The six documents that actually verify a vendor
- W-9 (or W-8 for foreign vendors). Tax identification and certification. Run through IRS TIN Matching for a name + TIN match against IRS records.
- Certificate of formation or incorporation. Establishes the legal entity. Verify against the state business registry (Delaware Division of Corporations, California Secretary of State Bizfile, similar).
- EIN confirmation letter (CP 575 or 147C). Original IRS issuance or verification letter. EIN-letter forgery is a known fraud pattern; forensic AI on the PDF catches obvious cases.
- Certificate of Insurance (COI). General liability, workers compensation, and other coverages required by the contract. Verify by direct contact with the listed insurance carrier or via an automated COI-tracking service.
- Beneficial-ownership disclosure. Names and ownership percentages of beneficial owners at 25 percent or more, plus a control person. See our beneficial-owner guide.
- Banking instructions. On vendor letterhead or via a verified portal. Out-of-band confirmation before adding to the vendor master.
Higher-risk vendors (large dollar value, international, regulated industry, or new relationship) add references, financial statements, sanctions screening (OFAC, EU, UN), and adverse-media review.
The BEC / banking-instructions fraud surface
Business Email Compromise is the dominant loss vector in AP. The FBI Internet Crime Complaint Center (IC3) places US BEC and email-account-compromise losses above USD 2 billion annually in recent reports. The vendor-impersonation variant works like this:
- The attacker compromises a real vendor's email account, or registers a look-alike domain (acme-corp.com vs acmecorp.com), or builds a complete spoofing infrastructure.
- An invoice or payment-request email arrives looking like the legitimate vendor, with updated banking instructions for routing the next payment.
- AP processes the change because the email looks right, the invoice numbers are real, and the timing aligns with an actual outstanding obligation.
- The payment goes to the attacker's account. Recovery is rare; bank-initiated reversals typically fail beyond a 72-hour window.
The defense is procedural: out-of-band confirmation of every banking change. AP confirms changes via a phone number from the vendor master (not from the email), or via a portal that requires multi-factor authentication, or by an explicit second-channel verification. The AI-detection cost is trivial relative to the savings.
Certificate of Insurance: the recurring fraud target
COI fraud is its own category. In construction, transportation, event services, and any vendor relationship where insurance coverage is contractually required, vendors sometimes supply forged COIs to meet onboarding requirements they cannot otherwise satisfy. Patterns:
- COI from a real insurance carrier with edited coverage amounts or expiration date.
- COI from a real carrier where the named insured is the vendor but the policy is for a different entity.
- Fully fabricated COI from a fictional carrier or with completely synthetic content.
The mitigation: direct verification with the carrier (most major carriers run an agent or broker portal where employers can confirm coverage) or COI-tracking services like Certificate Hero, MyCOI, Bindable that maintain real-time carrier connections. Forensic AI on the uploaded COI catches the obvious forgeries before the carrier contact, narrowing the queue.
A W-9 alone proves nothing. Six documents and out-of-band confirmation prove a real vendor.
The 2026 procurement workflow that works
- Standardize the six-document intake. Reject vendor onboardings missing any required item.
- Run TIN Matching at intake. Run business-registry lookup at intake. Run forensic AI on uploaded PDFs at intake.
- Maintain banking-instructions confirmation as a non-negotiable. Every initial set; every change.
- Segregate duties: the person who approves vendor-master changes does not process payments.
- Set up COI tracking with expiration alerts. Stop processing payments when COI lapses.
- Run sanctions and PEP screening on the entity and on beneficial owners; re-screen on a cadence.
- Document every step. The audit trail is the difference between a compliance program and a procurement habit.
Frequently asked questions
Do I need to KYB every vendor?
Risk-tiered. High-value or high-risk vendors get the full six-document stack plus enhanced due diligence. Low-value, low-risk vendors (small purchases, well-established suppliers) can run a lighter intake. Document the tier rationale in the procurement policy.
What about foreign vendors?
W-8 BEN (individual) or W-8 BEN-E (entity) replaces W-9. Country-specific entity registration replaces US state business registry. OFAC and sanctions screening becomes more important for foreign vendors. Currency, banking, and tax-withholding rules add their own layer.
How does the FinCEN BOI rule affect vendor KYB?
For non-bank vendor onboarding, FinCEN BOI is not directly applicable but the underlying concepts (beneficial-ownership transparency, identity of natural persons) overlap. See our BOI status guide.
What is a vendor portal vs ad-hoc onboarding?
Modern AP runs vendor onboarding through a portal (Coupa, Ariba, Avetta, ISN, Tipalti) where vendors submit documents directly. The portal enforces document requirements, runs automated checks, and produces an audit trail. Ad-hoc onboarding via email is the most fraud-prone path.
Can vendor fraud insurance cover BEC losses?
Some cyber insurance and crime-coverage policies include BEC, but coverage varies widely. Read the policy carefully; some carriers exclude voluntary parting of funds (which most BEC fits), some carve out coverage for failure to follow procedural controls. The insurance is a backstop, not a substitute for the control.