Vendor Verification Checklist Template

The verifier starts the run when a new vendor is requested, about three working weeks before its first payment. The answers on the first task assign every task, set each due date from the first payment date and add the checks this vendor needs.

• Record the vendor, the first payment date and who does what — the vendor’s name as requested, the date of its first payment, the requester, the verifier, the approver and the payments lead, where the vendor is based, which US tax form applies and whether the work needs insurance or a licence
• Confirm the business need and the requester — what the vendor will supply, the budget or cost centre, the contract or purchase order it will be paid against and the expected spend, confirmed by the person who asked for it
• Check the vendor is not already in the vendor master — the vendor master searched by name, trading name, tax number, address, phone number and bank account, so the same vendor is not set up twice under another name
• Send the vendor your set-up form — the form or supplier portal link sent to the vendor’s own contact, asking for its legal name, registration number, address, tax details, a remittance contact and its bank details, so everything comes from the vendor and not second-hand
• Check the requester, verifier and approver are different people — the three roles held by three people, and the payments lead not the person who will enter the vendor record, so no one can ask for, check and approve the same vendor

The verifier confirms the vendor is a real business with the name it gave, from the official register rather than the vendor’s own papers. The phone number found here is the one the bank call-back in Phase 4 uses.

• Check the legal name and registration on the official register — the vendor found on the official company register for its country, with its registered number, status and registered address recorded and an extract saved
• Match the legal name across every document — the legal name on the register checked against the set-up form, the contract or purchase order and the tax form, with any trading names recorded, so the vendor master, the tax record and the bank account all use one name
• Record the directors and owners — the directors and the people or companies that own or control the vendor, from the register where it shows them or from the vendor, so each can be screened against the sanctions lists in Phase 5
• Find the vendor’s phone number from an independent source — a main switchboard or finance number taken from the register, the vendor’s website typed in by hand or an existing contract, never from the set-up form, an email or an invoice, and recorded for the call-back

The verifier collects the tax form and checks the tax number the vendor’s country uses. A US vendor gives a Form W-9, matched through IRS TIN Matching where your business is enrolled; a foreign vendor paid by a US business gives a Form W-8; UK and EU VAT numbers are checked with HMRC or VIES. Only the tasks this vendor needs appear.

• W-9: get a signed Form W-9 from the vendor — the current Form W-9 completed, signed and dated by the vendor or a person authorised to sign for it, kept in your vendor file and not sent to the IRS
• W-9: check the name, tax classification and TIN — line 1 holds the legal name (the owner’s name for a sole proprietor or a disregarded entity, with the business name on line 2), one federal tax classification is ticked, the TIN has nine digits and the certification is signed
• W-9: match the name and TIN through IRS TIN Matching — the line 1 name and the TIN checked through IRS TIN Matching in e-Services, where your business is enrolled, with the response code and the date recorded
• W-8: get the right Form W-8 from a foreign vendor — Form W-8BEN from a foreign individual or Form W-8BEN-E from a foreign entity, given to you before the first payment and not sent to the IRS, with the date it was signed and the date it runs out recorded
• UK: check the VAT number with HMRC — the vendor’s VAT number checked in HMRC’s Check a UK VAT number service, with the name and address it is registered to compared with the legal name and address from Phase 2
• EU: check the VAT number in VIES — the vendor’s VAT number checked in the European Commission’s VIES, with the result saved, and the name and address where its country shows them
• Elsewhere: record the vendor’s tax registration — the tax or VAT number the vendor’s country uses, checked with that tax authority’s own online service where one exists, and the result recorded
• TIN mismatch: ask the vendor to check its details and send a corrected W-9 — the vendor asked, through the contact you know, to check the name and TIN it gave against its own IRS records, and the corrected W-9 matched again
• Record the tax details in the vendor file — the forms on file, the tax and VAT numbers, each check made and its date written down in one place, ready for the approver and for the vendor master

The bank details come from the vendor and are confirmed by calling the number found in Phase 2. A payee name check through your bank adds a second test where it is offered. A failed call-back, a close match and a no match each add their own task.

• Get the bank details from the vendor in writing — the account name, the account number with its sort code, routing number or IBAN, and the bank’s name, sent by the vendor itself on the set-up form or portal, not passed on in someone else’s email
• Call the vendor on the independent number to confirm the account — a call to the number found in Phase 2, never one from the set-up form, an email or an invoice, asking the vendor to read the account details to you rather than reading them out yourself
• Call-back failed: stop and escalate as possible fraud — no bank details entered, the approver told the same day, the set-up form and any emails kept as evidence, and the details asked for again through the contact you know
• Run a payee name check where your bank offers one — the account name and number checked through your bank before the account is saved: Confirmation of Payee for a UK account, Verification of Payee for a euro account, or your bank’s own account validation where it has one
• Close match: confirm the exact account name with the vendor — the name your bank showed read back to the vendor on the independent number, and the reason it differs from the legal name, such as a trading name, recorded
• No match: stop and escalate to the approver — the account not saved, the approver told, and the details asked for again through the known contact; a second no match is a reason to decline the account
• Check the account holder is the vendor’s legal entity — the account name, from the call and any name check, is the legal name from Phase 2; a personal account or another company’s name is resolved before approval
• Check the account is not used by another vendor or an employee — the vendor master searched for the same account, and the account checked against employee bank details with payroll, because a shared account needs an explanation before approval

The vendor, its owners and its directors are screened against the sanctions lists that apply to your business before any money is paid. A possible match adds a task to compare the details, and a match that cannot be cleared adds a task to escalate it and pay nothing.

• Screen the vendor against the sanctions lists that apply to you — the legal name, trading names and address searched in OFAC’s Sanctions List Search for a US business, the UK Sanctions List for a UK business and the EU’s consolidated financial sanctions list for an EU business, with the date and the result saved
• Screen the owners and directors — each name from Phase 2 searched in the same lists, because a company owned by a sanctioned person can be caught even when its own name is not listed
• Possible match: compare the details and clear it or escalate it — the listed entry compared with the vendor on full name, address, country and registration number, and dates of birth for people, with the reason it is or is not the same recorded
• Escalate a match you cannot clear, and pay nothing — the vendor not approved, no money paid or made available to it, the match passed to your compliance lead or adviser, and the regulator contacted as its guidance says

Insurance and licences apply only when the work needs them, and the first task’s answer adds those two tasks. The contract and the payment terms apply to every vendor.

• Insurance: get certificates for the cover the work needs — certificates for the cover your contract or policy asks of this vendor, such as public or general liability, employer’s liability or workers’ compensation, or professional indemnity, each checked for the insured name, the limits and the end date
• Licences: check the licences or registrations the work needs — any trade licence, professional registration or permit the work needs, checked with the body that issues it rather than from a copy alone
• Confirm the contract or purchase order is in place — the signed contract, or the approved purchase order, that this vendor will be paid against, with its value and term
• Record the payment terms and method — the payment terms, the currency and the payment method agreed with the vendor, matching the contract and the invoices it will send

The verifier puts the evidence together and the approver, who is neither the requester nor the verifier, decides. The approval is the gate: nothing after it, including the vendor master entry and the first payment, can be completed until it is done. Approved with conditions adds a task to meet them before the first payment.

• Put the verification pack together for the approver — one summary of every check, its result and its date, with each exception explained: registration, tax form and tax number, the bank call-back and name check, sanctions, and insurance and licences where they apply
• Approver checks who did each step — the checklist’s activity read to confirm the requester did not verify the vendor and the verifier is not approving it, and any overlap from Phase 1 covered by its compensating check
• Approve the vendor into the vendor master — the verification pack reviewed and the vendor approved, approved with conditions or not approved by the approver; until this is done, the vendor master entry and the first payment cannot be completed
• Not approved: put right what the approver raised, or decline the vendor — each point the approver raised answered or the check repeated, or the vendor declined and the requester told, with no vendor record created
• Approved with conditions: meet each condition before the first payment — each condition the approver wrote on the approval task met, with how and when recorded, before the first invoice is checked; a condition that cannot be met in time goes back to the approver

Only after approval is the vendor entered, exactly as verified, and checked by someone other than the person who entered it. Renewal dates and ongoing screening keep the record right after this run.

• Enter the vendor in the vendor master exactly as verified — the legal name, registration number, address, tax details, payment terms and bank details entered as the checks confirmed them, with the approval noted on the record
• Check the saved record against the verified details — the saved record compared field by field with the verification pack by someone other than the person who entered it, with the bank details checked character by character
• Set renewal dates and ongoing screening for the vendor — the W-8, insurance and licence end dates diarised, and the vendor added to the screening you repeat when the sanctions lists change
• Tell the requester and the vendor the set-up is complete — the requester given the vendor number to use on orders, and the vendor told through its known contact which details you hold, so a vendor that did not send them can say so before money moves

The payments lead checks the first invoice against the approved record before releasing it, and the verifier confirms with the known contact that the money arrived. Bank details on an invoice that differ from the record are a change request, not a payment.

• Check the first invoice against the approved record — the vendor name, the bank details printed on the invoice and the amount checked against the vendor record and the contract or purchase order
• Release the first payment — the first payment released to the account in the vendor master, by someone who did not enter the vendor record, with the payment reference recorded
• Confirm with the vendor that the first payment arrived — the vendor’s known contact asked, on the independent number or an address you already hold, to confirm the payment reached its account
• File the evidence and close the run — the set-up form, tax form, register extract, call note, name check, screening results, approval and payment confirmation kept together with the vendor record