Vendor Compliance Checklist for Canadian Finance Teams

Vendor compliance is the process of confirming a supplier meets your company's legal, tax, documentation and internal policy requirements — before you approve them, and again whenever something material changes. In Canada that usually means a legal name matching the invoice, a valid Business Number, a signed contract, and bank details verified through a channel you initiated.

Most businesses already do pieces of this. Few do it the same way twice.

What Is Vendor Compliance?

Vendor compliance is a control function, not a document collection exercise. It answers four questions on repeat: is this supplier who they claim to be, are they registered for the tax they charge, do we have a contract, and is the bank account we are about to pay actually theirs?

Those questions apply twice: once before approval, when the record is created; then continuously, whenever a supplier changes ownership, moves banks or asks to be paid in another currency.

The payoff shows up in accounts payable, where a complete file makes an invoice approvable without a chain of emails, and in audit readiness, where documents are produced in minutes.

Vendor Compliance vs. Vendor Onboarding vs. Vendor Risk Management

The three terms are used interchangeably and almost never mean the same thing.

Term	Main Focus	Typical Activities
Vendor Onboarding	Setting up a supplier	Collecting details, creating supplier records, setting up payment information
Vendor Compliance	Confirming requirements are met	Reviewing documents, tax details, contracts and payment information
Vendor Risk Management	Identifying and managing broader supplier risks	Assessing financial, operational, legal, security and continuity risks

Onboarding ends when the record exists. Compliance asks whether the record is supported, and recurs. Risk management asks what happens if the supplier fails or disappears. You can run compliance without a formal risk program; you cannot run it without onboarding.

Vendor Compliance Requirements for Canadian Businesses

Canada has no single federal vendor compliance standard. What you collect depends on the vendor's industry, contract value, risk level and data access: a design agency invoicing $4,000 and a cloud provider holding customer records should not be asked for the same file.

Business Identity and Registration Information

Start with the legal entity, not the brand. Suppliers often trade under a name that differs from their registered one, and an invoice issued under a trade name creates a matching problem as soon as a payment is disputed.

Collect the legal name and any operating name, address and contact details, and the CRA Business Number where applicable. Add registration details — Corporations Canada for federally incorporated vendors, or the provincial registry (Ontario's ONBIS, the BC Registry). A vendor incorporated elsewhere but operating in your province should show extra-provincial registration.

Tax Information and GST/HST Documentation

The most common Canadian vendor compliance error is treating a Business Number as proof of GST/HST registration. The BN is a nine-digit identifier for the business; GST/HST is a separate program account attached to it, marked RT, and a business can hold a BN without registering — for instance under the $30,000 small supplier threshold.

That distinction carries a cost. If a supplier charges GST/HST without valid registration, the tax is not creditable and your input tax credit claim fails on documentation. CRA's GST/HST Registry confirms a number and its effective date in about two minutes. Invoices of $150 or more must display that number, so cross-check invoice, registry and vendor record.

Contracts, Insurance and Business Licences

A signed service agreement defines what compliance means for that relationship: scope, payment terms, currency, termination and renewal dates. Store the executed version, not the draft.

Insurance certificates are typically required where a vendor works on your premises, handles goods, or carries professional liability exposure. Construction and trades vendors in Ontario are commonly asked for a WSIB clearance certificate, with equivalents from WorkSafeBC and CNESST. Those certificates expire, so one valid at onboarding may be worthless later.

Banking and Payment Information

Payment details are the highest-risk field in any vendor record: a small change redirects real money. Record the legal name exactly as it appears on the bank account, the beneficiary details, remittance instructions, the payment currency and the preferred method.

Then define what happens when any of it changes. A beneficiary change should never be processed on a single email, even one arriving in a thread you recognize from a correct address. Require verification through a channel established beforehand, and ensure the verifier is not the person keying the change.

Privacy, Security and Other Risk Requirements

Where a vendor handles personal information, PIPEDA applies to private-sector organizations collecting, using or disclosing it in commercial activity, with Quebec's Law 25, BC's PIPA and Alberta's PIPA adding provincial rules. In practice that means a privacy clause, a description of the data accessed, retention terms, and a security review proportionate to sensitivity.

Sanctions screening belongs here too, with a caveat on scope. Statutory duties under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act fall on reporting entities such as banks and money services businesses, not on every company that buys services. Screening suppliers against the Special Economic Measures Act and Justice for Victims of Corrupt Foreign Officials Act listings is risk management, not necessarily a legal duty.

Apply this on a risk basis: a stationery supplier does not need a security questionnaire; a payroll provider does.

Vendor Compliance Checklist for Canadian Businesses

The table below is the working version many finance teams adapt, short enough to use on every supplier.

Compliance Item	What to Check	Why It Matters
Business identity	Legal name, address and contact details	Confirms supplier identity
Business registration	BN or relevant registration details where applicable	Supports business and tax records
Tax information	GST/HST details where applicable	Supports accurate tax documentation
Contract	Signed agreement and payment terms	Confirms commercial obligations
Insurance and licences	Required certificates or licences	Confirms relevant qualifications
Banking information	Beneficiary name and payment details	Reduces payment errors and fraud exposure
Invoice details	Supplier name, invoice number, amounts and tax details	Supports AP processing
Data security	Privacy and security review where relevant	Protects business and customer information
Approval records	Internal approvals and supporting documents	Maintains an audit trail
Periodic review	Changes in ownership, contract, risk or payment details	Keeps supplier records current

This is a general checklist, not a legal requirement. Adapt it to your industry and risk profile, and delete rows that do not apply.

How to Build a Vendor Compliance Process

A process is what turns a checklist into something a team can run without asking questions every time.

Step 1: Create a Standard Vendor Intake Process

Use one supplier information form across the company, capturing legal name, business details, contact information, service description, and payment requirements including currency and method. Assign each supplier an internal owner so change requests have somewhere to land.

Step 2: Define Documentation Requirements by Risk Level

Tier your requirements instead of applying the maximum to everyone.

Low-risk vendors — basic identity and payment information.
Recurring service providers — contract, tax information and payment terms.
Software or data vendors — privacy and security review where relevant.
High-value or international vendors — additional due diligence per company policy and risk.

Write the tiers into a one-page policy so a new AP analyst can apply them without escalation.

Step 3: Verify Supplier and Payment Information

Verification separates compliance from data entry. Match the legal name across contract, invoice and vendor record — three documents, one name. Check tax details against the CRA registry where GST/HST is charged, and confirm bank details through an approved process.

For changes to payment instructions, confirm using a contact method established before the request arrived: a number from the signed contract, not the email signature asking for the change. Treat urgency as a warning sign.

Step 4: Set Up Internal Approval and Recordkeeping

Define who approves what. A common split is procurement for commercial terms, finance for payment setup and changes, and a second approver above a value threshold.

Store contracts, tax documents and payment verification records in one place, with an audit trail of who approved what. If your ERP holds the vendor master and a shared drive holds the contracts, you have no single answer to what you hold on a supplier.

Step 5: Review Vendors Regularly

Set review frequency by risk and business importance, not calendar convenience. Reassess whenever ownership, banking details, contract terms or scope change. An annual review of suppliers above a spend threshold, plus event-driven review, covers most mid-sized Canadian businesses.

Common Vendor Compliance Risks and How to Reduce Them

Incomplete or Inaccurate Supplier Information

Missing tax information, mismatched legal names and incorrect invoice details are the most common findings in a vendor file review. They rarely cause immediate loss, which is why they persist — until a tax authority queries an input tax credit or a dispute turns on who contracted. Standardized intake plus document review before the record goes active fixes it.

Vendor Payment Fraud and Bank Detail Changes

Fraudulent requests to change beneficiary details, often delivered through business email compromise or impersonation of a known contact, are the costliest vendor risk for most businesses because the transfer is authorized and hard to reverse. Controls that work: callback verification to a known number, dual approval, a pause between change and first payment, and updates restricted to a small group.

Inconsistent Documentation and Weak Audit Trails

Missing contracts, missing approvals and separate supplier lists held by different departments all produce the same outcome: nobody can evidence why a payment was made. Centralized records and documented approval workflows fix it, and shorten month-end, because reconciliation stops depending on institutional memory.

Risks When Working with International Suppliers

International supplier records add four complications. Banking formats differ — IBAN in Europe, routing and account numbers in the United States — and a malformed instruction is a failed payment. Currency conversion adds cost embedded in the rate rather than shown as a fee. Documentation and tax treatment vary, so a foreign supplier may have no GST/HST number, and reconciliation gets harder across channels. The answer is one standardized record and one documented payment procedure.

How to Manage Payments to Domestic and International Vendors

Compliance decides whether you may pay a supplier. Payment operations decide whether the money arrives correctly, on time, and at a cost you understood in advance.

Choose the Right Payment Method for Each Supplier

Domestic suppliers are usually best served by EFT or Interac e-Transfer for smaller amounts, with wire transfer for large or time-critical payments. International suppliers may be reachable through a local rail in their market, a wire, or a provider that settles locally on your behalf. Match the method to location, currency, urgency and all-in cost — wires carry correspondent deductions that can leave the beneficiary short.

Manage Multiple Currencies and International Payments

FX conversion is the largest controllable cost in most international supplier programs, and it is rarely quoted as a number. A rate carrying a spread, plus a transfer fee and correspondent deductions, can add several percent to an invoice that looked competitive. Holding balances in the currencies you pay in reduces conversions, and structured remittance information makes those payments reconcilable.

Reduce Manual Work in Accounts Payable

Standardize payment workflows, keep supplier records consistent across entities and currencies, and improve reconciliation so exceptions surface early. Most manual effort in AP is not payment execution; it is chasing references, resolving name mismatches and rebuilding context that should have been in the vendor record.

Payment Solutions for Canadian Businesses Working with Global Vendors

Approval is the gate. Payment is where the file gets tested every month, and where most friction sits for teams paying suppliers in several currencies.

PhotonPay is a payment operating system used by Canadian finance teams to hold, convert and pay out funds across supplier markets. Its Canadian entity, Photon Dance CA Inc., is registered with FINTRAC as a money services business (MSB registration M21161397). Where it sits in the supplier-payment stack:

Multi-asset wallets — Photon Wallet holds supported fiat currencies and stablecoins (USDC and USDT) in one place, so supplier balances do not have to be converted back to CAD between payment cycles.
Global payouts — Movement pays suppliers and contractors across 83 local payout markets connected through 22 direct local payment and clearing networks, with 97% of payouts settling in real time.
Currency conversion — convert between 60+ currencies ahead of payment, so the supplier is paid in the currency their invoice is denominated in, not the one your balance holds.
Payout API — teams running high-volume or system-triggered supplier payments can integrate payouts programmatically, subject to product availability and onboarding requirements.

PhotonPay does not verify supplier identity, validate GST/HST registration, screen sanctions lists or automate vendor onboarding. Those remain your controls; PhotonPay moves the funds once a supplier is approved and verified.

Open a PhotonPay business wallet and pay your first international supplier from one account.

FAQs About Vendor Compliance for Canadian Businesses

What documents are required for vendor compliance in Canada?

For most Canadian suppliers: a signed contract, business identity details, the CRA Business Number and GST/HST details where applicable, any licence the industry requires, and verified banking information. Vendors handling personal data also need a privacy review.

Is a CRA Business Number required for every vendor?

No. Many sole proprietors and small suppliers operate without one, and a BN is not the same thing as GST/HST registration. If they invoice GST/HST, confirm the number through the CRA GST/HST Registry before claiming the input tax credit.

How do businesses verify supplier bank details?

Through a channel the business initiates, using contact information already on file — a number from the contract or vendor master, not one supplied in the email requesting the change. The verifier should differ from the person keying the update, and the change needs a second approval.

What is different about vendor compliance for international suppliers?

Documentation is jurisdiction-specific: a foreign supplier will have no Canadian GST/HST number. Banking formats differ, so instructions need validating before the first payment. And currency, correspondent fees and settlement timing become part of the vendor record, not an afterthought in AP.

Conclusion

A vendor record is only as good as the checks behind it. Start with legal identity and tax documentation, confirm bank details through a channel you control, and keep the evidence in one place so an invoice can be approved without a chain of emails. For Canadian finance teams paying suppliers at home and abroad, the process that holds is the one you can repeat on every vendor, not the one that runs once at onboarding.

Once a supplier clears those checks, the payment itself should not add new friction — which is where a multi-asset platform such as PhotonPay carries the cross-border side.

Disclaimer: The information provided on this Blog is for general informational and reference purposes only. It does not constitute investment, financial, legal or other professional advice, nor does it constitute an offer, invitation, solicitation, inducement or financial promotion in any jurisdiction. We make no representation or warranty, express or implied, as to the completeness, accuracy, truthfulness, timeliness or reliability of the information provided on this Blog. The products, services and features referred to on this Blog may not be available in all countries or regions. Their availability, eligibility and applicable terms are subject to applicable laws and regulations and the information provided on the relevant product or service pages. The information provided on this Blog does not constitute an offer or recommendation of products or services to residents of any specific country or region.