To onboard a vendor you usually need three documents: a tax form (a W-9 for US vendors), a certificate of insurance, and proof of bank details such as a bank letter or voided cheque. Checking them quickly comes down to a short list of fields: the legal name matches across all three, the tax ID has the right format, the insurance is in force with the right limits, and the routing number passes its checksum. Anything that fails gets flagged before the first payment, not after.
What documents do you need to onboard a vendor?
The exact set depends on your company and the vendor's country, but most onboarding packs look like this:
| Document | What it proves | Key fields |
|---|---|---|
| W-9 (US) or tax registration | Who the vendor is for tax purposes | Legal name, tax classification, TIN or EIN, signature, date |
| Certificate of insurance | The vendor carries the cover your contract needs | Insured name, policy numbers, effective and expiry dates, limits, certificate holder |
| Bank letter or voided cheque | Where payments should go | Account holder name, bank name, routing number, account number, date |
| Your vendor setup form | Contact, terms, remit-to address | Payment terms, remittance email, contacts |
Outside the US the forms change but the logic does not. You still need proof of tax identity, proof of insurance and proof of bank details, and the name should be the same on all of them.
What should you check on a W-9?
The W-9 is short, which makes it easy to skim past problems. Check these fields:
- Line 1, name. Must be the name shown on the vendor's income tax return. For a company, that is the legal entity name, not the brand.
- Line 2, business name. The trading name or DBA, if different. Useful for matching invoices that use the brand name.
- Federal tax classification. Exactly one box should be ticked. If LLC is ticked, the tax classification letter should be filled in.
- Address. Should match what the vendor gave you on the setup form.
- TIN. Either an SSN or an EIN. An EIN is nine digits in the format XX-XXXXXXX. A TIN with eight digits or letters in it is a typo, and the form goes back.
- Signature and date. Most AP teams require a signed, dated form as part of their policy, and unsigned W-9s come in all the time.
- Form revision. Use the current IRS revision of the form.
A format check confirms the EIN is shaped correctly. Whether it belongs to that business is a separate check, which the IRS TIN Matching program handles if you are enrolled.
What should you check on a certificate of insurance?
In the US most certificates use the standard ACORD 25 layout. The certificate itself is information only; it does not change the policy. Its job is to show you what cover is in place.
Check:
- Insured name. Matches the vendor's legal name on the W-9. A parent company or a different entity is a question for the vendor.
- Policy effective and expiry dates. Every policy you need should be in force today. If any expires before the work ends, note the date and ask for the renewal certificate in advance.
- Coverage types. General liability, auto, workers' compensation, umbrella: whatever your contract asks for.
- Limits. Each occurrence and aggregate limits should meet or exceed your contract minimums.
- Certificate holder. Your company's correct legal name and address.
- Additional insured. If your contract requires it, the box should be marked for the relevant policy.
An illustrative example of what a flag looks like: "General liability expiry 2026-11-30 is before contract end date 2027-03-31." That is a renewal reminder, not a reason to stop onboarding, but someone needs to own it.
How do you verify a bank letter or voided cheque?
Bank details are where onboarding fraud tends to show up, so they deserve the most care. Check:
- Account holder name. Same legal name as the W-9. A personal name on a company's bank letter is a red flag.
- Bank name. Should be the bank that issues the routing number.
- Routing number. Nine digits, and it must pass the ABA checksum (more on this below).
- Account number. Present and plausible. On a voided cheque, compare it with the MICR line printed at the bottom.
- Letter details. On bank letterhead, signed by a bank officer, and recently dated.
If bank details arrive by email, or change after onboarding, call the vendor on a number you already have on file before you update anything. Do not use the phone number in the email.
How does a routing number checksum work?
US bank routing numbers (ABA numbers) have a check built in. Take the nine digits, multiply them in order by 3, 7, 1, 3, 7, 1, 3, 7, 1, and add up the results. For a real routing number, the total is always divisible by 10.
Here is an illustrative number, 123456780:
- 1x3 + 2x7 + 3x1 + 4x3 + 5x7 + 6x1 + 7x3 + 8x7 + 0x1
- = 3 + 14 + 3 + 12 + 35 + 6 + 21 + 56 + 0 = 150
150 divides by 10, so the number passes. Change the last digit to 9 and the total becomes 159, which fails.
The checksum catches typos and most transposed digits instantly. It cannot tell you whether the account belongs to your vendor. That is what the name match and the call-back are for.
What should you flag for follow-up?
Keep the list short and specific, so each flag is something a person can resolve:
- Legal name differs between W-9, certificate and bank letter
- TIN or EIN in the wrong format
- W-9 unsigned or undated (where your policy requires a signature)
- Any insurance policy expired, or expiring before the contract ends
- Coverage limits below your contract minimum
- Your company missing as certificate holder or additional insured
- Routing number fails the ABA checksum
- Account holder name does not match the vendor
- Bank details received or changed by email
How can you check vendor documents faster?
The SensiDocs Vendor compliance pack reads W-9s, certificates of insurance and bank letters from PDFs, scans or phone photos and returns the fields as structured data. Routing numbers are validated against the ABA checksum and EINs are checked for format. A failed check flags the field even if the model read it confidently.
Every field is either accepted or flagged with a plain reason: not found, failed a check, contradicted, bad format, not grounded in the document, or low confidence. Doubtful fields get a second, independent read, and a value is only accepted when both reads agree. In review, you see the highlighted fields and fix them in place.
If you also onboard workers rather than companies, the Staffing pack covers worker onboarding paperwork the same way.