New Vendor Onboarding Checklist

Match the legal name exactly to the secretary-of-state filing — checks issued to a DBA that doesn't match the registered entity get returned. Capture every DBA the vendor invoices under so AP doesn't open duplicate records later.

Get the W-9 before the first payment, not at year-end — chasing W-9s in January is the most common 1099 prep blocker. Confirm the TIN, entity classification, and exempt-payee status are completed; an unsigned or partially-completed W-9 doesn't satisfy IRS Pub 1281 backup-withholding rules.

Read the entity classification on line 3 of the W-9. Sole proprietors, single-member LLCs, partnerships, and most LLCs taxed as partnerships are 1099-eligible. C-Corps and S-Corps are exempt — except for legal and medical services payments, which are reportable regardless of entity type. Flag the answer here so the GL setup later picks it up.

Run the legal name and any beneficial owners through the OFAC SDN list and SAM.gov exclusions. Save the screenshot or report to the vendor folder — Treasury enforcement requires evidence of the check, not just the result.

Submit the name and TIN through the IRS e-Services TIN Matching program. A mismatch returned at year-end triggers CP2100 notices and 24% backup withholding obligations on prior payments — far cheaper to catch the typo now.

Tier based on annual spend, data access, and criticality. High = >$100K/yr, accesses client PII, or sole-source. Medium = $25K–$100K or moderate access. Low = under $25K and no sensitive access. Tier drives whether enhanced due diligence is required.

Look at PAYDEX, years in business, suits and liens, and any UCC filings. A vendor with a deteriorating PAYDEX or recent UCC filings is a going-concern risk that affects payment-term negotiations.

Request a current ACORD 25 with general liability, workers' comp (if they have employees), and professional liability where applicable. Check the expiration date — set a 30-day pre-expiration reminder so coverage doesn't lapse mid-engagement.

Read the certificate holder block and the additional-insured endorsement (CG 20 10 or CG 20 26). A COI without an endorsement only names the firm for notification purposes — it doesn't actually extend coverage. Reject and re-request if the endorsement is missing.

Set the legal name, DBA, remit-to, default GL account, and approval routing. Sync to QuickBooks Online once the record is clean — fixing a duplicate vendor in QBO after bills have posted is a multi-step reclass.

Default to Net 30 unless the contract specifies otherwise. Capture any 2/10 Net 30 discount terms in the vendor record so AP can take the discount automatically. Note any deposit or progress-billing terms separately.

Never accept banking details by email — that's the most common BEC attack vector against AP. Require the vendor to enter routing and account through Bill.com's verified channel and confirm the micro-deposit amounts. Phone-verify any change request to existing banking on file.

Send the activation note to AP, purchasing, and the requesting department lead with the vendor ID, payment terms, approved spend categories, and any PO requirements. Without this hand-off, the first invoice tends to arrive before AP knows the vendor exists.

Send the vendor the onboarding packet: invoice formatting requirements, PO reference policy, AP contact, payment schedule, and the WISP-aligned data-handling expectations if they touch client data. Sets the bar for clean invoices from invoice one.