Vendor onboarding checklist for India: the checks that cost money when skipped

Why onboarding checks are a finance problem, not paperwork

Most onboarding forms collect documents. Few of them check anything. That gap is expensive in India because several statutes put the consequence of a vendor's status on the buyer: your input tax credit depends on what the supplier files, your TDS rate depends on whether the supplier's PAN works, and your payment terms are capped by law if the supplier is a micro or small enterprise.

So the useful checklist is short and is organised by what goes wrong, not by which document is missing. Everything below is something that can be checked at onboarding and re-checked on a schedule.

1. Is the GSTIN active, and does the supplier actually file?

Section 16(2) of the Central Goods and Services Tax Act, 2017 lists the conditions a buyer must meet to take input tax credit. Two of them sit with the supplier, not with you. Clause (aa) requires that the supplier has furnished the invoice details in its statement of outward supplies and that they have been communicated to you; under the CGST Rules that means GSTR-1 and the auto-drafted GSTR-2B. Clause (c) requires that the tax charged has actually been paid to the Government.

In practice: a supplier with a cancelled registration, or one that does not file GSTR-1 on time, can cost you credit you have already paid for in the invoice price. The GST portal's public Search Taxpayer facility shows a GSTIN's registration status and its return filing history. Check it at onboarding, and again on a schedule for material suppliers, not only when an invoice fails to appear in GSTR-2B.

• GSTIN status is Active, and the legal name matches the contracting entity and the bank account holder.
• The principal place of business on the registration matches where the supplier says it operates.
• Return filing history shows GSTR-1 and GSTR-3B filed regularly.
• The registration type is noted (a composition taxpayer cannot charge GST on its invoice).

2. Is the PAN operative?

A PAN that has not been linked with Aadhaar, where linking is required, becomes inoperative. The Income Tax Department's published consequences of an inoperative PAN include tax deducted at source at a higher rate; under the Income-tax Act, 1961 the general higher rate where a valid PAN is not available was set by section 206AA at the higher of the applicable rate, the rate in force, or twenty per cent. Persons exempt from the Aadhaar-linking requirement are not affected.

The buyer carries this, not the vendor: a deductor who applies the normal rate to a vendor whose PAN was inoperative on the payment date can face a short-deduction demand. CBDT has given relief in specific windows where the PAN was made operative in time, which is the reason to check status before paying rather than reconciling afterwards. The Income-tax Act, 2025 has applied from 1 April 2026 and renumbers these provisions, so confirm the current reference with your tax team.

3. Is the vendor a micro or small enterprise?

This is the check most companies get wrong, because the vendor rarely volunteers it and the consequences arrive months later. Under section 15 of the Micro, Small and Medium Enterprises Development Act, 2006, a buyer must pay a micro or small supplier by the agreed date, and an agreed credit period cannot exceed forty-five days from the day of acceptance or deemed acceptance. Section 16 makes the buyer liable for compound interest, with monthly rests, at three times the bank rate notified by the Reserve Bank, if payment is late.

Two further consequences follow from the same fact. Companies that owe micro or small suppliers beyond forty-five days must report those dues to the Ministry of Corporate Affairs in a half-yearly return (MSME Form I), under an order issued under section 405 of the Companies Act, 2013. And income-tax law disallows the deduction for such dues until the year in which they are actually paid; under the 1961 Act this was section 43B(h). The rule continues under the Income-tax Act, 2025 with different numbering.

The control is simple: record the Udyam Registration Number and the enterprise's classification at onboarding, verify it on the Udyam portal, and make sure the payment terms in the contract and in the ERP respect the forty-five-day cap for those suppliers.

4. Does the bank account belong to the vendor?

Payment diversion, where a fraudster sends a convincing "change of bank details" letter, is one of the most common losses in accounts payable. No statute does this check for you. Validate the account holder name against the legal name on the PAN and GSTIN at onboarding, and treat every later change of bank details as a fresh onboarding: a call-back on a number already on file, not the one in the letter, and a maker-checker approval before the first payment to the new account.

5. Is the vendor, or its owner, on a list you cannot deal with?

Screen the entity and its directors or proprietors against the sanctions and designated-person lists relevant to your business, such as the UN Security Council consolidated list and India's lists of designated individuals and organisations, and against the export-control or sanctions regimes of other countries you operate in. Add an adverse-media search for fraud, insolvency and regulatory action. The point is not a one-off tick: it is recording what was checked, on what date, against which list, so the decision can be defended later.

6. Will the vendor touch personal data?

If the vendor will process personal data on your behalf, it is a Data Processor under the Digital Personal Data Protection Act, 2023. Section 8(2) allows you to engage it only under a valid contract, and section 8(1) keeps you responsible for processing it does on your behalf. Ask, before signing: where the data will be stored and processed, which sub-processors are involved, what security safeguards and logging are in place, and how quickly the vendor will tell you about a breach. Record the answers against the vendor, because they become contract terms.

7. What expires, and who is told?

Onboarding is a snapshot; the risk is in what changes afterwards. The items that lapse quietly are licences, insurance certificates, quality and safety certifications, and the GST and PAN status checked above. Each needs an expiry or re-check date and a named owner, so that a lapsed certificate is found before a delivery or an audit, not during one.

• Statutory registrations: GSTIN status and filing history; PAN status; Udyam classification.
• Commercial cover: insurance certificates with sums insured and expiry dates.
• Certifications and licences relevant to what the vendor supplies.
• Contract dates: renewal, notice period and termination, linked to the vendor record.

Where software helps, and where it does not

The checks above are not difficult; the failure is that they are done once, by one person, in a spreadsheet, and never repeated. Vendor management software earns its place by making the checks repeatable: a self-serve portal where the vendor submits its own details, a review stage with a maker and a checker, expiry dates that raise tasks, and the vendor linked to its contracts. IntelloVendor is built on that model, with AI that reads vendor documents and pre-fills assessments for a person to review.

What software cannot do is decide your risk appetite: which suppliers are material, how often they are re-checked, and who can approve an exception. Write that down first.