Supplier Onboarding Automation: AI Forms, Checks and Reminders

Use one intake form that collects everything at once, a status sheet that shows what each supplier is still missing, and a scheduled reminder sequence that names the gaps. Let AI read the documents and flag mismatches, but have a person approve the supplier and verify any bank detail by phone. Never accept a bank-detail change by email alone.

Most onboarding time is lost to chasing, not checking. A supplier sends three of six documents, someone replies to the wrong thread, and the missing item surfaces when the first invoice is due. Fix the chasing with a form and a schedule, and spend human time on the checks that carry risk.

Follow me on Instagram@sagnikteaches

The onboarding path as six statuses

Automation needs a clear picture of where each supplier is. Give every new supplier one row in a sheet with a status that moves in one direction.

Connect on LinkedInSagnik Bhattacharya

1. Invited. The buyer has agreed to trade and sent the form link.
2. Form received. The supplier has submitted details and uploads.
3. Documents incomplete. At least one required item is missing or failed a check.
4. Checks done. All items are present and a person has verified the bank details by call-back.
5. Approved. Added to the supplier master list and the purchasing system.
6. Review due. An expiry date (insurance, certificates) is near.

Say a trade wholesaler of heating and plumbing parts takes on about eight new suppliers a month. Before any change, the owner's assistant spends about 3.5 hours per supplier: writing the first email, collecting attachments from several threads, retyping bank details, and chasing. Average time from first contact to approved is 23 days, and in four of every ten cases something is still missing after two weeks. Those figures are illustrative; time your own for a month first, because a baseline is what proves the change worked.

Subscribe on YouTube@sagnikteaches

Decide what each kind of supplier must provide

Asking every supplier for everything slows the small ones, who give up, and fails to scrutinise the big ones. Split suppliers into three tiers when you invite them.

The $25,000 line is an example; set yours from what a failure would cost you. Record the tier in the sheet, because the form, the reminders and the checks all vary by tier. A tier C supplier should never receive a nine-document request, and a tier A supplier should never get a pass because they are busy.

The intake form: fields that save the typing

Use whatever form tool you already have, and build the form around these fields. The form's job is to remove retyping and to refuse an incomplete submission.

• Legal entity name, trading name, registration number, registered address, year started trading.
• Primary order contact, payments contact (a separate named person and a role-based mailbox if they have one).
• What they supply, categories, minimum order, usual lead time.
• Bank details: account name, account number or equivalent, bank name, and an upload of a bank letter or a recent statement header on their letterhead.
• Uploads: tax registration form, insurance certificate (tier A), quality or safety certificates, signed terms.
• A declaration that the details are correct, with the name and role of the person submitting.

Make uploads mandatory where the tier requires them, so the form cannot be submitted without them. When the submission arrives, a short automation writes the answers into the status sheet and moves the status to "form received" or "documents incomplete". The same idea of structured packets applies to hauliers; carrier packet onboarding shows how to collect and check a transport company's documents the same way.

A reminder sequence that names what is missing

Reminders work when they say precisely what is outstanding and by when. Build the schedule once and let the sheet decide who receives what. A simple version:

Have an assistant draft the five texts once, in your voice, and then store them as templates with merge fields for name, list of missing items and due date. Here is the day-7 message with the merge fields shown (illustrative).

Subject: Three items still needed to set up [supplier name]

Hi [first name],

Thanks for sending your form on [date]. To finish setting you up we
still need:

[missing items, one per line, e.g.:
- Insurance certificate showing cover that is current today
- Bank letter on company letterhead
- Signed terms, page 4]

You can upload them at [form link]. If you send them by [date], we can
place your first order on [date].

If anything is unclear, call [name] on [number] and we'll go through it.

Thanks,
[your name]

The sheet builds the "missing items" lines from the status columns, not from the assistant, because a reminder that lists the wrong gap annoys the supplier and teaches them to ignore you. Stop the sequence the moment the status moves to "checks done", and make sure a supplier who replies by email, not by form, is dealt with by a person who updates the sheet.

Let AI read the insurance certificate, not approve it

Insurance certificates are long, differently laid out, and checked rarely. An assistant is good at pulling the fields into a table so a person can compare them with your requirement. Remove or ignore anything you do not need, and use a plan that does not train on your content by default.

Read the attached certificate of insurance and return a table with:
insured name, insurer, policy type, policy number, start date, expiry
date, each limit with its amount, and who is named as certificate
holder. Then compare against these requirements and mark each
Pass / Fail / Cannot tell:
- Insured name matches "[supplier legal name]"
- Cover type includes general or public liability
- Limit of at least $2,000,000 per claim
- Expiry date is at least 60 days after today ([today's date])
- We are named as certificate holder
Quote the exact words from the certificate for every Pass or Fail.
If a field is unreadable, say Cannot tell. Do not guess.

The result (illustrative) is a table. Typical findings: "Insured name: 'Example Heating Supplies Ltd' against legal name 'Example Heating Supply Ltd': Fail (one word differs)"; "Expiry: 14 days from today: Fail"; "Certificate holder: not named: Fail". Check the quoted words against the page, because assistants sometimes quote a figure from a different line, and treat any Cannot tell as a task for a person. The decision, such as accepting a certificate where the name has a typo that is clearly the same company, is a human one. The same approach can read a quality certificate, but compare expiry and scope yourself.

Put expiry dates on a calendar, not in a folder

The certificate you checked today expires next year. Add the expiry date to the status sheet as a column, and have a rule that moves the supplier to "review due" 60 days before, with reminders at 60, 30 and 7. A supplier whose insurance lapses becomes your risk the day an incident happens. For a larger picture of the approval-and-payment chain once suppliers are live, accounts payable approvals without chaos places this step in context.

Bank details: the one step you never fully automate

Redirected-payment fraud is a plain trick. Someone emails a customer or buyer pretending to be a known supplier, says the bank account has changed, and attaches an official-looking letter. The next payment goes to the criminal. It works because the email looks routine and the person paying is busy. A change request is the highest-risk message an accounts team receives, so the rule is simple and has no exceptions.

The rule has five parts:

1. No new or changed bank detail is accepted by email, form or chat alone.
2. A person calls the supplier on a phone number already held on file from before the request (never one in the email), asks to speak to the named payments contact, and reads the new details back.
3. The new account name must match the legal name on the supplier record. A personal account for a company supplier stops everything.
4. A second person approves the change in the master list.
5. No payment goes to the new account for 48 hours after the change is recorded, with the supplier told the date their first payment will arrive.

The call-back is the part that works. A fraudster controls the email thread and can fake a letter; they rarely control the phone number you saved a year ago. For a new supplier, there is no earlier number, so use one from an independent source: the supplier's official website reached by you, or a trade reference. Keep the call-back to two minutes with a script, so staff do not skip it when busy.

Let the assistant flag a suspicious change request

An assistant can read an incoming "we have changed banks" message and mark the usual warning signs. It does not decide; it puts the message in the review queue with reasons. Paste the message with the account number blanked.

Review this email from a supplier asking us to change bank details.
List which of these warning signs are present, quoting the words:
urgency or pressure, a reply-to or sender domain that differs from
earlier emails from this supplier (earlier domain: [domain]), a new
account in a name that differs from the supplier's legal name
([name]), a request to keep the change confidential, a request to
skip normal checks, odd grammar compared with earlier messages, an
attachment that is an image or an editable file instead of a bank
letter. Then say "Hold for call-back" or "Routine". Do not recommend
paying.

A reply (illustrative): "Warning signs: sender domain 'example-heating-suppy.com' differs from earlier 'exampleheatingsupply.com' (quote: 'From: accounts@example-heating-suppy.com'); urgency ('please update before Friday's run'). Hold for call-back." The routine label does not clear the message either; every bank change, flagged or not, goes through the five-part rule. The assistant's value is that it never gets tired at four on a Friday. What you fix: it will miss a domain that differs in a subtle way unless you give it the earlier domain, which is why the sheet should keep each supplier's known email domain.

A change request that the call-back caught

Say a wholesaler receives an email from what looks like a regular supplier's accounts address: "We have changed bank. Please use the details on the attached letter for Friday's payment." The attachment is a clean PDF on a convincing letterhead. A new junior in accounts, working from the rule, flags it for a call-back instead of changing the master list. She phones the number held on file since the supplier was onboarded and reaches the real payments contact, who knows nothing about a change.

The payment due that week was $18,400. The fraud attempt cost 25 minutes of two people's time. What made the difference was not detection software but a written rule that did not rely on anyone feeling suspicious, and a number saved before anything went wrong. The incident went into the log, the sheet gained a column for each supplier's known domain, and the supplier was told their email may have been compromised. If you share bank data with AI tools beyond a document check, whether it is safe to connect AI tools to a business bank account sets out sensible limits.

From a thread of emails to a form: before and after

Before, a typical onboarding looks like this. The buyer emails a supplier asking for "your details". The supplier replies with a price list and a logo. The buyer asks for a tax form. Two days later a bank letter arrives from a different person. The insurance certificate comes as a photo of a printout. Someone retypes the account number into the system, and a digit goes wrong. The first payment bounces and the supplier calls to ask where their money is.

After, the buyer sends one link. The supplier fills in the legal name once; the sheet receives it. The bank details are typed once, by the supplier, and a person compares them with the bank letter rather than retyping. The upload for insurance is mandatory for tier A and absent for tier C. The retyping error cannot happen because nobody retypes. The point of the form is that it removes places where data gets changed by hand, and every one of those places was a chance for the number to be wrong.

Keep a tiny supplier from giving up

A one-person supplier, such as a craftsperson who sells you twenty units a month, may not have an insurance certificate, a registration number in the form you ask for, or a company letterhead. The same form that suits a ten-person firm can lose you a good supplier. Tier C exists for this. Ask for a name, a way to pay and a tax form where your own records need one. Do not ask for insurance unless the goods carry real risk (electrical, children's items, food). Where the supplier is a sole trader, a recent bank statement header showing their name and the account can stand in for a company bank letter.

The sheet should let a person move a supplier down a tier with a written reason, so the exception is recorded. A rule that is never relaxed gets worked around; a rule with a recorded exception route stays in use.

Catch duplicates and near-duplicates before approval

Duplicate supplier records are a quiet source of double payment, and a fraud route. Before approving, search the master list for the new supplier's bank account number, registration number, tax number and the first word of the name. A match on the bank account with a different supplier name is a stop sign. A match on the name with a different account is a change request in disguise, and goes through the call-back rule.

An assistant can help when the list is long: paste the new supplier's name and the supplier list (names only) and ask for any name that could be the same company written differently ("Example Heating Supplies Ltd", "Example Heating Supply Limited", "EHS Ltd"). It will find spellings you would skim past. It cannot see accounts you do not paste in, so the exact-number match stays a formula. Add the check as a step in the "checks done" status so it is never skipped.

What not to send to an AI tool

Onboarding documents hold sensitive data: full bank details, tax numbers, registration documents, names and phone numbers of individuals. Keep the principle simple. Send the assistant only what the task needs: for the insurance read, the certificate alone; for the change-request review, the email text with the account number blanked; for the duplicate check, names only. Use a business plan that does not train on your content by default, and leave the bank detail itself in the sheet and the form, which are already where it is meant to be.

Approval, and what happens to the first order

Approval is a short checklist a person signs off: tier correct, every required document present and passed, bank details verified by call-back with the date and the name of who spoke, second approver recorded, terms signed. Only then does the supplier move to "approved" and appear in the purchasing system. If you work with purchase orders, automating purchase orders and supplier emails takes over from here, and a supplier scorecard starts tracking delivery and quality from the first order.

Hold the first order if the supplier is not approved; do not release it on a promise that the paperwork is coming. A supplier who knows the first order waits for the paperwork provides it quickly. Keep an exception route for emergencies, with the owner's sign-off recorded, so staff do not invent their own.

How to tell the change worked

After two months, compare four numbers with your baseline: average days from invite to approved (the example was 23), staff time per new supplier (the example was 3.5 hours), the share of suppliers still missing something after two weeks (four in ten), and the number of bank changes verified by call-back against the number received. To see what the change would be worth, run the sum with illustrative targets: if the heating wholesaler reached 10 days to approval and 1.2 hours per supplier, eight suppliers a month would free about 18 hours, roughly $550 a month at $30 an hour of staff time. Your own figure depends on your baseline, so measure it rather than assume it.

Check also that the automation is not silently failing: once a month, take one approved supplier at random and trace its record from form to approval. Are all documents there, was the call-back logged, is the expiry date on the calendar? A random trace is the cheapest audit you can run, and it is the same habit used on supplier audit visits. Reread the reminder texts from time to time, too; a message that sounded firm in January may sound abrupt to a supplier who has met your team since.

Questions about automating supplier onboarding

What documents should a wholesaler collect from a new supplier?

At minimum: legal name and registration number, a tax registration form, bank details on company letterhead or a bank letter, a certificate of insurance where the goods or work carry risk, your signed terms, and a named contact for orders and for payments. Add product safety or quality certificates for goods you resell. Collect more only for higher-risk suppliers.

Can AI check bank details are genuine?

No, it can only compare what the documents say. It can flag that the account name differs from the legal name, that a letter looks edited or that a change request carries urgent wording. Confirming that an account really belongs to the supplier needs a call to a number you already held, made by a person.

How many reminders are too many?

Four over three weeks is a sensible ceiling: a friendly nudge, a specific list of what is missing, a deadline note and a final notice from a named person. After that, pause the supplier's first order rather than send a fifth. A reminder that names exactly what is missing is easier to act on than a general one.

Should the same person who onboards a supplier approve payments?

Avoid it. Splitting the roles means one person can set up a supplier and another must approve the first payment or any bank change. In a very small team, the owner can be the second check on new accounts and changes only. Separation of duties catches both honest slips and fraud.

Further reads

• 3PL Client Onboarding Checklist: AI-Drafted SOPs and SLAs — Onboard clients in the same structured way.
• How to Match Supplier Invoices to Purchase Orders Automatically — Once a supplier is live, match their invoices to orders.
• Supplier Price Increases: Update a Wholesale Price List With AI — Handle the first price-list update from a new supplier.
• AI for Distribution Companies: Chase Late Invoices and Credit Holds — The customer side of the same money controls.
• AI Supplier Negotiation Emails for Importers: Price, MOQ, Terms — Agree terms before the form goes out.
• Subcontractor Management: Track Insurance Expiry and Onboarding With AI — A document pack checklist, an expiry tracker with working formulas and four reminder emails, with AI reading certificates and a person approving them.
• Subcontractor Prequalification Questionnaire: Build and Score It With AI — A question set for insurance, safety, references, capacity and finances, a weighted scoring sheet, and tests that make AI scoring fairer before you act on it.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: general accounts-payable and fraud-prevention practice; a 2023 law-enforcement public service announcement on business email compromise (verify account changes through a second channel, watch for misspelt domains), checked November 2026; the figures and example messages are illustrative. Check any legal or tax requirement for supplier records with a qualified adviser.