Supplier onboarding, explained.

What supplier onboarding is: getting a new company paid safely, then keeping its bank account where it is

One lab, from a scientist's request to a supplier number, and what watches it afterward

1. Someone asksA requester names the supplier, the work and the spend. In the example, Dr. Maya Chen needs a lab working under Good Laboratory Practice, or GLP, for study samples, about $420,000 a year.
2. The papers arriveTax form, bank letter, insurance certificate, code of conduct and questionnaire, through a portal or by email. In the example, five documents reach the team at 8:12 am.
3. Papers meet the recordsTax number against the tax authority, bank account against its holder, names against sanctions lists and your own supplier list, limits against your rules. This step, and the bank-change check in step 5, are what this guide is about.
4. The right people signOnly the reviews the answers call for. A record approver, then a second person for the bank details. Then the supplier number exists.
5. The record is watchedCertificates expire, sanctions lists change, and emails ask for new bank details. In the example, one such email arrives at 9:18 am the same morning for a different supplier.

The companies, people and figures in this example are fictional.

Why a neat bank letter means little, and three more onboarding surprises

Vendor master, TIN, call-back, qualification: four words this work runs on

You will also meet GxP, the family of quality rules for regulated work: Good Laboratory Practice (GLP) for nonclinical lab studies, Good Clinical Practice (GCP) for clinical trials, Good Manufacturing Practice (GMP) and Good Distribution Practice (GDP). Fourteen terms are defined in the summary and glossary.

Where supplier onboarding starts and stops at a drug or device company, and the reviews it hands off

In shortOnboarding answers one question: can we safely create and pay this company? It sits between the decision to buy and the deeper reviews. A life sciences company has more of those reviews than most, because a lab, a courier or a translator can touch regulated work. Two lists result, and they are easy to confuse: the vendor master says you can pay a firm, and the approved supplier list says it may do regulated work.

The split matters because the rules bind different teams. ICH Q7, the international manufacturing guideline for active ingredients, says materials should come "from a supplier or suppliers approved by the quality unit(s)".5 ICH Q10, the international guideline on drug quality systems, asks a drug company to monitor incoming materials "to ensure they are from approved sources".6 A number in the finance system meets neither text.

A company can have a perfectly clean vendor record for an active ingredient maker that Quality has yet to approve, so a good onboarding process tells Quality the moment it creates one.

A translator looks harmless until the document in hand is a consent form with a patient's name on it. A janitorial firm near a cleanroom looks harmless too, and on the example list it triggers nothing, which a quality team may want to question. Category gives a first guess, and the answers about the actual work settle it. Section 11 returns to that.

What a new supplier's W-9, bank letter, insurance certificate and questionnaire each prove

In shortEvery paper on a vendor onboarding checklist is somebody's statement, and each is good for a specific thing. A tax form is a signed statement under penalty of perjury. A bank letter is a document you cannot trust alone. A questionnaire is the supplier's own account. Much onboarding trouble comes from asking a paper to prove more than it can, or from reading it once and forgetting the date it runs out.

In our example, the lab's five documents produce 25 fields a person would otherwise type. They fall into six groups. Compliance holds the most, because each questionnaire answer that matters becomes a field of its own: regulated work, personal data, government contact and system access.

TIN matching, backup withholding and foreign supplier forms, worked through with a $260,000 agency

In shortA US payer collects a W-9 or a W-8 before paying. If a supplier that is not exempt gives no correct number, the payer may have to hold back 24% of each payment, which is called backup withholding. Information returns are the forms, such as the 1099, that tell the IRS what you paid. Penalties for bad ones are small per form and add up. The reporting threshold rose to $2,000 for 2026 payments. That rise did not remove the need to collect the form.

What a wrong TIN costs on one agency's invoices

Take the example agency, Marlowe & Finch Medical Communications LLC, taxed as a partnership, with about $260,000 of work a year. Suppose its W-9 carries a wrong number, the mismatch goes unfixed, and backup withholding applies to every payment for a whole year. The rate is 24 percent.10 That is $62,400 your company holds back from a supplier who expected to be paid in full (our arithmetic, on the example's spend). The supplier's first call will be angry, and it will land on accounts payable.

Corporations look different. The W-9 instructions say corporations are exempt from backup withholding for certain payments, including interest and dividends, with listed exceptions. Two matter here: attorneys' fees, and payments reportable on Form 1099-MISC to corporations that provide medical or health care services.7 The example lab's record reads "not subject", and that exception list is the reason a team reads the form each time.

Annual maximums for returns due in 2027 run from $244,500 to $4,191,500, by lateness and business size.11 At $340 a form, 200 bad returns come to $68,000 (our arithmetic).

What TIN Matching can do, and who may use it

The IRS's TIN Matching service lets a payer "validate TIN and name combinations before submitting an information return".12 Access is narrow: it is for payers and their authorized representatives on the IRS Payer Account File, which means those who filed Forms 1099 reporting backup withholding in the last two years.12 A company new to US payments may not qualify. The service checks a name against a US TIN, so a foreign supplier with no US number gets nothing from it (our reading).

Foreign suppliers: the W-8BEN-E and its clock

A foreign company signs Form W-8BEN-E at Part XXX. The form generally stays valid from the signing date to the last day of the third calendar year after it, unless something on it becomes incorrect.8 A form signed September 23, 2026 therefore runs through December 31, 2029. An unsigned Part XXX is one of the most ordinary reasons to go back to a supplier, and our example's supplier list has one.

For EU suppliers, the VAT number goes through VIES, a search tool over national databases. A valid result means the number is registered in the national database. An invalid result can mean the number does not exist, that the firm has not activated it for intra-EU transactions, or that registration is not finished, so it calls for a question to the supplier before any conclusion. The Commission's guidance says to keep a record of your check.9

How to prove a bank account belongs to a supplier: letters, micro-entries, validation services and name checks

In shortNo single method settles it. A letter says who the account belongs to, and a letter can be false. A micro-entry shows someone can see the account. A validation service or a bank's name check tells you whether the holder matches, within what its data covers. A call to a number you already held tells you whether the real supplier asked. Strong programs combine at least two, and they compare the holder with the legal name on the tax form.

Nacha, which runs the rules for ACH, the US network for electronic payments between bank accounts, defines a micro-entry as "a credit or debit Entry used by an Originator for the purpose of verifying a Receiver's account".15 In plain words, you send a tiny payment, with credits under a dollar, and the account holder reads the amount back. That shows a person can see the account, and that person might be the thief, because a thief opens accounts too.

Coverage of commercial validation services varies by country and bank, and we found no public figure that measures it, so ask any provider for its match rates in your own supplier countries.

Parent companies, factoring firms and the awkward honest case

Many mismatches are innocent: a parent company, a trade name, or a factoring firm, which buys a supplier's invoices and collects the payments. In our example, Saltmarsh Bioreagents sends a letter for an account held by SBR Holdings Ltd., its parent. The example's rule: payments go to an account in the supplier's own name, or the parent signs a payment direction letter that says so. Your rule may differ.

Either way, a person should decide, on a reason you can show later. The check should also compare the account with your employee payroll accounts and your other suppliers, which is how an insider scheme tends to show up.

Europe's banks now check payee names, and companies can opt out

Since October 9, 2025, payment providers in euro-area states must offer "verification of the payee" before a payer authorizes a euro credit transfer. Providers in other member states follow by July 9, 2027.14 When the name and account do not match, or almost match, the payer's bank must say so. The check cannot stop the payment: providers must not prevent the payer from authorizing it.14

Two points surprise companies. First, business customers may opt out when they submit "multiple payment orders as a package",14 which describes most accounts payable files. Second, a bank that meets these duties is shielded from liability for a transfer to the wrong payee, and the bank must tell customers what ignoring a warning means for refund rights.14

Worldline, a payments vendor, wrote the day after launch that "many corporates have decided to opt-out" because their process did not fit the two-step flow.17 That is one vendor's observation, so ask your own treasury team whether your company has opted out.

What vendor bank-change fraud looks like in 2026: $3 billion in FBI reports and eight warning signs

In shortThe FBI's 2025 figures show business email compromise, the family of scams that includes false bank-change requests, at just over $3 billion. Nearly three in four US organizations in one survey say it touched them in 2025. The attempt arrives as ordinary paperwork, usually with a deadline. Getting the money back gets harder by the hour, so the time to stop it is before the payment run.

These numbers cover all business email compromise, of which a false supplier bank change is one form. The FBI's definition names people "working with suppliers" first.18 We found no public figure that isolates supplier bank changes. A longer FBI count put exposed losses at $55.5 billion across 305,033 incidents from October 2013 to December 2023, adding financial filings to complaints.16

How one false bank-change email gives itself away

Here is the fictional Corvane request again. Eight signs sit in it, and no single one is proof. The email domain is the only thing that many clerks check, and a thief working from a compromised mailbox would pass that test.

Children's Healthcare of Atlanta and a $5.3 million wire

In early June 2023, conspirators compromised the email of a firm that supplied furniture to Children's Healthcare of Atlanta. On June 5 they asked, from what looked like the supplier's address, for the form to change its ACH payment instructions. Posing as the supplier, they updated the bank details on file. On June 13 they directed a $5.3 million wire to an account held by a former accountant. Eight days passed between the first email and the wire.

A federal jury convicted him of conspiring to launder the money, and he was sentenced to four years in prison. The hospital system says it has recovered nearly $4 million.4 We read two press accounts of what prosecutors said, and neither the court papers nor the prosecutors' release.

Fast action can work. The FBI reports a 2025 case in which an Oregon city's $6 million wire was recalled because an earlier freeze on the same receiving account led the bank to question it.18

UK case counts fell by about half in four years, then rose again

We read a trade publication's account of UK Finance's report, not the report itself, and other summaries print different counts, so compare like with like. The account describes consumers paying for things like property purchases, so it covers more than suppliers, and it does not say why the count fell.

How to run a vendor call-back that a thief cannot answer, and the five ways teams undo it

In shortHold the payment, call a number you held before the request came, ask an open question, and record what was said. A different person then approves the change. The FBI's own advice is to use a secondary channel for changes in account information.16 The control is cheap and old, and it fails only in the specific ways listed below.

Five steps of a call-back: which number, what to ask and who approves

1. Use only the number on the record. Never one from the request, its signature block or a web search made because of the request.
2. Say who you are, then ask an open question. "Did your company ask us to change its bank account this week?" Leave the new details out of your first sentence, so that a thief on the line learns nothing.
3. If they say yes, have them read the details to you. The account and bank should come from their side.
4. Record it. Who you reached, on what number, at what time, and what they said.
5. Hand it to someone else. The person who made the call does not approve the change.

Five ways a sound call-back rule still fails

If money has already gone, speed decides the outcome. The FBI's first advice is to contact your bank immediately and request a recall, then file at ic3.gov regardless of the amount.18 Keep your bank's fraud contact and the ic3.gov address in your written procedure.

Which sanctions and supplier lists to screen at onboarding, and why a 25% owner check can miss OFAC's test

In shortScreen the company, its owners and its signer, then screen again as lists change. OFAC is the US Treasury's sanctions office. Its 50 Percent Rule adds up blocked owners, so a firm can be blocked with no blocked owner above 25%. New lists matter for life sciences: BIOSECURE's federal list is due by December 18, 2026, the US forced-labor import list, the UFLPA Entity List, was updated again on October 28, 2026, and the EU's forced labor rules apply from December 14, 2027.

Three owners of 20% each, and a supplier OFAC's rule treats as blocked

OFAC sanctions generally prohibit transactions involving a blocked person, one whose property US sanctions freeze.23

OFAC's rule "applies to entities owned 50 percent or more in the aggregate by one or more blocked persons".23 Some onboarding rules, including the fictional one in this guide, screen owners at 25% and above. That is a company's own policy choice, and OFAC's test works differently: FAQ 399 gives two blocked owners of 25% each as its example, and FAQ 401 counts indirect ownership too.23 Imagine a supplier with four owners: three blocked at 20% each, and one other at 40%.

A fix: collect all owners from the questionnaire, screen everyone you are given, and ask directly whether any owner is a sanctioned person. OFAC also says its rule "speaks only to ownership and not to control".23 A firm a blocked person controls without owning half is not automatically blocked, and that is a reason for caution, as OFAC may designate it separately.

Under IEEPA, the International Emergency Economic Powers Act, OFAC's maximum civil penalty is the greater of $377,700 or twice the underlying transaction, the figure set in January 2025, and we found no 2026 change.24 Transaction records must be available for at least 10 years.25 OFAC lists "sanctions screening software or filter faults" among root causes of violations, including lists not updated and alternative spellings missed.26

The lists a life sciences supplier check should know about

BIOSECURE reaches a company only through federal contracts and federal money. Even so, a company with a grant or a government contract will want to know now which labs and manufacturers it uses, because once the limits apply, a loan or grant recipient may not use those funds to obtain listed services.28

Sanctions name-matching is covered in depth in our guide to third-party due diligence. For onboarding, the point is simpler: a possible match goes to a person, with the reason it matched.

The renamed duplicate and the short insurance certificate: two supplier checks that look clerical and save real money

In shortA duplicate supplier record lets the same invoice be paid twice and hides how much you spend with a firm. Matching on tax ID and bank account finds what a name search misses. The insurance check is simple arithmetic against your own table of minimums, and we found no regulation that sets those minimums. Both checks fail quietly, so a team seldom knows until later.

Finding the same company under a new name

Names are the weakest way to match. In our example, Cobalt Ridge Recruiting Partners LLC applies as new. A name search in the master might miss Cobalt Ridge Staffing LLC, supplier 100-3120. Its tax ID and bank account give it away, and the right move is to extend the old record.

Beside it sits the opposite case: Quillstone Labs LLC shares most of a name with the new lab, and it closed in 2021 with a different tax ID and a different bank. A name-only rule would have blocked an innocent company.

How common are duplicates? We found no public figure a reader can check, only vendor claims. You can measure your own in a day: export the master, then group by tax ID and by bank account. Any group with more than one active record is worth a look. A shared bank account between a supplier and an employee is worth more than a look.

What a certificate of insurance shows, and what you still have to ask for

The US standard form is the ACORD 25. It states that it "does not affirmatively or negatively amend, extend or alter the coverage afforded by the policies", and if you are meant to be an additional insured, "the policy(ies) must have additional insured provisions or be endorsed".2 One law firm's advice, from 2014: "The only way that a party can be added as an additional insured is by endorsement", so ask for the endorsement too.2

Limits are your choice. No regulation we found sets a minimum general liability limit for a bioanalytical lab or a courier. Companies set them by category, and our example's table shows the usual shape: the closer a supplier is to product or samples, the higher the limit.

GxP supplier qualification: what ICH, EU GMP, FDA and ISO 13485 expect before a supplier's work counts

In shortThe rules agree on the shape. Assess a supplier before you use it, in proportion to the risk. Write down who does what. Monitor it after. Stay responsible yourself. Quality signs that decision, and procurement cannot sign it for them. FDA's component citations show one common failure: accepting a supplier's certificate of analysis without the checks the rule asks for.

Reading the citations: ICH is the International Council for Harmonisation, whose guidelines drug regulators share. EU GMP is the EU's manufacturing rulebook. 21 CFR is FDA's title of the US Code of Federal Regulations.

Where FDA finds the gap: certificates of analysis nobody checked

FDA's inspection data for fiscal 2025 shows 161 citations under 21 CFR 211.84, the testing and approval of components. We grouped them by what went wrong, and accepting a supplier's paper without the checks leads.40 On the device side, the same data shows 190 citations under old 21 CFR 820.50, purchasing controls, by our sum. The fiscal year closed before the new device rule took effect.40

One warning letter shows the pattern. On May 29, 2026, FDA told Macau-Union Pharmaceutical that it "relied on your suppliers' certificates of analysis (COA) without verifying your supplier's test results at appropriate intervals". FDA also asked for an assessment of the "adequacy of the supplier qualification program and its selection, qualification, and disqualification provisions".41 That second sentence turns out to be a stock request, and it explains most of the recent rise in the phrase.

How we counted. We ran the exact phrase through FDA's warning letter search on November 3, 2026, took the text of all 79 letters and read where the phrase falls. 68 went to drug makers, seven to device makers, two to compounders, one to an animal drug firm and one to a food importer. FDA's index holds 737 letters dated 2025 and 503 dated 2026 so far.

The stock request appears in 4 of the 15 letters for 2025 and 18 of the 29 for 2026, and in none before. So the rise shows FDA asking about supplier programs more often, and it does not show more failed suppliers. A letter that says "vendor qualification" or "supplier audit" and never uses this phrase is not counted.

Reading a supplier's ISO or GMP certificate

A certificate from a supplier is a real and useful document, and it has limits you should check. Does the named site match the one doing your work? Does the scope cover your product or service? Who issued it, and is that body accredited? Has it expired?

For EU GMP, you can check directly. EudraGMDP, EMA's database, publishes GMP certificates and statements of non-compliance, and the national authority adding an entry decides what is public, so a blank result does not settle anything.43 In the US, registration "does not denote approval of the establishment".3 So a paper saying "FDA certified" is a reason to ask questions.

Sending every new supplier to every risk review feels safe; here is what it costs, and what replaces it

In shortA blanket rule puts a stationery shop in the same queue as a GMP contract lab, so reviewers learn to skim. Routing by the questionnaire's answers gives each reviewer only the suppliers that need them, along with the answer that sent them. The weakness is that answers are self-reported, so someone must test them by sampling.

Coded study data, and the answer that needs a second look

The example lab answers "coded study data only, no names", and that triggers a Privacy review. Coded data carries a code in place of the patient's name, and whether it counts as personal data for the lab is a real question.

The EU Court of Justice held in September 2025 that pseudonymized data "must not be regarded as constituting, in all cases and for every person, personal data", depending on whether the recipient can identify the person. That case applied Regulation 2018/1725, the data rules for EU institutions, so a company under GDPR should ask counsel how far it carries.44 So the review has work to do. It should not close on the word "coded" alone.

Keeping self-reported answers honest

A supplier that wants to start soon has a reason to answer "no". Three habits help.

Questionnaires themselves face limits in Europe. Under Directive (EU) 2026/470, a supplier of up to 1,000 employees gains a right to decline requests for sustainability reporting data beyond a set cap. National laws are due by March 19, 2027, and the cap covers gathering for that reporting and leaves a buyer's own risk management alone.31 So keep your risk questions and your sustainability questions apart.

Eight ways vendor onboarding goes wrong, from the unsigned W-8 to the bank change approved by one person

In shortMost failures are ordinary and cheap to prevent. A few are rare and expensive, and those are the ones to design against first. The common thread is timing: a problem found on day 12 could have been found on day 1, and a change approved by one person could have been stopped by a second.

What AI can take from supplier onboarding, what stays with people, and what regulators have said so far

In shortReading a form into fields, comparing them with a register and drafting one clear message suit software, because a person can check each result against its source. Approving a record, releasing a payment and qualifying a supplier stay with named people. Few regulators speak to this work directly. FDA's AI draft leaves out operational uses, while one FDA warning letter already tells a firm to review what AI writes.

The limits are practical. A tool that reads a certificate reports what the certificate says, and the certificate may be false. Screening gives possible matches, which someone must clear. A validation service knows what its data covers. Only 17% of organizations in AFP's 2026 survey used AI against payments fraud at all, and those that held back gave cost, immaturity and reliance on existing controls as reasons.19 A fair test of any tool is whether a person can reach the source of each result in one step.

How procurement teams onboard suppliers today: who touches a new lab, the hand-offs, and where three weeks go

In shortPublished surveys, all from software vendors, put typical onboarding at about two to four weeks, with long tails. By our estimate, most of those days are waiting, on the supplier and on reviewers. In our example, six roles touch one lab, and the lab's own contact can get separate emails from several of them.

Enablement, accounts payable, Quality, Compliance: who touches a new lab

How long onboarding takes: what the published figures say, and who published them

Definitions differ. Some studies stop the clock when the record is created, and others when the supplier can transact. Before comparing yourself with anyone, fix your own start and stop.

In house, shared service or software: three ways teams run supplier set-up

October 7: Quillstone's five documents arrive at 8:12, and one insurance limit stands between it and a supplier number

In shortDr. Maya Chen needs a GLP lab for samples from VLT-302, the fictional drug in this story, before December, about $420,000 a year. Lena Ortiz, the supplier enablement lead, starts on the onboarding wall, a screen where every supplier and bank change carries its own evidence. Six agents read and check in under a minute. One finding comes out, one message goes to the supplier, two reviews open for a stated reason, and three people sign.

1

The wall shows who needs Lena, and why

Two lanes. Bank-detail changes sit on top, each with the account on file against the new one and six signals. New suppliers sit below, eleven in onboarding against a 10-day target and one just created, each with its documents, seven check results and who acts next.

Quillstone's card is on day 1 with five documents received at 8:12 am and no checks yet.

2

Five documents in, and one run of the checks

A W-9, a bank letter from Cardinal Trust Bank, a certificate of insurance, a code of conduct signed by the CEO, and a questionnaire with 38 answers. Maya's reason and spend sit beside them. The tax form on the right is the product's sample, in condensed wording. The real form is the IRS's.7

3

Six agents work in order, and each shows what it found

The document reader classifies the five documents and reads 25 fields in 14 seconds. Then three checkers run: tax and identity, bank, and sanctions and duplicates. The risk trigger router applies the category rules, and the follow-up writer drafts.

4

25 fields, each one a click from its page

The record groups fields by legal entity, tax, bank, insurance, compliance and set-up. Each carries a confidence score and a link to its source. Ownership scores lower, at 86, which tells Lena where to look twice. The finding sits at the top: general liability of $1,000,000 against a $2,000,000 minimum.

5

Seven checks: six pass, one is a problem

Identity, tax, bank, sanctions, duplicates, insurance and code of conduct, each with a numbered source. A near name, Quillstone Labs LLC, closed in 2021 with a different tax ID and bank, so the screener does not call it a duplicate.

6

One message to the supplier, sent by a person

Everything else checks out, so the draft asks for one thing: a revised certificate or umbrella policy with at least $2,000,000, naming Northwind Bio as holder, by October 9. Lena can edit it. It goes only when she sends it.

7

The revised certificate clears the check

It arrives through the portal, the check re-runs, and the record clears. The certificate on the right shows a $2,000,000 limit, valid to March 31, 2027. As Part A said, a certificate is a broker's summary of a policy, so a company that wants additional insured status should also ask for the endorsement.2

8

Only the reviews the answers call for, each quoting its answer

Lena approves. Quality opens for Sam Patel because the answer reads "Yes, regulated bioanalysis under GLP". Privacy opens for Dana Okafor because of "Coded study data only, no names". Anti-bribery and Cyber are skipped, each showing the "No" that skipped it. The bank details wait for Omar Haddad.

9

Sam signs with meaning, name and time

The Quality review lists what was done: GLP, GCP and GMP scope confirmed, quality agreement template sent, audit or desk assessment scheduled. Only the named reviewer can sign. This is the supplier quality decision Part A described, and the lab's GLP status still rests on Sam's assessment.

10

Supplier 100-4417, with its bank details locked

With Quality, Privacy and the bank details signed, Lena creates the supplier in the ERP. Terms are set to Net 60, the bank details are added and locked, and Maya is told she can raise her purchase order.

9:18 am: Corvane's bank letter turns its card red, Lena calls the number on file, and $186,420 stays put

In shortThis is the example from the top of the page, inside the product. An email reaches the accounts payable mailbox. The bank verifier compares it with the record and seven years of payments, holds the money and books a call. Lena calls, Karen Doyle says Corvane never asked, and Lena blocks the change. The agents hold and flag. Lena makes the decision.

1

The card turns red and the money is held

Lena presses Check the letter. Four signals go red and two amber on the card: sender, holder, account age and history in red, country and phone in amber. The total held on the lane rises to $240,720: Corvane's $186,420 plus the $54,300 already held for Halvorsen Freight.

2

The email, with its tells marked

The sender is corvane-packagng, one letter off. The deadline, the new holder and the new phone number are highlighted in the message. On this screen the IBAN, the international account number, and the phone are masked, because sample numbers should never resemble real ones.

3

The call-back panel gives one number and a script

+1 414 555 0187, on file since March 2019. The script says to introduce yourself, leave out the new details, ask whether Corvane asked for a change this week, and, if so, have them read the new account and bank back. Three buttons record the outcome: confirmed, did not request it, or no answer.

4

Eight warning signs, each with its source

Lookalike sender, seven years of payment history broken, an account outside the supplier's name, an account opened 11 days ago, a new country, pressure to act before Thursday, a different phone, and a letter made with an online editor. Below them: the two invoices held, $118,260 and $68,160.

5

The letter and the record, side by side with the call

The bank letter names CVP Trading Ltd at Marlowe Digital Bank, opened September 26. The record on file shows Menomonee Valley Bank, the holder, and 84 payments since March 2019. A note on the record says that the contact number is the only number used for call-backs.

6

"Did not request it"

Karen confirms Corvane asked for nothing. Lena records that, and the screen offers two actions: block and keep the verified account, or report to security. A confirmed change would have gone a different way, on to a second person.

7

Blocked, and the invoices still get paid

INV-88412 and INV-88430 stay on Thursday's run, to the verified account. The sender domain is blocked in the mailbox, security has the evidence, and Karen was told by phone. Corvane, a real supplier in this story, gets paid on time.

A parent's bank account, a renamed duplicate, an unsigned W-8BEN-E, and how the whole supplier list looks

In shortMost findings are ordinary, and each gets the same treatment: a plain statement, its source and one next step. The list views show where every supplier stands against the 10-day target, and the dashboard shows where the days go. A genuine bank change gets the same call and the same second person.

What the sample dashboard says about days, reviews and follow-ups

Over the sample's last 30 days, 38 suppliers were created at a median of 6.2 days, 58% of suppliers needed no follow-up, and 15 of 38 needed no review. The Quality row's 39% and the "no review" row's 39% happen to match and mean different things: one is a share of the 33 reviews, the other a share of the 38 suppliers. The tile's "typical by hand: 3–6 weeks" is the product's own phrase, and Part A gives what published surveys say.

The six supplier onboarding agents, the signatures people keep, and the rules you can change

In shortEach agent has one job and a line it does not cross. People approve records, sign reviews, send messages, make calls, change bank details and release payments. Every field cites its page, and every review quotes its answer. The rules are settings, versioned, and they are yours.

The screener's owner threshold is a setting, and Part A explains why 25% does not by itself cover OFAC's aggregated test. Ask how your team wants to handle smaller owners, and keep every owner the questionnaire gives you in the screen.

Who signs at Northwind Bio, and what they can never share

Supplier documents in, a cited record and held payments out

Systems a supplier onboarding program connects to

Insurance minimums, hold rules and review triggers, as settings you own

Who approves, what the agents check against, which answers open which reviews and where documents arrive are all settings, and each change is saved as a new version. In the sample, version 1.7 was approved on September 30. In the sample, the rule that sends every supplier to every review is switched off.

6.2 days, 39% and 100%: the design targets to hold a supplier onboarding pilot to

What one false bank change and a slow supplier set-up cost a drug or device company, and how to count your own

In shortYou face two different costs. Fraud is rare and large, and much of the money may never come back. Delay is constant and small per supplier, and it spreads across every requester who waits. We found no public figure for either in life sciences alone, so the fastest honest answer is a week with your own payment and supplier data.

Counting your own onboarding and bank-change costs in one week

Supplier risks no onboarding calculator counts

Sizing the return on faster supplier set-up: reading hours, fewer reviews, stopped fraud and a calculator you fill in

In shortThree levers carry the money: fewer hours reading and keying, fewer reviews that lead nowhere, and fewer false bank changes that get through. A fourth, days back for requesters, is real and hard to price, so we count it separately and leave it out of the total. Treat every default below as a placeholder for your own number.

The $123,000 is the FBI's 2025 total divided by its complaints, across every kind of victim.18 The fraud line is the one to argue about, because a single stopped payment can exceed or fall far short of it. The 6.2 days is the solution's design target, and the 21 days is an estimate for one lab. Time your own.

Is your vendor master team ready to automate onboarding? Eight scored questions and one to reflect on

In shortScore each question 0, 1 or 2. Automation works best where the rules are written down, the master is clean enough to compare against, and someone owns the bank-change control. A low score points to work that pays off even without any software.

What a low, middle or high supplier onboarding score means

What to ask a supplier onboarding software vendor about reading, bank proof, screening and who signs

In shortAsk for proof on your own documents. Many products collect forms in a portal and stop there. Find out what the tool reads, what it compares with, what its data covers in your countries, and how bank changes on existing suppliers are handled. Ask us the same questions.

A 10-week pilot on your own suppliers: replay 20 past files and last year's bank changes, then run one category live

In shortStart with work whose answers you already know. Replay past supplier files and past bank-change requests, compare what comes out with what your team found, and only then run a live category beside your team. Fix your measures before the first file goes in.

The measures that show whether a supplier onboarding pilot worked

W-9s, TIN matching, bank checks, OFAC and AI: common supplier onboarding questions

In shortCommon questions about vendor and supplier onboarding, each answered on its own.