Supplier onboarding that reads every paper and verifies every bank change before a payment leaves
New suppliers set up in days, every bank change verified before payment.
See one case, screen by screen ↓Software that takes a new supplier from the first request to a supplier number: tax forms, bank details, insurance, Code of Conduct, sanctions and risk reviews checked before the supplier is created. Supplier Onboarding adds six agents that read every document with its page, run seven checks, open only the risk reviews the answers fire and draft one ask — and it watches every bank-detail change on existing suppliers.
How to choose AI solutions for life sciences →
Updated
A life-sciences company adds suppliers all year — bioanalytical labs, clinical couriers, API makers, agencies, translators. Each one sends a W-9 or W-8BEN-E, a bank letter, a certificate of insurance, a Code of Conduct attestation and a questionnaire, and someone in procurement reads them by hand. The insurance limit that misses the category minimum, the unsigned tax form, the bank letter in the parent company's name are found late and asked for one at a time, while the scientist who needs the lab waits three to six weeks to raise a PO.
Every supplier is sent to every risk review to be safe, so Quality, Privacy and Cyber reviewers queue behind an office-supply shop that never needed them. Meanwhile bank-change emails on existing suppliers are worked from the AP mailbox. One lookalike domain and one rushed payment run can be a six-figure loss.
Estimated split for one lab-services supplier, in days. By hand is our estimate; with the solution follows the lab-services medians on the working solution's dashboard.
Six specialist agents read, verify and screen every supplier and bank change; people approve and make the call-back.
October 7 at Northwind Bio. Dr. Maya Chen needs a GLP lab for VLT-302 PK samples before December, and a packaging supplier's bank details are about to change. Here is the morning, screen by screen, in the working solution.
Lena's onboarding wall has two lanes. Bank-detail changes: four existing suppliers, each with the account on file against the new one and six signals — sender, holder, account age, country, phone, history. New suppliers: eleven in onboarding against a 10-day target and one just created, each with its document checklist, seven check results and who acts next.
“11 in onboarding · target under 10 days from request.”
Quillstone Analytical Laboratories, a lab in Raleigh, NC, sends its W-9, a bank confirmation letter from Cardinal Trust Bank, a certificate of insurance, a Code of Conduct attestation signed by its CEO and a 38-answer questionnaire through the supplier portal. Maya Chen's request sits beside them: GLP bioanalysis of VLT-302 PK samples, an estimated $420,000 a year.
The document reader classifies the five documents and reads 25 fields, each with its page. Then three checkers run side by side. The tax and identity checker matches TIN 84-2913377 to the legal name and finds the company active with the NC Secretary of State since 2014. The bank verifier confirms the account holder and that the account is six years old and shared with no supplier or employee. The sanctions and duplicate screener clears the company, its owner and its CEO.
Each step shows what it found and how long it took — 14 s to read the documents, seconds for each check.
Identity, tax, bank, sanctions, duplicates and Code of Conduct pass, each with a numbered source. A near name, Quillstone Labs LLC, closed in 2021, has a different tax ID and bank, so it is not a duplicate. The insurance does not pass: the certificate shows general liability of $1,000,000, and lab services need $2,000,000.
“General liability $1,000,000 each occurrence — below the $2,000,000 minimum for lab services handling study samples.”
The follow-up writer drafts one email to Elena Brooks, Quillstone's CEO, with Maya Chen copied: everything checks out except one item — a revised certificate (or an umbrella policy) with general liability of at least $2,000,000 and Northwind Bio named as certificate holder, uploaded to the portal by Oct 9. Lena reads it and sends it.
“Drafted by the follow-up writer from the findings — edit anything before sending.”
The revised certificate arrives through the portal — $2,000,000 each occurrence, valid to Mar 31, 2027 — and the insurance check passes. Lena approves the record. Two reviews open, each citing the answer that fired it: Quality for Sam Patel, because the work is GLP bioanalysis, and Privacy for Dana Okafor, because Quillstone handles coded study data. Anti-bribery and Cyber are skipped. The bank details wait for Omar Haddad's second approval.
“In the last 30 days, 15 of 38 new suppliers (39%) needed no risk review at all — they were never sent to one.”
Sam Patel signs the Quality review: GLP/GCP/GMP scope confirmed from the questionnaire, the quality agreement template sent, an audit or desk assessment scheduled. Dana Okafor signs Privacy and Omar Haddad signs the bank details. Quillstone is created in the ERP as supplier 100-4417, its bank details added and locked and payment terms set to Net 60 — and Maya Chen is told she can raise the purchase order.
“Signed as Sam Patel — an electronic signature with meaning, name and time. Only the named reviewer can sign.”
“Updated remittance details — urgent” arrives from Karen Doyle at Corvane Packaging, supplier 100-2214 since 2019, with $186,420 due on Thursday's run. Lena presses Check the letter and the bank verifier works signal by signal: a sender one letter off, an account held by CVP Trading Ltd, opened 11 days ago, in Cyprus, a different phone number, and 84 payments since 2019 all to account ••2291. The payments are held and a call-back is booked.
“4 signals red, 2 amber · call-back booked for 09:24 with Karen Doyle on +1 414 555 0187, the number on file — never the number in the email.”
The change opens with the email, the bank letter and the record on file side by side, what would change from Menomonee Valley Bank to Marlowe Digital Bank, and the eight warning signs with their sources — including a letter made with an online editor three days before the email. The call script tells Lena not to read out the new account details, and to ask whether Corvane asked to change its bank account this week.
“Introduce yourself; do not read out the new account details.”
Karen Doyle confirms Corvane did not ask for any change. Lena records “Did not request it” and blocks the change. Invoices INV-88412 and INV-88430, $186,420 in total, stay on Thursday's run to the verified account. The sender domain is blocked in the AP mailbox and the security team has the evidence.
“Blocked — $186,420 stays on the verified account · sender domain blocked · security notified.”
The same supplier, seen by the five people who carry it — what their week looked like, and what it looks like now.
Six specialist agents read, verify and screen every supplier and bank change; people approve and make the call-back.
Classifies everything a supplier sends — W-9, W-8BEN-E, VAT extracts, bank letters, insurance certificates, Code of Conduct attestations, questionnaires — and reads each field with the page it came from.
Matches the legal name and tax ID with the issuing authority, confirms EU VAT numbers and the company registry, and checks tax forms are complete and signed — down to an unsigned part of a W-8BEN-E.
Confirms a bank account belongs to the supplier and checks its age, and compares every bank-change request with the record on file — domain, holder, country, phone, urgency — then holds payments and books a call-back.
Screens the company, owners of 25% or more and the signing officer against OFAC, EU and UK lists, rescreens active suppliers nightly, and looks for the same supplier in the master by tax ID, bank account, name and address.
Applies the category rules — insurance minimums, a Code of Conduct signed by an officer — and opens only the reviews a supplier's answers trigger: Quality, Privacy, Anti-bribery, Cyber.
Writes one precise ask to the supplier for exactly what is missing or wrong, with the page it comes from, sends reminders two days before the due date and re-runs the checks when the document arrives.
Approves the record. The agents propose; a named person decides.
Ask in plain words. Every answer comes from the documents suppliers sent, the checks the agents ran, the bank-change requests and your rules — and points to the page behind it.
Where is Quillstone in onboarding?
Day 1, and close. Six of seven checks passed: the tax ID matches the legal name, the bank account belongs to Quillstone, sanctions are clear. One finding: general liability is $1,000,000 against the $2,000,000 lab minimum. The follow-up is drafted — one click to send. Quality and Privacy reviews fire because of GLP work and coded study data.
Why did you hold the Corvane bank change?
Four reasons. The email came from corvane-packagng.com — one letter away from the domain on file. The new account is in the name of CVP Trading Ltd, not Corvane. The account was opened 11 days ago. And it pushes to act before Thursday's run and gives a different phone number. Payments of $186,420 are held until you call the number on file.
How does the call-back work?
The bank verifier holds payments and opens a call-back with the verified contact and number from the supplier record. You ask whether they requested a change — without reading out the new details — and record the answer: confirmed, did not request, or no answer. A confirmed change still needs a second approver; “did not request” blocks the change and alerts security.
Which suppliers are over the 10-day target?
Two are near or over it: Ostrava Fine Chemicals on day 9 and Tessera Imaging Labs on day 12. Both are in risk reviews, not checks. Tessera waits on Sam Patel and Dana Okafor; Ostrava has a Quality audit booked Oct 14.
13 screens from the working solution, on its sample data. Pick one to see it large.
Who approves, what the agents check against, which reviews fire and where documents arrive are all settings. Every change is saved as a new version.
| Setting | Default | Choose from |
|---|---|---|
| Approve supplier records | Lena Ortiz | Lena Ortiz · Ines Duarte |
| Second approver for bank details | Omar Haddad — never the person who approved the record or made the call-back | Omar Haddad · Dana Okafor |
| Minimum general liability · lab services | $2,000,000 per occurrence | $1,000,000 · $2,000,000 · $5,000,000 |
| Hold bank changes to new accounts | Under 30 days | Under 30 days · Under 60 days · Under 90 days |
| Sanctions lists | OFAC + EU + UK | OFAC + EU + UK · OFAC + EU + UK + UN |
| Tax ID must match before a supplier is created | On | On · Off |
| Hold payments while a bank change is open | On | On · Off |
| Send every supplier to every review | Off — reviews open only when an answer fires their trigger | On · Off |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample supplier data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (published supplier-onboarding studies, 2025 — 3–6 weeks by hand; FBI IC3 2024 Internet Crime Report — about $2.8 billion of business email compromise losses). People, companies, banks and products named on this page are fictional — characters and sample data in the working solution.
Software that takes a new supplier from the first request to a supplier number: tax forms, bank details, insurance, Code of Conduct, sanctions and risk reviews checked before the supplier is created. Supplier Onboarding adds six agents that read every document with its page, run seven checks, open only the risk reviews the answers fire and draft one ask — and it watches every bank-detail change on existing suppliers.
The bank verifier confirms with a bank-validation service that the account belongs to the supplier and checks its age — a bank letter alone is never enough. It also checks that the account is not shared with another supplier or with an employee's payroll account. A bank letter in another company's name, such as a parent company, is a finding.
Every request to change bank details is compared with the record on file and the supplier's payment history: sender domain, account holder, account age, country, phone and history. Payments to that supplier are held, and a person calls the number already on the record — never the one in the request. A confirmed change still needs a second approver; “did not request it” blocks the change and alerts security.
No. Reviews open only when a questionnaire answer fires them — Quality for GLP, GCP, GMP or GDP work, Privacy for personal or coded study data, Anti-bribery for contact with government officials or healthcare professionals, Cyber for access to your systems. Each review quotes the answer that fired it. On the sample data, 15 of 38 new suppliers needed no review at all.
US suppliers' name and tax ID are matched with the tax authority; foreign suppliers' W-8BEN-E is checked for completeness and signature; EU VAT numbers are confirmed in the EU VAT register. The company, owners of 25% or more and the signing officer are screened against OFAC, EU and UK lists, and active suppliers are rescreened nightly. A possible match is a finding for a person, never an automatic block.
Yes. The agents read, check, hold payments and draft; only people approve records, send follow-ups, release payments and change bank details. Two different people approve bank details, and reviewers sign with the meaning of their signature.
Yes. Approvers and reviewers, insurance minimums by category, the hold rule for new bank accounts, sanctions lists, review triggers and where documents arrive are all settings. Every change is saved as a new version on the activity trail.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your onboarding policy, category rules and a sample of past supplier documents and bank-change requests — and it goes live once every quality gate has passed. We will walk you through it on your own suppliers first.
Every CRO bid compared like for like, each number traced to its page.
1-min demoSupplier Invoice AuditOvercharges caught against contract, rate card and PO before payment.
1-min demoContract Obligation ManagementNo missed renewal or rebate, each term linked to its source page.
1-min demoWe'll run Supplier Onboarding on a sample of your own supplier documents and bank-change requests.