Supplier Onboarding and Due Diligence Template (KYS, Sanctions, ABC)

Risk tiering, checks by tier (identity, owners, sanctions, bribery, security, ESG), bank details verification, decision, monitoring

采购标准ISO 37001:2025 cl. 8.2 (cited only)supplier onboarding due diligence更新于 2026年10月29日

在编辑器中打开下载 .md

使用方法: Use it before a new supplier is created in the vendor master. Fill the risk tiering first, since the tier decides which checks are mandatory, and verify bank details through an independent channel. The main pitfall is screening the company name but not its owners and directors.

预览

Supplier Onboarding and Due Diligence: [Supplier name]

Record of the checks done before a new supplier is created in the vendor master and allowed to receive orders: identity and ownership ("know your supplier"), sanctions screening, anti-bribery and corruption, financial health, information security and privacy, sustainability and human rights, and verification of bank details. Due diligence depth follows a risk tier, in line with the proportionate approach of ISO 37001:2025 clause 8.2 (cited by name and clause number only). Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice: check the current official text and a qualified professional.

Document control

Field	Value
Record ID	[ONB-YYYY-NNN] Example: ONB-2025-041
Supplier legal name	[Name] Example: Pellacourt Logistics B.V.
Requested by	[@name, department] Example: [@logistics-manager]
Category	[Category] Example: Logistics and freight
Prepared by	[@procurement-analyst]
Decision owner	[Role per tier, section 6]
Status	[In progress / Approved / Approved with conditions / Rejected]
Next review	YYYY-MM-DD
Classification	[Confidential]

Revision history

Version	Date	Author	Change summary
0.1	YYYY-MM-DD	[@name]	Record opened
1.0	YYYY-MM-DD	[@name]	Example: Approved with conditions, security follow-up due

1. Risk tiering

Answer each question; the highest triggered tier applies.

Question	Triggers	Answer
Expected annual spend	Above [GBP 1,000,000] = Tier 1; [GBP 100,000 to 1,000,000] = Tier 2	Example: EUR 1,450,000 per year, above the GBP 1,000,000 trigger at recent exchange rates = Tier 1
Supports a critical process (production, customer delivery, regulated activity)?	Yes = Tier 1	Example: Yes, inbound parts and outbound deliveries
Processes personal data or connects to our systems?	Yes = at least Tier 2	Example: Yes, shipment data and portal access
Interacts with public officials on our behalf (customs, permits, licences)?	Yes = Tier 1 for bribery risk	Example: Yes, customs brokerage
Country or sector with elevated sanctions, corruption or labour risk?	Yes = at least Tier 2	Example: Subcontracted road haulage, labour risk in the sector
Replaceable within [3] months?	No = Tier 1	Example: Yes, within 3 months

Result: Tier [1 / 2 / 3]. Example: Tier 1.

2. Checks by tier

ID	Check	Tier 3	Tier 2	Tier 1	Detail template
CHK-01	Legal identity, registration and tax numbers against official registers	M	M	M	This record
CHK-02	Ultimate beneficial owners and directors	C	M	M	`compliance/kyc-cdd-profile`
CHK-03	Sanctions screening of entity, owners and directors	M	M	M	`compliance/sanctions-compliance-procedure`
CHK-04	Anti-bribery and corruption due diligence	n/a	C	M	`compliance/iso-37001-anti-bribery`
CHK-05	Conflict of interest check against employee declarations	M	M	M	`compliance/conflicts-of-interest-register`
CHK-06	Financial health (accounts, credit report)	n/a	M	M	This record
CHK-07	Information security and privacy	C	M	M	`compliance/supplier-security-assessment`, `legal-lite/dpa`
CHK-08	Sustainability, human rights and environment	C	M	M	`procurement/supplier-code-of-conduct`, `finance/csddd-due-diligence-plan`
CHK-09	Insurance certificates	C	M	M	This record
CHK-10	Quality approval (for production materials)	C	C	M	`procurement/supplier-performance-review`
CHK-11	Bank details verification	M	M	M	Section 4
CHK-12	Code of conduct accepted	M	M	M	`procurement/supplier-code-of-conduct`

3. Results

ID	Result	Date	Checked by	Evidence
CHK-01 (Example)	Registered in the Netherlands trade register, VAT number valid in the EU VIES check	2025-08-11	[@analyst]	DMS ONB-2025-041/01
CHK-02 (Example)	Two owners above 25%, both individuals, identity confirmed from registry extract and supplier declaration	2025-08-11	[@analyst]	/02
CHK-03 (Example)	No match on UK Sanctions List, EU consolidated list, OFAC SDN list for entity, owners and four directors; added to ongoing screening	2025-08-12	[@analyst]	/03
CHK-04 (Example)	Questionnaire complete; customs brokerage uses own licensed staff; anti-bribery clause and audit right required in contract	2025-08-15	[@compliance]	/04
CHK-05 (Example)	No employee declarations relate to the supplier	2025-08-12	[@analyst]	/05
CHK-06 (Example)	Three years of filed accounts, profitable, credit score in the low-risk band	2025-08-13	[@finance]	/06
CHK-07 (Example)	Security assessment rated medium; MFA on the shipment portal missing for customer users, fix by 2025-12-31	2025-08-20	[@security]	SSA-2025-018
CHK-08 (Example)	Sustainability questionnaire complete; subcontracted hauliers not yet covered by its own code; condition set	2025-08-19	[@sustainability]	/08
CHK-09 (Example)	Carrier liability and public liability certificates valid to 2026-06-30	2025-08-13	[@analyst]	/09
CHK-10 (Example)	n/a, service supplier
CHK-11 (Example)	Verified by call-back, see section 4	2025-08-21	[@ap-master-data]	/11
CHK-12 (Example)	Signed 2025-08-18	2025-08-18	[@analyst]	/12

4. Bank details verification

Step	Rule	Result
Source of details	On supplier letterhead or portal, signed by an authorised person	Example: Portal submission
Independent call-back	Phone number from an independent source (registry, contract, previous correspondence), not from the submission	Example: Called the finance director on the switchboard number from the contract, 2025-08-21
Name check	Payee name verification service where available: Verification of Payee for euro credit transfers (euro-area payment service providers offer it since 2025-10-09 under Regulation (EU) 2024/886), Confirmation of Payee in the UK	Example: Match
Account ownership	Account in the supplier's own legal name and in its country of establishment, unless justified	Example: Yes
Second person review	A second person in master data approves the record	Example: [@ap-lead]
Test payment	Optional for Tier 1: small payment confirmed by the supplier through the call-back contact	Example: Not used

Changes to bank details later follow the same steps and the vendor master controls in finance/procure-to-pay-and-expense-policy.

5. Onboarding workflow

The supplier record is created in the ERP only after the decision in section 6, so no order or payment can happen while checks are open.

6. Decision and conditions

Tier	Decision owner
Tier 1	Head of procurement and compliance officer
Tier 2	Category manager
Tier 3	Buyer

Field	Value
Decision	Example: Approved with conditions
Decided by	Example: [@head-of-procurement], [@compliance-officer]
Date	Example: 2025-08-22

Condition ID	Condition	Owner	Due	Status
COND-01 (Example)	Enforce MFA for all shipment portal users	Supplier, tracked by [@security]	2025-12-31	Closed 2025-11-28
COND-02 (Example)	Flow down the Corvanna Supplier Code of Conduct to subcontracted hauliers	Supplier, tracked by [@sustainability]	2026-03-31	Open
COND-03 (Example)	Anti-bribery clause and audit right in CTR-005	[@legal]	Before signature	Closed 2025-09-15

7. Ongoing monitoring and re-assessment

Trigger	Action
Daily sanctions list updates	Automatic re-screening; hits reviewed within [1] working day
Change of ownership or control	Repeat CHK-02 to CHK-04
Bank detail change request	Repeat section 4
Adverse media, data breach, labour allegation	Compliance review within [5] working days
Calendar	Tier 1 every [12] months, Tier 2 every [24] months, Tier 3 every [36] months

8. References

Reference	Version or date	Official source
ISO 37001, Anti-bribery management systems	2025, clause 8.2 due diligence	Official text: ISO, purchase or licensed access: https://www.iso.org/standard/85816.html
UK Sanctions List (sole UK list since the OFSI Consolidated List closed on 2026-01-28)	Current	https://www.gov.uk/government/publications/the-uk-sanctions-list
EU consolidated financial sanctions list	Current	https://data.europa.eu/data/datasets/consolidated-list-of-persons-groups-and-entities-subject-to-eu-financial-sanctions
OFAC Specially Designated Nationals list	Current	https://sanctionssearch.ofac.treas.gov/
Regulation (EU) 2024/886 on instant credit transfers (Verification of Payee)	Euro-area obligation since 2025-10-09	https://eur-lex.europa.eu/eli/reg/2024/886/oj

Standard and licence note

Structure aligned with ISO 37001:2025 (proportionate due diligence on business associates), cited by name and clause number only; no standard text is reproduced. Sanctions lists and payment regulation facts are from the official sources named above and must be checked on the date of use. Corvanna Instruments, Pellacourt Logistics and all results are fictional. The text is original and is not legal advice. Template licence: MIT.