The supplier record is where a payment run gets its bank details, its VAT treatment and its payment terms. One wrong field gets repeated on every bill. And because criminals know small businesses rarely check, a supplier record with changed bank details is the most common route for invoice and mandate fraud: the real invoice is paid, in full and on time, to someone else’s account. The few minutes spent checking a supplier before the first payment are the cheapest control in the purchase ledger.
Before you create the record
Work through these in order. If any step fails, the supplier is not set up until it is resolved.
1. Establish the legal entity
Ask for the supplier’s full legal name, not just the trading name on the letterhead.
- Limited companies and LLPs: search the Companies House register by name or company number. Confirm the company is active (not dissolved, in liquidation or with a strike-off notice), that the registered office matches what you were given, and that the person you are dealing with is plausibly connected to it.
- Sole traders and partnerships are not on a public register. Record the individual’s or partners’ full names and the business address, and keep the quote or engagement letter showing whom you are contracting with.
Record the company number on the supplier record; it is the most reliable key for spotting duplicates later.
2. Validate the VAT number
If the supplier will charge VAT, check the number with HMRC’s Check a UK VAT number service. It confirms whether the number is valid and shows the name and address it is registered to; they should match the entity from step 1. Input VAT can only be reclaimed on a valid VAT invoice from a registered supplier, so a supplier who charges VAT without being registered costs you the VAT. Set the supplier’s default VAT code at the same time, including the domestic reverse charge where it applies to construction services.
3. Verify the bank details independently
Take bank details from a source the supplier controls, such as a signed form or a letter on headed paper, and then confirm them by phone on a number you found yourself: from the supplier’s website, a previous contract or the person you already deal with. Never use a number printed on the same email or invoice that carries the bank details.
Your bank’s Confirmation of Payee check, which compares the account name with the payee name you enter, is a useful second layer. A “no match” or “close match” result is a reason to stop and call, not to adjust the spelling until it passes. Note on the record who verified the details, how and when.
4. Agree payment terms and defaults
Record the agreed payment terms, the default nominal code for this supplier’s bills, the currency and the remittance email. Leaving terms blank means the software uses its default, and your supplier payment runs will pay too early or too late.
5. Construction subcontractors: CIS verification
If you are a contractor under the Construction Industry Scheme, you must verify a subcontractor with HMRC before the first payment, either through HMRC’s online service or your CIS software. You need your own UTR, accounts office reference and employer reference, plus the subcontractor’s UTR and their National Insurance number (sole trader) or company name, UTR and registration number (company). The details must match what the subcontractor registered with. HMRC tells you whether to pay gross or which deduction rate to apply.
You do not need to verify again if the subcontractor has been included on one of your CIS returns in the current or previous two tax years. HMRC’s guidance for verifying subcontractors sets out the details. Store the verification reference on the supplier record. For the scheme itself, see the Construction Industry Scheme guide.
Changes to an existing supplier
Any request to change bank details goes through step 3 again, however urgent it sounds and however genuine the email looks. Good practice is that the person who enters a change is not the person who approves the next payment run, and that the software logs every change to a payee’s bank details with user and date.
Cleaning the existing supplier list
Most supplier lists were built without any of the checks above. Clean yours once, then review it every six or twelve months.
Find duplicates. Export the list and sort by company number, VAT number and bank account number in turn. The same company set up twice (“ABC Ltd” and “A.B.C. Limited”) is how duplicate invoices and payments slip through. Merge them where the software allows, or make one inactive and move its open items to the survivor. Two different suppliers sharing one bank account, or a supplier sharing an account with an employee, needs an explanation before any further payment.
Retire inactive suppliers. Pick a cut-off, such as no transactions for eighteen months, and mark those suppliers inactive rather than deleting them; history and audit trail stay intact, but they cannot be selected on a new bill or included in a payment run. Check first that none has an open balance.
Audit bank detail changes. Run the software’s audit log or change report for supplier bank fields over the period since the last review. For every change, there should be evidence of the call-back in step 3. Where there is none, call the supplier now on an independently sourced number and confirm the account; for anything paid to unverified details, confirm the supplier actually received the money.
Fill the gaps. Add missing company numbers, VAT numbers, terms and default codes, and re-run the VAT number check for suppliers whose registration may have been cancelled.
The same discipline on the sales side is described in customer master data cleanup.
If your current software cannot show who changed a supplier’s bank details and when, that is worth fixing before the next payment run.