What is supplier onboarding?

What does supplier onboarding mean?

Supplier onboarding is the process of collecting a new supplier’s legal, tax, bank and compliance data, checking it, approving the supplier and creating one record for it in the buyer’s systems. When onboarding is complete, the supplier can be invited to tenders, receive purchase orders and be paid on verified bank details.

Onboarding happens at two moments. At registration, often before any tender, the supplier gives its identity, tax number, addresses, contacts and the categories it supplies, and the buyer checks them. Once the supplier wins business, the same record is enabled for ordering: onboarding adds the vendor account, payment terms, verified bank details and the ordering channel. The supplier management pillar shows where these two moments sit in the supplier lifecycle.

A simple case shows the scope. The maintenance team wants to use a new local electrician. Before the first order, procurement asks the electrician to fill in a form, checks the company in the official register, screens it against sanctions lists, confirms the bank account by phone, checks its liability insurance and creates the supplier in the ERP. The first purchase order can then go out, and the first invoice can be paid to a verified account.

Vendor onboarding means the same thing: finance and IT teams tend to say “vendor”, procurement teams “supplier”. Keeping the record right afterwards, when the address, bank account or owner changes, is supplier master data management, which a dedicated guide will cover.

Why does supplier onboarding matter?

Supplier onboarding matters because many supplier data problems and payment frauds start with a record created without checks. Four problems come back when onboarding is weak.

• Payment fraud. A criminal pretends to be a supplier and sends new bank details. The FBI’s Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025, with reported losses of about $3.05 billion; this fraud targets businesses that pay suppliers by wire transfer. A bank account checked at onboarding, and every later change checked the same way, closes the easiest way in.
• Duplicate suppliers. The same company is created three times under slightly different names. The same invoice can be paid twice, and nobody sees how much is spent with that company.
• Compliance gaps. A supplier owned by a sanctioned person receives an order. The US Treasury’s sanctions compliance framework says the risk assessment should guide how much due diligence is done at points such as onboarding, and it names the supply chain among the areas to assess.
• Slow purchases. A requester waits weeks for a new supplier, then buys elsewhere or pays with a personal card. Slow onboarding pushes spend outside the process.

The benefits of supplier onboarding done well are the reverse: one clean record per supplier, payments only to verified accounts, a recorded check for each rule, and a new supplier ready in days rather than weeks.

What are the steps of the supplier onboarding process?

The supplier onboarding process runs in ten steps, from the internal request to the first order. Small organisations combine some of them and tools name them differently, but the order of this new supplier onboarding process flow stays the same.

1. Request. A requester or buyer asks for a new supplier through one channel, with the reason, the category and the expected spend. “We have always used them” is not a reason on its own; a need no current supplier covers, or a tender result, is.
2. Duplicate check. Procurement searches the supplier master by tax number, company number and bank account, not only by name. If the supplier exists, the request stops here and the existing record is used.
3. Invitation. The supplier receives a link to a registration form or a supplier portal, in its language, with the list of documents to provide.
4. Data and documents. The supplier enters its legal name, registration and tax numbers, addresses, contacts, bank details and the documents its type requires, such as insurance or certificates.
5. Validation. The buyer checks the data against official sources: company register, tax number check, sanctions screening and an independent confirmation of the bank account.
6. Risk assessment. A short questionnaire rates the supplier’s risk from what it will do: access to systems or personal data, critical service, amount of spend, country. Higher tiers get deeper checks before approval.
7. Approval. A person who did not enter the data approves the supplier. Bank details are approved separately, by finance.
8. Record creation. The approved supplier is created once in the ERP or procurement system, with its vendor account, payment terms and the categories it may supply.
9. Enablement for ordering. The ordering channel is set up: email or portal purchase orders, EDI, a catalogue or a punchout connection, and the e-invoicing route.
10. Close and confirm. The requester is told the supplier is ready; the supplier is told how to receive orders and how to send invoices. The first order and the first invoice are watched for errors.

If a step is skipped because the need is urgent, the record should show it, and the check must be done before the first payment.

What information does a supplier onboarding form collect?

A supplier onboarding form collects the data needed to identify, check, order from and pay the supplier, and nothing more. The table lists the usual fields, why each one is needed and the check that confirms it.

Many suppliers still send a scanned form or a PDF bank letter. Supplier onboarding form processing tools read these documents with optical character recognition (OCR) and copy the fields into the record. The extracted data still goes through the same checks: a bank account read correctly from a fake letter is still a fake account.

Which onboarding checks apply in different countries?

The same controls apply everywhere, but each country has its own official tools to run them. The table gives examples from the United States, the European Union and the United Kingdom; it is a starting point, not a complete legal list.

Bank details deserve the strictest check, because a wrong account loses money at once. Where no name-check service such as the UK’s Confirmation of Payee exists, call the supplier on a phone number already on file or found independently, never on the number in the email that sent the bank details.

How does supplier onboarding handle risk?

Supplier onboarding handles risk by rating each new supplier before approval and setting the depth of checks by that rating. A supplier onboarding risk assessment is usually a short questionnaire filled in by the requester: will the supplier access our systems or personal data, would its failure stop a critical service, how much will we spend, where is it based?

A low-risk supplier, such as a local florist, gets identity, tax, sanctions and bank checks. A supplier that will host customer data also needs a security assessment and data processing terms, because the GDPR allows an organisation to use only processors that give sufficient guarantees. The 2023 US interagency guidance for banks makes the same point for every third party: the scope of due diligence should match the level of risk and complexity.

Onboarding is the first moment of risk work, not all of it. How to tier suppliers, what due diligence covers, which contract clauses to add and how to monitor suppliers after approval is explained in the vendor risk management guide.

What is supplier self-onboarding?

Supplier self-onboarding means the supplier enters and updates its own data through a portal, instead of sending a form for procurement to type in. The buyer’s team checks and approves; it no longer keys data.

Self-onboarding speeds up supplier onboarding and cuts typing errors, because the supplier knows its own data best. It also moves work to the supplier, so the portal must be simple: a supplier asked to upload twelve documents for a one-off order of €500 will give up or call the buyer. Ask less of low-risk suppliers.

Self-service does not remove the controls. A bank account entered by the supplier in the portal still needs independent confirmation and finance approval, because an attacker who takes over a supplier’s portal account can change it too. A dedicated guide to supplier portals is in preparation.

What does EDI and catalogue onboarding involve?

For suppliers that trade often or in volume, onboarding also connects the buyer’s and the supplier’s systems, so that orders and invoices travel electronically.

EDI supplier onboarding

Electronic data interchange (EDI) sends business documents between systems in a standard format. In the X12 standard used mostly in North America, a purchase order is transaction set 850, the order acknowledgement 855, the ship notice 856 and the invoice 810. Onboarding a supplier to EDI means choosing the connection (direct or through a network provider), agreeing which documents and fields are used, testing sample documents and then going live.

Catalogue onboarding

The supplier’s products and contract prices are loaded so requesters can order from a list. Either the supplier sends a price file that the buyer loads, or the buyer connects to the supplier’s web shop through punchout. cXML, a protocol for business documents between buyers and suppliers, covers purchase orders, invoices and punchout.

E-invoicing route

The supplier sends invoices through the buyer’s portal, a network or a national e-invoicing system, instead of by email. Where e-invoicing is mandatory, this step is not optional.

EDI supplier onboarding programmes usually start with the suppliers that send the most invoices. A typical test case: the supplier receives a test purchase order with three lines, sends back an acknowledgement and an invoice for two of them, and the buyer checks that its system matches both against the order. Only then does the supplier go live.

How do you automate supplier onboarding?

You automate supplier onboarding by turning the steps into a workflow with rules: the system sends each task to the right person, runs the routine checks and leaves people to decide the exceptions. Supplier onboarding automation usually covers:

• One request form that starts the workflow and checks for duplicates before anything else happens.
• The right form and document list chosen from the supplier type and country.
• Automatic reminders to suppliers that have not finished, and to approvers that have not decided.
• Checks run through online services where available: company register, tax number, sanctions screening.
• Reading of uploaded documents with OCR, with expiry dates recorded and renewal reminders set.
• Creation of the approved record in the ERP through an integration, instead of retyping.

Keep people on the decisions that carry risk: approving a supplier that failed a check, approving bank details and approving high-risk suppliers. GAO’s internal control standards describe segregation of duties as separating authority, custody and accounting so that no one person controls every key step of a transaction; an automated workflow should enforce that separation, not bypass it.

Onboarding workflows come in ERPs, in source-to-pay suites and in specialist tools. How to compare suites is explained in the supplier management software guide; a guide to choosing supplier onboarding software is in preparation.

What are supplier onboarding best practices?

Supplier onboarding best practices aim at two goals at once: a fast, simple experience for the supplier and the requester, and strict control of the few things that can cost money or break a rule.

• One way in. All new supplier requests go through one form or one tool. A supplier created directly in the ERP by someone in a hurry is the most common source of duplicates and unchecked bank details.
• Ask why before asking who. Check that no existing supplier or contract covers the need before inviting a new supplier. Fewer new suppliers means less onboarding work.
• Forms by supplier type. A one-off service supplier, a software provider and a raw material supplier need different data. Ask each only what its checks need.
• Keep the few strict controls. Confirm every new or changed bank account through a channel the supplier did not choose, have finance approve it, and never let the person who requests or enters a supplier approve it.
• Set a time target and publish it. Tell requesters how long onboarding takes for each supplier type, and track it. A known delay is easier to plan around than an unknown one.
• Record every check. Keep the result and date of each check in the supplier record, so an auditor, or the next buyer, can see what was verified.
• Plan the exit at the start. Record the end date of certificates and contracts, so the supplier can be blocked for new orders when they lapse.

Best practices for automating supplier onboarding follow the same order: fix the process and the forms first, then automate. Automating a process with ten optional fields and no owner for bank changes only makes mistakes faster.

How do you measure supplier onboarding?

You measure supplier onboarding with a few indicators that show speed, data quality and control. No public benchmark compares organisations on the same definitions, so track the trend in your own data rather than a target copied from elsewhere.

What goes on a supplier onboarding checklist?

A supplier onboarding checklist lists what must be true before a supplier is enabled for ordering. Use it as a template and adapt the lines to your supplier types and countries.

• The request states the need, the category and the expected spend, and no existing supplier covers it.
• The legal entity is found in the official register, and the name on the record matches it.
• The tax number has been checked with the tax authority’s service, where one exists.
• The supplier and its owners have been screened against the sanctions lists that apply.
• The bank account has been confirmed through an independent channel and approved by finance.
• The risk questionnaire is complete, and the checks its tier requires are done.
• Required insurance and certificates are on file, with their expiry dates recorded.
• Data processing terms are signed if the supplier will handle personal data.
• A second person has approved the supplier.
• The ordering channel and invoicing route are set up and tested.