# Vendor due diligence checklist: checks by risk tier before you rely on a supplier

[Home](/) / [Document guides](/documents) / [Due diligence checklist](/documents/due-diligence-checklist) / Vendor

By [Arthur Teboul](/authors/arthur-teboul), Founder, DokuTrak. Published 2026-11-05, updated 2026-11-05.

> **In brief:** A vendor due diligence checklist lists the checks you run before relying on a supplier, scaled to its risk. Every vendor gets identity, tax ID, sanctions and insurance checks; moderate ones add licenses and references; critical ones add financial statements, security reports and data terms.

## What is a vendor due diligence checklist?

Vendor due diligence asks one question: can you trust this supplier with your money, your data or your operations? **A critical vendor** is one whose failure would stop or seriously harm your business, such as a payroll processor or the host of your client files.

Bank regulators frame this as a life cycle and say plainly that not every relationship carries the same risk or criticality ([OCC Bulletin 2023-17, Third-Party Relationships: Interagency Guidance on Risk Management](https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html)). That logic works outside banks too: a cleaning company and a payroll processor should not get the same list.

This page is the risk review. The paperwork to set up a vendor for payment, such as the W-9 and the remit-to address, is on the [vendor onboarding checklist](/documents/vendor-onboarding-checklist).

## Who sends it, and when

The vendor supplies most of the evidence: its registration, insurance certificate, licenses, financial statements and audit reports. Some checks you run yourself against government sources, such as the IRS name and TIN match and Treasury’s sanctions list. Procurement, finance or compliance owns the review, and a business owner signs off on critical vendors.

## Where to get a vendor due diligence checklist

1. Place the vendor in a tier from what it touches: money, data, customers or operations.
2. Send the request email with the list for that tier only.
3. Run the checks you can do yourself while you wait: sanctions, registration, TIN.
4. Read what comes back against the tier list and record gaps.
5. Set review dates for insurance, licenses, security reports and re-screening.

## Wrong files people send instead

- Sending every supplier the full critical-tier list, so low-risk vendors never finish it.
- Accepting a security report that covers a period ending long before today.
- Screening the vendor’s name but not the names of its owners.
- Checking once at signing and never again during the contract.
- Leaving data return and access removal out of the contract until the vendor is leaving.

## The checks, tier by tier

Each tier includes everything in the tiers above it. The last column is the evidence that proves the check was done.

| Tier | Check | Evidence to keep |
| --- | --- | --- |
| All vendors | Legal name and tax ID | Signed Form W-9, or Form W-8BEN-E from a foreign entity |
| Vendors you report on Form 1099 | Name and TIN match with the IRS | TIN Matching result and date |
| All vendors | Sanctions screening | Search result from OFAC’s sanctions list, with date |
| All vendors | Registration and good standing | Secretary of state record |
| All vendors | Insurance | Certificate of insurance and endorsements |
| All vendors | Conflict of interest | Signed disclosure of ties to your staff or owners |
| Moderate | Licenses | State licensing board lookup |
| Moderate | References | Notes from a few current customers |
| Federal contractors | Exclusion check | SAM.gov exclusions search result, with date |
| Moderate | Continuity | Business continuity and recovery summary |
| Critical | Financial health | Audited or reviewed statements, or tax returns for a small firm |
| Critical | Controls | SOC report or completed security questionnaire |
| Critical | Data handling | Data processing agreement and list of subcontractors |

## Sanctions screening and TIN matching

**A Specially Designated National** is a person or company on Treasury’s SDN list. OFAC says their assets are blocked and U.S. persons are generally prohibited from dealing with them ([OFAC, Frequently Asked Questions: Sanctions List](https://ofac.treasury.gov/faqs/topic/1631)). Search the vendor and its owners with OFAC’s Sanctions List Search tool, and save the result ([OFAC, Frequently Asked Questions: Sanctions List](https://ofac.treasury.gov/faqs/topic/1631)).

Screen the owners for a reason. Under OFAC’s 50 Percent Rule, a company owned 50 percent or more by blocked persons is itself blocked, even if it is not on the list ([OFAC, FAQ 401: Entities owned by blocked persons (50 Percent Rule)](https://ofac.treasury.gov/faqs/401)).

TIN Matching is only for payers that file information returns, and those who file for them ([IRS, Taxpayer Identification Number (TIN) Matching](https://www.irs.gov/tax-professionals/taxpayer-identification-number-tin-matching)). The payer must also be in the IRS Payer Account File, based on Forms 1099 filed within the last 2 years ([IRS, Taxpayer Identification Number (TIN) Matching](https://www.irs.gov/tax-professionals/taxpayer-identification-number-tin-matching)). If you qualify, you can check a vendor’s name and TIN before filing, one at a time or in bulk. A mismatch usually means the W-9 shows a trade name instead of the legal name, so ask for a corrected form.

## What a critical vendor review adds

For a vendor that holds your data or moves your money, ask for proof of its controls. **A SOC report** is an independent auditor’s report on a service organization’s controls, over financial reporting or over security.

- Check the report period, and ask for a bridge letter covering the time since it ended.
- Read the exceptions the auditor found, not only the opinion page.
- List the subcontractors that will touch your data, such as hosting providers.
- Ask for cyber and errors and omissions coverage on the insurance certificate.
- Agree how data comes back or is destroyed when the contract ends.

## Keeping the file current

Due diligence decays. Put each expiry in a calendar and re-run the cheap checks on a regular cycle, for example yearly for most vendors and more often for critical ones.

1. Request a new insurance certificate before each policy expires, using a [COI request](/documents/certificate-of-insurance-request).
2. Re-screen the vendor and its owners against the sanctions list.
3. Ask for the new SOC report when the old period lapses.
4. Request a fresh W-9 after any change of name, entity or tax ID.
5. At termination, record that access was removed and data returned or destroyed.

## The template: Vendor due diligence request email

Send this to a new or renewing vendor. Keep the tier block that fits the vendor and delete the others.

Subject: [Your company] vendor review: documents needed by [date]

```text
Hi [Client name],

Before we start working together, we review every vendor. Please send by [date]:

- A signed Form W-9 in your legal name.
- A certificate of insurance naming [Your company] as certificate holder.
- Your state registration and any license the work requires.
- A short note listing any ties between your owners and our staff.

Because you will [handle our data / process our payments], please also send your latest SOC report with a bridge letter, your two most recent financial statements, and the list of subcontractors that will see our data.

Thank you,
[Your name]
```

## Questions people ask

### What is included in vendor due diligence?

Identity and tax ID, sanctions screening, registration, insurance and conflicts for every vendor. Riskier vendors add licenses, references, financial statements, security reports and data terms.

### How do I verify a vendor’s bank account?

Ask for a voided check or a bank letter, then confirm the details by calling a phone number you already hold for the vendor. Never confirm through contact details sent with a change request.

### How often should vendor due diligence be repeated?

Track expiry dates for insurance, licenses and security reports as they come. Re-screen and review each vendor on a fixed cycle, more often for critical vendors.

### Is a due diligence questionnaire the same as this checklist?

No. A questionnaire collects written answers about practices, while this list collects evidence. Many firms send both to critical vendors.

**Not advice.** This page is general information, not tax, legal or HR advice. Rules change: check the cited source and ask your own professional before you rely on it. Last reviewed October 25, 2026.

## Sources

- [OCC Bulletin 2023-17, Third-Party Relationships: Interagency Guidance on Risk Management](https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html): The interagency guidance outlines a third-party risk management life cycle and clarifies that not all third-party relationships present the same level of risk or criticality.
- [OFAC, Frequently Asked Questions: Sanctions List](https://ofac.treasury.gov/faqs/topic/1631): SDNs’ assets are blocked and U.S. persons are generally prohibited from dealing with them; the full list can be browsed with OFAC’s Sanctions List Search tool.
- [OFAC, FAQ 401: Entities owned by blocked persons (50 Percent Rule)](https://ofac.treasury.gov/faqs/401): Under OFAC’s 50 Percent Rule, the property of entities directly or indirectly owned 50 percent or more in the aggregate by one or more blocked persons is considered blocked.
- [IRS, Taxpayer Identification Number (TIN) Matching](https://www.irs.gov/tax-professionals/taxpayer-identification-number-tin-matching): TIN Matching lets payers that file information returns validate TIN and name combinations before filing, interactively or in bulk, after applying through IRS e-Services.

## More on this topic

- [Vendor onboarding checklist](/documents/vendor-onboarding-checklist)
- [Certificate of insurance request](/documents/certificate-of-insurance-request)
- [Due diligence checklist](/documents/due-diligence-checklist)
- [TIN checker](/tools/tin-checker)
- [SOC 2 Engagement Letter: AT-C 205 Terms for Type 1 and 2](/templates/engagement-letters/soc-2)

## About the author

Arthur Teboul (Founder, DokuTrak) is building DokuTrak after watching professionals lose hours chasing clients for documents over email. [Arthur Teboul](/authors/arthur-teboul).

How this page was made (methodology): it is built from the primary sources listed under Sources, and every rule and figure on it links to the source it comes from. Last updated October 25, 2026. Spotted an error or a rule that changed? [Contact us](/contact).

## Ask once. DokuTrak does the chasing.

- Your client uploads from one link, with no account and no password.
- Reminders go out on a schedule, by default 2, 5, 10 and 14 days after the request, until the file arrives.
- You accept every file or mark it for re-upload, and your client gets the note by email. The AI never accepts a file.

14-day free trial, no card. Add one only to keep going.

[Request these documents with DokuTrak](https://app.dokutrak.com/sign-up?docs=w-9%2Ccontract%2Cvoided-check%2Cinvoice)