 and banking details through a controlled channel, verify the account with a known contact, separate setup from approval, and keep the evidence.

_Vendor verification · Published 2026-10-05 · 5 min read · By the RealPayee team_

## Key takeaways

- Onboarding is where your vendor master file is either kept clean or quietly poisoned. Most later fraud depends on a bad record created here or changed later.
- Collect data through a **controlled channel** (a portal or form), not open email attachments.
- Verify bank details with a contact you found independently, and treat a bank letter or voided check as supporting evidence, not proof.
- Whoever creates the vendor should not approve it or release its first payment.

## Why vendor onboarding is a fraud control

Vendor onboarding is usually treated as admin: get the W-9, create the record, move on. But every record in your vendor master file is a standing instruction to pay someone. A fake vendor created at onboarding, or a real vendor created with the wrong bank account, will be paid automatically for as long as nobody looks. In the AFP's 2025 survey, 45% of organizations reported vendor imposter fraud, up 11 points, and those attacks succeed by getting a bad bank account into a vendor record.

A good process is not slow. Most of the steps below take minutes, and the ones that take longer only apply to vendors above a spend threshold.

## The vendor onboarding process, step by step

### Step 1: Request comes from inside the business

A new vendor should start with an internal requester (a budget owner or buyer), not with an email from the vendor. Capture who requested it, why, the expected annual spend and the cost center. Unsolicited "please set us up as a supplier" emails are a classic route for fake vendors.

### Step 2: Collect information through a controlled channel

Send the vendor a link to a vendor portal or secure form rather than asking for documents by email. Collect:

- Legal business name, any DBA, and registered address
- IRS Form W-9 (or W-8 for foreign vendors) with taxpayer identification number
- Primary contact and accounts receivable contact: name, role, direct phone and email
- Bank name, routing number, account number and account holder name
- Certificate of insurance where your policy requires it
- Payment terms and preferred payment method

### Step 3: Validate the business is real

- Match the name and TIN through the IRS TIN Matching program (available to payers who file information returns).
- Check the business against the state's business registry and confirm the status is active.
- Screen against the OFAC sanctions list.
- Look at the vendor's website domain: does the email domain match, and how old is it? A domain registered last month is a question to ask.
- Check for duplicates in your vendor master: same TIN, bank account, address or phone as an existing vendor or employee.

### Step 4: Verify the bank account belongs to the vendor

This is the step that stops payment fraud, and the one most often done badly. A bank letter, voided check or screenshot can be forged in minutes, and in the US the receiving bank generally posts an ACH credit by account number without checking the name. Do both of these:

1. **Confirm with a contact you found independently.** Call the vendor using a number from their public website or from your requester's existing relationship, not the number on the onboarding form, and confirm the last four digits of the account and the bank name.
2. **Validate the account where you can.** Bank account validation services can confirm that an account is open and, with some banks, that the owner name matches. Use it as an extra check, not a replacement for confirming with the person.

Our [vendor verification guide](https://realpayee.com/vendor-verification) covers the callback in detail, and the [comparison of verification approaches](https://realpayee.com/compare) explains where account validation helps and where it does not.

### Step 5: Approve with separated duties

The person who enters the vendor in the ERP should not be the person who approves it, and neither should release the first payment alone. For small teams, the controller reviewing a weekly list of new vendors is enough. See our guide to [segregation of duties in accounts payable](https://realpayee.com/blog/segregation-of-duties-accounts-payable) for a practical matrix.

### Step 6: Record the evidence

Store, against the vendor record: who requested it, the documents received, the TIN match result, the sanctions check, who confirmed the bank account, on which number, when, and who approved. When an auditor or your cyber insurer asks how you verify vendors, this is the answer.

### Step 7: Watch the first payment

Flag the first payment to any new vendor for a second look, especially if the first invoice arrives quickly after setup or is unusually large for a new relationship.

## Match the effort to the risk

Not every vendor needs the same depth of checking. A simple tiering keeps onboarding fast for low-risk suppliers while making sure the ones that can cost you most get the full treatment. Set the thresholds to fit your spend profile:

| Tier | Example | Minimum checks |
| --- | --- | --- |
| Low | One-off purchase, small annual spend, paid by card | W-9, TIN match, sanctions screen |
| Standard | Recurring supplier paid by ACH | All low-tier checks plus bank account confirmed with an independent contact and separate approval |
| High | Large annual spend, wires, foreign bank, access to your systems or data | All standard checks plus account validation, a second approver and a review of the first payment |

Whatever the tier, bank account verification never drops out for a vendor you pay by bank transfer. That one check is what separates a clean vendor master file from one that pays whoever asked last.

## Vendor onboarding checklist

| Check | Evidence to keep | Owner |
| --- | --- | --- |
| Internal requester and business reason | Request ticket or form | Requester |
| Data collected through portal or secure form | Submitted form | AP |
| W-9 received and TIN matched | W-9 file, TIN match result | AP |
| Business registration active | Registry lookup, date | AP |
| OFAC screening | Screening result, date | AP or compliance |
| Duplicate check against vendors and employees | Search result | AP |
| Bank account confirmed with independently sourced contact | Who, which number, when, what was confirmed | AP (not the requester) |
| Bank account validation (if used) | Validation result | AP |
| Approval by someone other than the creator | Approval record in ERP | Controller or AP manager |
| First payment flagged for review | Payment approval record | Approver |

## After onboarding: changes are the bigger risk

A clean onboarding does not protect you from what happens next. Most vendor payment fraud targets **established** vendors, by asking to change the bank account on a record you already trust. Apply the same standard to every later change:

- Bank-detail changes only through the controlled channel, never by email alone.
- Every change verified with the known contact on file before the next payment, and the next payment held until then.
- A notification to the previous contact and account details after any change.
- A review of the vendor change log before each payment run.
- An annual cleanup: deactivate vendors with no activity in 12 to 18 months, so dormant records cannot be hijacked.

The [vendor bank-change policy template](https://realpayee.com/templates/vendor-bank-change-policy) gives you this as a ready policy, and [vendor fraud: types and examples](https://realpayee.com/vendor-fraud) shows the schemes it is designed to stop.

> [!NOTE]
> **Where RealPayee fits**
> RealPayee watches your ERP for new vendors and bank-detail changes, holds the payment, confirms the account with the real vendor contact out-of-band and stores the evidence on the record. It works with NetSuite, QuickBooks and Xero. [Book a demo](https://realpayee.com/demo) to see it on your own vendor list.

## Frequently asked questions

### What should be included in a vendor onboarding checklist?

An internal requester, W-9 and TIN match, business registration check, sanctions screening, duplicate check, bank account confirmation with an independently sourced contact, separate approval, and stored evidence for each step.

### How do you verify a new vendor's bank account?

Call the vendor on a number you found independently, such as their public website, and confirm the bank and account details. Bank account validation services add a useful second check. A bank letter alone is not proof.

### Who should approve new vendors?

Someone other than the person who created the record, typically the AP manager or controller. Neither should release the first payment alone.

### What is the vendor onboarding process?

The steps a company takes to set up a new supplier for payment: request, data collection, validation of the business, bank account verification, approval and record keeping.

### How often should the vendor master file be reviewed?

Review the change log before every payment run, and do a full cleanup of inactive and duplicate vendors at least once a year.

## Related

- [Accounts payable segregation of duties: a practical matrix](https://realpayee.com/blog/segregation-of-duties-accounts-payable) - How to segregate duties in accounts payable, with a role matrix, small-team workarounds and the gap segregation of duties does not close: impersonation. (markdown: https://realpayee.com/blog/segregation-of-duties-accounts-payable.md)
- [ACH fraud: how it works and how to prevent it](https://realpayee.com/blog/ach-fraud-prevention) - The four kinds of ACH fraud that hit businesses, why ACH credits are hard to recover, and a practical prevention checklist for AP and treasury teams. (markdown: https://realpayee.com/blog/ach-fraud-prevention.md)
- [Vendor verification: how to verify vendor bank details before you pay](https://realpayee.com/vendor-verification) - A practical guide to vendor verification for finance teams: how to confirm vendor bank-detail changes, run callbacks, and prevent vendor impersonation fraud. (markdown: https://realpayee.com/vendor-verification.md)
- [Vendor fraud: types, examples and how to prevent it](https://realpayee.com/vendor-fraud) - What vendor fraud is, the most common schemes (vendor impersonation, fake bank changes, fake invoices) and the controls that stop them. (markdown: https://realpayee.com/vendor-fraud.md)
- [Free vendor bank-change verification policy template](https://realpayee.com/templates/vendor-bank-change-policy) - A free, copy-ready vendor bank-detail change and callback verification policy template plus checklist for AP teams. (markdown: https://realpayee.com/templates/vendor-bank-change-policy.md)

---

**Further reading**
- [Vendor verification guide](https://realpayee.com/vendor-verification.md)
- [Free vendor bank-change policy template](https://realpayee.com/templates/vendor-bank-change-policy.md)
- [Compare: callbacks vs bank-account validation vs RealPayee](https://realpayee.com/compare.md)
- [Pricing](https://realpayee.com/pricing.md)

Canonical HTML: https://realpayee.com/blog/vendor-onboarding-checklist · Site index for AI agents: https://realpayee.com/llms.txt?src=md-footer · Pricing: https://realpayee.com/pricing.md · Book a demo: https://realpayee.com/demo