Can an AI agent onboard new suppliers?

Up to the last step, yes. An AI agent can collect a new supplier's documents, check the company exists, screen it against sanctions lists, verify its bank details through an independent route and draft the supplier record. Creating the record in the master file is approved by someone outside purchasing, never by the person who asked for the supplier.

Why is onboarding a control point?

The supplier master file decides who the business can pay. Every fictitious supplier scheme starts with getting a record into it, and every bank detail fraud depends on what the record says. A supplier that passes onboarding is trusted by every later step: orders are raised against it, invoices matched to it and payments sent to it.

So onboarding has two jobs. It checks that the supplier is real, legitimate and not sanctioned. And it separates the person who wants the supplier, usually a buyer or budget holder, from the person who lets it into the system. The agent can do almost all of the first job. It must not collapse the second.

What does the agent prepare?

1. Request intake. Records who asked for the supplier, why, and the expected spend.
2. Document collection. Sends the supplier the onboarding form and chases missing items: registration details, tax number, insurance certificates, bank confirmation.
3. Existence checks. Confirms the company in the official registry, compares the registered address and directors with the form.
4. Screening. Runs sanctions and adverse media checks and records the results.
5. Duplicate check. Searches the master file for the same tax number, bank account or address under another name.
6. Bank verification. Drafts the call-back to a phone number taken from the registry or an independent source, not the form. A person makes the call.
7. Draft record. Prepares the master file entry with every field traced to its source.

Steps 1 to 5 and 7 are depth 2 or 3 work. Step 6 needs a person on the phone. The detailed process is in how to onboard new suppliers to the supplier master file.

Which step keeps the separation of duties?

Approval of the record. Three roles should be distinct: the requester, who wants the supplier; the verifier, who makes the bank call-back; and the master data approver, who creates the record. A buyer who can both request and approve a supplier can create one they control. The agent prepares the file for all three and fills none of the roles.

An illustrative example

Take a regional housing association commissioning a new roofing contractor. The maintenance manager requests the supplier, with expected spend of 150,000 over a year.

The agent sends the onboarding form. The contractor returns it within a day. The registry confirms the company, but it was incorporated four months ago, and one listed director shares a surname and home address with a member of the maintenance team. Sanctions screening is clear. The bank account on the form is a personal account, not a business one.

The agent records all three findings and marks the file for enhanced review. It does not decline the supplier; new companies and family links can be innocent. The master data owner, who has no link to maintenance, reviews the file, asks the contractor for a business account and refers the possible conflict of interest to the compliance lead under the conflicts policy.

What controls make it safe?

• No write access to the master file. The agent drafts; a person creates.
• Independent bank verification. Contact details come from the registry or a prior source, never from the supplier's own form.
• Conflict checks. Directors and addresses are compared with staff records where policy allows.
• Every field sourced. Each entry shows whether it is sealed, from the registry; signed, from the supplier's verified documents; or declared, from the form.
• Periodic re-screening. The agent re-runs sanctions checks on the whole supplier base on a schedule.

Where Pryme fits

In Pryme, the Pryme Context Protocol records each supplier field with its provenance class, and a bank account that arrived only on the supplier's own form stays external until a person verifies it. Creating the master file record is a separate capability held for the master data owner.

Once a supplier is on file, the agent can help a buyer prepare negotiations with it. The agent itself deserves a similar introduction, as set out in how to onboard an AI agent like a new hire. Firms in New York's financial sector face their own expectations on third-party risk, covered in NYDFS and AI agents in New York financial services. The wider controls are in AI agents for finance: books you can audit.