Supplier Onboarding Documents Checklist (US): Cross-Check Company ID

This article is provided for information only and is not legal or tax advice. Regulatory references are accurate as of the publication date (October 1, 2026). Check current rules with a qualified attorney or CPA before applying them to an individual supplier file.

A supplier onboarding documents checklist lists the papers a US buyer collects before a new vendor is created in the accounts payable system: a signed IRS Form W-9, a state certificate of good standing, bank details, a certificate of insurance and any industry-specific licenses. Collecting them is the easy part. The control that prevents bad payments is confirming that the legal name, EIN, address and signer match on every document. This guide gives the checklist, a cross-check matrix and the US rules that shape it, from backup withholding to OFAC screening.

What documents belong on a US supplier onboarding checklist?

A usable US checklist has seven blocks: legal existence, tax identity, payment details, insurance, sanctions screening, licenses and signed terms. The table below is a starting point to adapt to spend and risk.

Ask for the minimum your risk justifies. A one-time $500 purchase does not need the file a three-year subcontract needs. Tiering vendors by annual spend and by risk (access to systems, access to customer data, work on your premises) keeps the file proportionate. Our vendor due diligence checklist shows how to set the tiers.

How do you cross-check the company ID across W-9, good standing and insurance?

Cross-checking means comparing the same fields (legal name, tax ID, address, signer, dates) on each document and recording every difference with a named decision. The state registry record is the source of truth for the legal name; the W-9 is the source of truth for the tax identity; every other document must point back to them.

A validation tool automates the comparison, not the judgment. Our platform supports more than 3,200 document types and OCR extraction in 24 languages across 32 jurisdictions, so the same matrix runs on a Delaware good standing certificate, a W-9 and an ACORD 25. It compares fields, dates and registers and flags differences; it does not prove that a document is genuine.

How do you check the W-9 and the EIN?

Collect a signed W-9 from every US supplier before the first payment, and compare its name and TIN to the state record and to the bank account. The IRS Form W-9 page provides the current form and instructions. The form gives you the supplier's legal name, federal tax classification, address and taxpayer identification number (an EIN for most businesses, an SSN for many sole proprietors).

Why it matters: if a payee gives no TIN, or the IRS reports a name and TIN mismatch, you may have to apply backup withholding, currently 24 percent, on reportable payments. Review the IRS guidance on backup withholding with your tax team.

To verify name and TIN combinations before you file, enroll in the IRS TIN Matching program, part of e-Services. It tells you whether a name and TIN combination matches IRS records. It does not tell you whether the person on the phone is who they claim to be, and it does not check the bank account.

Foreign suppliers. A non-US entity normally provides Form W-8BEN-E instead of a W-9, which records its country of residence, its foreign tax ID and any treaty claim. Check that the entity name matches the foreign registry extract, and send payment and withholding questions to a tax professional.

How do you check the certificate of good standing?

A certificate of good standing is checked against the Secretary of State record for the state of formation, not only against the PDF the supplier sends. Every state runs its own business search. The National Association of Secretaries of State links to each state's business services, and Delaware, a common state of incorporation, publishes its entity services through the Delaware Division of Corporations.

Federal contractors have an additional record: the SAM.gov registry holds a registered entity's name, address, Unique Entity ID and registration status, and is worth consulting when you subcontract on federal work.

How do you validate bank details?

Bank details are validated by obtaining a bank-issued document and confirming that the account holder name matches the legal name on the W-9 and the state record. A voided check, a bank letter on letterhead or a statement header showing the holder, routing number and account number all work. A screenshot of an online banking page or an email with new instructions does not.

Business email compromise is the main risk. The FBI Internet Crime Complaint Center warns about fraudsters impersonating vendors to change ACH details, and the Nacha operating rules include fraud-monitoring provisions for originators. These tools are a last line of defense; your own comparison at onboarding leaves an audit trail.

Treat any change of bank details after onboarding as a new onboarding event: call back on a number already in your file. Our article on fake certificates of insurance and vendor fraud covers related patterns.

What must the certificate of insurance show?

A valid certificate of insurance names the same legal entity as the state record and shows the insurer, the coverage type, the limits and a policy period that includes the contract dates. Most US certificates use the ACORD 25 Certificate of Liability Insurance form; ACORD is the standards body behind it.

Check these items in order: the named insured, the policy effective and expiration dates, the per-occurrence and aggregate limits, and the type of coverage (general liability, professional liability, workers' compensation, auto). Then check the contract requirements: whether your company is listed as an additional insured or certificate holder, and whether a waiver of subrogation is required.

A certificate is informational and does not by itself prove that an endorsement exists. For higher-risk contracts, ask for the endorsement and have the broker confirm coverage. See also the vendor compliance certificate verification guide.

Which US compliance checks apply on top of the documents?

Three screens sit beside the paperwork: sanctions, beneficial ownership status and data protection.

• OFAC sanctions screening. The Treasury's Office of Foreign Assets Control publishes the Specially Designated Nationals (SDN) list and related lists at ofac.treasury.gov. US persons are generally prohibited from dealing with listed parties, and OFAC enforces on a strict liability basis, so screen the supplier name, owners where known, and addresses at onboarding and again periodically.
• FinCEN and the Bank Secrecy Act. Most buyers are not BSA financial institutions, but your bank is, and its questions about your payment flows follow from it.
• Corporate Transparency Act. The Corporate Transparency Act created a federal beneficial ownership reporting regime. In March 2025 FinCEN issued an interim final rule narrowing it: domestic companies and US persons are no longer required to file beneficial ownership information reports, and the requirement now focuses on entities formed under foreign law that register to do business in the United States. The rules have moved several times, so do not make a BOI receipt a standard item; see the FinCEN beneficial ownership page.
• State privacy laws. There is no single federal privacy statute. State laws such as the California Consumer Privacy Act apply depending on your size and the data involved. A supplier handling personal data for you should sign a data protection addendum, and the signer should be an authorized officer.

For the wider picture of industry file types, read the industry verification pillar guide.

How do you run the checklist in practice?

Run the checklist as a gate: no supplier is activated for payment until every line is validated or has a recorded exception. Eight steps cover most files:

1. Send one request listing every document, the accepted formats and the deadline.
2. Collect the signed W-9 (or W-8BEN-E) and compare the name to the state record.
3. Look up the entity on the Secretary of State site and record its status.
4. Run the cross-check matrix: name, tax ID, address, signer, dates.
5. Confirm bank details with a bank-issued document and compare the holder name.
6. Check the ACORD 25 for the named insured, period, limits and additional insured wording.
7. Screen the supplier against the OFAC SDN list and keep the result.
8. Record the reviewer, the date and any exception, then set expiry reminders.

A spreadsheet can hold the list but cannot enforce the order or alert on expiry. To run these comparisons on your own files, see our pricing page; storage and access controls are described on the security page. You can also start from the CheckFile homepage and test a sample supplier file, which compares fields, dates and registers across the documents.

Frequently Asked Questions

What documents do I need to onboard a new US supplier?

At minimum: a signed Form W-9, a state certificate of good standing, bank details confirmed by a voided check or bank letter, a certificate of insurance and signed terms. Add licenses, a W-8BEN-E for foreign entities and an OFAC screening record where your policy requires them.

How do I check that a supplier's EIN is valid?

Compare the W-9 name and EIN to the state registry record and to the bank account holder. For a formal name and TIN match, use the IRS TIN Matching program, which is part of IRS e-Services.

Do I need a beneficial ownership filing from my suppliers?

Not as a standard item. The Corporate Transparency Act reporting scope was narrowed in 2025 and may change again, so check the current FinCEN guidance and your counsel's advice before making it a requirement.

Does validation prove a supplier document is genuine?

No. Validation compares fields, dates and formats across documents and against registers, and highlights differences for a person to review. It complements the checks your policy requires.

Who is responsible for supplier checks, procurement or finance?

Whoever releases the first payment should own the final decision, with procurement collecting documents. Record the reviewer and date on every file so an audit can see who approved what.