Vendor due diligence helps a business assess a supplier before granting access, signing a contract, or relying on its services. The review should reflect what the supplier will do and the consequences if something goes wrong. A routine purchase and a service involving customer funds need different evidence.
A clear scope also helps avoid unnecessary delays. Instead of sending every supplier the same long questionnaire, the business can identify the relevant risks and request evidence that addresses them. However, a shorter process still needs a documented basis for approval.
Compliance Officers helps assess third parties, organize supporting records, and explain unresolved issues. This guide covers risk tiers, ownership, sanctions, contracts, and continuing review. It also explains why a completed questionnaire alone cannot establish every fact about a vendor.
What vendor due diligence should establish
Start with the proposed relationship. Identify the service, the contracting entity, and the people responsible for approval and oversight. Then determine whether the vendor will access funds, personal information, business systems, or regulated processes.
Procurement and compliance questions often overlap. Price and delivery terms matter, but so do legal identity, relevant licenses, security controls, and service continuity. Therefore, the review should involve the people who understand the proposed service and its risks.
A database search can locate useful records. However, it cannot automatically confirm that the business offering the service is the entity in those records. Legal names, registration numbers, addresses, and ownership information help resolve that question.
Legal duties and vendor due diligence
There is no single federal checklist that every U.S. business must apply to every supplier. Duties depend on the organization, activity, data, jurisdiction, and applicable law. A contract may also impose obligations beyond a statutory minimum.
The federal Customer Due Diligence Rule governs covered financial institutions and qualifying customer relationships. It does not automatically turn every supplier into a covered customer. However, an entity can hold more than one role, so the actual relationship matters.
Similarly, banking guidance on third-party risk management addresses banking organizations within the relevant agencies’ supervision. Other businesses may find its principles useful, but should not present that guidance as a universal legal requirement.
Current guidance and proposed changes
The 2023 interagency banking guidance discusses planning, selection, contracting, monitoring, and termination. On September 11, 2026, federal agencies proposed revised guidance emphasizing reviews proportionate to reasonably assessed risk. As of September 30, that proposal remains distinct from final guidance.
Consequently, a business should distinguish applicable law, supervisory guidance, contractual duties, and its own policy. That distinction helps explain why a particular check is necessary. It also prevents an internal preference from appearing to be a requirement imposed on all vendors.
Match vendor due diligence to the service
A risk tier should reflect the relationship’s potential impact. Contract value may matter, but a low-cost service with privileged system access can create substantial exposure. Conversely, an expensive purchase may involve limited access to sensitive operations.
Relevant factors include access to funds or data, regulatory responsibilities, dependence on the service, and the difficulty of replacing it. Ownership and geographic exposure may also affect the review. No single factor should automatically settle every case.
The team should record its reasoning, including any assumptions that could change the tier. For example, a vendor initially handling public information may later receive confidential customer records. That change calls for reassessment before the expanded access begins.
An illustrative tiering approach
The table below offers a possible internal framework. These labels and checks are examples, not a federally prescribed classification system. A business should adapt them to its obligations and operating model.
| Illustrative tier | Relationship characteristics | Possible review focus |
|---|---|---|
| Lower risk | Limited access and readily replaceable service | Identity, relevant status, sanctions exposure, and basic contract terms |
| Moderate risk | Recurring service with some operational or data access | Ownership, appropriate controls, licensing, and service history |
| Higher risk | Sensitive data, funds, regulated work, or substantial dependency | Deeper evidence review, subcontractors, controls, and escalation criteria |
| Critical service | Disruption could seriously affect essential operations | Continuity, concentration, recovery, oversight, and a workable exit plan |
A domestic address does not by itself make a relationship lower risk. Likewise, a foreign connection does not automatically require rejection. The assessment should explain the particular exposure and the evidence supporting the decision.
Identity and ownership in vendor due diligence
Confirm which legal entity will sign, perform the work, and receive payment. Those roles may involve affiliates or authorized agents. If they differ, the file should explain the arrangement and establish appropriate authority rather than assume every mismatch means wrongdoing.
State records can help establish formation, recorded names, and current status. However, they may not identify every owner or the person ultimately controlling the business. Our guide to verifying a U.S. company explains the limits of those sources.
A registered agent’s address may belong to a service provider. Therefore, it does not necessarily establish where the supplier operates or whether it has the resources to perform. Evidence of actual capacity should relate to the promised service.
Ownership evidence and BOI information
A review may need organizational documents, ownership records, and explanations of intermediate entities. The appropriate evidence depends on the purpose and risk. Where sources conflict, the report should identify the discrepancy and seek clarification.
FinCEN’s BOI system is not a public ownership directory. Its August 2026 final rule exempts U.S. companies and U.S. persons from BOI reporting requirements. Consequently, ordinary vendor reviews cannot rely on a public FinCEN lookup to establish a domestic supplier’s owners.
Sanctions checks beyond the vendor name
U.S. persons and businesses must comply with applicable OFAC restrictions. Civil sanctions penalties can arise on a strict-liability basis, even without knowledge of a prohibited transaction. However, the relevant program, jurisdiction, exceptions, and authorizations affect the legal analysis.
A name search alone may miss an entity blocked through ownership. Under OFAC’s 50 Percent Rule, an entity can be blocked when blocked persons own at least 50 percent in the aggregate, directly or indirectly. The ownership analysis therefore matters even without an exact list match.
For example, direct stakes of 30 percent and 25 percent held by two blocked persons total 55 percent. That ownership reaches the rule’s threshold. More complex indirect structures require careful analysis rather than simply adding every percentage appearing in a corporate chart.
Resolve matches before drawing conclusions
A similar name may refer to a different entity. Identifiers and supporting records help distinguish a true match from a namesake. Conversely, a clean name-search result does not establish that ownership or other applicable restrictions present no concern.
A business should define how it reviews potential matches and escalates uncertainty. Where the exposure warrants deeper work, enhanced review of ownership and risk can help address the evidence gaps. A private report cannot authorize a transaction that sanctions law prohibits.
Questionnaires need supporting evidence
A questionnaire records the vendor’s representations. It can identify issues and guide follow-up, but it does not independently prove every answer. Therefore, material claims should receive the level of corroboration appropriate to the risk.
For instance, a claimed license should match the entity, activity, and relevant regulator. A security report needs review of its scope, period, findings, and exclusions. The existence of a report alone does not establish that it covers the service under consideration.
Insurance documents also require context. Coverage periods, insured parties, exclusions, and policy terms can affect relevance. Likewise, a state status certificate confirms particular matters on a stated date; it does not establish financial strength or future performance.
Record limitations clearly
Sometimes a vendor cannot provide the requested material, or a source does not cover the relevant period. The file should explain the gap and its significance. Depending on the risk, the business may seek alternative evidence, impose conditions, or decline the relationship.
Our guide to organizing review documents discusses related records. A complete-looking folder is only useful when its contents answer the questions behind the decision.
Subcontractors and service dependencies
The contracting vendor may depend on another provider for hosting, processing, staffing, or a critical function. Consequently, a review should identify material dependencies where they affect the proposed service. The appropriate depth will vary with access and impact.
Relevant questions include which parties handle sensitive information and where they perform the work. The business may also need to understand how the primary vendor selects and monitors those parties. A contract with one entity does not eliminate the operational consequences of another provider’s failure.
Concentration matters as well. Several vendors may rely on the same infrastructure provider. Therefore, reviewing each supplier separately may leave a shared dependency unexplained. Continuity planning should consider that possibility when the consequences justify it.
Contracts that support continuing review
Contract terms should reflect the service and the business’s ability to oversee it. Depending on the arrangement, relevant provisions may address information access, audit rights, incident reporting, subcontractors, ownership changes, and cooperation with regulatory obligations.
Other terms may concern service levels, continuity, data handling, termination, and return or deletion of information. However, contractual language needs legal review and negotiation. A broad clause does not ensure that the business can exercise it effectively in practice.
For example, an audit right may have limited value if the vendor cannot provide records concerning the outsourced activity. The parties should understand the scope, process, and practical constraints. Counsel can assess enforceability and the allocation of legal responsibilities.
Keep vendor due diligence current
Approval records the information available at a particular time. Later changes can affect that assessment. Relevant events may include new ownership, a security incident, loss of a license, altered payment instructions, or expansion into a different service.
Periodic reviews and event-triggered reviews can work together. The frequency should reflect applicable duties, risk, and the nature of the service. An annual calendar alone may miss an urgent development, while event-based monitoring alone may leave unnoticed changes unresolved.
The business also needs someone responsible for receiving notices and acting on them. A notification clause offers little operational benefit if nobody reviews incoming information. Our discussion of corporate identity and control checks provides related context.
Document approval conditions and follow-up
If approval depends on missing evidence or a control improvement, record the condition and its owner. Also, identify the date or event that requires follow-up. That makes the remaining work visible to the people overseeing the relationship.
When a concern arises, assess its effect on the service and applicable obligations. Possible responses may include additional evidence, restricted access, remediation, or termination. The appropriate response depends on the facts; a discrepancy does not justify the same action in every case.
How Compliance Officers supports vendor due diligence
Compliance Officers helps define the review around the vendor’s role and the client’s decision. The work may include corporate records, ownership, relevant licensing, sanctions information, and other agreed evidence. It can also identify where specialist technical or legal review is necessary.
The resulting file can distinguish supported findings from unanswered questions and explain source limitations. For existing vendor portfolios, the review can help identify outdated records or gaps requiring attention. The client remains responsible for its approval decisions and applicable obligations.
Timing depends on scope, jurisdictions, source availability, and vendor cooperation. Therefore, the initial discussion should identify urgent questions and likely constraints. Professional coordination can help organize the process, but cannot guarantee a vendor’s conduct or eliminate every risk.
Vendor due diligence: frequently asked questions
Is this review legally required for every supplier?
No single federal rule imposes an identical review on every supplier relationship. Applicable law, regulatory expectations, contracts, and internal policy may create different duties. Therefore, the business should identify the basis for its particular requirements.
How long does a supplier review take?
Scope, risk, jurisdictions, and access to records determine timing. A complex ownership structure or missing evidence can require further work. An initial assessment should identify those constraints rather than promise a fixed turnaround for every vendor.
Is an SDN list search enough?
A name search alone may miss ownership-based blocking and other relevant restrictions. Also, a possible name match needs assessment before the business treats it as confirmed. The process should address the parties, ownership, transaction, and applicable sanctions programs.
Can a public search establish every owner?
Usually, a state company search does not establish every beneficial owner. Company documents and other appropriate evidence may be necessary. FinCEN’s BOI database is not available as a general public ownership directory.
How often should approved vendors receive another review?
The schedule depends on risk and applicable duties. Periodic checks should work alongside reviews prompted by significant changes or incidents. In addition, the business should identify who receives new information and decides whether further action is necessary.
Which contract terms support later verification?
Depending on the service, terms may address access to records, audits, incident notices, subcontractors, and material changes. Continuity and exit provisions may also matter. Counsel should assess the wording, enforceability, and fit with the relationship.
Discuss your supplier review
Contact Compliance Officers to discuss the vendor, proposed service, and records available. Call +1 305-647-3000, use WhatsApp, or email info@complianceofficers.org. The team can assess the scope and explain the information needed.
This publication provides general information and does not constitute legal advice. Requirements depend on the organization, relationship, and applicable law. A due diligence review cannot guarantee future conduct or prevent every loss.
