Vendor onboarding forms: what customers ask and how to fill them in fast

You won the deal. Then a vendor onboarding form arrives: a Word document, a PDF or a spreadsheet from the customer's procurement or finance team, asking for your company details, tax forms, insurance, bank information and a round of risk questions. Until it is complete, you cannot be paid or even set up as a supplier.

Vendor onboarding forms are less intimidating than security questionnaires, but they are the last gate before revenue and they go to several departments. This guide covers what they ask, what to have ready, and how to answer the risk questions without delay.

What a vendor onboarding form asks

Formats differ, but most have the same five parts:

1. Company details: legal name, trading name, address, registration number, year founded, ownership, key contacts
2. Tax and payment: a tax form, bank details for payment, invoicing address and currency
3. Insurance: the coverage you hold and limits, usually with a certificate
4. Risk and compliance: a short set of questions about security, privacy, business continuity, conflicts of interest and sometimes sanctions screening
5. Agreement: a signature confirming the answers are accurate

The tax form depends on the buyer's country. A US buyer paying a US person typically asks for an IRS Form W-9, which the IRS describes as a way to [provide your correct taxpayer identification number](https://www.irs.gov/forms-pubs/about-form-w-9) to the business that has to file an information return. Foreign suppliers are usually asked for a different form. Ask the buyer which one they need rather than guessing.

Have these ready before the form arrives

• Legal name, address, registration or business number
• A tax form completed for your situation
• A voided cheque or bank letter, if they will pay by transfer
• A certificate of insurance
• A one-page company overview
• Your privacy policy, security overview and subprocessor list
• Your answers to past security questionnaires
• An authorized signer who is allowed to attest to the answers

Putting these in one shared folder turns a two-week process into a two-day one. The same folder helps when a customer later sends a vendor security assessment.

The risk questions, with example answers

Most onboarding forms include a short risk section. The wording is usually brief. These examples use a made-up company, Harbour Analytics, and should be replaced with your own facts.

Question: Do you have a written information security policy? Answer: Yes. Our information security policy was last reviewed on [date] and is available on request under NDA.

Question: Will you have access to our systems or data? Answer: [No. / Limited access to X, through accounts we create for named staff.] We do not copy customer data outside the service.

Question: Do you have a business continuity plan? Answer: We have [a written plan / documented recovery steps] covering [scope]. We last reviewed it on [date]. [If you do not have one, say: Not yet in writing; here is what we do instead.]

Question: Do you use subcontractors who will handle our data? Answer: Yes. We use [number] subprocessors, listed with their locations at [link].

Question: Do you comply with applicable data protection law? Answer: Yes. Our privacy policy at [link] describes what we collect and how we use it. We offer a data processing agreement on request.

If the form's security section runs past ten or twenty questions, it is really a security questionnaire in disguise. Treat it like one: read how to answer a security questionnaire first.

Why buyers ask about your suppliers too

Questions about subcontractors and subprocessors are not idle curiosity. NIST's [SP 800-161 Rev. 1](https://csrc.nist.gov/pubs/sp/800/161/r1/final), published in May 2022, treats the supply chain as a source of cybersecurity risk and describes how organizations should manage it. Buyers who follow that kind of guidance want to know who sits behind you. Keep a current list of the services you rely on, and where each is hosted.

Common mistakes

• Guessing the tax form. The wrong form delays the first payment.
• Letting the wrong person sign. The signer attests that the answers are true; make sure it is someone who can stand behind them.
• Answering 'N/A' when you mean 'no'. Buyers treat the two differently.
• Different answers in different places. The onboarding form, the contract and your security page should agree.
• Sending bank details by ordinary email. Ask the buyer for their secure method and confirm by phone before you send anything.
• Rebuilding the form. Fill in the buyer's own file; they may load it into their vendor system.

Word and PDF forms

Most onboarding forms are Word or PDF. In Word, answer in the cells or under the question. A PDF is often a flat document: print-and-sign is rarely needed, so ask for an editable copy, or use a PDF editor that fills form fields. Keep the buyer's page order and numbering so their team can find each answer.

Where Rendro helps

At upload, Rendro lets you choose 'vendor onboarding form' as the form type. It drafts answers to the risk and company questions only from your own documents, shows the source for each one, and marks anything your documents do not cover as Needs review. A Word form comes back as the same Word file with the answers in place; a PDF comes back as an Excel answer sheet in the same order, because a PDF cannot be filled in reliably. It does not fill in tax forms or bank details, and it does not work inside supplier portals. See vendor onboarding at Rendro.

Got a vendor form waiting? Send us the blank file and we will fill in the first 25 questions free within 48 hours, so you can judge the quality before you pay. Get the free 25-answer sample, or email team@rendro.net with the subject 'Free draft'. Send only the blank form, never confidential documents or bank details.