Supplier onboarding: what to collect before the first order

Supplier onboarding is the process of collecting what you need from a new supplier before you start trading with them: legal identity, banking details, tax status, insurance where relevant, contacts, and agreed terms. Vendor onboarding is the same thing under a different name, and the difference between doing it properly and doing it in an email thread shows up months later.

The case for the paperwork is specific rather than procedural. Each item on the list prevents a failure that small businesses actually experience: paying a fraudulent bank account, being unable to claim against a supplier because nothing was signed, or discovering during a job that a certificate expired in March.

What to collect

• Legal entity name and registration number, which is often not the trading name on their invoices. Match them once, at the start.
• Bank details, verified by a phone call to a number you already have — never from the email that supplied them. This single step blocks the most common invoice fraud, discussed in phishing awareness.
• Tax registration status, which determines how their invoices should look and what you can reclaim.
• Contacts by function: who to call about an order, an invoice, and a problem. The last one matters most and is asked for least.
• Agreed terms: prices, payment days, delivery, what happens with defects. Even a short written exchange beats an assumption.
• Insurance and certifications where the work requires them, with expiry dates recorded rather than filed.
• For significant suppliers, a basic check that they exist and have traded for a while — the ground covered in third party risk management.

Verify bank details out of band, always. An email saying our bank has changed, arriving from a real supplier's compromised mailbox, is the single most effective attack on small businesses, and it works because the request is plausible and the timing is right. A thirty-second call to a number you already had is the entire defence, and it has to be a rule rather than a judgement call — because in the moment it always feels unnecessary.

Keeping it proportionate

1. Tier the effort. A supplier you will spend heavily with needs the full list; one you buy stationery from once needs a name, bank details and terms.
2. Collect through a form rather than an email thread, so the same fields arrive every time and nothing is missing at payment.
3. Record expiry dates for insurance and certificates with a review date attached — an expired certificate discovered on site is a job stopped.
4. Set the payment terms at onboarding rather than negotiating them on the first invoice.
5. Review the register annually and remove suppliers you no longer use. Dormant supplier records with live bank details are a risk with no upside.

Where it lives

Ettex Records holds the supplier register with the fields, expiry dates and owners, and the intake form itself runs through Ettex Forms so the same information arrives each time. The ongoing relationship is covered in vendor management, and the payment side, where the bank details matter, in accounts payable.

To be direct: there is no supplier portal where vendors maintain their own details, no automated credit checking, no sanctions screening and no integration with company registries. Those exist as products for organisations with hundreds of suppliers; below that the form and the register do the job.