Supplier Onboarding Evidence Checklist: What to Keep

A supplier onboarding evidence checklist is most useful when every item carries a state, not just a tick. Sort each piece of evidence into requested, retrieved or unresolved. Requested evidence came from the supplier. Retrieved evidence came from a named source at a recorded time. Unresolved evidence is missing, conflicting or pending. The reviewer then decides on what the file actually shows.

This guide is for procurement, finance and compliance teams who approve new suppliers, and for anyone automating part of that work. It lists the evidence items most teams collect, explains what each source can and cannot confirm, and shows how to keep the decision separate from the evidence behind it.

A supplier onboarding evidence checklist, built on states

A tick in a column says that someone looked. It does not say what they found, where they found it or whether anything was left open.

A state-based checklist fixes that. Each row answers one question about the supplier and records five things: the question, the state, the source or the person who supplied the information, the date, and a short note.

The file supports one decision: whether this supplier can be onboarded under your policy, with or without conditions. It does not establish that a supplier is trustworthy, solvent or compliant in general.

A reviewer should be able to read the checklist and see three lists at a glance: what the supplier claimed, what sources confirmed and what nobody has resolved yet.

Ticked boxes. Missing answers.

Most onboarding files are assembled under time pressure. A buyer wants the supplier live, the finance team needs bank details and the checks run in whatever order people get to them.

The common failures are not dramatic:

• A supplier's own statement is recorded as if a register had confirmed it.
• A screening result has no date, so nobody knows which list version was used.
• A check that returned nothing is filed as a clean result.
• Evidence about a parent company is attached to the contracting subsidiary.
• The approval sits in an email thread, away from the evidence it relied on.

Each one is harmless until someone asks why the supplier was approved. Then the file has to be reconstructed from memory.

Decide the questions first

Start by writing the questions your policy needs answered for this kind of supplier. The core set for most businesses is short.

• Contracting entity: which legal entity will sign and invoice, with its registration number and country.
• Registration status: whether the register shows the company as active, and who is on file as a director.
• VAT number: whether it is valid for intra-EU transactions, where relevant.
• Bank account: whether the account the supplier gave you belongs to that supplier.
• Ownership: who owns or controls the company, as far as the available records show.
• Screening: whether the entity, and the people your policy names, match a sanctions or PEP list.

Optional items depend on risk, value and sector. They can include adverse media, court records, insurance certificates and quality accreditations. Mark which items are mandatory for this supplier class before anything runs, so a missing optional item is not mistaken for a failed mandatory one.

For the identity questions in detail, see supplier identity verification before onboarding and the guide to trading names versus legal names.

Sources confirm. People decide.

Every source answers a narrower question than its label suggests. Record what it actually confirmed.

A company register confirms what the register holds about an entity at the time you looked. It is the right anchor for the legal name, number, status and directors on file.

A VAT number check is narrower. The EU's Your Europe page on VIES describes VIES as a search engine, not a database, that retrieves data from national VAT databases. An invalid status means the number is not registered in the relevant national database, which can include a registration that is not finalised yet. The same page says national authorities will not supply the name and address behind a VAT number for data protection reasons. KVK lists further causes of an invalid result, including changes not yet processed and a temporarily unavailable national database.

Bank details need their own evidence. An IBAN format check says the number is well formed, not who holds the account. In the euro area, the ECB explains that payment service providers had to offer verification of payee by 9 October 2025. The service tells the payer about discrepancies between the account identifier and the payee name, with results of match, close match, no match or other. Keep that result with the bank details.

Ownership is often partly unretrievable. On 22 November 2022, the Court of Justice of the EU ruled invalid the provision of the EU anti-money-laundering directive under which beneficial ownership information had to be accessible in all cases to any member of the general public. Depending on the member state, you may only have the supplier's own declaration. In the UK, Companies House states that identity verification became a legal requirement on 18 November 2025 for directors and people with significant control. That verifies who they are, not that every filed detail is complete.

Screening results are matches, not findings. A possible match opens a review, as covered in our guide to reviewing a sanctions name match. No match against the lists checked is not a clearance of everything else.

Record the decision as its own entry: who decided, when, under which policy version and on which evidence. If an AI agent assembled the file, record that too. An agent can collect and compare evidence, but the approval belongs to the person your policy names.

One file. Then keep it current.

Building the checklist into a workflow is mostly about discipline in what gets recorded.

• Create the file before any check runs, with the questions and their mandatory or optional status.
• Record supplier statements as requested evidence, with the document or message they came from.
• Record source results as retrieved evidence, with the source, the identifier used and the retrieval time.
• Move anything missing, conflicting or pending into unresolved, with a note on what would resolve it.
• Route unresolved mandatory items to the reviewer instead of letting the workflow proceed by default.
• Store the decision with a link to the evidence it relied on.

A fictional example shows the states in use. Brightwater Fittings B.V. supplies its registration number, a VAT number and an IBAN. The register record matches the entity on the quotation, so that row is retrieved. VIES returns invalid, so the VAT row is unresolved, with a note that the supplier says its registration is recent. The bank's verification of payee returns close match, so the bank row is also unresolved until the supplier explains the name difference. The reviewer can approve with conditions or wait, but the file shows exactly why.

Evidence ages. Registration status, directors and list contents change after onboarding, so set a re-check interval per item rather than one date for the whole file. Our article on company registry data freshness explains what each date in a record means.

How we approach it

Apiosk runs the source checks that fill the retrieved column. Company verification returns the legal name, number, registered address, status, registration date and directors on file from the official register. Identifier validation checks VAT numbers, IBANs and company numbers against the issuing source, and sanctions and PEP screening returns match or no match, with the score, the list and a timestamped record of the check.

Our pricing page describes a full supplier check that combines the register, IBAN, sanctions and news checks into one report. Before anything runs, you see the sources and the maximum cost and approve them. Ownership comes from available official filings, so where a register does not publish ownership, the gap stays visible instead of being filled.

After onboarding, change alerts can repeat an approved check on a schedule and send only what changed to Slack or Gmail. The approval decision itself stays with your reviewer.

Onboarding files hard to defend? Keep the evidence.

If your supplier files mix claims, results and approvals, see the checks Apiosk runs and start the next onboarding with the source attached to every row.

This article was prepared with AI assistance using the linked European Commission, ECB, CJEU, KVK and Companies House pages and the current Apiosk product pages. It is not legal advice, and Brightwater Fittings B.V. is fictional.