Vendor Onboarding Checklist for Bookkeepers and AP Teams

A vendor onboarding checklist makes sure your file is complete before the first payment goes out. That means the right tax form (a W-9 for U.S. vendors, a W-8 for foreign ones), bank details you have confirmed yourself, and any insurance certificate your contracts require. Whoever sets up vendors in your payment system should own the process, and we recommend that no payment goes out until the file is complete.

General information, not tax or legal advice.

The short answer

Before you pay a new vendor for the first time, we recommend these steps:

1. Collect the right tax form. Ask U.S. vendors for a W-9. Foreign individuals give a W-8BEN and foreign entities a W-8BEN-E.
2. Review it. Check the name, TIN and tax classification.
3. Confirm bank details on a second channel. Use a phone number you already had.
4. Collect a certificate of insurance if your contract or client requires one.
5. Store everything securely under a written retention rule, and log who did each step.

Why this matters in a real workflow

Many 1099 problems start at onboarding and surface in January, when a vendor from last spring has stopped answering.

For payments made in 2026, the general reporting threshold for Forms 1099-NEC and 1099-MISC, and for backup withholding, is $2,000, up from $600. It is indexed for inflation starting in 2027, and the IRS hasn't published the 2027 amount yet (Instructions for Forms 1099-MISC and 1099-NEC).

At onboarding you usually don't know which vendors will cross that line; a one-off repair can become a year-long contract. So our recommendation is to collect the W-9 up front from every U.S. vendor, whatever you expect to spend.

Onboarding is also when new bank details enter your system, which makes it a target. The FBI's Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025, with more than $3 billion in reported losses (FBI IC3, 2025 IC3 Annual Report). These are self-reported complaints.

What the IRS says

• The W-9 comes first. Once you've decided the person you're paying is an independent contractor, the IRS says the first step is to have them complete Form W-9 (IRS: Forms and associated taxes for independent contractors).
• Suggested for U.S. payees, required for some. IRS instructions suggest requesting a W-9 from U.S. payees, and note that the W-9 is required for recipients of certain types of payments under the backup withholding regulations (IRS Publication 1099).
• Ask at the start. You must make an initial request for the payee's TIN when the account is opened or the transaction occurs. If you don't get it, backup withholding begins (26 CFR 301.6724-1; IRS Publication 1281).
• Backup withholding is 24%. The IRS says you must withhold 24% from reportable nonemployee compensation if the payee hasn't provided a TIN as required, or if the IRS notifies you the TIN is incorrect and the payee doesn't certify as the notice requires (IRS: Forms and associated taxes for independent contractors; IRS: Backup withholding).
• Withholding means a 1099 at any amount. If you backup withhold from a vendor, you must file a 1099 for them regardless of the amount paid, even under the $2,000 threshold.

Documents to collect by vendor type

The W-9 also tells you what kind of vendor you're dealing with, which decides whether a 1099 is due.

U.S. individual or sole proprietor

Collect a W-9. Sole proprietors put their individual name on line 1 and any business or DBA name on line 2 (Form W-9, Rev. March 2024). A sole proprietor with an EIN may enter either the SSN or the EIN. IRS information-return instructions say the IRS prefers the SSN, and a DBA name can't be used alone (IRS General Instructions for Certain Information Returns).

Single-member LLC

Collect a W-9, and expect the owner's name on line 1. A disregarded entity, such as most single-member LLCs, puts its owner's name on line 1 and its own name on line 2, and checks the tax classification box for its owner. It enters the owner's SSN, or the owner's EIN if the owner has one.

Partnerships, multi-member LLCs and corporations

Collect a W-9. An LLC taxed as a partnership, or one that elected corporate treatment, checks the LLC box and enters P, C or S. Payments to corporations, including LLCs taxed as C or S corporations, generally don't need a 1099, but there are important exceptions (i1099mec).

• Law firms. The corporate exemption doesn't apply to legal services. Attorneys' fees go on 1099-NEC box 1a, and gross proceeds on 1099-MISC box 10, even for incorporated law firms.
• Medical providers. Medical and health care payments of $2,000 or more are reportable even when the provider is a corporation. Payments to pharmacies for prescription drugs, and to tax-exempt or government hospitals, are not.

A requester may generally rely on a payee's claim of exemption from backup withholding unless it has actual knowledge that the claim is wrong (Instructions for the Requester of Form W-9).

Foreign vendors

Only U.S. persons, including resident aliens, use Form W-9. Foreign persons use the appropriate Form W-8 or Form 8233. IRS requester instructions tell you to point foreign vendors to those forms.

• Foreign individuals give Form W-8BEN to establish that they are not a U.S. person and, if applicable, to claim a reduced rate of or exemption from withholding (About Form W-8BEN).
• Foreign entities use Form W-8BEN-E to document their status (About Form W-8BEN-E).
• U.S. citizens living abroad still use the W-9 (Instructions for Form W-8BEN).

Unlike the W-9, a W-8BEN generally stays valid only through the last day of the third calendar year after it's signed, unless circumstances change. Record that date. If you can't determine whether a payee is foreign or U.S., the presumption rules require you to treat them as a non-exempt U.S. person and backup withhold. Take withholding questions on foreign payments to your tax adviser.

Certificate of insurance, where relevant

If the vendor will work on site or your contract requires coverage, we recommend collecting a certificate of insurance at intake. The standard ACORD 25 certificate says it is issued for information only, confers no rights on the certificate holder, and doesn't alter the policies' coverage (ACORD 25, as filed with NY DFS). If you need to be an additional insured, the policy itself must provide for it or be endorsed. A statement on the certificate alone doesn't give you those rights.

Bank or ACH details

Nacha defines "False Pretenses" as inducing a payment by misrepresenting identity, authority or account ownership. It says this covers business email compromise and vendor impersonation (Nacha: Fraud Monitoring Phase 1). The FBI's IC3 advises using secondary channels or two-factor authentication to verify requests to change account information (IC3 PSA). The FTC advises verifying emailed requests for sensitive information through a separate channel, without using the links, phone numbers or websites in the email (FTC: Protecting Personal Information).

Our recommendation: call the vendor at a number you found independently, such as on a signed contract, and confirm the account before the first payment. Have a second person approve any later change.

Recommended workflow

This is our recommended practice for a small firm, not an IRS procedure.

1. Intake request (whoever engages the vendor). Record the legal name, contact, scope and start date.
2. Classification check (bookkeeper or controller). Contractor or employee? U.S. or foreign? This decides which form to request.
3. Document request (AP). Request the W-9 or W-8, plus a certificate of insurance if needed, through a secure upload channel rather than an email attachment.
4. Document review (AP reviewer). Check the name/TIN pairing, classification box and any exemption code. Flag individuals, law firms and medical providers as likely 1099 recipients.
5. Bank verification (a second person). Call back on a known number. Log the date, the contact and the verifier.
6. Vendor record (AP). Enter the classification, 1099 flag, TIN and any W-8 expiry date.
7. First payment approval (controller or owner). Release it only when steps 1–6 are done.
8. Filing (records owner). Store the forms under restricted access with a retention date.

Exception path. If someone insists on paying before the W-9 arrives, require the controller's sign-off and talk to your tax adviser about backup withholding, which the IRS says is required on reportable nonemployee compensation when the payee hasn't provided a TIN as required.

When to request a new W-9

Neither the W-9 nor the backup withholding certificate regulation sets an expiration date for a W-9. What triggers a new one is a change, such as a new name, a new TIN or a lost exemption (26 CFR 31.3406(h)-3). A payee must give you a new W-9 if the name or TIN on the account changes, and must update you if they are no longer an exempt payee, for example a C corporation that elects S status.

We recommend asking for a fresh W-9 whenever a vendor reports a name, entity or tax classification change, or your review finds a mismatch. A bank-detail change doesn't by itself call for a new W-9, but it should always trigger the call-back check.

Secure collection and retention

A W-9 carries a full TIN, often an SSN. IRS guidance says a legitimate business will never ask you to email personal or sensitive information unless it is through a secured mail service (IRS Publication 4557). Standard email attachments are usually a poor channel for documents containing TINs, because copies linger in inboxes and sent folders and get forwarded. See our guides to W-9 email risks and secure W-9 collection.

IRS instructions require payers to keep W-9 identity information, including SSNs and EINs, confidential, and to use it only to comply with the tax laws.

On retention, the sources don't agree. The regulation requires a payor to keep a W-9 for 3 years from the date the account is opened. The IRS's own independent-contractor page says to keep the W-9 in your files for four years. As a practice, many firms keep W-9s for at least four years after the last payment. That's a policy choice to confirm with your adviser, not an IRS rule.

Example scenario

Example scenario: Ridgeway Books & Tax, a made-up four-person firm, handles AP for a property-management client that engages three vendors in one week: a sole-proprietor handyman, an incorporated law firm, and a designer based outside the U.S.

AP sends each vendor a secure upload request. The handyman's W-9 shows his own name on line 1 and his trading name on line 2, so AP flags him as a likely 1099 recipient even though his first invoice is small. The law firm's W-9 shows a C corporation, but AP flags it anyway, because the corporate exemption doesn't apply to payments for legal services. The designer gets a W-8BEN request instead, and AP records its expiry date.

When the law firm emails wiring instructions, a second staff member confirms them by calling the number on its engagement letter before the controller approves payment.

Common mistakes

• Collecting W-9s only from vendors expected to cross the threshold. Spending changes, and chasing a TIN later is harder.
• Skipping the W-9 because the vendor is a corporation. Law firms and medical providers can still need 1099s.
• Sending a W-9 to a foreign vendor. They need the appropriate W-8.
• Taking bank details from an email without a call-back, or letting one person both enter and approve them.
• Using an LLC's trade name as the 1099 name when the W-9 shows the owner on line 1.

Checklist

• ☐ Vendor legal name, contact and scope recorded
• ☐ Contractor vs. employee and U.S. vs. foreign status decided
• ☐ W-9 (U.S.) or W-8BEN / W-8BEN-E (foreign) requested through a secure channel
• ☐ Line 1 name matches the TIN (individual or owner vs. entity)
• ☐ Tax classification checked; LLCs show P, C or S where applicable
• ☐ Exempt payee code reviewed, if entered
• ☐ Likely 1099 recipients flagged (individuals, law firms, medical providers)
• ☐ W-8 expiry date recorded, if applicable
• ☐ Certificate of insurance collected, if required; additional insured status confirmed by policy or endorsement
• ☐ Bank details confirmed by call-back to an independently sourced number
• ☐ Verification logged and approved by a second person
• ☐ Forms stored under restricted access with a retention date

For a W-9-only version, see the W-9 collection checklist.

How W9Vault supports this workflow

W9Vault covers the document-request step. You send the vendor a secure upload link that expires after 7 days. Files are encrypted in the vendor's browser before upload, so the server never receives the plaintext file. One request can ask for several documents at once, such as a W-9 plus a certificate of insurance, in PDF, JPG or PNG up to 20 MB. Your dashboard shows whether each request is sent or completed.

W9Vault is a collection channel, not your archive. Uploaded files are automatically deleted 30 days after upload for completed requests, so your retention policy lives in your own records system.

W9Vault is designed to support a secure collection workflow; the customer remains responsible for their own tax, recordkeeping and security obligations. See how it works and our security overview.

Frequently Asked Questions

Do I need a W-9 from a vendor I expect to pay less than $2,000?

The $2,000 figure is the general 1099-NEC and 1099-MISC threshold for payments made in 2026, but you often cannot tell at onboarding who will cross it. The IRS describes the W-9 as the first step with a contractor, so we recommend collecting one from every U.S. vendor before the first payment.

Do W-9s expire?

Neither the form nor the backup withholding regulation sets an expiration date. A vendor must give you a new W-9 if the name or TIN on the account changes, and must tell you if they lose an exempt status.

What do I collect from a foreign vendor?

Not a W-9. Foreign individuals generally give Form W-8BEN and foreign entities Form W-8BEN-E. A W-8BEN generally stays valid through the end of the third calendar year after signing, unless circumstances change.

How long should we keep vendor W-9s?

The backup withholding regulation says 3 years from when the account is opened, while the IRS independent contractor page says four years. Many firms keep W-9s at least four years after the last payment as a matter of practice. Confirm your policy with your adviser.

Official resources

• IRS: Forms and associated taxes for independent contractors
• Form W-9 and Instructions for the Requester of Form W-9
• Instructions for Forms 1099-MISC and 1099-NEC
• IRS Publication 1099 and General Instructions for Certain Information Returns
• IRS Publication 1281 and IRS: Backup withholding
• 26 CFR 31.3406(h)-3 and 26 CFR 301.6724-1
• About Form W-8BEN, Instructions for Form W-8BEN and About Form W-8BEN-E
• IRS Publication 4557
• FTC: Protecting Personal Information
• FBI IC3: 2025 Annual Report and BEC PSA
• Nacha: Fraud Monitoring Phase 1

More in this series

• Secure W-9 collection: the complete guide