Vendor Onboarding Process: A Step-by-Step Guide for Indian Businesses

Ask a procurement team why vendor onboarding takes three weeks. The answer is usually that vendors are slow to send documents.

Measure it properly and you see something else.

The vendor sent their documents the next day. Two were missing. Someone emailed back. That round trip took four days. Compliance checks took one afternoon of work, spread across nine days, because the person had other things to do. Then three approvals moved one after another. Each one sat in an inbox until somebody noticed it.

The vendor was waiting for one of those days. Your company was waiting for the rest.

That difference matters. You cannot make a vendor faster. You can remove a queue.

What Is Vendor Onboarding?

Vendor onboarding is how you check, approve and activate a new supplier. It runs from the first conversation to the moment the vendor is live in your system and the first order has been reviewed.

It is not the same as procurement. Procurement decides what you buy. It is not accounts payable either. That decides how vendors get paid.

Onboarding answers a different question. Should this vendor be doing business with you at all? On what terms? And what proof do you hold?

Done well, it gives you three things. A vendor who can transact without friction. A written reason for approving them. And a record that still answers an audit question two years later.

The Vendor Onboarding Process, Step by Step

Step 1 — Identify and qualify the vendor

Before you collect a single document, check that this vendor is worth onboarding.

You need three things. A clear business need. A check that no approved vendor already covers it. And a basic view of whether the vendor can deliver.

For routine categories, a short note is enough. For high-spend or strategic categories, send a Request for Information first. Ask about capability, capacity and references before you commit any real effort.

This step prevents the most wasteful outcome in vendor management. Onboarding a supplier who duplicates one you already have.

Step 2 — Collect documentation

For an Indian vendor, the standard set is:

• Vendor information form with entity details, contacts and category of supply
• PAN card
• GST registration certificate, where applicable
• Certificate of Incorporation, Partnership Deed or proprietorship proof
• Cancelled cheque or bank account verification letter
• Udyam registration certificate, if the vendor is an MSME
• EPFO and ESIC registration proof, where headcount requires it
• Lower or nil TDS certificate, if the vendor holds one
• Trade licences or category-specific safety and quality certificates
• Insurance certificates, for vendors working on your premises

The usual mistake is collecting all this by email.

A vendor sends six of ten documents. Someone spots four missing. They email back. Then they wait. Two or three rounds of this is normal. Each round costs days.

A simple submission form or checklist fixes most of it. One that rejects an incomplete set. The vendor can see straight away what is still outstanding.

Step 3 — Verify statutory compliance

A document on file is not a document verified. Four checks matter most in India.

GST registration status. Check the GSTIN on the GST portal using Search Taxpayer. Confirm the legal name, that the registration is active, and that filings are up to date. A cancelled GSTIN on a vendor you pay puts your Input Tax Credit at risk.

MSME classification. Check the certificate on the Udyam Registration portal. This is not just paperwork. MSME status triggers statutory payment protection. Public sector buyers also work to MSME sourcing targets.

Labour law compliance. Vendors who supply manpower or work on your site need valid employee registrations. EPFO generally applies to covered establishments once they employ 20 or more people. ESIC generally applies to covered establishments in notified areas at 10 or more employees, for those earning up to ₹21,000 a month. Coverage depends on the type of establishment as well as headcount, so check the category rather than the number alone. If you do not check, you carry principal employer liability.

TDS checks. Sections 206AB and 206CCA, which set higher rates for non-filers, were omitted with effect from 1 April 2025, so that check no longer applies. Higher rates still apply where PAN is invalid or not provided, so validate the PAN itself. Record any lower or nil deduction certificate the vendor holds, with its validity window. Under the Income-tax Act, 2025, in force from 1 April 2026, these certificates are issued under Section 395 and applied for in Form 128, replacing Section 197 and Form 13.

The same logic applies inside your own company. The thresholds behind payroll compliance work exactly the same way.

Step 4 — Finalise terms, assess risk and tier the vendor

Not every vendor needs the same scrutiny. Putting a stationery supplier through the same checks as a strategic manufacturing partner wastes weeks. It adds no safety at all.

Agree the commercial terms here. Pricing, service levels, deliverables and NDAs.

For MSME vendors, payment terms must follow the MSMED Act. The clock starts at acceptance, or deemed acceptance, of the goods or services. Without a written agreement, payment is due within 15 days of that date. With one, the agreed period applies, but it cannot exceed 45 days from the same date.

Then give the vendor a risk tier. The tier decides how many approvals they need.

Tiering lets a low-risk supplier go live in two days. It keeps the heavy controls where the risk actually sits.

Step 5 — Route for internal approvals

This is where most onboarding stalls.

The reason is almost always the same. Approvals move one after another by email. Procurement approves and forwards to finance. Finance approves and forwards to the category owner.

Most of the elapsed time is inbox time. Nobody can say where the request is without asking three people.

Run the same approvals in parallel instead, from one shared queue. Everyone reviews at the same time. Anyone can see the status without chasing it. No control is weakened. Each approver still looks at the same evidence.

Who those approvers should be is covered in detail further down.

Step 6 — Create the ERP master record

Once approved, activate the vendor in your ERP or accounting system. SAP, Oracle and Tally all work the same way here.

Give the vendor a unique code. Set up bank details, the verified GSTIN and PAN, the TDS rate and the MSME flag.

Feed that record straight into your procurement and accounts payable modules. Purchase orders then generate cleanly and three-way invoice matching works without manual help.

Step 7 — Run a trial transaction

A trial order tests things paperwork cannot.

Does the vendor deliver on time? Does the quality match the spec? Is the GST invoice correct? Do they fix problems quickly?

Finding a problem on a small trial order is much better than finding it on a delivery you cannot afford to miss.

Step 8 — Monitor compliance and performance continuously

Onboarding compliance expires.

A GSTIN you verified today can be cancelled next month. MSME certificates, trade licences and insurance policies all run out.

Track expiry dates automatically and raise an alert before each one lapses. Record vendor performance as transactions happen, not once a year. Lead times and invoice accuracy are the two worth watching.

Whose Approval Is Required for New Vendor Onboarding?

There is no single legal answer, and that catches people out.

Indian law does not set your internal approval matrix. Almost every threshold you will meet is your own policy. Two signatures above ₹5 lakh. CFO sign-off above ₹25 lakh. Your company wrote those rules, not Parliament.

There is one important exception. Where the vendor is a related party, the Companies Act, 2013 can impose approval requirements of its own. That case is covered below.

The standard approval chain

In most Indian mid-market companies, a new vendor passes four gates. Each one checks something different. That is why merging them into a single sign-off causes problems later.

Look at that last row again.

Under the MSMED Act, 2006, payment to an MSME vendor runs from acceptance or deemed acceptance. With a written agreement you can agree a period up to 45 days from that date. Without one, it is 15. Skipping legal review to save time can therefore shorten your own payment window. Interest follows under Section 16, and a disallowance can follow under Section 43B(h).

Setting your own thresholds

The law is silent here, so the matrix is yours to write.

Two things make it work. It has to exist in writing. And it has to be tied to expected annual spend, not first order value.

That second point matters more than it sounds. A ₹40,000 trial order can quietly become a ₹40 lakh relationship. Nobody re-approves it along the way.

Here is a workable starting structure. Adjust the bands to your own turnover.

Two rules keep the matrix honest.

The person who asked for the vendor cannot be the person who approves payment to it. And approvals attach to the vendor record, not to an email thread. An auditor should be able to see who approved what, and when, without opening anyone's inbox.

When the vendor is a related party, the law may decide

Say the supplier is a director. Or a relative of a director. Or a firm where a director is a partner. Or a company under common control.

That transaction may fall under Section 188 of the Companies Act, 2013. Where it does, your internal matrix does not override it.

• Board approval is required for transactions the section covers, at any value. It must be a resolution passed at a properly convened board meeting. A circular resolution does not count.
• Shareholder approval may also be needed once the prescribed limits in Rule 15 are crossed. The limit depends on the type of transaction. Check the current Rule 15 threshold for your category before relying on a number, since they have been amended more than once.
• The ordinary-course exemption can take a transaction outside the section entirely. The proviso to Section 188(1) carves out transactions entered into in the ordinary course of business and on an arm's length basis. Both conditions must hold. A deal being routine does not by itself make it ordinary course, and a price nobody benchmarked is hard to call arm's length.
• Audit committee approval applies separately, where a committee exists. That means listed companies, and public companies above the paid-up capital, turnover or borrowing limits in Rule 6. This obligation is not removed by the ordinary-course exemption. Omnibus approval is allowed, but it runs for one financial year only.

The practical point is about timing. Related party status has to surface when you collect documents, not when you process the payment. Once an invoice is already in the approval queue, working out whether the section applies, and obtaining a resolution if it does, is no longer routine. Take advice on the specific transaction rather than reading a threshold off a table.

A Realistic Onboarding Timeline

Where Onboarding Breaks Down

Documents collected by email. Partial files cause endless back and forth.

Manual portal checks. Typing GSTINs, PANs and bank details into government portals by hand costs hours per vendor.

Sequential approvals. Requests sit in one inbox at a time instead of moving in parallel.

The same scrutiny for everyone. Auditing a low-spend supplier like a strategic one slows down the whole business.

Treating verification as one-time. A GSTIN cancelled after onboarding, or a licence that quietly expires, is a real exposure.

How to Measure Onboarding Efficiency

Three numbers show you where the bottleneck is.

Internal versus external cycle time. Count the days from request to ERP activation. Then split them. How many days were you waiting on the vendor? How many were you waiting on yourselves? The second number is the one you can fix.

First-pass yield. What share of vendors send a complete, compliant document set on the first try? A low number means your instructions are not clear.

Compliance currency. What share of your active vendors have valid tax records and licences today? Not at onboarding. Today.

Frequently Asked Questions

How long should vendor onboarding take in India?
Two to three days for a low-risk vendor if you have automated the checks. Two to three weeks for a strategic supplier that needs a site audit and a negotiated contract.

Whose approval is required to onboard a new vendor?
No law sets your internal approval matrix, so it depends on your own policy. Most companies use four gates: the requesting department, procurement, finance, and legal above a certain value. The exception is a related party vendor. Section 188 of the Companies Act can require board approval, and shareholder approval may apply once the prescribed thresholds are crossed. Take advice on the specific transaction.

What documents are mandatory for Indian vendors?
PAN, GST registration, bank proof such as a cancelled cheque, entity registration proof, Udyam certificate if they are an MSME, any lower or nil TDS deduction certificate, EPFO and ESIC registration where it applies, and the signed agreement and NDA.

How do I verify a vendor's GST status?
Use Search Taxpayer on the GST portal with their 15-digit GSTIN. Check that the legal name matches your contract and that the registration is active.

Do I still need to check whether a vendor has filed returns?
No. Sections 206AB and 206CCA, which set higher TDS rates for non-filers, were omitted with effect from 1 April 2025. What still matters is a valid PAN, since higher rates apply without one, and any lower or nil deduction certificate the vendor holds.

How does MSME registration affect payment terms?
Under the MSMED Act, the payment clock runs from acceptance or deemed acceptance of the goods or services. Without a written agreement, payment is due within 15 days of that date. With one, you can agree a longer period, but not beyond 45 days from the same date. Check the Udyam certificate early so you set the terms correctly the first time.

What is the difference between vendor onboarding and vendor management?
Onboarding brings a vendor in. Vendor management is everything after that: compliance monitoring, performance, renewals and the relationship over time. Onboarding is a project. Management is ongoing.

Should every vendor go through the same process?
No. The same checks for everyone slows down low-risk onboarding without improving control where the risk really is. Tier by spend, replaceability, site access and data handling.

Can vendor onboarding be automated?
Most of it. Document submission, checks against government records, parallel approval routing and licence expiry alerts all automate well. What does not automate is the commercial judgement of whether this is the right vendor.

Conclusion

Vendor onboarding is usually described as a series of steps. In practice it is a series of queues.

Total time is decided by how long a request waits between steps, not by how long each step takes to do.

So fix the waiting. Collect documents through one structured intake. Check compliance against official records. Run approvals in parallel. Match the depth of scrutiny to the risk.

Get that right and the rest follows. Clean audit trails, contracts that hold, and payments that go out on time.

Structured onboarding workflows, compliance document tracking, and vendor performance history in one place — see how Infisuite Vendor Management handles the vendor lifecycle.