Tuesday, October 20, 2026

Vendor onboarding checklist: what to check before you pay a new supplier

Procapy Team

On a Tuesday in May, a plant engineer at a packaging manufacturer in Cikarang asks procurement to add a new vendor. The main air compressor has failed, and the engineer has found a contractor who can repair it this week. Procurement sets the vendor up that afternoon, from a photo of an NPWP card and a bank account number sent over WhatsApp.

The invoice arrives on Thursday: Rp 96,800,000 for parts and labour. The engineer confirms the work was done, the plant manager approves the invoice and it’s paid in Friday’s run. Over the next eight months, three more maintenance invoices are paid, bringing the total to Rp 320,550,000.

Then internal audit looks at the vendor. The NPWP belongs to a real company with a similar name, which has never heard of the plant. The bank account is held by a relative of the engineer. And the compressor was repaired for free, under the manufacturer’s warranty. Procurement, the plant manager and AP each handled one step, and each step looked reasonable on its own.

Catching that is the job of vendor onboarding. This guide covers what to collect from a new vendor, how to check it, the compressor vendor run through those checks, how to handle bank account changes (the other way money ends up in the wrong account) and the Indonesian details.

What is vendor onboarding?

Vendor onboarding is how a new supplier gets into your vendor master: collecting its legal, tax and bank details, checking that they’re genuine and belong to the same company, making sure it isn’t already in the master or connected to someone inside the company, and approving it before anyone can order from it or pay it.

The vendor master is the list of every supplier you can pay, with the details each payment relies on: legal name, tax ID, address, contacts, payment terms and bank account. Every payment run trusts it. That makes a vendor record a standing instruction to pay, and creating or changing one deserves the same care as approving a payment.

Onboarding doesn’t end with the first payment. Every later change to the record, above all to the bank account, needs the same checks again. A common vendor payment fraud doesn’t involve a new vendor at all: it’s a convincing email, apparently from a supplier you’ve paid for years, with new bank details.

The vendor onboarding checklist

What to collect from every new vendor:

Legal name and type: the name exactly as registered, and whether it’s a company, a partnership or an individual. Every other document is checked against this name.
Tax registration: the tax ID, and whether the vendor is registered for VAT.
Business registration: the business licence and, for a company, the deed that names its directors and shareholders.
Bank account: evidence that the account is held in the vendor’s legal name, such as a letter from the bank or the header of a recent statement.
Contacts: a named finance contact, with a phone number and email address.
Commercial terms: what they’ll supply, payment terms, currency and the contract or accepted quote.
The business reason: who asked for the vendor, what for and why an approved vendor can’t do the job.

Vendor onboarding, step by step

Request. The person who needs the vendor raises a request with the business reason, rather than a chat message to procurement.
Collect. The vendor completes the form and sends its documents itself, through one channel, instead of through the colleague who wants it added.
Verify. The name matches across the tax ID, licence and bank account, and someone calls the vendor on a number found independently, such as on its website, not the one on the form.
Check for duplicates and conflicts. Search the vendor master for the same tax ID, bank account, address or phone number, and compare the vendor’s details with your employees’.
Approve. By someone other than the requester and whoever entered the data, with a second approval for riskier vendors, such as one paid into a personal account.
Activate, with limits. For the entities and categories it was approved for, and nothing else.
Review. Re-check the details of active vendors periodically, and deactivate the ones you no longer use.

A worked example: the compressor vendor, checked

Here is the request from the opening, run through the checklist. The engineer still asks on Tuesday. Procurement sends the onboarding form to the vendor and checks what comes back:

Check	What it would have shown
Documents from the vendor	None: everything came from the engineer’s phone
Name on the NPWP	A different company, with a similar name
Licence and deed	Not provided
Bank account holder	An individual, not a company
Call-back to the company	It has never worked for the plant
Address against HR records	The engineer’s home address
Why not an existing vendor?	Still under the manufacturer’s warranty

Any one of these lines would have stopped the vendor before the first payment, and none needs special tools: a form, a phone call, a search of the vendor master and the HR records, and asking why an approved vendor can’t do the job. A genuine contractor passes them all in a day. The checks only slow down a vendor that can’t pass them.

The urgency is part of the pattern. A vendor that must be added this week, for work only one person can vouch for, is exactly the one whose checks shouldn’t be skipped.

Bank account changes: the riskiest moment after onboarding

An email from your logistics vendor’s finance manager, on the vendor’s letterhead, says the company has moved banks and asks you to pay this month’s invoices to the new account. The address is one letter different from the real one, or it’s the real address, sent from a mailbox someone has broken into. A bank account change should never be made on an email, a letter or a chat message alone:

Call back on a number you already had, not the one in the request, and ask for the same evidence as at onboarding.
Have one person enter the change and another approve it, and record both in your audit trail.
Tell the vendor’s existing contact that the change was made, so a real vendor hears about a change it didn’t ask for.
Watch the timing. A change just before a large payment, followed by pressure to pay quickly, is the pattern.

Why vendor onboarding goes wrong

Anyone can create a vendor. Procurement or AP adds whoever a colleague says is urgent, and nobody approves the record.
Documents come from the requester, not the vendor. A photo forwarded on WhatsApp proves only that someone had a photo.
Names that almost match. CV or PT, with or without “Indonesia”, a brand instead of the legal name. Nobody compares the name on the bank account with the name on the tax ID.
Duplicates nobody looks for. The company already exists under another code, which splits its history and makes duplicate payments easier.
One person does too much. The same person creates the vendor and approves its invoices, or changes its bank account and releases the payment.
Urgency as an override. “The line is down” or “the event is tomorrow” skips the checks, and the exception becomes the process.
Records that are never reviewed. Vendors stay active for years after their last invoice, and a dormant record is an easy one to reuse.

Vendor onboarding in Indonesia

NPWP and PKP status. Check that the name on the NPWP matches the legal name, and record whether the vendor is a VAT-registered business (Pengusaha Kena Pajak, PKP): only a PKP can issue a faktur pajak, and input VAT (PPN masukan) can only be credited with a complete and correct one. A vendor that charges VAT without being a PKP is a question to ask before the first invoice.
Withholding depends on who the vendor is. Whether you withhold income tax, and which, depends on what the vendor supplies and whether it’s a company or an individual, and tax is generally withheld at a higher rate from vendors without an NPWP. Record the vendor type and NPWP at onboarding, so the first invoice is withheld correctly.
NIB and the deed. The business identification number (Nomor Induk Berusaha, NIB) shows that the business is registered. The deed of establishment (akta pendirian) and its latest amendment name the directors and shareholders, which you can check against your employees.
Accounts in the right name. Pay a PT or a CV into an account in that PT’s or CV’s name. Small businesses often use a personal account; accept one only as a documented exception, with a second approval.
Individual vendors and UU PDP. For freelancers and consultants, the KTP, NIK and personal bank account are personal data under UU PDP. Collect only what you need, keep it in one place and limit who can see it, not in chat groups and shared drives.

Signs your vendor onboarding needs work

You probably need to look at how you onboard vendors if any of these sound familiar:

Anyone in procurement or AP can create a vendor, and nobody approves it.
Vendor documents arrive on WhatsApp, forwarded by the person who wants the vendor.
Bank details are changed on the strength of an email or a letter.
The same NPWP or bank account appears under more than one vendor code.
Vendors you haven’t paid in years are still active.
Some vendors are paid into personal accounts, and nobody can say why.
Nobody has ever compared vendor addresses and bank accounts with employees’.

A vendor record is a standing instruction to pay. Create one with the same care as a payment.

How to set up vendor onboarding

Separate the roles. The requester, the person who enters the data and the approver are three different people, and whoever creates a vendor doesn’t approve its invoices. Put vendor approval in your approval matrix.
Use one form and one channel. A standard onboarding form that the vendor completes itself, with the documents attached, instead of photos passed along by colleagues.
Decide what each type of vendor needs. A company supplying goods, an individual consultant and an overseas software vendor need different documents. Set the list for each type, and what’s mandatory.
Treat changes like new vendors. Changes to the bank account, legal name or tax ID are verified and approved by a second person, and payments to a new account wait until that’s done.
Start new vendors on purchase orders. For a new vendor’s first invoices, require a PO and a receipt confirmed by someone other than the requester, so three-way matching has something to check.
Clean up the master once, then keep it clean. Merge duplicates, deactivate vendors you haven’t used in, say, 18 months, and re-confirm the bank details of your largest vendors every year.

How Procapy helps

In Proca to Pay, spend starts from your approved vendor list, with catalogue items and contract prices, and quotes are compared side by side and kept with the request. New vendors are onboarded and verified before they can be used: they need a tax registration, ownership details and bank account evidence before they can be invoiced against. Procapy checks for near-identical vendor names and bank accounts already in the master.

Any change to a vendor’s bank details triggers a separate approval, by a different person from the one who made the change. The person who creates a vendor can’t approve its invoices, changing vendor bank details is a separate role, and every change is in the audit log. Invoices from vendors that don’t match the approved list are flagged and held before approval. Before a payment file is built, the bank account on each payment is checked against the verified vendor master. A payment to an account that changed after the invoice was approved is held until the change is approved, and releasing a payment needs dual authorisation.

In a group, vendor records can be shared across entities or held per entity, with bank accounts, payment terms and tax registrations kept at entity level. The fraud and risk page covers the rest of the checks. Book a 30-minute walkthrough, bring a month of vendor invoices, and we’ll run them through the duplicate, mismatch and policy checks live.

Back to blog