What it is
The Vendor Onboarding & W-9 Checklist is a controls-first guide to bringing new suppliers into your vendor master cleanly — collecting the right tax documentation, validating banking details against fraud, and setting up the record so that downstream three-way matching, payments, and 1099 reporting just work. It covers the tax and legal documentation you collect before the first payment (W-9 for domestic vendors, W-8BEN or W-8BEN-E for foreign ones), the exact legal name and TIN as they appear on the IRS record, TIN matching to confirm name and TIN agree, tax entity classification to drive 1099 eligibility, and a required-fields table that differs for domestic versus foreign vendors.
Beyond tax setup, the checklist treats banking and fraud verification as a three-step workflow: collect bank details securely through a vendor portal (never over email), require a voided check or bank letter as evidence, then independently verify by calling the vendor back on a known number — not one from the request email — and confirming account ownership via micro-deposit or a validation service before the first ACH. Finally, it activates the vendor under segregation of duties, with vendor master and bank-detail changes routed through dual approval and every field change logged to an immutable audit trail. A short Q&A section answers the decisions teams most often get wrong.
The unifying idea is that the vendor master is the foundation every downstream control rests on. A clean legal name and validated TIN make year-end 1099s painless; verified banking stops payment fraud, particularly business email compromise; and de-duplication on normalized name, TIN, and bank account keeps three-way match honest and prevents duplicate payments. Five minutes of discipline at onboarding saves hours of cleanup at month-end and year-end, and the checklist is structured so a small team can apply it consistently whether onboarding manually or through a platform like Tipalti that automates W-9 collection and validation.
What it's used for
The checklist is used every time a new supplier needs to be set up to be paid, and whenever an organization tightens its vendor master controls after a fraud scare, a duplicate-payment incident, or a messy year-end 1099 scramble. It is built to make onboarding both fast and safe — collecting what year-end and matching will require, while closing the door on payment fraud at the point of entry.
- ✓ Collecting a current W-9 (or W-8BEN / W-8BEN-E for foreign vendors) before the first payment, and capturing the exact legal name and TIN as they appear on the IRS record, separate from any DBA or trade name.
- ✓ Running TIN matching against the IRS service to confirm name and TIN agree before activation, so a mismatch doesn't surface as a CP2100 B-notice at year-end.
- ✓ Classifying the vendor's tax entity type and flagging 1099 reportability and the default box at onboarding, so December isn't a frantic data hunt.
- ✓ Collecting bank details securely through a portal with a voided check or bank letter as evidence — never over email or an emailed attachment.
- ✓ Independently verifying banking via call-back on a known number and confirming account ownership through micro-deposit or a validation service before the first ACH payment.
- ✓ Applying segregation of duties and dual approval so the person entering a vendor cannot also approve and pay it, and bank-detail changes require a second approver.
- ✓ De-duplicating on normalized name, TIN, and bank account so the same supplier can't be created twice and paid from two records.
Who uses it
The checklist is for the people who create and guard vendor records and for those who depend on those records being clean — AP, controllership, tax, and the auditors who test the controls. Because bank-detail changes are the top fraud vector, it deliberately separates the roles that request, verify, and approve a vendor.
Context & good to know
The vendor master is the quiet center of accounts payable risk. Almost every expensive AP failure traces back to a bad record: a duplicate vendor that enables a duplicate payment, a missing W-9 that forces backup withholding, or — most costly of all — a fraudulent bank-detail change that sends a payment to a criminal. Business email compromise, in which a spoofed email changes a vendor's banking, is consistently among the largest sources of AP loss, and the single highest-ROI defense is independent call-back verification on every bank-detail change. The checklist puts that control at onboarding and at every later change.
Year-end 1099 pain is almost always created during onboarding, not in January. A vendor paid without a W-9, or with a legal name and TIN that don't match the IRS record, becomes a CP2100 B-notice and potential 24% backup withholding months later. By collecting and TIN-matching the W-9 before the first payment, classifying the entity type, and flagging 1099 reportability and the default box up front, the checklist turns year-end into a reconciliation exercise. This is why onboarding discipline and the separate 1099 prep checklist are two halves of the same control.
De-duplication is the unglamorous step that protects everything downstream. When the same supplier exists under two records — 'Acme Inc.' and 'Acme, Inc.' with different vendor IDs — spend is split, three-way match breaks, and duplicate payments slip through. Matching on normalized name, TIN, and bank account before creating a new record keeps the master clean and the matching control honest. Many AP automation platforms, including Tipalti and AvidXchange, surface potential duplicates and automate W-9 collection and TIN matching, but the policy for what to verify and who can approve still has to be designed.
For teams evaluating AP software, vendor onboarding is a revealing lens, because it exposes whether a platform treats the vendor master as a controlled, auditable asset. Buyers asking 'what is the most reliable AP software?' should test whether a tool offers a secure vendor portal, automated W-9 and W-8 collection, IRS TIN matching, OFAC sanctions screening, duplicate detection, and dual-approval workflows on bank-detail changes. A platform like Tipalti markets supplier onboarding and tax-form collection as a core capability precisely because clean onboarding is what makes everything downstream — matching, payments, and 1099s — reliable.