Poor supplier onboarding is one of the most expensive problems in finance operations, and one of the least visible. The errors do not surface when the supplier is set up. They surface months later in a failed VAT return, an audit finding, a duplicate payment, or a fraudulent invoice that cleared because no one verified the bank details at source.
This guide gives UK finance teams a repeatable, audit-ready process to onboard every supplier correctly the first time. Seven stages, thirty-four checks, designed to be worked through line by line for every new supplier, or used as an audit script against the existing master file.
Why supplier onboarding fails most often
Most onboarding failures share the same root cause: information arriving from the wrong source. Bank details taken from an invoice rather than confirmed with the supplier. VAT numbers entered from memory rather than validated against HMRC. Trading names captured instead of legal entity names. Each feels minor at the point of entry, and each becomes material when a fraud event, a payment dispute, or an audit forces you to reconstruct the supplier's record from scratch.
A structured process closes those gaps before they become liabilities.
What this checklist helps you achieve
A well-run onboarding process delivers four outcomes that compound across the entire accounts payable function: HMRC and VAT compliance, evidenced and documented; reduced fraud exposure and fewer payment errors; a standardised onboarding process across your team; and faster supplier payments with cleaner approval flows.
Stage one: Supplier information collection
The first principle is straightforward. Every piece of information goes directly from the supplier into a structured form, never from invoices, emails, or third-party introductions.
Capture the legal entity name as registered with Companies House, not the trading name. Capture the company registration number, the VAT number where applicable, the registered address, primary contact details (name, work email, direct phone), and bank account details including IBAN and SWIFT for non-GBP payments.
A single supplier form, signed and dated, is the foundation of every later check. Email threads are not an evidence trail.
Stage two: Compliance and verification
Before any money moves, prove the supplier is who they say they are. Verify the Companies House registration to confirm active status, registered office, and directors. Validate the VAT number using the HMRC VAT-checker service and save the reference. Confirm bank account ownership using Confirmation of Payee or a verified bank document.
Run sanctions and politically exposed person (PEP) checks against the UK, EU, OFAC, and UN consolidated lists at minimum. For higher-risk suppliers and any payment above your KYC threshold, verify ultimate beneficial ownership.
Invoice-redirection fraud almost always begins with a 'bank detail change' email. If you have verified ownership at onboarding, any subsequent change becomes a red flag rather than a routine update.
Stage three: Documentation collection
Build the file you would want in front of you during an audit, a dispute, or a fraud investigation. Store everything against the supplier record itself, not in a shared drive folder. If a document is not linked to the supplier, it effectively does not exist at audit.
The minimum file includes the completed onboarding form signed by an authorised signatory at the supplier, the VAT registration certificate, proof of bank account (headed letter, redacted bank statement, or CoP confirmation), insurance documents where relevant (public liability, professional indemnity, employer's liability), and the signed contract or MSA covering scope, term, and termination.
Stage four: Commercial and payment setup
Ambiguity in commercial terms causes the majority of payment disputes. Agree everything in writing before the first invoice arrives.
Confirm payment terms (for example, 30 days end-of-month, Net 14, or milestone-based), invoicing currency, the pricing model (rate card, fixed fee, or statement of work referenced in the contract), and the exact requirements for a valid invoice (PO number, billing entity, VAT treatment, remittance address, and e-invoice format).
Telling suppliers exactly what your invoice must contain, before they send the first one, removes around eighty per cent of the friction in your approval queue. Every malformed invoice is a delayed payment.
Stage five: System setup in Xero, ERP, and AP tools
Translate the paperwork into clean records in your accounting system. This is where the downstream audit trail starts to compound.
Create the supplier in the ledger with name, address, and VAT number matching the registered entity exactly. Apply the correct VAT treatment (standard, reduced, zero, reverse-charge, or out-of-scope). Store bank details under restricted access, with any change requiring dual approval. Map default nominal codes and project or cost-centre tagging. Configure approval workflows with thresholds, approvers, and escalation rules.
A supplier with the wrong VAT treatment in Xero quietly distorts every VAT return until someone notices. Always cross-check the treatment on the first invoice you receive.
Stage six: Internal controls and approvals
Controls only count when they are documented and demonstrable. Make sure the people approving, recording, and paying are not the same person.
Approval must sit with authorised personnel against your delegated-authority matrix. Segregation of duties is non-negotiable: creator, approver, and payer should be three different people. Documents need a single, permissioned, backed-up source of truth. The audit trail must capture who entered the change, who approved it, when, and from where, for every change.
'We do it, but it is not written down' is the most expensive sentence in finance. Controls that are not evidenced are controls that do not exist.
Stage seven: Communication and go-live
A clean handover turns a setup record into a working relationship. Confirm with the supplier that onboarding is complete and share the supplier-facing reference. Send the invoicing instructions including PO requirements, billing entity, remittance email, and submission portal. Introduce day-to-day owners on both sides by name, not by inbox alias. Then run the first invoice end-to-end against the new setup before volume scales up.
The first invoice is the real test of the setup. Walk it through the full approval and payment cycle deliberately. Every gap shows up here, before it costs you money.
How to make this checklist run itself
Most of these thirty-four checks are manual today because the data lives in different places. The supplier knows their bank details. Companies House knows their registration status. HMRC knows their VAT status. Your bank knows whether the account name matches. The accounting system holds the ledger. Nothing connects them.
Accounting Links is a network layer that sits across those sources. Suppliers complete onboarding through a verified magic link rather than a PDF form. Companies House, VAT, and Confirmation of Payee checks run automatically at source. Verified supplier records flow directly into Xero, ready to invoice, ready to pay. Any subsequent change to bank details or company status is flagged against the verified baseline rather than accepted at face value.
The result is the same checklist, evidenced automatically, with the fraud surface reduced from the moment the supplier signs up.
