Suggested: an accounts-payable specialist on a verification phone call, an invoice on hold and a vendor record open on screen.
–>
Compliance Practice Guide
Vendor Onboarding Controls That Prevent Payment Fraud
A practical control framework for approving vendors, validating payment instructions, and protecting vendor master data before money moves.
Payment fraud is easiest to stop before a vendor or bank account enters the payment system. A reliable process should verify business and tax identity, independently confirm payment instructions, separate vendor maintenance from payment release, restrict access, and repeat the same controls for every vendor change.
1. Definition
Vendor onboarding controls determine whether a supplier is legitimate, collect required tax/payment information, approve the vendor, and create the record securely. The same controls should apply to later changes in legal name, address, tax status, ownership, contact information, or bank account.
The goal is not just document collection. It is a supported chain of trust from the business request to the approved vendor record and ultimately to the bank account receiving payment.
| Control Objective | Evidence or System Result |
|---|---|
| Confirm the vendor exists and is expected | Business need, contract or purchase support, verified contact details |
| Validate tax identity | Appropriate Form W-9 or W-8 and applicable TIN review |
| Validate payment destination | Bank evidence plus independent confirmation through a trusted channel |
| Prevent unauthorized changes | Dual approval, restricted access, change log, and payment hold |
| Detect unusual activity | Duplicate checks, first-payment review, exception reporting, and periodic monitoring |
2. Why It Matters
A fraudulent bank-change request can look routine—using a real vendor name, familiar invoice, copied signature block, or lookalike email domain. If AP treats the email itself as proof, the company can pay the wrong party and still owe the real vendor.
The risk is significant. The FBI’s 2025 Internet Crime Report recorded more than $3.0 billion of reported business-email-compromise losses. Vendor impersonation and false payment instructions are therefore operational control risks—not just IT risks.
Nacha’s 2026 Phase 2 fraud-monitoring rules apply to all non-consumer Originators, Third-Party Service Providers, and Third-Party Senders, regardless of volume, with a practical effective date of June 22, 2026. The rules require risk-based processes intended to identify ACH entries initiated through false pretenses. A documented vendor-control process supports that obligation.
3. How It Works
Step 1: Require a Business Owner and a Valid Business Purpose
Every new vendor should have an internal requestor and valid business purpose supported by a contract, PO, engagement letter, or similar evidence. Before setup, search the vendor master for duplicate names, tax IDs, addresses, bank accounts, and similar spellings. Do not let an unverified email both request and approve setup.
Step 2: Collect and Validate Tax and Identity Information
For U.S. payees, collect a current signed Form W-9 when appropriate; for foreign payees, obtain the applicable Form W-8. Review legal name, entity type, address, signature, and TIN. Eligible payers may use IRS TIN Matching before filing information returns.
A tax form alone does not prove identity. Compare it with the contract, official website, government registration information when appropriate, and a verified vendor contact. Resolve conflicting names or addresses before approval.
Step 3: Apply Risk Based Sanctions Screening
Use a risk-based sanctions screening process based on location, ownership, industry, payment route, and company risk. When required, check relevant OFAC lists at onboarding and periodically thereafter, retain evidence, and escalate potential matches rather than clearing them informally.
Step 4: Verify Bank Instructions Independently
Obtain bank instructions through an approved channel and supporting evidence, but do not rely on a bank letter or voided check alone. Confirm instructions with a known vendor contact using a phone number or portal established independently of the request. Never use only the number, link, or reply path provided in the change email.
Document who verified the request, when, whom they contacted, and what was confirmed. Use bank/payment-platform account validation when available, and place a temporary hold on the first payment to a new or changed account until approvals are complete.
Step 5: Separate Vendor Maintenance From Payment Release
Separate vendor maintenance from payment release. The person requesting or entering a vendor should not also approve the vendor and release payment alone. Use role-based access, MFA, workflow approvals, system change logs, and second-level review for new vendors and key changes. Emergency requests should follow the same verification rules.
Step 6: Monitor the First Payment and Vendor Master
Review the first payment to a new or changed account for unusual amount, timing, country, currency, or method. Monitor for duplicate vendors, shared bank accounts, reactivated inactive vendors, changes followed quickly by payment, after-hours edits, and manual payments. Periodically remove duplicate/inactive records and re-screen vendors based on risk.
4. Simple Example
A long-standing supplier appears to email AP asking that a $48,000 invoice be sent to a new bank account. The request is urgent and includes a professional-looking bank letter.
| Control Response | What Happens |
|---|---|
| Pause the change | Accounts payable places the invoice on hold and opens a controlled bank-change request. |
| Verify independently | The employee calls the supplier using the number already stored in the approved vendor record. |
| Escalate the exception | The supplier confirms that it did not request a change. The email is reported to security and management. |
| Protect the record | No bank change is entered, the attempted fraud is documented, and related invoices are reviewed. |
The email and bank letter looked legitimate, but neither was independent evidence. A trusted callback to the supplier using existing contact information confirmed that no change was requested and prevented the fraudulent payment.
5. Common Mistakes and FAQs
Common Mistakes
- Relying on one document. A W-9, voided check, bank letter, or email signature is not sufficient proof by itself.
- Calling the number in the change email. Use a trusted, independently sourced contact instead.
- Allowing one person to control the process. Separate vendor creation, approval, and payment release.
- Bypassing workflow for urgent requests. Urgency should increase—not reduce—verification.
- Skipping monitoring. Review duplicates, vendor-master changes, first payments, and inactive vendors.
Is a W-9 Required From Every Vendor
No. Documentation depends on the payee and payment. U.S. reportable payees commonly provide Form W-9; foreign payees generally provide the applicable Form W-8. Tax documentation should be collected based on the facts, not used as a universal identity form.
Should Every Vendor Be Screened Against OFAC Lists
Use a documented risk-based process. Scope and frequency should reflect geography, ownership, industry, payment route, and sanctions exposure. Higher-risk or uncertain results should be escalated to qualified legal or compliance personnel.
What if the Request Is Urgent
Urgency increases the need for verification. Do not release payment until the request is independently confirmed and approved. A short delay protects both the company and the vendor.
6. Practical Checklist and What Comes Next
Convert the checklist into a written vendor-onboarding and change-management policy covering required documents, trusted verification channels, approval thresholds, system roles, payment holds, exception escalation, review frequency, and retention. Periodically test new vendors and bank changes to confirm the controls operate as designed.
0 of 6 complete
How PNJ Can Help
PNJ Group can assess vendor-master risk, design onboarding and bank-change workflows, clarify role ownership, develop control evidence, test control performance, and help remediate payment-process gaps.
Official References
- IRS Backup Withholding B Program
- IRS TIN Matching
- OFAC Compliance Framework
- Nacha Fraud Monitoring Phase 2
- FBI 2025 Internet Crime Report
Disclaimer
General educational information only, not accounting, tax, legal, sanctions, cybersecurity, or banking advice. Appropriate controls depend on the entity’s risk profile, payment methods, systems, counterparties, and applicable requirements.