The Supplier Onboarding Process for UK Businesses: 7 Steps, Owners and Timings (2026)

Most supplier onboarding problems are not caused by a missing document. They are caused by a missing process: nobody agreed who asks for what, who checks it, who signs it off or what happens when the supplier goes quiet. The result is a familiar scene. The purchase is already agreed, the supplier needs paying, and someone in procurement or compliance is asked to wave it through.

This guide sets out the supplier onboarding process as seven steps, each with an owner, a time allowance and a list of what to collect, plus the UK-specific checks that belong in it: Companies House, the UK Sanctions List, insurance, UK GDPR, the Modern Slavery Act and finance set-up. If you want the item-by-item list of documents instead, our supplier onboarding checklist covers that. This guide is about the sequence that list runs inside.

What Supplier Onboarding Is

Supplier onboarding is the process of taking a new supplier from a request to buy from them to an approved, verified and payable record in your systems. It covers the business case, a risk assessment, collecting information and documents from the supplier, checking them, approving the supplier and setting them up in finance. Once the supplier is live, it hands over to ongoing monitoring.

Vendor onboarding is the same process under a different name: US finance teams tend to say vendor, UK procurement teams tend to say supplier. The steps are identical.

In the UK, onboarding also carries legal and audit weight. It is where you gather the due diligence your Modern Slavery statement describes, put the processor contract required by UK GDPR Article 28 in place, confirm that contractors working on your sites hold employers' liability insurance and, if you are ISO 9001 certified, apply the criteria for evaluating and selecting external providers that clause 8.4 asks for. A good process makes all of that a by-product of normal work rather than a scramble before an audit.

The 7-Step Supplier Onboarding Process

Here is the whole process on one screen. The time allowances are planning assumptions for a standard-tier supplier, not benchmarks; adjust them to your sector and your suppliers.

Step 1: Request and Justify

Onboarding should start with a request, not with a supplier's bank details arriving in accounts payable. The requester, usually the budget holder, explains what is being bought, roughly how much will be spent a year and why an existing supplier will not do. That last question is the cheapest control in the whole process: every supplier you do not add is one you never have to monitor. Check the request against your approved supplier list before anything else; our free approved supplier list template gives you one if you do not have it yet.

• Owner: the budget holder raises it; procurement accepts it or points them to an existing supplier.
• Time to allow: same day.
• What to collect: supplier name and contact, what is being bought, estimated annual spend, whether the supplier will access your sites, systems or personal data, and the reason a new supplier is needed.

Step 2: Risk-Tier the Supplier

Tiering is the step most teams skip and the one that makes everything after it proportionate. Without it, every supplier gets the same questionnaire: the window cleaner is asked for ISO 27001 and the contract manufacturer gets the same light touch as the stationery supplier. Three tiers are enough for most businesses:

• Low: low spend, no site or data access, easily replaced. A company check, a sanctions screen and bank verification.
• Standard: material spend or regular site visits. Adds insurance, key policies, a signed code of conduct and a data processing agreement where personal data is involved.
• Critical: sole or hard-to-replace source, high spend, safety or quality critical, or large volumes of personal data. Adds certifications, a financial health review, an audit or site visit, and senior sign-off.

• Owner: procurement.
• Time to allow: under an hour, using criteria agreed in advance rather than debated per supplier.
• What to collect: answers to your tiering questions: spend band, criticality, site access, data access, sector risk such as food safety or construction work, and where the supplier operates.

Step 3: Collect Information and Documents

Send one structured request that covers everything the tier requires, with a deadline, rather than asking for documents one at a time. A trickle of emails is how a two-day task becomes a month. The supplier should be able to see exactly what is outstanding, and you should be able to see where each supplier is up to without searching an inbox. Our free supplier email templates include the onboarding invitation and the chaser for when it stalls.

• Owner: the supplier completes it; procurement sends the request and chases it.
• Time to allow: 3 to 10 working days, set mostly by how quickly the supplier responds.
• What to collect: whatever the tier requires from the list below.

For a standard-tier UK supplier, that usually means:

• Company details: registered name, company number, registered office, VAT number, and contacts for orders, accounts and compliance.
• Insurance: employers' liability, a legal requirement for most employers with a minimum of £5 million cover; public liability; and professional indemnity or product liability where relevant. Each with its expiry date.
• Certifications: ISO 9001 where quality matters, and sector schemes such as BRCGS or SALSA for food, or SSIP schemes such as CHAS for construction contractors.
• Policies and declarations: health and safety, anti-bribery and environmental policies, a signed supplier code of conduct, and a Modern Slavery statement if the supplier is above the £36 million turnover threshold.
• Data protection: a data processing agreement meeting UK GDPR Article 28 if the supplier will process personal data for you.
• Payment details: bank details on company letterhead or through a secure form, never only in the body of an email.

Step 4: Verify

Collection gives you claims; verification turns them into evidence. Check each item against a source the supplier does not control:

• Companies House: the number matches the name, the company is active, filings are not overdue, and the officers and people with significant control are who you expect.
• The Gazette: no winding-up petitions, administration or other insolvency notices.
• The UK Sanctions List: screen the company and, for higher tiers, its directors.
• VAT: confirm the number with HMRC's online VAT number checker.
• Insurance and certificates: the insured or certified entity is the one you are contracting with, cover meets your minimum, the scope covers what you are buying and the expiry date is in the future. For ISO certificates, check the certification body is UKAS-accredited.
• Bank details: confirm by phone on a number you already hold, not one from the same email, and use Confirmation of Payee when the first payment is set up.

Anything that fails goes back to the supplier with a specific reason, not a vague request to resubmit. Specific reasons get fixed first time.

• Owner: procurement, with compliance, legal or IT security for specialist items such as DPAs or security questionnaires.
• Time to allow: 1 to 2 working days of reviewer time.
• What to record: what you checked, against which source, on what date, and any exceptions.

Step 5: Approve

Approval is a decision, so record it like one: who approved the supplier, on what date, on what evidence and for what scope. "Approved for packaging materials" is more useful than "approved". Route approvals by tier, so a low-risk supplier needs one signature and a critical supplier collects procurement, the budget holder and the relevant specialist. Allow conditional approval where it is genuinely needed, for example while a renewed insurance certificate is on its way, but give the condition a date and an owner.

The record matters long after the day itself. Your Modern Slavery statement describes your due diligence, an ISO 9001 auditor will ask how external providers are evaluated and selected, and a customer audit will ask why a supplier was approved. A recorded decision answers all three.

• Owner: procurement, plus the approvers the tier requires.
• Time to allow: 1 to 3 working days.
• Output: the supplier on your approved supplier list with scope, tier, approver and next review date.

Step 6: Set Up in Finance or ERP

Only now should the supplier be created in your finance system or ERP. The vendor record should use the legal name exactly as it appears at Companies House, with the company number, VAT number, payment terms, remittance contact and the bank details verified in step 4. Search for an existing record first: duplicate suppliers in the ledger are how invoices get paid twice.

Keep duties separate. The person who approves a supplier should not be the person who enters or changes their bank details, and any later change of bank details should go through the same independent verification as the first. Payment terms matter too: large companies must report their payment practices for each half of their financial year under the Reporting on Payment Practices and Performance Regulations 2017, so the terms you set here end up in public data.

• Owner: finance or accounts payable.
• Time to allow: 1 to 2 working days.
• What to collect: nothing new from the supplier. Finance works from the approved record and the verified details.

Step 7: Monitor

Approval is the start of a supplier record, not the end of the work. Insurance renews every year, certificates expire, companies change directors, fall behind on filings or enter insolvency, and the scope of what you buy drifts. Build monitoring into the process from day one:

• At every expiry: insurance certificates and certifications, chased before they lapse rather than after.
• Continuously: Companies House changes, Gazette notices and sanctions list updates.
• Annually: code of conduct re-acknowledgement, Modern Slavery statements and security questionnaires for suppliers handling your data.
• On change: re-tier the supplier when spend, scope or access changes, and collect whatever the new tier requires.

Our supplier compliance checklist sets out how quickly each type of evidence goes stale.

How Long Supplier Onboarding Takes

There is no official UK benchmark for supplier onboarding time, and a single average hides very different suppliers. Using the allowances above, a realistic plan looks like this:

• Low tier: one or two working days, if the supplier responds the same day.
• Standard tier: one to two weeks, most of it waiting for the supplier to return documents.
• Critical tier: several weeks where samples, an audit or a site visit are involved.

The pattern that matters is that elapsed time is mostly waiting rather than working. The supplier waits to start the questionnaire, the submission waits in a reviewer's inbox, and the approval waits for a signature. To shorten onboarding, measure two things: the time from request to approval, and how long each submission sits with the supplier versus with your team. Those two numbers tell you whether to fix your chasing or your review.

Where Onboarding Stalls, and the Best Practices That Fix It

The same seven stalls appear in almost every onboarding process. Each has a simple fix, and together the fixes are what people mean by supplier onboarding best practices.

• The request arrives after the deal is done. Make the request step easy and early, and back it with a no purchase order, no payment rule so the shortcut stops working.
• Every supplier gets the same questionnaire. Tier first, and ask low-risk suppliers for the minimum.
• Documents are requested one at a time. Send one structured request with a deadline.
• Chasing depends on someone remembering. Use automatic reminders at fixed intervals, with escalation to the budget holder when a supplier goes quiet.
• Submissions wait in someone's inbox. Use a review queue with a named reviewer and a way to send a submission back with reasons.
• Bank details arrive by email. Verify independently every time, including every later change.
• Documents are filed without expiry dates. Capture the expiry at collection, or the record starts going stale the day you approve it.

Process vs Checklist: You Need Both

A process and a checklist answer different questions. The process says who does what, in what order, and when a supplier counts as approved. The checklist says what evidence to collect and check at steps 3 and 4. Teams with only a checklist collect the right documents but cannot say who approved the supplier or why it took six weeks. Teams with only a process move suppliers through quickly with the wrong evidence.

Use our 37-point supplier onboarding checklist, which comes as a printable PDF, as the content of steps 3 and 4, and the seven steps above as the frame it runs in.

Automating the Process with Supplio

Supplio is supplier onboarding software built around this process for UK teams. Mapped to the seven steps:

• Request and tier: add the supplier, and rule-based automations can react to a new supplier by assigning an onboarding form, creating a task or sending an email.
• Collect: invite the supplier by email, with invites that expire and can be resent or revoked. Suppliers complete your questionnaires and upload documents with expiry dates in a branded portal that is free for them on every plan.
• Verify: Supplier Watch checks suppliers daily against Companies House, The Gazette and the UK Sanctions List, plus FSA registers for food supply chains, and surfaces findings for you to confirm or dismiss.
• Approve: submissions land in a review workspace where you assign a reviewer, leave notes, and approve or send back with the reason attached. Multi-stage approval workflows are configurable and rule-based, and every action is recorded in an immutable audit log you can export to CSV.
• Set up in finance: Supplio does not push vendor master data into your ERP, so this step stays with finance, working from an approved and evidenced record.
• Monitor: documents keep their expiry dates, with automatic reminders 30 and 7 days before expiry, and insurance shows as Valid, Expiring soon or Expired.

Pricing is published in GBP, with plans from £599 a year.

Frequently Asked Questions

Sources

• Companies House and The Gazette
• The UK Sanctions List (gov.uk)
• Check a UK VAT number (HMRC)
• Modern Slavery Act 2015, section 54 (legislation.gov.uk)
• Employers' Liability (Compulsory Insurance) Act 1969 (legislation.gov.uk)
• UK GDPR guidance (ICO)
• Reporting on Payment Practices and Performance Regulations 2017 (legislation.gov.uk)