New Vendor Setup Checklist

A vendor onboarding checklist for small businesses: collect supplier details, verify bank and tax data, review contracts and security, then create the record.

Typical schedule per new vendor
The checklist 5 sections, 17 items
Variables {{vendor}}

Use this template Free, no credit card. Imports the checklist into your Runbook organization.

Use this checklist each time you add a new supplier to your accounting system, before the first invoice is paid. It covers the master data finance needs, the checks that prevent payment fraud, and the contract and data protection points that matter when the vendor will handle your data or your customers' data.

Who owns it

The person who wants to buy from the vendor requests the setup and provides the business case. Finance owns the run, creates the vendor record and verifies the bank details. If the vendor will process personal data or connect to your systems, the person responsible for security or data protection reviews that part.

Common pitfalls

Bank details taken from an email. Fraudsters impersonate new and existing suppliers. Verify bank details by phone with a contact you found independently, not one given in the same email.
Duplicate vendor records. Creating "ACME Ltd" next to "Acme Limited" splits the history and makes duplicate payments more likely. Search before creating.
No contract or terms on file. If there is a dispute, you need the agreed price, payment terms and notice period. Store the signed document with the vendor record.
Data protection as an afterthought. If the vendor processes personal data on your behalf, a data processing agreement is usually needed before they start, for example under GDPR.

Adapt this to your jurisdiction and your purchasing policy; it is a practical checklist, not legal advice.

The checklist: Set up vendor {{vendor}}

Request

Record who is requesting {{vendor}}, what will be bought and the expected annual spend
Confirm budget approval for the expected spend
Search the accounting system for an existing record for {{vendor}} under a similar name

Collect details

Collect the full legal name, registered address and company registration number
Collect the VAT or tax identification number and check it in the official register where available
For EU VAT numbers, the VIES service can confirm a number is valid.
Collect a billing contact, an accounts receivable email and the invoice delivery method
Collect bank details on the vendor's letterhead or through their supplier portal

Verify

Verify the bank details by phone using a number from the vendor's website or contract
Record who called, the date and the person who confirmed the details.
Confirm the bank account holder name matches the vendor's legal name
Check sanctions or restricted-party lists if you trade internationally optional

Contract and risk

Store the signed contract, order form or accepted terms with price, payment terms and notice period
Sign a data processing agreement if {{vendor}} processes personal data on your behalf optional
Review security information (e.g. SOC 2 report, ISO 27001 certificate or security questionnaire) if {{vendor}} will access your systems or customer data optional
Confirm required insurance certificates are received optional

Set up

Create the vendor record with payment terms, currency, default expense account and tax code
Second person reviews the vendor record and bank details before the first payment
Inform the requester that {{vendor}} is set up and how invoices should be sent

Checklist as Markdown

# Set up vendor {{vendor}}

## Request
- [ ] Record who is requesting {{vendor}}, what will be bought and the expected annual spend
- [ ] Confirm budget approval for the expected spend
- [ ] Search the accounting system for an existing record for {{vendor}} under a similar name

## Collect details
- [ ] Collect the full legal name, registered address and company registration number
- [ ] Collect the VAT or tax identification number and check it in the official register where available
  For EU VAT numbers, the VIES service can confirm a number is valid.
- [ ] Collect a billing contact, an accounts receivable email and the invoice delivery method
- [ ] Collect bank details on the vendor's letterhead or through their supplier portal

## Verify
- [ ] Verify the bank details by phone using a number from the vendor's website or contract
  Record who called, the date and the person who confirmed the details.
- [ ] Confirm the bank account holder name matches the vendor's legal name
- [ ] Check sanctions or restricted-party lists if you trade internationally (optional)

## Contract and risk
- [ ] Store the signed contract, order form or accepted terms with price, payment terms and notice period
- [ ] Sign a data processing agreement if {{vendor}} processes personal data on your behalf (optional)
- [ ] Review security information (e.g. SOC 2 report, ISO 27001 certificate or security questionnaire) if {{vendor}} will access your systems or customer data (optional)
- [ ] Confirm required insurance certificates are received (optional)

## Set up
- [ ] Create the vendor record with payment terms, currency, default expense account and tax code
- [ ] Second person reviews the vendor record and bank details before the first payment
- [ ] Inform the requester that {{vendor}} is set up and how invoices should be sent

Frequently asked questions

What information do you need from a new vendor?

Typically the legal name, registered address, company registration number, VAT or tax number, a billing contact, bank details and the agreed payment terms. Depending on the purchase, you may also need insurance certificates, a signed contract, a data processing agreement or security documentation.

How do I verify a supplier's bank details?

Call the supplier using a phone number you found independently, such as from their website or an existing contract, and confirm the account number and account holder name. Do not use contact details from the same email that sent the bank details. Record the verification and have a second person check it before the first payment.

Does every new vendor need a security review?

No. A security review matters when the vendor will access your systems, hold your data or process personal data on your behalf. A supplier of office furniture needs no such review; a cloud tool that stores customer data does. Mark those steps optional and complete them when they apply.

Updated 2026-11-04