Supplier Onboarding Documents Checklist: Cross-Check Company ID

This article is provided for information only and is not legal advice. Regulatory references are accurate as of the publication date (1 October 2026). Check current rules with a qualified professional before applying them to an individual supplier file.

A supplier onboarding documents checklist lists the papers a buyer collects before a new supplier is created in the payment system: a company registration extract, tax and VAT identifiers, bank details, an insurance certificate and any sector-specific compliance proof. Collecting them is the easy part. The control that prevents bad payments is checking that the legal name, company number and address say the same thing on every document. This guide gives the checklist, a cross-check matrix and the country differences that matter for the UK, France, Germany and Spain.

What documents belong on a supplier onboarding checklist?

A usable checklist has six blocks: legal existence, tax status, payment details, insurance, compliance certificates and signed terms. The names change by country, the logic does not. The table below is a starting point to adapt to your risk level and contract value.

Ask for the minimum your risk justifies. A one-off purchase of 500 euros does not need the same file as a three-year subcontract. Tiering suppliers by spend and by risk keeps the file proportionate and keeps suppliers willing to answer. Our guide to a vendor due diligence checklist shows how to set those tiers.

How do you cross-check the company ID across registration, bank and insurance?

Cross-checking means comparing the same four fields (legal name, company number, address, signatory) on each document and recording every difference with a decision. A supplier file is consistent when the registration extract is the source of truth and every other document points back to it.

Three mismatches come up repeatedly. First, the bank account belongs to a person or to a different company, which is the typical pattern behind redirected payments. Second, the insurance certificate names a group parent or a former trading name, so the legal entity you contract with is not covered. Third, the registration extract is old and hides a change of director or a company in liquidation. None of these proves fraud. Each one needs a named person to decide before the first payment, not after.

A validation tool automates the comparison, not the judgement. Our platform supports more than 3,200 document types and OCR extraction in 24 languages across 32 jurisdictions, so the same matrix runs on a UK Companies House extract, a French Kbis or a Spanish nota simple. It compares fields, dates and registers and flags differences; it does not prove that a document is genuine.

How do you check the registration extract?

The registration extract is checked against the public register that issued it, never only against the PDF the supplier sends. Fetch the record yourself and compare it to the supplier's copy.

• United Kingdom. The Companies House service shows the company number, status, registered office, officers and filing history for free. A company marked "dissolved" or with an overdue confirmation statement deserves a question.
• France. The Kbis comes from the commercial court registry and is searchable through the Annuaire des entreprises, which also shows the SIREN, the SIRET of each establishment and the legal status. Service-public.fr explains what a Kbis contains.
• Germany. The Gemeinsames Registerportal gives access to the commercial register entry, the register number and the managing directors.
• Spain. The Registro Mercantil issues a certificate or nota simple through the Registradores portal.

Check the VAT number separately. In the EU, the Commission's VIES service confirms whether a VAT number is valid and, in many member states, returns the registered name and address. In the UK, the HMRC VAT number checker does the same. A valid VAT number with a different name than the registry is a red flag worth a phone call.

How do you validate bank details?

Bank details are validated by confirming that the account holder name matches the legal name in the registry, using the bank's own confirmation rather than an email. A bank letter, a recent statement header or a bank-issued account confirmation all work. A screenshot of an online banking page does not.

Payment-side name checks now exist in the banking system. In the euro area, Regulation (EU) 2024/886 on instant payments requires payment service providers to offer a verification-of-payee service, matching the payee name to the IBAN, with the obligation applying to euro-area providers from 9 October 2025. In the UK, Confirmation of Payee performs a similar check for domestic transfers. These services protect against typing errors and some fraud, but they are a last line of defence. Your own comparison at onboarding catches the problem earlier and leaves an audit trail.

Treat any change of bank details after onboarding as a new onboarding event: call back on a number already in your file, not the one in the change request. Our article on fake certificates of insurance and vendor fraud covers related patterns.

What must the insurance certificate show?

A valid certificate of insurance names the same legal entity as the registry, states the insurer, the cover type, the limits and a policy period that includes the contract dates. Check four things in order: insured name, policy period, limit per claim and the activity covered. Public liability is not professional indemnity, and a policy for "consulting" does not necessarily cover "installation".

Brokers sometimes issue a summary on letterhead. Ask for the certificate or the schedule, and for contracts above your risk threshold, ask the broker to confirm cover directly. Diarise the expiry date and request the renewal 30 days before. The vendor compliance certificate verification guide lists the other certificates to track.

Which country-specific certificates change the checklist?

Some countries make the buyer legally exposed if a supplier fails its tax or social security duties, so a clearance certificate becomes mandatory in the file.

• France. A buyer who contracts for 5,000 euros or more excluding tax must collect the supplier's attestation de vigilance from the Urssaf and renew it every six months, under article L8222-1 of the Code du travail. The buyer can be held jointly liable for undeclared work if it does not.
• Germany. Construction clients may need a Freistellungsbescheinigung under section 48b of the Einkommensteuergesetz, and many buyers request a Unbedenklichkeitsbescheinigung from the tax office and social bodies. Companies in scope of the Lieferkettensorgfaltspflichtengesetz add supply chain due diligence questions.
• Spain. Subcontracting triggers certificates of being up to date with the tax agency and with social security, issued by the Agencia Tributaria and the Seguridad Social.
• United Kingdom. No equivalent clearance certificate exists for general suppliers; construction contractors work under the CIS scheme, where the contractor verifies the subcontractor with HMRC.

For a France-specific walk-through, see our article on the attestation de vigilance for suppliers. For the wider picture of industry file types, read the industry verification pillar guide.

What do buyers ask most often about supplier paperwork?

Procurement and finance teams usually ask three things: how old a registration extract may be, whether a supplier can use a personal bank account, and who owns the check. Synthesising typical questions from procurement and accounts payable forums:

• A registration extract is usually accepted if issued in the last three months, but because the public register is free in many countries, fetching a fresh record is faster than chasing the supplier.
• A sole trader may legitimately be paid to a personal account, but the name must match the registered trader and the file must say so.
• The check belongs to whoever releases the first payment. Splitting it between procurement and finance without a recorded decision is how mismatches slip through.

Users also complain about chasing suppliers by email for the same document three times. A single upload request that lists exactly which documents are needed, in which format, avoids most of that.

How do you run the checklist in practice?

Run the checklist as a gate: no supplier is activated for payment until every line is validated or has a recorded exception. Seven steps cover most files:

1. Send one request listing every document, the accepted formats and the deadline.
2. Fetch the registry record yourself and compare it to the supplier's extract.
3. Run the cross-check matrix: name, number, address, signatory, dates.
4. Validate the VAT number on the official service.
5. Confirm bank details with a bank-issued document and compare the holder name.
6. Check the insurance certificate for entity, period, limits and activity.
7. Record the reviewer, the date and any exception, then set expiry reminders.

A spreadsheet can hold the list but cannot enforce the order or alert on expiry. To run these comparisons on your own files, see our pricing page; storage and access controls are described on the security page. You can also start from the CheckFile homepage and test a sample supplier file, which compares fields, dates and registers across the documents.

Frequently Asked Questions

What documents do I need to onboard a new supplier?

At minimum: a registration extract, a VAT or tax identifier, bank details confirmed by the bank, an insurance certificate and signed terms. Add clearance certificates or licences where the law or the contract requires them.

How do I check that a supplier's bank account is genuine?

Obtain a bank-issued document showing the account holder and IBAN, and compare the holder name to the legal name in the registry. Where available, use your bank's verification-of-payee or confirmation-of-payee service as an extra check.

How recent must a company registration extract be?

Three months is the common internal standard, and some countries or contracts set it explicitly. Fetching the record from the public register yourself removes the question.

Does validation prove a supplier document is genuine?

No. Validation compares fields, dates and formats across documents and against registers, and highlights differences for a person to review. It complements the checks your policy requires.

Who is responsible for supplier checks, procurement or finance?

Whoever releases the first payment should own the final decision, with procurement collecting documents. Record the reviewer and date on every file so an audit can see who approved what.