Vendor due diligence checklist: checks by risk tier before you rely on a supplier

Vendor due diligence asks one question: can you trust this supplier with your money, your data or your operations? A critical vendor is one whose failure would stop or seriously harm your business, such as a payroll processor or the host of your client files.

Bank regulators frame this as a life cycle and say plainly that not every relationship carries the same risk or criticality (OCC Bulletin 2023-17, Third-Party Relationships: Interagency Guidance on Risk Management). That logic works outside banks too: a cleaning company and a payroll processor should not get the same list.

This page is the risk review. The paperwork to set up a vendor for payment, such as the W-9 and the remit-to address, is on the vendor onboarding checklist.

The vendor supplies most of the evidence: its registration, insurance certificate, licenses, financial statements and audit reports. Some checks you run yourself against government sources, such as the IRS name and TIN match and Treasury’s sanctions list. Procurement, finance or compliance owns the review, and a business owner signs off on critical vendors.

1. Place the vendor in a tier from what it touches: money, data, customers or operations.
2. Send the request email with the list for that tier only.
3. Run the checks you can do yourself while you wait: sanctions, registration, TIN.
4. Read what comes back against the tier list and record gaps.
5. Set review dates for insurance, licenses, security reports and re-screening.

• Sending every supplier the full critical-tier list, so low-risk vendors never finish it.
• Accepting a security report that covers a period ending long before today.
• Screening the vendor’s name but not the names of its owners.
• Checking once at signing and never again during the contract.
• Leaving data return and access removal out of the contract until the vendor is leaving.

Each tier includes everything in the tiers above it. The last column is the evidence that proves the check was done.

A Specially Designated National is a person or company on Treasury’s SDN list. OFAC says their assets are blocked and U.S. persons are generally prohibited from dealing with them (OFAC, Frequently Asked Questions: Sanctions List). Search the vendor and its owners with OFAC’s Sanctions List Search tool, and save the result (OFAC, Frequently Asked Questions: Sanctions List).

Screen the owners for a reason. Under OFAC’s 50 Percent Rule, a company owned 50 percent or more by blocked persons is itself blocked, even if it is not on the list (OFAC, FAQ 401: Entities owned by blocked persons (50 Percent Rule)).

TIN Matching is only for payers that file information returns, and those who file for them (IRS, Taxpayer Identification Number (TIN) Matching). The payer must also be in the IRS Payer Account File, based on Forms 1099 filed within the last 2 years (IRS, Taxpayer Identification Number (TIN) Matching). If you qualify, you can check a vendor’s name and TIN before filing, one at a time or in bulk. A mismatch usually means the W-9 shows a trade name instead of the legal name, so ask for a corrected form.

For a vendor that holds your data or moves your money, ask for proof of its controls. A SOC report is an independent auditor’s report on a service organization’s controls, over financial reporting or over security.

• Check the report period, and ask for a bridge letter covering the time since it ended.
• Read the exceptions the auditor found, not only the opinion page.
• List the subcontractors that will touch your data, such as hosting providers.
• Ask for cyber and errors and omissions coverage on the insurance certificate.
• Agree how data comes back or is destroyed when the contract ends.

Due diligence decays. Put each expiry in a calendar and re-run the cheap checks on a regular cycle, for example yearly for most vendors and more often for critical ones.

1. Request a new insurance certificate before each policy expires, using a COI request.
2. Re-screen the vendor and its owners against the sanctions list.
3. Ask for the new SOC report when the old period lapses.
4. Request a fresh W-9 after any change of name, entity or tax ID.
5. At termination, record that access was removed and data returned or destroyed.

• OCC Bulletin 2023-17, Third-Party Relationships: Interagency Guidance on Risk Management: The interagency guidance outlines a third-party risk management life cycle and clarifies that not all third-party relationships present the same level of risk or criticality.
• OFAC, Frequently Asked Questions: Sanctions List: SDNs’ assets are blocked and U.S. persons are generally prohibited from dealing with them; the full list can be browsed with OFAC’s Sanctions List Search tool.
• OFAC, FAQ 401: Entities owned by blocked persons (50 Percent Rule): Under OFAC’s 50 Percent Rule, the property of entities directly or indirectly owned 50 percent or more in the aggregate by one or more blocked persons is considered blocked.
• IRS, Taxpayer Identification Number (TIN) Matching: TIN Matching lets payers that file information returns validate TIN and name combinations before filing, interactively or in bulk, after applying through IRS e-Services.