Vendor Onboarding Checklist for AP Teams: W-9 & COI

Vendor onboarding is the process of formally approving a new supplier or contractor before your company pays them for the first time. Done well, it is a compliance checkpoint that protects your organization from fraud, tax penalties, and regulatory risk. Done poorly — or skipped entirely — it is one of the most common entry points for vendor fraud, IRS penalties, and audit findings.

This guide covers everything an accounts payable team needs to include in a vendor onboarding checklist, why each step matters, and how to build a process that scales as your vendor count grows.

Why Vendor Onboarding Matters for AP Teams

Most AP teams think of vendor onboarding as a procurement function — something that happens before an invoice arrives. But from a compliance perspective, the onboarding process is where the most important controls live.

The three biggest risks that proper vendor onboarding prevents are:

Tax compliance risk. If you pay a vendor without a W-9 on file and they later turn out to have an incorrect or missing TIN, the IRS can require you to apply 24% backup withholding retroactively and assess penalties of up to $340 per incorrect information return. Collecting a W-9 before the first payment substantially reduces this risk.

Fraud risk. Business email compromise (BEC) fraud — where an attacker impersonates a vendor and redirects payments to a fraudulent bank account — almost always succeeds because the target company had no formal onboarding process. If you verify bank account details and collect a W-9 before the first payment, you establish a baseline that makes fraudulent bank account changes detectable.

Regulatory and insurance risk. Many cyber insurance policies, SOC 2 audits, and internal audit frameworks require documented vendor approval workflows. "We checked the invoice and paid it" is not a documented process. A formal onboarding checklist with sign-off records is.

The Complete Vendor Onboarding Checklist

Step 1: Collect the W-9 (or W-8 for Foreign Vendors)

A completed Form W-9 is the foundation of vendor compliance. It provides the vendor's legal name, business name (if different), federal tax classification, and Taxpayer Identification Number (TIN) — either an EIN for businesses or an SSN for sole proprietors and individuals.

What to collect:

Why it matters: Without a W-9, you cannot file a 1099-NEC or 1099-MISC at year-end. If the IRS discovers you made payments without collecting a TIN, you may be required to apply 24% backup withholding on all past and future payments to that vendor. The penalty for each missing or incorrect information return is up to $340.

Best practice: Make W-9 collection a hard gate in your onboarding workflow — no vendor record is created in your AP system until a signed W-9 is on file. Use a vendor self-service portal to collect the form digitally so there is a timestamped record of receipt.

| Vendor Type | Required Form | Notes | |---|---|---| | U.S. business (LLC, Corp, Partnership) | W-9 | EIN required | | U.S. sole proprietor / individual | W-9 | SSN or EIN | | Foreign individual | W-8BEN | Withholding may apply | | Foreign entity | W-8BEN-E | Withholding may apply | | U.S. exempt payee (Corp, government) | W-9 | Still collect — confirms exemption |

Step 2: Verify the TIN Against IRS Records

Collecting a W-9 is not the same as verifying it. A vendor can submit a W-9 with an incorrect TIN — either accidentally (common with sole proprietors who mix up their SSN and EIN) or deliberately (rare, but it happens in fraud scenarios).

The IRS TIN Matching program allows authorized payers to verify that a name/TIN combination matches IRS records before filing a 1099. Third-party services like TINCheck and Compliancely offer real-time API-based TIN matching that can be integrated into your onboarding workflow.

Why it matters: If you file a 1099 with an incorrect TIN, the IRS sends a CP2100 notice (a "B-Notice") requiring you to begin backup withholding on that vendor's payments. The first B-Notice gives you 15 business days to obtain a corrected W-9. The second B-Notice requires you to begin withholding immediately. Catching TIN mismatches at onboarding avoids this entire cycle.

Step 3: Collect a Certificate of Insurance (COI) for Service Vendors

Any vendor who performs services at your location, handles your data, or creates liability exposure should provide a current Certificate of Insurance before work begins. This is separate from the W-9 and is a risk management requirement, not a tax requirement.

What to collect:

What to verify on the COI:

Best practice: Set a calendar reminder 30 days before each COI expires and require the vendor to provide a renewed certificate before the expiration date. An expired COI is as risky as no COI — your company has no coverage for incidents that occur after the policy lapses.

Step 4: Verify the Vendor's Bank Account Details

Bank account verification is the single most important fraud prevention control in vendor onboarding. Business email compromise (BEC) attacks specifically target the moment when a new vendor provides their bank account details — because that is when AP teams are most likely to accept new information without question.

What to do:

What not to do:

For high-value vendors: Consider requiring a voided check or bank letter on official letterhead in addition to the verbal callback.

Step 5: Screen Against OFAC and Sanctions Lists

Before adding any vendor to your AP system, screen their legal name and any known aliases against the U.S. Treasury's Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list and other applicable sanctions databases.

Paying a sanctioned entity — even unknowingly — can result in civil penalties of up to $1 million per transaction and criminal penalties including imprisonment. The "we didn't know" defense has limited value with OFAC; the standard is strict liability for most violations.

What to screen:

How often: Screen at onboarding and re-screen periodically (at least annually) — the SDN list is updated frequently, and a vendor who was clean at onboarding may appear on the list later.

Step 6: Obtain a Formal Approval Sign-Off

Every new vendor should be approved by someone other than the person who initiated the onboarding request. This is the foundational segregation of duties control for vendor onboarding.

Minimum approval requirements:

Document the approval: The approval should be recorded with the approver's name, the date, and any conditions or notes. An email chain is not a documented approval — use a system that creates an immutable record.

Why this matters for audits: When an auditor or cyber insurer asks "how do you know this vendor is legitimate?", the answer should be "here is the approval record, the W-9, the COI, and the OFAC screen result." If the answer is "we checked the invoice and it looked right," you have a control gap.

Step 7: Create the Vendor Record in Your AP System

Only after Steps 1–6 are complete should the vendor be added to your AP system (BILL, QuickBooks, or your ERP). This sequencing is critical — adding the vendor to the payment system is the point of no return. Once a vendor is in the system, payments can be initiated.

What to record:

Step 8: Set Up Ongoing Monitoring

Onboarding is not a one-time event. The compliance controls that matter most are the ones that run continuously after the vendor is in your system.

What to monitor after onboarding:

Common Vendor Onboarding Mistakes

Collecting W-9s reactively. Many AP teams only request a W-9 when they realize they need to file a 1099 in January — after paying the vendor all year. At that point, the vendor may be unresponsive, the information may be incorrect, and you are already at risk for backup withholding. Collect the W-9 before the first payment, every time.

Treating the W-9 as the only compliance step. A W-9 is a vendor’s certification of their tax identity. TIN matching provides additional verification. It does not verify bank account details, screen for sanctions, or establish that the vendor is a legitimate business. All of the steps in this checklist serve different purposes — none of them is a substitute for the others.

Skipping the COI for "small" vendors. A vendor who causes a slip-and-fall at your office or a data breach in your systems can generate liability far exceeding their invoice value. The size of the vendor's invoice is not a reliable proxy for the size of the risk they create.

No documented approval. "I know this vendor, we've worked with them for years" is not a documented approval. It is also exactly what an insider fraud scheme relies on — the assumption that familiarity substitutes for controls.

Not monitoring after onboarding. The most common form of vendor fraud — BEC bank account takeover — happens after onboarding, when a vendor's bank account is changed. A one-time onboarding process with no ongoing monitoring leaves the most dangerous window unguarded.

Building a Scalable Vendor Onboarding Process

For teams with fewer than 50 vendors, a manual checklist with email-based document collection may be workable. But as vendor count grows, manual processes break down in predictable ways: documents get lost, W-9s expire without anyone noticing, OFAC screens are skipped under time pressure, and approval records exist only in email threads that are impossible to audit.

A scalable vendor onboarding process requires:

A centralized document repository where W-9s, COIs, and approval records are stored and searchable — not in email inboxes or shared drives.

Automated expiry tracking that sends reminders before W-9s and COIs expire, so you are never caught with a lapsed document at year-end.

Integration with your payment platform so that vendors without a completed onboarding record cannot be paid — the compliance check is enforced at the system level, not by individual AP staff remembering to check.

An immutable audit trail that records every action taken on every vendor record, so you can demonstrate your controls to auditors, insurers, and regulators without reconstructing events from memory.

Vendor Onboarding Checklist Summary

Use this checklist for every new vendor before the first payment is released:

| Step | Action | Required For | |---|---|---| | 1 | Collect signed W-9 (or W-8 for foreign vendors) | All vendors | | 2 | Verify TIN against IRS records | All vendors | | 3 | Collect current Certificate of Insurance | Service vendors, vendors with site access or data access | | 4 | Verify bank account via independent callback | All vendors paid via ACH | | 5 | Screen against OFAC SDN list | All vendors | | 6 | Obtain formal approval sign-off | All vendors | | 7 | Create vendor record in AP system | All vendors | | 8 | Set up ongoing monitoring (bank changes, document expiry, re-screening) | All vendors |

Frequently Asked Questions

Do I need a W-9 from every vendor?

You are required to file a 1099-NEC for any unincorporated vendor (sole proprietor, LLC, partnership) to whom you pay $2,000 or more in a calendar year for services (the threshold increased from $600 to $2,000 for tax year 2026). You need a W-9 to file the 1099 correctly. In practice, it is simpler to collect a W-9 from every vendor at onboarding — including corporations — rather than trying to determine at payment time whether the threshold will be met. Corporations are generally exempt from 1099 reporting, but you still need their EIN for your records.

How long should I keep vendor W-9s?

The IRS recommends retaining W-9s for at least four years after the date of the last payment to the vendor. If the vendor relationship is ongoing, retain the most recent W-9 indefinitely and request a new one if any information changes (name, address, TIN, or tax classification).

What is backup withholding and when does it apply?

Backup withholding is a 24% withholding requirement that applies when a vendor fails to provide a TIN, provides an incorrect TIN, or the IRS notifies you that the TIN is incorrect. You must withhold 24% of each payment and remit it to the IRS. Collecting a valid W-9 before the first payment — and verifying the TIN — is the only way to avoid backup withholding.

How do I handle vendors who refuse to provide a W-9?

If a vendor refuses to provide a W-9, you are required to apply backup withholding (24%) to all payments. In practice, most vendors will provide a W-9 when they understand that refusal results in 24% of their payment being withheld. If a vendor continues to refuse, that is a significant red flag — legitimate businesses have no reason to withhold their tax information.

What is the difference between a vendor onboarding checklist and a vendor approval workflow?

A vendor onboarding checklist is the list of documents and verifications required before a vendor is approved. A vendor approval workflow is the process by which those documents are collected, reviewed, and signed off. The checklist defines what is required; the workflow defines who does it, in what order, and how it is documented. Both are necessary — a checklist without a workflow is just a list of things you intend to do.

Summary

A complete vendor onboarding checklist is not bureaucracy — it is the minimum set of controls that protects your organization from fraud, tax penalties, and audit findings. The eight steps in this guide — W-9 collection, TIN verification, COI collection, bank account verification, OFAC screening, approval sign-off, AP system entry, and ongoing monitoring — address the most common and most costly risks in the vendor management lifecycle.

The AP teams that get this right are not the ones with the most sophisticated technology. They are the ones that treat onboarding as a compliance checkpoint, not a paperwork exercise, and that enforce the process consistently for every vendor, every time.

ApprovedAP helps teams using BILL and QuickBooks Online track W-9 and COI status, monitor for vendor record changes, run OFAC screens, and maintain a compliance audit trail. Bank-change monitoring via the BILL integration is available to early-access users; contact us for access. "