Vendor onboarding is where compliance intentions either become real controls or quietly turn into a folder of unverified PDFs. It's also where most of the actual friction in procurement lives — not because the checks are individually hard, but because doing them consistently, for every vendor, under deadline pressure, is genuinely difficult without a defined process. This checklist walks through what to collect, how to verify it, and how to sequence approvals so nothing gets activated on the strength of a document nobody actually checked.
What Is Vendor Onboarding?
Onboarding is the controlled process of creating a supplier record, verifying identity and payment details, assessing relevant risks, obtaining approvals, and enabling the supplier for transactions. It starts before the vendor master record exists and continues through activation, communicating obligations to the vendor, and scheduling future review. It's a distinct step from sourcing: a commercially preferred bidder shouldn't automatically become an approved, payable vendor just because they won the tender.
What Information Should Be Collected From a New Vendor?
- Identity: legal and trading names, legal form, licence number, issuing authority, registered and operating addresses, activities, contacts and website.
- Ownership and control: shareholders, UBOs, directors, managers and authorized signatories.
- Tax and payment: VAT and corporate-tax status, TRNs where applicable, bank name, account name, IBAN, currency and remittance contact.
- Commercial and risk fields: category, products or services, countries served, proposed spend, contract owner, criticality, site/data/system access, and subcontractors.
Collect personal identification only where it's necessary, lawful, held securely, and subject to a defined retention period — not because a template happened to include the field.
UAE Vendor Onboarding Document Checklist
- Core: business licence, incorporation or constitutional documents, ownership/UBO evidence, signatory authority, bank confirmation.
- Tax: VAT certificate/TRN and corporate-tax registration evidence, where applicable.
- Risk-specific: audited financials, insurance, HSE and quality records, cybersecurity/privacy evidence, ICV certificate, product conformity, professional or municipality approvals.
- Contractual: code of conduct, confidentiality terms, conflicts declaration, anti-bribery acknowledgement, and data-processing or subcontracting schedules.
For every document, record who issued it, which entity and scope it covers, its issue and expiry dates, and the verification result — not just the fact that a file was uploaded. This is the same baseline our vendor onboarding document checklist works from, extended here with the UAE-specific verification steps.
How to Verify a UAE Trade Licence
Search the National Economic Register or the official portal of the issuing emirate or free zone — Dubai's official service supports searches by licence number, DUL number and business name, and the federal licence-inquiry service covers the broader picture. Match legal name (English and Arabic where available), licence number, legal form, status, expiry, and activities. Confirm whether you're dealing with a branch or the head office, and whether the contracting entity actually holds the relevant licence. A current general licence doesn't automatically prove permission for regulated work — check for activity-specific external approvals separately, and save the verification source, date and result against the vendor record. For a deeper walkthrough of this step specifically, see GCC trade license verification: a field guide for procurement.
How to Validate VAT and Corporate Tax Registration
Verify the VAT TRN using the FTA's official verification service and match the registered name to the vendor. Confirm whether registration should even exist in the first place: the standard mandatory threshold for resident businesses is AED 375,000 of taxable supplies and imports, with a voluntary threshold of AED 187,500. Corporate-tax registration is a separate process — check current FTA corporate tax registration requirements, noting that natural persons carrying on business generally fall within scope once annual turnover exceeds AED 1 million, per the FTA's guidance on the basis of taxation for natural persons. Investigate mismatched names, cancelled registrations, suspicious certificates, or invoices charging VAT with no verifiable registration behind them — and route uncertain tax treatment to tax professionals rather than issuing an internal tax opinion.
How to Verify a Vendor's Bank Account
Validate the IBAN structure and bank identifier using the Central Bank of the UAE's IBAN standard, but remember that a mathematically valid IBAN says nothing about who actually owns the account. Obtain bank-issued evidence or independently confirm the account title, and match the beneficiary to the contracting legal entity — escalate anything routed to a personal, unrelated, or third-party account. This matters most, and is most often skipped, when bank details change mid-relationship: always confirm new or changed details using a trusted contact pulled from the existing approved vendor record, never the number in the change-request email itself, apply maker-checker approval to the change, and retain the callback evidence and full change history.
How to Identify UBOs, Directors and Authorized Signatories
Work from the licence, memorandum/articles, shareholder register, official registry extracts, UBO declaration and ownership chart — not a simplified summary the vendor provides. Follow corporate shareholders down through each layer until natural-person owners or controllers are identified, or the applicable fallback under Cabinet Resolution No. 109 of 2023 is reached. Shareholders, UBOs, directors, managers and signatories are distinct roles — don't treat them as interchangeable. Verify that whoever is signing actually has authority through governing documents, a board resolution, or a power of attorney, and check its scope and expiry. Screen or collect IDs only in line with applicable risk, AML and privacy requirements, not as a default step for every vendor.
Which Vendor Assessments Should Be Assigned?
Basic KYB and payment-fraud controls should apply to essentially all suppliers. Layer HSE and labour review on top for site-based or labour-intensive work, cyber and privacy review for anyone with data or system access, and financial review for critical or high-value vendors. Add quality, product conformity, insurance, ESG, ICV, business continuity, and subcontractor modules when the vendor's profile actually triggers them. The discipline that keeps this from becoming arbitrary is a rules matrix based on defined risk attributes, rather than letting individual requesters informally skip assessments they find inconvenient.
Internal Vendor Approval Workflow
A workable sequence: business sponsor initiates → procurement reviews → KYB/compliance verifies → information security, privacy, HSE or finance weigh in as triggered → legal reviews the contract → vendor-master or finance activates the record. Separate the requester, the verifier, the approver and the vendor-master creator wherever your organization's size allows it. Define approval thresholds, service-level targets, rejection reasons, remediation steps, and time-limited conditional approvals — and prevent purchase orders and payments from proceeding until the minimum controls are actually complete, except through a documented emergency procedure with its own audit trail.
Vendor Onboarding Red Flags
- Licence or activity can't be verified, or names, addresses and dates conflict across the documents submitted.
- A recently formed entity claims a long operating history or major past projects with no supporting evidence.
- Complex or unexplained ownership, nominee indicators, sanctioned or high-risk exposure, or reluctance to identify controllers.
- The bank account belongs to an individual, an affiliate, or a foreign entity with no documented commercial reason.
- Altered files, unverifiable certificates, generic email domains, urgent payment pressure, or resistance to an independent callback.
How Long Should Vendor Onboarding Take?
There's no universal UAE statutory duration for ordinary procurement onboarding. In practice, a complete, low-risk UAE supplier can often be processed in one to three business days when verification sources and approvers are readily available. Medium- or high-risk, foreign, regulated, or complex-ownership suppliers can reasonably take days or weeks — the timeline is usually driven by remediation and external approvals, not the core checks themselves. It's worth measuring queue time separately from vendor-response time and review time, so that automation gains aren't overstated by lumping all three together.
How VendorEye Automates Supplier Onboarding
Vendoreye captures vendor referrals from authorized channels, invites the supplier, and prepopulates known details so nobody's re-typing the same fields twice. Documents are collected through a controlled portal, and names, identifiers, dates, ownership and tax fields get extracted automatically rather than manually re-keyed. Validation rules run against the collected evidence, conditional assessments get assigned automatically, and reviewers are routed in parallel where the workflow allows it — so a KYB check and an HSE review don't have to happen strictly sequentially just because that's how the process was originally drawn on a whiteboard. The result is an approval record carrying evidence, scores, comments, exceptions and timestamps, which then synchronizes into your governed vendor master through integration with your ERP. Expiry alerts, rescreening and reassessment continue automatically after activation — onboarding well doesn't mean the record can be forgotten the day after. See the full platform picture on our pricing page or read the details behind our security and data-handling posture.