Supplier onboarding checklist: what to ask for and check

Onboarding a supplier usually means sending a questionnaire and collecting whatever comes back. The weak point is not the questions. It is that the answers are rarely checked against anything the supplier did not write.

This checklist is for UK buyers. For each item it gives what to ask for, where to check it independently, and when to check it again. Adjust it to the risk: a one-off stationery order needs less than a supplier that will hold your customers’ data or work on your site.

The checklist

Company identity

Search the company on Companies House. Check that the legal name and company number match the contract and the invoices, that the status is active and not in liquidation or dissolved, and that the registered office is where you expect. The filing history shows whether accounts and confirmation statements are filed on time; overdue filings are worth a question. The register also lists directors and people with significant control, which you need for sanctions screening.

VAT registration

If the supplier charges VAT, check its number with HMRC’s VAT number check. The service confirms whether the number is valid and the business name registered to it. A name that does not match the company you are contracting with is a question to ask before the first invoice is paid.

Bank details

Payment diversion fraud works by sending convincing emails that change a supplier’s bank details. Take bank details on the supplier’s letterhead at onboarding, confirm them by calling a number you already hold rather than one in the email, and apply the same check to every later change. Never accept a change by email alone.

Insurance

Most UK employers must hold employers’ liability insurance of at least £5 million from an authorised insurer. Public liability and professional indemnity are not generally required by law, so your contract sets the minimum. Check the insured name, the dates, the limit, the activities covered and the insurer on every certificate. The detail is in how to check a supplier’s insurance certificates.

Quality certification

A certificate PDF proves only that a document exists. Search it in IAF CertSearch or UKAS CertCheck, and match the legal entity, sites, scope, standard, number and dates. ISO 9001:2026 was published on 16 September 2026; ISO 9001:2015 certificates remain valid until the transition ends on 30 September 2029. The full method is in how to verify a supplier’s ISO certificate.

Cyber security

For suppliers that will hold your data or connect to your systems, ask for Cyber Essentials, Cyber Essentials Plus or ISO 27001 certification. Cyber Essentials certificates can be checked in the official search and are renewed every year. Suppliers to central government and NHS bodies may need Cyber Essentials under PPN 014. See how to check a supplier’s Cyber Essentials certificate.

Data protection

If the supplier will process personal data on your behalf, UK GDPR requires a written contract with specific terms between you as controller and the supplier as processor. The ICO’s guidance on controller and processor contracts lists what the contract must cover. Ask the supplier for its standard terms and check them against that list, or use your own.

Modern slavery

Commercial organisations supplying goods or services in the UK with a turnover of £36 million or more must publish an annual slavery and human trafficking statement under section 54 of the Modern Slavery Act 2015. Ask for the latest statement and check its date and approval. Smaller suppliers are not required to publish one, so ask what they do instead. The detail is in modern slavery due diligence: what to ask suppliers for.

Anti-bribery

Under section 7 of the Bribery Act 2010, a commercial organisation can commit an offence if a person associated with it, which can include a supplier acting on its behalf, pays a bribe to win or keep business for it. Having adequate procedures to prevent bribery is a defence. For suppliers that will act for you, such as agents, distributors or anyone dealing with officials, ask for their anti-bribery policy and how it is applied.

Sanctions

Screen the company, its directors and its people with significant control against the UK Sanctions List, published by the Foreign, Commonwealth & Development Office. Since 28 January 2026 it has been the only source of UK sanctions designations: the OFSI Consolidated List of Asset Freeze Targets closed on that date and is no longer updated. If your process or screening tool still points at the OFSI list, update it.

Health and safety

For suppliers that will work on your premises, ask for their health and safety policy and the risk assessments and method statements for the work. A business with five or more employees must have its policy written down, as HSE’s guidance explains. Check that the method statement describes the work you are buying, not a generic job.

Record what you checked

For every item, keep what you checked against and the date: the register entry, a screenshot of the search, or the written confirmation. A file that says “insurance: yes” tells an auditor nothing; one that says “EL £10m, insurer on the FCA register, policy to 31 March, checked 22 October” does.

Then set recheck dates. Insurance and Cyber Essentials expire every year, ISO certificates run on a three-year cycle with surveillance audits in between, and company details change. The wider review process, including how to handle answers that are missing or unclear, is in how to review supplier compliance evidence and supplier questionnaires: checking answers against evidence.

Where DataStruct fits

DataStruct reads the onboarding pack a supplier sends against your own checklist. For each requirement it finds the passages that support it, links each one to the file and page or row it came from, and says so plainly when nothing in the pack supports it, so gaps are visible before approval rather than after.

It does not search Companies House, the FCA register, certificate registers or the sanctions list, and it does not approve suppliers. Those checks, and the decision, stay with your team.