Supplier Onboarding Documents Checklist: Cross-Check Company ID in Australia

This article is provided for information only and is not legal advice. Regulatory references are accurate as of the publication date (1 October 2026). Check current rules with a qualified professional before applying them to an individual supplier file.

A supplier onboarding documents checklist lists the papers an Australian buyer collects before a new supplier is created in the payments system: an ASIC company extract, ABN details, bank account details, a certificate of currency and any industry-specific proof. Collecting them is the easy part. The control that prevents bad payments is checking that the legal name, ACN or ABN and address say the same thing on every document. This guide gives the checklist, a cross-check matrix and the Australian rules that shape the file, from ABN withholding to modern slavery reporting.

What documents belong on an Australian supplier onboarding checklist?

A usable checklist has six blocks: legal existence, tax status, payment details, insurance, compliance evidence and signed terms. The names are local, the logic is the same everywhere. The table below is a starting point to adapt to your risk level and contract value.

Ask for the minimum your risk justifies. A one-off purchase of $500 does not need the same file as a three-year subcontract. Tiering suppliers by spend and by risk keeps the file proportionate and keeps suppliers willing to respond. Our guide to a vendor due diligence checklist shows how to set those tiers.

Note what you should not ask for. Do not ask for a supplier's Tax File Number (TFN); the ABN is the identifier that matters, and collecting a TFN creates privacy exposure.

How do you cross-check the company ID across the extract, bank details and certificate of currency?

Cross-checking means comparing the same fields (legal name, ACN or ABN, address, signatory, dates) on each document and recording every difference with a decision. A supplier file is consistent when the ASIC extract is the source of truth and every other document points back to it.

Three mismatches recur: a bank account held by a person or different entity (the typical pattern behind redirected payments), a certificate of currency naming a group parent or former trading name, and an old extract that hides a change of director or external administration. None proves fraud. Each needs a named person to decide before the first payment.

A validation tool automates the comparison, not the judgement. Our platform supports more than 3,200 document types and OCR extraction in 24 languages across 32 jurisdictions, so the same matrix runs on an ASIC extract, a bank letter and a certificate of currency. It compares fields, dates and registers and flags differences; it does not prove that a document is genuine.

How do you check the ASIC extract and the ABN?

The company extract is checked against the register that issued it, never only against the PDF the supplier sends. Search the record yourself and compare it to the supplier's copy.

• ASIC. The Australian Securities and Investments Commission maintains the company register. A search shows the ACN, company type, status, registered office and officeholders, and a current extract is available for a small fee. A status such as "deregistered" or an external administrator listed against the company deserves a question.
• ABN Lookup. The Australian Business Register's ABN Lookup is free and shows the entity name, ABN status, entity type, the date the ABN became effective and whether the entity is registered for GST. Compare the entity name with the ASIC record and with the name on the invoice.
• GST status. A supplier charging GST must be registered. If the invoice shows GST but ABN Lookup shows no GST registration, hold the payment and ask why.

Understand the no-ABN rule. If a supplier does not quote an ABN on an invoice, the payer generally must withhold tax from the payment at the top marginal rate plus the Medicare levy, currently 47 per cent, and remit it to the ATO. The supplier can avoid this by quoting an ABN or by giving a Statement by Supplier where the work is private or domestic, or where the supplier is not carrying on an enterprise. Keep that statement in the file. The Australian Taxation Office explains the current withholding rules, and you should confirm the rate and exceptions there before applying them.

How do you validate bank details?

Bank details are validated by confirming that the account name matches the legal or registered trading name, using bank-issued evidence rather than an email. A bank letter, a recent statement header or a bank-issued account confirmation all work. A screenshot of an online banking page does not.

Australian accounts are identified by a six-digit BSB, which points to the bank and branch, and an account number. The BSB can be checked against the public listing from the Australian Payments Network, which administers BSB numbers, to see that it belongs to a real institution. This catches typing errors and implausible values; it does not show who owns the account.

Some banks offer account-name verification for payments to a BSB and account number. It protects against typing errors and some fraud, but it is a last line of defence; your own comparison at onboarding catches the problem earlier and leaves an audit trail.

Treat any change of bank details after onboarding as a new onboarding event: call back on a number already in your file, not the one in the change request. The Scamwatch site run by the ACCC describes business email compromise and false billing scams in current form. Our article on fake certificates of insurance and vendor fraud covers related patterns.

What must the certificate of currency show?

A valid certificate of currency names the same legal entity as the register, states the insurer, the cover type, the limits and a policy period that includes the contract dates. Check four things in order: insured name, policy period, limit per claim and the activity covered. Public liability is not professional indemnity, and a policy for "consulting" does not necessarily cover "installation".

Workers compensation is arranged under state and territory schemes, so ask for the certificate that matches where the work is performed. For sole traders it may not apply, and the file should say why.

Brokers sometimes issue a summary on letterhead. Ask for the certificate itself, and for contracts above your risk threshold, ask the broker to confirm cover directly. Diarise the expiry date and request the renewal 30 days before. The vendor compliance certificate verification guide lists the other certificates to track.

Which Australian obligations change the checklist?

Three regimes affect what a buyer asks for and how it stores the answers: modern slavery reporting, privacy law and, for financial businesses, AML/CTF.

• Modern Slavery Act 2018 (Cth). Entities with annual consolidated revenue of at least $100 million must publish a modern slavery statement covering their operations and supply chains, and report it through the government's register. Smaller buyers are often asked supplier questions by larger customers. Add a short questionnaire to the onboarding pack. Guidance is on the Department of Home Affairs website.
• Privacy Act 1988 and the Australian Privacy Principles. A supplier file holds names, addresses and sometimes identity details of directors and sole traders. Collect only what you need, store it securely and delete it when the relationship ends. The OAIC publishes guidance on the APPs. This is also why you do not collect a TFN.
• AML/CTF Act 2006. If your business is a reporting entity regulated by AUSTRAC, supplier onboarding is not the same as customer due diligence, but unusual payment instructions can matter for your monitoring. Check AUSTRAC guidance to see whether and how it applies to you.

For the wider picture of industry file types, read the industry verification pillar guide.

How do you run the checklist in practice?

Run the checklist as a gate: no supplier is activated for payment until every line is validated or has a recorded exception. Seven steps cover most files:

1. Send one request listing every document, the accepted formats and the deadline.
2. Search ASIC and ABN Lookup yourself and compare the results to the supplier's documents.
3. Run the cross-check matrix: name, ACN or ABN, address, signatory, dates.
4. Confirm GST status, and obtain a Statement by Supplier if no ABN is quoted.
5. Confirm BSB, account number and account name with a bank-issued document.
6. Check the certificate of currency for entity, period, limits and activity.
7. Record the reviewer, the date and any exception, then set expiry reminders.

A spreadsheet can hold the list but cannot enforce the order or alert on expiry. To run these comparisons on your own files, see our pricing page; storage and access controls are described on the security page. You can also start from the CheckFile homepage and test a sample supplier file, which compares fields, dates and registers across the documents.

Frequently Asked Questions

What documents do I need to onboard a new supplier in Australia?

At minimum: an ASIC company extract or business name record, an ABN confirmed on ABN Lookup, bank details confirmed by the bank, a certificate of currency and signed terms. Add licences, workers compensation or modern slavery responses where the law or the contract requires them.

How do I check that a supplier's bank account is genuine?

Obtain a bank-issued document showing the account name, BSB and account number, and compare the account name to the entity name on ASIC and ABN Lookup. Where your bank offers an account-name check, use it as an extra step.

What happens if a supplier does not give me an ABN?

You generally must withhold tax from the payment, currently at 47 per cent, unless the supplier gives a Statement by Supplier or another exception applies. Confirm the current rules with the ATO before paying.

Does validation prove a supplier document is genuine?

No. Validation compares fields, dates and formats across documents and against registers, and highlights differences for a person to review. It complements the checks your policy requires.

Who is responsible for supplier checks, procurement or finance?

Whoever releases the first payment should own the final decision, with procurement collecting documents. Record the reviewer and date on every file so an audit can see who approved what.