Supplier Onboarding Documents Checklist for Canada: Cross-Check Company ID

This article is provided for information only and is not legal advice. Regulatory references are accurate as of the publication date (October 1, 2026). Check current rules with a qualified professional before applying them to an individual supplier file.

A supplier onboarding documents checklist lists the papers a buyer collects before a new supplier is created in the payment system: a proof of incorporation or business registration, tax identifiers, banking details, a certificate of insurance and any sector-specific clearance. Collecting them is the easy part. The control that prevents bad payments is checking that the legal name, corporation or Business Number and address say the same thing on every document. This guide gives the checklist, a cross-check matrix and the Canadian specifics: federal and provincial registries, the CRA Business Number, GST/HST validation, workers' compensation clearance and privacy rules.

What documents belong on a supplier onboarding checklist in Canada?

A usable checklist has six blocks: legal existence, tax status, banking, insurance, compliance clearances and signed terms. The names are specific to Canada, and the logic is the same everywhere. The table below is a starting point to adapt to your risk level and contract value.

Ask for the minimum your risk justifies. A one-off purchase of CAD 750 does not need the same file as a three-year subcontract. Tiering suppliers by spend and by risk keeps the file proportionate and keeps suppliers willing to answer. Our guide to a vendor due diligence checklist shows how to set those tiers.

How do you cross-check the company ID across incorporation, bank and insurance?

Cross-checking means comparing the same fields (legal name, corporation or Business Number, address, signatory and dates) on each document and recording every difference with a decision. A supplier file is consistent when the registry record is the source of truth and every other document points back to it.

Three mismatches come up repeatedly. First, the bank account belongs to a person or to a different company, the usual pattern behind redirected payments. Second, the certificate of insurance names a parent or an old operating name, so the entity you contract with is not the insured. Third, the incorporation record is old and hides a change of director or a dissolution. None of these proves fraud. Each one needs a named person to decide before the first payment, not after.

A validation tool automates the comparison, not the judgement. Our platform supports more than 3,200 document types and OCR extraction in 24 languages across 32 jurisdictions, so the same matrix can run on a federal Certificate of Incorporation, a void cheque or a CGL certificate. It compares fields, dates and registers and flags differences; it does not prove that a document is genuine.

How do you check the incorporation record and Business Number?

The incorporation record is checked against the public registry that holds it, never only against the PDF the supplier sends. Canada has a federal registry and one for each province and territory, so first find out where the supplier was incorporated.

• Federal. Corporations incorporated under the Canada Business Corporations Act are searchable on the Corporations Canada site, which shows the corporation number, status and registered office. Since January 2024, federal corporations also have to file information on individuals with significant control, held in a registry that is partly public.
• Ontario. The Ontario Business Registry is the place to search provincially incorporated companies and business names and to order a Certificate of Status.
• Quebec. The Registraire des entreprises publishes the Quebec enterprise number (NEQ), the legal form and the state of the enterprise. Records can appear in French, so keep Quebec legal suffixes such as "Ltée" or "S.E.N.C." as written.
• British Columbia. BC Registries and Online Services covers companies, societies and business names in the province.

Check the tax number separately. Every Canadian business registered with the CRA has a nine-digit Business Number, and the GST/HST account adds a program identifier such as "RT 0001". The Canada Revenue Agency offers a GST/HST Registry service where you can enter a supplier's number and confirm that it is active, along with the registered legal name. This matters because input tax credits depend on a valid registration, and a supplier below the CAD 30,000 small supplier threshold may legitimately have no GST/HST number. A valid number under a different name than the incorporation record is worth a phone call.

How do you validate banking details?

Banking details are validated by confirming that the account holder name matches the legal name in the registry, using a bank-issued document rather than an email. In Canada the standard documents are a void cheque, a letter on bank letterhead or a bank-issued confirmation of the account. A screenshot of an online banking page does not qualify.

A Canadian account is identified by a five-digit transit number, a three-digit financial institution number and the account number. Make sure all three are present and legible, and that they match the pre-authorized debit or direct deposit form. Electronic funds transfers over the national rails are described by Payments Canada, which is a useful reference when a supplier asks for wire or EFT instructions you have not seen before.

Unlike the UK or the euro area, Canada does not currently apply a mandatory payee-name matching service at the point of payment, so your own comparison at onboarding is the main control. Treat any change of banking details after onboarding as a new onboarding event: call back on a number already in your file, not the one in the change request. Our article on fake certificates of insurance and vendor fraud covers related patterns.

What must the certificate of insurance show?

A valid certificate of insurance names the same legal entity as the registry, states the insurer, the cover type, the limits in Canadian dollars and a policy period that includes the contract dates. Check four things in order: the named insured, the policy period, the limit per occurrence and the activity covered. CGL is not professional liability, and a policy for "consulting" does not necessarily cover "installation".

Many Canadian contracts ask for CGL limits of CAD 2 million or more per occurrence and for the buyer to be named as an additional insured, but the number belongs in your contract, not in a template. Brokers often issue a certificate on letterhead that is a summary only. Ask for the certificate or the policy declarations, and for contracts above your risk threshold, ask the broker to confirm the cover directly. Diarize the expiry date and request the renewal 30 days before. The vendor compliance certificate verification guide lists the other certificates to track.

Which Canadian clearances and obligations change the checklist?

Workers' compensation clearance is the most common Canada-specific item, and it is set by each province rather than nationally.

• Ontario. Under the Workplace Safety and Insurance Act, a principal who hires a contractor in many industries should obtain a clearance certificate from the WSIB and check that it is current. If the contractor owes premiums, the principal can be asked to pay them. Certificates must be checked again as they lapse.
• Other provinces. WorkSafeBC in British Columbia and the Alberta Workers' Compensation Board issue clearance letters or account status confirmations. Rules, forms and names differ, so use the board of the province where the work is done.
• Quebec. The CNESST holds the equivalent for Quebec, and some contractors also need a licence from the Régie du bâtiment du Québec.
• Federal sanctions and AML context. Suppliers in financial services, real estate or money services may be reporting entities under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. FINTRAC publishes the obligations. For most buyers this is context for supplier questions, not a document the supplier must send.

Privacy shapes how you store the file. A supplier file contains personal information about directors and sole proprietors: names, home addresses, sometimes a SIN on a tax form. The federal Privacy Commissioner of Canada explains the PIPEDA principles, including limiting collection to what is needed and safeguarding it. Knowingly failing to report a breach of security safeguards or to keep the related records can lead to fines of up to CAD 100,000 under PIPEDA. In Quebec, Law 25 adds duties such as privacy impact assessments for some transfers outside the province, and its penal fines can reach CAD 25 million or 4 percent of worldwide turnover, whichever is greater. Collect only the fields you compare and delete what you do not need.

For the wider picture of file types by sector, read the industry verification pillar guide.

What do buyers ask most often about supplier paperwork?

Procurement and finance teams usually ask three things: how old a registry search may be, whether a supplier can be paid into a personal account, and who owns the check. Synthesizing typical questions from procurement and accounts payable forums:

• A search or certificate is usually accepted if dated within the last three months, but because registry searches are quick and inexpensive, running a fresh one is faster than chasing the supplier.
• A sole proprietor may legitimately be paid to a personal account, but the name must match the registered proprietor and the file must say so.
• The check belongs to whoever releases the first payment. Splitting it between procurement and finance without a recorded decision is how mismatches slip through.

Users also complain about chasing suppliers by email for the same document three times. A single upload request that lists exactly which documents are needed, in which format, avoids most of that.

How do you run the checklist in practice?

Run the checklist as a gate: no supplier is activated for payment until every line is validated or has a recorded exception. Seven steps cover most files:

1. Send one request listing every document, the accepted formats and the deadline.
2. Search the right registry yourself and compare it to the supplier's copy.
3. Run the cross-check matrix: name, number, address, signatory, dates.
4. Validate the GST/HST number in the CRA registry.
5. Confirm banking details with a void cheque or bank letter and compare the holder name.
6. Check the certificate of insurance for entity, period, limits and activity, and the clearance certificate where the province requires it.
7. Record the reviewer, the date and any exception, then set expiry reminders.

A spreadsheet can hold the list but cannot enforce the order or alert on expiry. To run these comparisons on your own files, see our pricing page; storage and access controls are described on the security page. You can also start from the CheckFile homepage and test a sample supplier file, which compares fields, dates and registers across the documents.

Frequently Asked Questions

What documents do I need to onboard a new supplier in Canada?

At minimum: a Certificate of Incorporation or business registration, a Business Number and GST/HST number where applicable, a void cheque or bank-issued confirmation, a certificate of insurance and signed terms. Add workers' compensation clearance or licences where the province or the contract requires them.

How do I check that a supplier's bank account is genuine?

Obtain a void cheque or a letter from the bank showing the account holder, transit, institution and account numbers, and compare the holder name to the legal name in the registry. Call back on a known number before acting on any change request.

How recent must a corporate search or certificate be?

Three months is a common internal standard, and some contracts set it explicitly. Running the registry search yourself removes the question.

Does validation prove a supplier document is genuine?

No. Validation compares fields, dates and formats across documents and against registers, and highlights differences for a person to review. It complements the checks your policy requires.

Who is responsible for supplier checks, procurement or finance?

Whoever releases the first payment should own the final decision, with procurement collecting documents. Record the reviewer and date on every file so an audit can see who approved what.