Supplier onboarding form template

Templates are guides only. Adapt this form to your own policies and check it with your legal and finance teams before use. This is not legal advice.

A supplier onboarding form (often called a supplier set-up form or new vendor form) collects what Finance and Procurement need before a supplier can be paid. Use it alongside our supplier onboarding checklist, which covers the checks you run on the answers. Ask only for what you'll use: a short form that suppliers complete properly is better than a long one they skip.

Section 1: About the supplier

Field	Notes
Legal name	Exactly as registered. Payments and contracts must use the legal name, not a trading name.
Trading name, if different	The name that will appear on invoices.
Type of organisation	Limited company, LLP, partnership, sole trader, charity, public body or other.
Company or charity number	Check it on Companies House or the relevant charity register.
Registered address	And a trading address if different.
VAT number	If VAT registered. Check it with HMRC's VAT number checker on GOV.UK.
Website	Useful for checking the supplier is who it says it is.
Parent company, if any	Helps with group-level checks, such as modern slavery statements and credit risk.

Section 2: Contacts

Contact	Why you need it
Account or relationship manager	Day-to-day contact for the work.
Accounts receivable (credit control)	For invoice and payment questions, and the number to use for bank detail call-backs.
Escalation contact	A senior person to contact if service goes wrong.
Data protection or security contact	If they will handle your personal data or access your systems.

For every contact, ask for a name, role, email and phone number. Record where the call-back number came from: a number from the supplier's letterhead or website, checked independently, is safer than one given in the same email as the bank details.

Section 3: Payment details

Field	Notes
Bank account name	Should match the supplier's legal name. A mismatch is a warning sign.
Sort code and account number	Or IBAN and BIC for overseas suppliers.
Bank name	For reference.
Remittance email	Where to send payment advice.
Payment terms	Agreed terms, for example 30 days from a valid invoice. Public bodies have their own rules on paying suppliers promptly.
Currency	If not sterling.

Never accept bank details, or a change to them, on email alone. Call the supplier back on a number you already hold, run a Confirmation of Payee check through your bank, and consider a penny test. See our penny test and bank detail fraud guide. Collect bank details through a secure form or portal rather than an email attachment, and limit who can see them.

Section 4: Tax and employment status

Construction Industry Scheme (CIS). If they will do construction work for you and you're a CIS contractor, you need their UTR so you can verify them with HMRC.
Off-payroll working (IR35). If you're engaging an individual through their own company, decide and record whether the off-payroll rules apply. Medium and large organisations must make a status determination.
Umbrella companies and agencies. If workers are supplied through an agency or umbrella company, record which, as responsibility for PAYE can depend on the supply chain.

Section 5: Insurance and certificates

Item	Ask for
Public liability insurance	Certificate, cover amount and expiry date.
Employers' liability insurance	Required by law for most employers. Certificate and expiry date.
Professional indemnity insurance	For advice, design and professional services.
Cyber insurance	Where they hold your data or access your systems.
Certifications	Cyber Essentials, ISO 27001, ISO 9001, ISO 14001 or trade accreditations (such as Gas Safe), with expiry dates.

Section 6: Policies and declarations

Acceptance of your supplier code of conduct.
Modern slavery: a link to their statement if their turnover is £36 million or more. Our modern slavery statement checker explains the rules.
Anti-bribery and anti-fraud: confirmation they have proportionate procedures.
Data protection: whether they will process personal data on your behalf. If so, you need a written contract meeting UK GDPR Article 28. See our DPA checklist.
Conflicts of interest: any links between the supplier and your staff, directors or trustees. Ask your own team to declare too.
Sanctions: confirmation that neither the supplier nor its owners are subject to UK sanctions. Check the UK Sanctions List yourself as well.

Section 7: Internal approval

This part is for your team, not the supplier.

Field	Notes
Requested by	Who needs the supplier, and why.
Internal owner	The named person who manages the relationship.
Tier	T1 to T4. Try our supplier risk tier calculator.
Expected annual spend	Helps decide the tier and approval level.
Checks completed	Companies House, VAT, sanctions, bank detail verification, insurance, with dates.
Approved by and date	A named person with the authority for this tier.

Keep it proportionate

A one-off low-value supplier may only need sections 1 to 3 and the conflict and sanctions declarations. A supplier handling personal data or critical services needs the whole form plus a due diligence questionnaire.

In SupplierVault, the supplier set-up form is built in. On the Professional plan and above, suppliers fill it in through a secure portal; bank detail changes put their invoices on hold until a call-back and checks are recorded; and the tier decides which other checks are created. Edit any question to match your policy.

Try the live demo