Supplier onboarding checklist: what to collect before the first PO

In short

Collect and verify a new supplier's legal, bank, insurance, pricing and delivery details before you raise the first purchase order. Confirm bank details by calling a number you found independently, and keep the supplier on hold until a second person approves.

Before you place a first order with a new supplier, get and check six things: who they legally are, where they want to be paid, what insurance they hold, what they will charge, when and where they will deliver, and who in your business has approved all of it. Collect these before the first purchase order goes out, not after the first invoice arrives. A supplier you have never verified can send an invoice with the wrong entity name, a bank account you cannot confirm, or a price nobody agreed. At that point you are checking under pressure, with a due date running. This checklist shows what to collect, how to verify it, and who should sign it off.

Why the first purchase order is the right deadline

Most small and mid-sized businesses onboard a supplier the way they find one: a quote arrives, the price looks fair, and an order goes out. The paperwork follows later, usually when accounts payable asks for bank details to pay the first invoice. By then the goods may already be late, the price may already differ from the quote, and the person asking for bank details is under pressure to pay.

That sequence is exactly what payment fraudsters rely on. In invoice redirection fraud, criminals impersonate a supplier or take over a real supplier mailbox and substitute their own bank account. Bitdefender's November 2026 guidance on vendor bank detail verification notes that a familiar email thread and a convincing invoice do not authenticate new bank details. If you recorded verified details before the first order, a changed account becomes an obvious exception instead of a routine request.

The same logic applies to mismatched invoices and late deliveries. Agree the price list, payment terms and lead time first, and the invoice has something to be matched against. Wise's supplier onboarding checklist for UK businesses describes onboarding as assessing, approving and integrating a supplier before the first approved purchase or payment. That is the standard to aim for, scaled to the size of the supplier.

Match the depth of checking to the risk

A one-off stationery order does not need the same scrutiny as a supplier who will make your best-selling product or hold your customers' artwork. Tier each new supplier before you start. A simple three-level approach works for most small businesses:

• Low: low spend, easily replaced, no customer impact. Collect identity, bank and contact details only.
• Medium: regular spend or a supplier your customers will notice. Add insurance, pricing and delivery terms.
• High: single-source, high-value, or handling your customers' data or on-site work. Add certifications, references and a written agreement.

Record the tier and the reason on the supplier record. Wise's checklist recommends recording the risk tier, the rationale, the due-diligence outcome and a review date, which is a sensible habit even for a five-person business.

1. Legal identity

Confirm the legal entity name, any trading name, the registered address and the company registration number or local equivalent. Check them against the public company register in the supplier's country, such as Companies House in the UK. The aim is to make sure the name on the invoice, the contract and the bank account all belong to the same legal entity. Record the tax or VAT registration number too, and check it on the relevant tax authority's validation service where one exists. Ask who is authorised to agree terms for the supplier, because the salesperson you met may not be.

2. Bank and payment details

Collect the account holder name, bank, account number or IBAN, sort code or SWIFT/BIC, payment currency and remittance contact. Get them on the supplier's own letterhead or through a secure form, not only in an email body. Then verify them by phone, using a number you found independently, such as the supplier's website or a signed contract. Ask the contact to confirm the account holder name, bank and last four digits. Log who you spoke to, when, and the result.

This is the check that stops payment fraud, so do it once, properly, at onboarding. Bitdefender's template adds a useful rule: a matching payee name alone does not mean the details are legitimate, and if you cannot reach the trusted contact, leave the change unapproved. Keep full account numbers in an access-controlled system rather than a shared spreadsheet. That is where role-based permissions and security matter: the person who creates or edits a supplier's bank details should not be the person who releases payments.

3. Insurance and compliance documents

Ask for current certificates for the cover that matches the work: public liability for anyone attending your site or your customers' premises, product liability for goods you resell, and professional indemnity if they advise or design. Record the insurer, the limit of cover and the expiry date, and diary a reminder before it lapses. Collect any certifications your customers expect, such as quality, health and safety, or environmental accreditations, and screen against sanctions or restricted-party lists where your market requires it. For a low-risk supplier, note that you waived these and why. A recorded decision is better than a silent gap.

4. Pricing and commercial terms

Get the price list, catalog or written quote in a form you can attach to your records. Confirm the currency, the payment terms, minimum order quantities, setup or tooling charges, and how long the prices are valid. Agree what happens on price changes: notice period, and whether you will be told before an order or only on the invoice. Capture return and fault terms in writing.

This step is what makes invoice checking possible later. If the price list is on file and the first purchase order is raised against it, a supplier invoice that arrives higher than the agreed price is flagged on receipt instead of disputed three weeks later.

5. Delivery and operational details

Record the lead time for standard and rush orders, the dispatch location, the carrier they use, and who your day-to-day contact is when something is late. Ask for a named operations contact separate from the sales contact, and a named accounts contact for invoices and remittances. Confirm the delivery address format they will print on documents, and whether they send dispatch notices or tracking. Late deliveries are rarely a surprise to the supplier. They are a surprise to you because you had no one to ask. A first order is also a cheap test: set a delivery date on the purchase order and note whether it was met.

6. Internal approval and set-up

Finally, record who asked for the supplier, who approved the spend and who checked the payment details. Separating these roles is the simplest fraud control a small business has. If your team uses an approvals step, make supplier activation one of the things that needs a second person's sign-off, and keep the new supplier on hold until the checklist is complete. Create the supplier record with the verified legal name, tax number, contacts, payment terms and currency, and only then allow purchase orders to be raised against it.

Keep the record alive

Onboarding is not a one-time event. Set a review date, diary insurance and certification expiry, and agree that any change of bank details goes through the same callback check as the original. Trigger a re-check when spend rises sharply, when the supplier changes ownership, or after repeated late deliveries. A short log of these events is enough.

Pitfalls to avoid

• Accepting bank details by email alone, especially from an address that has just changed.
• Letting one person create the supplier, raise the order and approve payment.
• Skipping checks because the supplier was recommended by a friend or a customer.
• Collecting documents but never recording expiry dates.
• Treating onboarding as finished after the first payment, with no review date.

A supplier who is verified before the first order costs you an hour of administration. A supplier who is verified after the first invoice can cost you the payment itself.

Sources

• Supplier Onboarding Checklist for UK Businesses (Updated for 2026)Wise · accessed 2026-11-07
• Vendor bank detail verification template and BEC response kitBitdefender · accessed 2026-11-07