AS | Ankit Sarawagi|Founder, CFOmatrix·July 2026·9 min read | Lean SOP |
- Six steps, one owner. Request, collect documents, verify, approve, add to the vendor master, ready to pay. Finance runs it; one approver signs off.
- A new vendor is a sensitive action. The founder approves every new vendor, the same way founders approve salary changes and bank-detail changes.
- Verify the bank account, always. Match a cancelled cheque or bank letter to the vendor’s legal name. Never onboard bank details typed in an email.
- Split the roles. Whoever negotiates a vendor’s terms should not also be the person who onboards that vendor.
- The vendor master lives in Zoho Books. Attach the documents, record the approval in the tool, and the audit trail is a byproduct, not extra work.
| 6 steps Request to ready-to-pay, one owner | 4 docs PAN, GST, bank proof, agreement | Founder Approves every new vendor |
| 1. What vendor onboarding is 2. The step-by-step process 3. Documents to collect (KYC and TDS) | 4. Verify and prevent bank fraud 5. Who does, who approves 6. The vendor master and audit trail |
What Vendor Onboarding Is
The vendor onboarding process is the set of steps you run before a new supplier can be paid. It is the gate between “someone wants to work with this vendor” and “this vendor sits in our books with verified details and an approval on record”. Skip the gate and you are one spoofed email away from paying a fraudster, and one audit away from being unable to prove you ever checked.
The spine of this SOP, and every SOP in this series, is simple: right-sized controls a lean startup can actually run. That means one owner in finance, the minimum number of approvers, no long signature chains, and a record that lives inside the tool you already use. Onboarding is where you set the vendor up correctly once, so that accounts payable, TDS, GST input credit and payments all flow cleanly afterwards.
This SOP sits inside a wider system of finance controls. Onboarding feeds directly into your accounts payable process and your payment controls, and it is one chapter of the full finance SOPs and controls guide for founders.
The Step-by-Step Process
Here is the whole flow, from the first request to a vendor that is ready to pay. In a lean team the head of finance owns steps two, three, five and six, the requester triggers step one, and the founder is the single approver at step four.
The single most common failure I see is founders who do steps one, two, five and six but quietly skip step three and four. The vendor gets created and paid, and nobody ever verified the bank account or approved the relationship. The verify-then-approve pair is the whole point of the SOP; the rest is just data entry.
Documents to Collect: KYC and TDS
The documents do double duty. They are your KYC (proof the vendor is a real, identifiable entity) and they are what lets you deduct the right TDS and claim GST input credit. For an ordinary Indian vendor there are four essentials, plus a few situational extras.
Use our free vendor onboarding form and documents checklist. Send it to every new vendor so the documents arrive complete and in one go, instead of a back-and-forth. The rules that sit behind this process, thresholds, categories and TDS rates, belong in your finance policy library; this SOP is the process, the policy is the rule.
Verify the Vendor, and Prevent Bank Fraud
Verification is the step that saves you real money. There are three checks, and the bank-account check is the one that stops fraud. Vendor bank-detail fraud, where an attacker emails “our bank account has changed, please update”, is the most common way startups lose money. The defence is a rule, not vigilance.
Treat any change to an existing vendor’s bank account as a brand new, founder-approved event, exactly like onboarding a new vendor. Confirm the change on a phone call to a number you already have on file, never a number in the request email. Keep bank-detail changes out of the hands of whoever releases the payment, and record who requested, who verified and who approved. This one rule prevents the single most expensive mistake a lean finance team can make.
“The person who negotiates a vendor’s terms should never be the same person who onboards that vendor. It is a tiny bit of friction that closes the biggest hole: no one gets to invent a supplier and pay it on their own say-so.”
Ankit Sarawagi, from building lean finance functionsWho Does, Who Approves
The approval model is deliberately short. The baseline is two people: finance does and checks the onboarding, and one other person approves. For a new vendor, that approver is the founder, because a new vendor sits in the same sensitive category as a salary change and a bank-detail change. There is no auto-approve-below-a-number free pass; every new vendor gets a real approval.
| Step | Who does it | Who approves | Record left |
| Request | Requester | – | Request note |
| Collect & verify | Head of finance | – | Documents + verification proof |
| Approve new vendor | Head of finance prepares | Founder | Approval in the tool |
| Create in master | Head of finance | – | Zoho Books audit log |
Even a one-person finance team never self-approves. Finance does the action; the founder approves. If a quick nod over email or Slack is how you move fast, that is fine, as long as you capture the approval back into the vendor record so it stays defensible.
- Finance collects and verifies
- Founder approves every new vendor
- One vendor master in Zoho Books
- Bank-detail changes = fresh founder approval
- Department head approves routine vendors within a category
- Founder keeps large or strategic vendors
- Board limit set by your investment agreement or SHA reserved matters
- Annual re-verification of active vendors
The Vendor Master and the Audit Trail
Every vendor you onboard lives in one place: the vendor master in your accounting tool. We use Zoho Books, which has a built-in audit trail that logs who created or edited each vendor and when. QuickBooks has a good audit-trail option too. The point is that the record, and the log of changes to it, sit inside the tool, not in someone’s inbox.
For every vendor, the record holds the PAN, GST, cancelled cheque and agreement (attached to the vendor), the verification proof, the founder’s approval, and Zoho Books’ own edit log showing who created and changed the vendor. That is exactly the paper trail an auditor or a diligence team asks for. Note that the MCA now requires accounting software to keep an audit-trail feature switched on, and auditors check it, so keeping the vendor master in the tool is not optional hygiene, it is compliance.
Startups rarely get caught because they did the wrong thing; they get caught because they did the right thing and never documented it. Run the six steps in the tool and the documentation is produced as a byproduct, not as extra work. The verified vendor then flows into your accounts payable and payment control processes, and the whole chain is covered in the finance SOPs and controls pillar.
“Auditors and diligence teams always ask for the same things: the document, the agreement, the process, the approval and the log. If your vendor onboarding lives in the tool, you hand all five over in a click instead of a scramble.”
Ankit SarawagiFrequently Asked Questions
What is vendor onboarding?
Vendor onboarding is the process of adding a new supplier to your books so you can pay them safely and legally. It runs from a request to work with a vendor, through collecting their documents (PAN, GST, a cancelled cheque or bank proof, and the agreement), verifying those details, getting the right approval, and finally creating the vendor in your accounting tool’s vendor master. Only then is the vendor ready to be paid. Done well, it protects you from paying the wrong bank account, missing TDS, or losing input tax credit, and it leaves a clean audit trail.
What documents should I collect to onboard a vendor?
For an Indian vendor, collect the PAN card (mandatory for TDS), the GST registration certificate (or a declaration if the vendor is unregistered or composition), a cancelled cheque or bank letter showing the account name, number and IFSC, and the signed agreement, purchase order or engagement email that sets the terms. Also capture the registered address, a contact person and MSME or Udyam registration if they claim it, because that affects your payment timelines under the MSMED Act. For a foreign vendor, collect the tax residency certificate and Form 10F for treaty benefits and Form 15CA and CB where required.
How do I verify a new vendor?
Verify three things before you approve. First, that the entity is real: check the PAN and the GST number on the GST portal, confirm the GST status is active, and match the legal name across documents. Second, that the bank account belongs to the vendor: match the account name on the cancelled cheque to the vendor’s legal name, and never accept bank details sent only in the body of an email. Third, that the person requesting the vendor is not the same person who negotiated the terms. Save the proof of each check into the record so it is auditable.
Who approves a new vendor?
In a lean startup, a new vendor is a sensitive action, so the founder approves it. The head of finance collects and verifies the documents and prepares the vendor, and the founder gives the go-ahead before the vendor is created and paid. This keeps the model to two sets of eyes without a long signature chain. As you scale, a department head can approve routine vendors within a category while the founder retains approval for large or strategic suppliers, with the board limit set by your investment agreement.
How do I prevent vendor bank fraud?
Bank-detail fraud is the most common payment loss for startups. Prevent it with a few rules: always verify a vendor’s bank account against a cancelled cheque or bank letter in the vendor’s own name, never against details typed in an email. Treat any change to an existing vendor’s bank account as a fresh, founder-approved event, and confirm the change on a phone call to a known number, not a number in the request. Keep bank-detail changes out of the hands of the person who pays, and record who requested, who verified and who approved each change.
How do I keep an audit trail for vendor onboarding?
Keep the vendor master in your accounting tool, such as Zoho Books, which has a built-in audit trail that logs who created or edited each vendor and when. Attach the PAN, GST, cancelled cheque and agreement to the vendor record itself, and record the approval inside the tool. If you approved quickly over email, Slack or WhatsApp, save that approval back into the vendor record so it stays defensible. This way the paper trail, the document, the verification and the approval, is produced as a byproduct of the process, which is exactly what an auditor or a diligence team asks for.
This is general educational information for founders, current to mid-2026, and is not legal, tax or audit advice. Document requirements, TDS rates, GST rules and the MCA audit-trail requirement change over time; verify the current position or consult a professional before acting on a specific matter.
Payment Controls and Maker-Checker for Startups
Finance SOPs & Controls: The Founder’s Guide
AS | Founder, CFOmatrix | Finance Strategy & Equity Compliance CFOmatrix is a knowledge platform focused on how finance actually works inside growing companies. This SOP draws on hands-on experience building lean, audit-ready finance functions for startups, from vendor onboarding and payment controls to month-end close. |