For Compliance & Buyers

New supplier, ready to transact. Every check made.

The worker runs KYB, sanctions screening, and collects certificates, insurance, and banking details. Your team gets one approval pack per supplier and gives the final approval. Compliance is pulled in only for genuine exceptions: a sanctions hit, an expired cert, or an unclear beneficial owner.

Request a demo

Definition

What supplier onboarding is, and where it goes wrong

Supplier onboarding is the process that takes a company from “we want to buy from them” to “approved vendor in the ERP”. It covers collecting the documents your policy requires, verifying each one, screening the entity and its owners against sanctions and exclusion lists, scoring the supplier’s risk, getting an approval from the right person, and creating the vendor record so a purchase order can be issued.

For US manufacturers and construction companies the process usually crosses four teams: procurement asks for the supplier, compliance or EHS checks the risk, finance owns the banking and tax details, and IT or the ERP team creates the record. Most of the time is spent chasing: a certificate of insurance with the wrong limits, a W-9 that never arrives, a safety letter that expired last month.

Traza runs that chasing and checking with an AI agent, Nora, and hands your team one approval pack per supplier. The approval itself always sits with a person.

See it run

Illustrative example with sample data, not a customer record.

Vanguard Components · Onboarding

3/5 checks

KYB check · Company registration

Sanctions screening · OFAC + EU

ISO 9001 certificate

ESG attestation

Banking details · SEPA

What actually runs

The worker handles execution. You make the one call that matters.

Runs KYB and sanctions screening

Company registration is verified and the supplier is screened against OFAC and EU sanctions lists automatically.

Collects certificates and attestations

ISO certificates, ESG attestations, and banking details are requested and validated as they come in.

Assembles one approval pack

When every check is in, the worker hands your team one pack: what was checked, what passed, what is unclear, and a recommendation. On approval, the vendor record is created in your ERP.

ACTION REQUIRED

Approve the supplier. Exceptions come with the evidence.

A person always gives the final approval. Compliance is pulled in earlier only when something needs judgment: a sanctions hit, an expired certificate, or an unclear beneficial owner.

The process

The full flow, from request to vendor record

Every onboarding follows the same eight steps. Steps one to six are execution work the agent runs end to end. Steps seven and eight only happen after a person approves.

01
Intake
A buyer, a sourcing award or an engineer asks to onboard a supplier. The agent confirms the category, the states or countries the supplier will work in, and the expected spend, and picks the matching requirement set from your policy.
02
Document collection
The supplier receives a checklist with exactly what your policy needs for that category, a secure way to send it, and a named contact. Missing items are followed up on a fixed cadence until each one is in.
03
Validation
Each document is read, not just filed. Expiry dates, issuers, named insured, coverage limits and certificate scopes are checked against your requirements.
04
Know Your Business (KYB)
The legal entity is confirmed against the Secretary of State registry, the TIN is matched to the legal name, and beneficial owners above your threshold are identified.
05
Sanctions and exclusion screening
The entity, its owners and its directors are screened against the OFAC SDN and consolidated lists and the SAM.gov exclusion records. Any potential match stops the flow and goes to a person.
06
Risk scoring
Financial, compliance, safety, geographic and single-source risk are scored on your scale, with the inputs listed next to the score. Anything above your threshold is escalated with the reason.
07
Approval
Your approver gets one pack: what was checked, what passed, what is unclear, and a recommendation. They approve, ask for more, or reject. No supplier is activated without this step.
08
ERP setup
On approval, the vendor record is created in your ERP or vendor master with the verified details, and the contracts agent is asked to draft the agreement if one is needed.

Division of work

What the agent runs, and what always stays with a person

The split is set by policy, not by what the software happens to be able to do. These are the defaults most teams start from.

Nora handles

Choosing the requirement set for the category, location and spend
Sending the checklist and following up until every document is in
Reading each document and checking dates, issuers, limits and scopes
Matching the TIN and confirming the entity with the state registry
Screening the entity, owners and directors against OFAC and SAM.gov
Scoring risk on your scale and listing the inputs behind the score
Assembling the approval pack and, after approval, creating the vendor record

ACTION REQUIRED

A person always decides

The final approval of every supplier
Any potential sanctions or exclusion match, however weak
Beneficial ownership that is layered, offshore or unclear
A risk score above the threshold you set
Any request to waive or lower a requirement
Changes to banking details on an existing vendor

Requirement set

Documents, checks, evidence and escalation

A typical requirement set for a US manufacturer or general contractor. Yours replaces it; the agent only collects what your policy asks for.

Document or check	What is verified	Evidence in the approval pack	Goes to a person when
Form W-9 and TIN	TIN matches the legal name, entity type is consistent with the registry	TIN match result, legal name, entity type	Mismatch, or a foreign supplier needing a W-8 instead
Business registration	Entity is active and in good standing in its state of formation	Registry extract with status and date	Inactive, dissolved, or name does not match the W-9
Certificate of insurance (COI)	Coverage types and limits meet your requirements, your company is named as additional insured where required, policy dates are current	Limits table against requirements, expiry dates	Limits below requirement, missing endorsement, or a waiver is requested
OFAC and SAM.gov screening	Entity, beneficial owners and directors against the SDN and consolidated lists and the SAM.gov exclusion records	Screening result with lists checked and date	Any potential match
Beneficial ownership	Owners above your threshold identified and screened	Ownership chart	Layered, offshore or undisclosed ownership
Safety record (construction)	Experience modification rate (EMR) letter, OSHA 300A summaries for the last three years, written safety program	EMR value, recordable rates, program on file	EMR or rates above your threshold
Contractor licensing (construction)	License active in each state where work is performed, scope matches the trade	License numbers, status, expiry	Expired, suspended, or wrong scope
Quality certification (manufacturing)	ISO 9001, AS9100 or IATF 16949 certificate is current and issued by an accredited registrar for the right site and scope	Certificate, registrar, scope, expiry	Expired, unaccredited registrar, or site not covered
Banking details	Bank letter or voided check matches the legal entity, routing number is valid	Bank letter on file, match result	Any later change request, which is confirmed by finance before it reaches the ERP
Supplier code of conduct	Signed by an authorized signatory	Signed copy	Refused or returned with changes

Form W-9 and TIN

What is verified: TIN matches the legal name, entity type is consistent with the registry
Evidence in the approval pack: TIN match result, legal name, entity type
Goes to a person when: Mismatch, or a foreign supplier needing a W-8 instead

Business registration

What is verified: Entity is active and in good standing in its state of formation
Evidence in the approval pack: Registry extract with status and date
Goes to a person when: Inactive, dissolved, or name does not match the W-9

Certificate of insurance (COI)

What is verified: Coverage types and limits meet your requirements, your company is named as additional insured where required, policy dates are current
Evidence in the approval pack: Limits table against requirements, expiry dates
Goes to a person when: Limits below requirement, missing endorsement, or a waiver is requested

OFAC and SAM.gov screening

What is verified: Entity, beneficial owners and directors against the SDN and consolidated lists and the SAM.gov exclusion records
Evidence in the approval pack: Screening result with lists checked and date
Goes to a person when: Any potential match

Beneficial ownership

What is verified: Owners above your threshold identified and screened
Evidence in the approval pack: Ownership chart
Goes to a person when: Layered, offshore or undisclosed ownership

Safety record (construction)

What is verified: Experience modification rate (EMR) letter, OSHA 300A summaries for the last three years, written safety program
Evidence in the approval pack: EMR value, recordable rates, program on file
Goes to a person when: EMR or rates above your threshold

Contractor licensing (construction)

What is verified: License active in each state where work is performed, scope matches the trade
Evidence in the approval pack: License numbers, status, expiry
Goes to a person when: Expired, suspended, or wrong scope

Quality certification (manufacturing)

What is verified: ISO 9001, AS9100 or IATF 16949 certificate is current and issued by an accredited registrar for the right site and scope
Evidence in the approval pack: Certificate, registrar, scope, expiry
Goes to a person when: Expired, unaccredited registrar, or site not covered

Banking details

What is verified: Bank letter or voided check matches the legal entity, routing number is valid
Evidence in the approval pack: Bank letter on file, match result
Goes to a person when: Any later change request, which is confirmed by finance before it reaches the ERP

Supplier code of conduct

What is verified: Signed by an authorized signatory
Evidence in the approval pack: Signed copy
Goes to a person when: Refused or returned with changes

Rows and thresholds are an illustrative requirement set, not a recommendation for your policy. Your compliance team defines what is required for each category.

Vocabulary

Onboarding, qualification, prequalification, risk management

The terms overlap and vendors use them loosely. They describe different parts of the same lifecycle.

Supplier onboarding: The end-to-end process from request to active vendor record. Includes qualification as one of its steps, plus the administrative setup that follows approval.
Supplier qualification: The assessment itself: does this supplier meet our requirements for this category? It is repeated when a requirement changes, a certificate expires, or a supplier is moved to a new category.
Vendor or contractor prequalification: The construction industry’s term for qualifying a subcontractor before it can bid: safety record, licensing, insurance, bonding capacity and relevant project experience. Often tracked in platforms such as ISNetworld or Avetta.
Supplier risk management: What happens after approval: watching for expiring certificates, new sanctions designations, financial distress or single-source exposure, and re-qualifying when something changes.
Supplier homologation: The term used in Spain and Latin America for qualification plus approval. Same process, different word. Nora’s profile uses it because that is where she first worked.

By industry

What manufacturers add to the baseline

Beyond the legal and financial checks, industrial buyers qualify on whether the supplier can actually deliver the part, on time, to spec.

Quality system certification for the right site and scope: ISO 9001 as a baseline, AS9100 for aerospace, IATF 16949 for automotive
Capacity and lead time against your forecast, and whether the supplier is already single-source for anything you buy
Financial stability, usually from a D&B report or audited statements for larger awards
Country of origin and tariff exposure for the parts in scope
Conflict minerals and material declarations where your customers require them
Cybersecurity posture for suppliers that handle your drawings or connect to your systems; NIST SP 800-171 and CMMC where defense work is involved
ITAR registration where the parts are controlled

What construction companies add to the baseline

Contractor prequalification is driven by safety and insurance. A subcontractor with a bad safety record is a liability on every site, so these checks run before anything commercial.

Experience modification rate (EMR) and OSHA recordable rates for the last three years, with your threshold set by project type
Written safety program and site-specific plans where the project requires them
Active contractor license in every state where the work is performed
Insurance with your company as additional insured and a waiver of subrogation, at limits set per contract value
Bonding capacity for subcontracts above your threshold
Prevailing wage and certified payroll capability where public funding applies
Comparable project experience and references, and how the subcontractor qualifies its own subs

Systems

Where it runs: your ERP and procurement suite, not a new system

Nora works inside the systems your team already runs. The vendor master in your ERP stays the system of record; the agent reads from it to avoid duplicates and writes the approved vendor back to it after a person approves. Requests arrive from your procurement suite, from Slack or from email. Documents are requested and signed through the tools suppliers already know.

Where your subcontractors are already prequalified in ISNetworld or Avetta, the exported status and grade is one more document in the pack, checked for currency like any other. Nothing is replaced. Traza is the layer that does the collecting, reading and screening between those systems and hands the result to the person who decides.

SAP vendor master
Coupa
Gmail / Outlook
Slack
DocuSign
OFAC and SAM.gov lists
State registries and IRS TIN matching
D&B

Rollout

How to roll out an onboarding agent

Start narrow, on real suppliers, with your existing checklist. The goal of the pilot is not a demo. It is to see the agent produce approval packs your compliance team would sign, next to the process you run today.

Week 1
Scope
Pick one category and one site, and the next ten suppliers you need to onboard there. Share the requirement checklist you already use and name the approver. Agree on what the pilot has to show, for example every pack complete before it reaches the approver.
Weeks 2–3
Configure
Connect the vendor master in your ERP, the mailbox suppliers will hear from, and the screening lists. Turn your checklist into the requirement set for the category, and set the risk thresholds and the points where the agent must stop and ask.
Weeks 3–6
Run side by side
The agent onboards the pilot suppliers while your team reviews every pack against how they would have done it. Nothing is created in the ERP without a person approving it. Disagreements become rule changes, not workarounds.
Weeks 7–8
Review and extend
Compare the pilot against the goal you set in week one, using the audit log rather than impressions. Decide which categories and sites come next and which thresholds to adjust before they do.

Governance from day one

Your policy, written down: Requirement sets, risk thresholds and escalation points live in configuration your compliance team owns and can read. Changing a rule is a reviewed change, not a prompt.
A person at every decision: Final approval, any potential sanctions or exclusion match, unclear ownership and requests to waive a requirement always go to a named approver. The agent cannot approve a supplier.
Every action on the record: Each email sent, document read, check run and result is logged with its timestamp and the evidence behind it, in an immutable audit log you can export for internal audit or a customer review.
Access by role: Procurement, compliance, finance and IT each see and change only what their role allows, and users sync from your identity provider.

FAQ

Common questions

How do you roll out an AI agent for supplier onboarding?

Start with one category, one site and your next ten suppliers, using the requirement checklist you already have. Connect the ERP vendor master, the supplier mailbox and the screening lists, and set the thresholds where the agent must stop and ask. Run it side by side with your team for several weeks: the agent prepares every approval pack and a person approves each supplier. Review the results against a goal agreed at the start, using the audit log, before extending to more categories.

What are the steps in a compliant supplier qualification process for a US manufacturer or construction company?

Confirm the category and requirement set, collect the required documents (W-9, business registration, certificate of insurance, and sector items such as an EMR letter or ISO certificate), verify each one against the requirement rather than just filing it, confirm the legal entity and match the TIN, screen the entity and its owners against OFAC and SAM.gov, score the risk on a defined scale, obtain approval from a named approver, and only then create the vendor record. Keep the evidence for each step with the approval so an auditor can follow it.

Which documents should a US company collect before approving a new supplier?

The common baseline is a Form W-9 (or W-8 for foreign suppliers), proof of business registration and good standing, a certificate of insurance at the limits your policy requires, banking details supported by a bank letter, and a signed supplier code of conduct. Manufacturers add quality certificates such as ISO 9001, AS9100 or IATF 16949 and, for defense work, NIST SP 800-171 or CMMC evidence. Construction companies add the EMR letter, OSHA 300A summaries, state contractor licenses and bonding capacity.

How can AI agents collect and verify supplier documents before approval?

An agent sends the supplier a checklist matched to the category, follows up until each document arrives, then reads each one: it extracts expiry dates, issuers, named insured and coverage limits and compares them to your requirements. It matches the TIN to the legal name, confirms the entity with the state registry and screens owners and directors against sanctions and exclusion lists. The result is an approval pack with the evidence attached. The agent does not approve the supplier; a person does, with the pack in front of them.

How can manufacturers reduce manual follow-up during supplier onboarding?

Most follow-up comes from three causes: the supplier was not told exactly what was needed, nobody owned the chase, and documents were filed without being read so problems surfaced late. Fixing them means one checklist per category sent at intake, a fixed follow-up cadence that does not depend on a buyer remembering, and validation at receipt so a wrong insurance limit is caught the day it arrives. An agent like Nora runs all three; your team only sees the pack and the exceptions.

What is the difference between supplier onboarding, qualification and prequalification?

Onboarding is the whole process from request to active vendor. Qualification is the assessment inside it: does the supplier meet the requirements for this category? Prequalification is the construction term for qualifying a subcontractor before it is allowed to bid, with the emphasis on safety record, licensing and insurance. Supplier risk management is what follows approval: monitoring for expiring certificates, new sanctions designations and financial distress.

What is supplier homologation, and how can software automate it for US procurement teams?

Supplier homologation is the term used in Spain and Latin America for supplier qualification and approval. The process is the same as in the US: define requirements, collect and verify documents, screen, score, approve, and set up the vendor. Software can automate the collection, reading, screening and scoring, and prepare the approval. The approval itself should stay with a person, which is how Traza is built.

Does Traza replace our ERP or procurement suite for supplier onboarding?

No. Your ERP vendor master stays the system of record and your procurement suite stays where requests and purchase orders live. Traza’s agent does the work between them: collecting, verifying, screening, scoring and assembling the approval pack. After a person approves, it writes the verified vendor back to your ERP.

What should procurement teams look for in supplier qualification software?

Four things. That it reads documents against your requirements rather than storing them. That it screens owners and directors, not just the company name, and keeps the screening date. That every automated step produces evidence an auditor can follow. And that it lets you set exactly where a person must decide, with the context to decide quickly, instead of either approving everything or routing everything to a queue.

8-week pilot

Your first worker runs side by side
with your team.

We connect to your ERP, configure the worker around your process, and run it next to your team until you're confident. You approve every decision that matters. No IT project.

Book a pilot call

New supplier, ready to transact. Every check made.

What supplier onboarding is, and where it goes wrong

The worker handles execution. You make the one call that matters.

The full flow, from request to vendor record

Intake

Document collection

Validation

Know Your Business (KYB)

Sanctions and exclusion screening

Risk scoring

Approval

ERP setup