Split onboarding into collection, checking and creation. The agent collects the supplier's details, checks them against company registers, sanctions lists and your existing master file, and prepares a complete record. A person verifies the bank account by calling a number found independently, and a different person in master data creates the supplier. The agent never writes bank details.
Why is the supplier master file the control that matters most?
Every payment you make goes to an account recorded in the supplier master file. If a fraudster's account gets into that file, every later control, from three-way matching to payment approval, will pass the payment, because the invoice is real and the supplier looks known. The master file is where fictitious suppliers and bank detail fraud start.
Ownership is usually split. Procurement sponsors the new supplier because someone needs to buy from them. A master data team, often in finance shared services, creates and maintains records. The finance controller owns the policy: what must be checked before a supplier exists. Whether an agent can onboard new suppliers at all depends on keeping those roles apart.
What are the steps, and who acts at each one?
- Person, requester: asks for the new supplier. States the business need, expected spend and category. Evidence: the request with the requester's identity.
- Agent, depth 1: checks for an existing record. Same name, similar name, same tax number, same address, same bank account. Many "new" suppliers already exist under a different spelling.
- Agent, depth 2: sends the supplier the onboarding form. Through your supplier portal or to an address the requester confirmed, never to an address in an unsolicited email. Under certification, the standard request can go at depth 3.
- Agent, depth 1: validates what comes back. Company registration against the official register, tax number format and registration, sanctions and watchlist screening on the company and named directors, address against the register, and whether the bank account holder name matches the company.
- Agent, depth 2: prepares the record. All fields completed, every check listed with its result and source, and anything that did not match flagged.
- Person, finance: verifies the bank account. Calls the supplier on a number from the official register or a previous trusted record, not from the form, and confirms the account. Evidence: who called, which number, when, and with whom they spoke.
- Person, master data: creates the supplier. Reviews the prepared record and the checks, then creates it. This person is not the requester.
- Agent, depth 1: post-creation check. Confirms the created record matches the prepared one field by field and that the supplier starts with a cooling period before the first payment.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Request | Nothing | none | Requester states need |
| Duplicate check | Searches the master file | 1 | Nothing |
| Collect | Sends standard form | 2 or 3 | Confirming the address |
| Validate | Registry, tax, sanctions, name match | 1 | Reviewing hits |
| Prepare | Completes the record | 2 | Nothing yet |
| Bank verification | Nothing | none | Finance calls back |
| Create | Nothing | none | Master data creates |
| Post-check | Compares record to prepared | 1 | Resolving differences |
Which controls matter, and what evidence do they leave?
Three people, three roles. Requester, verifier and creator are different people. Evidence: identities on each step.
Independent call-back. The phone number used comes from a source the supplier did not provide in this request. Evidence: the number's source on the verification record.
Register checks are signed sources. A company register entry is a named authority answering for the facts; a PDF certificate the supplier attached is external. Evidence: source class against each check.
Sanctions hits go to a person. The agent does not clear a possible match. Evidence: the hit, the reviewer and the decision.
Cooling period. New suppliers are not paid until a set time after creation, so a fraud has time to surface. Evidence: the first-payment date against the creation date.
What should you measure?
- Duplicates prevented at step two.
- Bank account name mismatches found at validation.
- Time from request to created supplier. Long times push people to work around the process.
- Records corrected after creation. Each points to a check that missed something.
- Suppliers created with no spend after a set period. Dormant new suppliers deserve a look.
Where does it usually go wrong?
The requester supplies the bank details. A requester forwards an email "from the supplier" with the account. The agent must treat it as external and require the form through the proper channel.
Call-back to the number on the form. The fraudster answers. Use only independently sourced numbers.
Fictitious suppliers through real people. An employee creates a company, requests it as a supplier and approves its invoices. The agent should compare new supplier directors and addresses against employee records where your privacy assessment allows; detecting fictitious suppliers covers the patterns.
Onboarding becomes negotiation. Suppliers ask for different payment terms on the form. The agent records the request and sends it to procurement; whether an agent should negotiate with suppliers is not decided by an onboarding form.
Changes after onboarding skip the process. Six months later the supplier "changes bank". That change needs the same verification as a new supplier.
Where Pryme fits
In Pryme, collecting, validating and preparing records are separate capabilities, and creating suppliers or writing bank details is outside this agent's role scope. Register data arrives as signed, the supplier's form as declared and emailed documents as external, and an external claim cannot authorise a payment. Every check is filed. The finance bounds are in AI agents for finance.
Questions people ask
Can the agent onboard sole traders and individuals?
Yes, with more care. Their records are personal data, register checks are thinner, and identity verification may be needed. Keep the same separation of roles.
Should the agent screen suppliers again later?
Yes. Re-screen the whole master file against sanctions lists when they change, and review dormant suppliers periodically. Both are good depth 1 work.
What if the supplier has no phone number we can verify independently?
Use another independent route, such as a confirmation through an existing relationship at the supplier or a small test payment returned by them. If none exists, the payment waits.