Vendor Setup and Maintenance Checklist

Use the legal name on the W-9 line 1, not the DBA. Mismatches between the AP master and the TIN of record are the top reason 1099-NECs get rejected by the IRS in the January B-Notice cycle.

Capture the AR contact name, email, and phone separately from the sales rep. The AR contact is who you call about a missing invoice or a misapplied payment; the sales rep usually cannot help.

Request the current-revision W-9 (most recent IRS revision date). Do not accept a typed or photo-copied signature without a date — unsigned W-9s do not satisfy the solicitation requirement and leave you exposed to backup withholding penalties.

W-8BEN for individuals; W-8BEN-E for entities. If the vendor claims a treaty rate, confirm the treaty article and that a foreign TIN is provided. Without a valid W-8, default 30% withholding applies to US-source income.

Use the IRS e-Services TIN Matching program or your AP platform's built-in match (Bill.com, Ramp, Avalara 1099). A mismatched name/TIN combination triggers a CP2100 B-Notice and 24% backup withholding on subsequent payments.

Apply the standard test: payments for services to a non-corporate vendor at $600+ annually are 1099-NEC reportable. Carve-outs: legal fees to attorneys are reportable regardless of entity (1099-NEC box 1); medical and healthcare payments to corporations are reportable (1099-MISC box 6); payments for goods are not reportable.

ACH is preferred for domestic recurring vendors; wire for high-value or international; check only when the vendor cannot accept electronic. Avoid Zelle and Venmo for B2B — they bypass AP controls and complicate 1099-K reconciliation.

Collect routing number, account number, and account type (checking/savings) on the vendor's letterhead or a voided check — never just an email body. Wire instructions need the SWIFT/BIC and intermediary bank if applicable.

Call the vendor at a phone number from your existing records — not the number on the new banking form. Business email compromise (BEC) wire fraud almost always uses a spoofed change-of-banking email; the callback control catches it. Document the name spoken to, date, and time.

Required for vendors performing on-site work, professional services with E&O exposure, or anything contractually obligated. Verify general liability limits, additional-insured endorsement naming your entity, and the policy expiration — set a calendar reminder 30 days before lapse.

Run the legal entity name and any beneficial owners against the OFAC Specially Designated Nationals list and the SAM.gov debarment list. A hit blocks payment entirely; document the screening date and screenshot.

Populate all required fields in QuickBooks, Xero, Sage Intacct, or NetSuite: legal name, DBA, TIN, address, terms, default expense account, 1099 flag, payment method. Attach the W-9 and COI to the vendor record so they travel with the file under future audit.

Pick the GL account that matches the goods or services this vendor provides — not a generic suspense account. Add class, location, or department dimensions where the COA uses them so the default coding doesn't dump every bill into the wrong P&L bucket.

Set approval thresholds in Bill.com, Ramp, or Stampli — typically dual approval above $5K, controller approval above $25K, CFO above $100K. Assign the budget owner as first approver based on the default expense account.

The IRS treats a W-9 as valid until circumstances change, but a three-year refresh cycle catches entity-type changes (LLC to S-corp election, sole prop to LLC) that would otherwise silently misclassify 1099 reporting.

Pull a COI expiration report monthly. Request the renewal certificate 30 days before lapse. A vendor working on-site without active coverage exposes the firm to vicarious liability if something happens.