“TRUST STARTS & ENDS WITH THE TRUTH”
“TRUST STARTS & ENDS WITH THE TRUTH”
Matt is both the company founder and a nationally renowned private investigator. Matt is an intelligence specialist who excels in detecting and preventing the illegal interception of communications and in providing high-tech covert surveillance. Matt has years of hands on experience in the investigation industry and has developed a reputation for incorporating state of the art technology and innovative ideas to provide effective solutions for his clients. Matt also serves as Treasurer for the Executive Board of Directors of FALI, The Florida Association of Licensed Investigators.
A vendor due diligence checklist lists the legal, financial, ownership, security, and insurance checks a business completes on a supplier ahead of a contract. Our investigators usually see these vendor files after someone accepted a vendor’s answers and never matched them to a record. The checklist below sorts every item by where you can confirm the answer against a record.
A vendor due diligence checklist covers six areas: who the vendor legally is, who owns and runs it, whether it can pay its bills, its court and regulatory history, its licenses and insurance, and how it protects your data and money.
The closest thing to an official list comes from the federal banking agencies. Their 2023 guidance for banks names 14 due diligence factors for third parties, including legal and regulatory compliance, financial condition, business experience, the backgrounds of key personnel, information security, reliance on subcontractors, and insurance coverage. The guidance applies to banking organizations and does not carry the force of law. Businesses outside banking still borrow its structure because the factors fit almost any supplier.
A smaller company does not need all 14 factors for a janitorial contract or an office supply account. The same guidance says the depth of review should match the risk of the relationship.
For vendors that will touch money, data, or your customers, our corporate background investigations for vendors and partners verify credentials and look for risks the vendor left out.
A vendor due diligence checklist should include the vendor’s legal registration, owners and officers, tax identity, financial condition, litigation and regulatory history, sanctions status, licenses, insurance, security practices, and payment details. Each item needs two parts: what the vendor provides and the independent record that confirms it. A list with only the first part is a questionnaire.
Yes. In mergers and acquisitions, vendor due diligence means a report the seller commissions on its own company for prospective buyers, with “vendor” meaning the seller. In procurement and risk management, the same phrase means a buyer checking a supplier. The checklist on this page covers the second meaning: vetting a company you plan to pay.
The table below pairs six common checklist items with the record that confirms each one.
| Checklist item | What the vendor gives you | Where to confirm it independently |
|---|---|---|
| Legal entity and status | Company name and formation documents | State corporation records |
| Owners and officers | Names on a form | Officer and registered agent searches, plus court records |
| Tax identity | Form W-9 | IRS TIN Matching, open to payers that file information returns |
| Sanctions | A "no" on a questionnaire | OFAC Sanctions List Search |
| Insurance | Certificate of insurance | The agent or carrier named on the certificate |
| Bank details | An invoice or an email | A phone call to a number you had on file |
A vendor due diligence questionnaire collects what the vendor says about itself, and independent verification checks those statements against records the vendor does not control. Both belong in the process. Problems start when the first stands in for the second.
A questionnaire works like a resume. A resume tells you where a candidate claims to have worked, and the reference call tells you whether it happened. Vendor answers deserve the same second step.
The federal banking agencies make the point directly. Their guidance says its list of considerations is illustrative and was never meant to serve as a checklist. The same document says prior experience with a third party is no substitute for due diligence, and it suggests reviewing a vendor’s website and marketing materials to see whether the claims match the vendor’s real capabilities.
Example (illustrative only): A property manager in Orlando receives a polished proposal from a restoration contractor. The contractor’s website describes ten years in business. The state registration shows the company was formed four months ago, and one listed officer appears on two dissolved companies with similar names. The questionnaire came back complete. Every gap sat in records the vendor never mentioned.
When the stakes justify a closer look, a due diligence investigation goes past the form. Our team checks civil court history for judgments, liens, and bankruptcies, reviews regulatory records and professional licenses, and looks for undisclosed ownership interests and a trail of failed businesses.
The vendor due diligence checklist template below has eight groups, and each line names the item and the record to match it against. Copy the template into a document or spreadsheet and add a column for the date and the person who checked.
Red flags in vendor due diligence are mismatches between what a vendor says and what a record shows. One mismatch alone can have an innocent explanation. Several together call for a closer look ahead of any payment.
Red flags:
Newly formed entities deserve particular attention. A paper identity can be assembled for a company the same way it is for a person, a pattern we cover in our guide to how synthetic identities are built.
Inside risk belongs on the list too. The Association of Certified Fraud Examiners studied 2,402 occupational fraud cases across 143 countries for its 2026 report, and cases where the perpetrator was unusually close with a vendor or customer carried a median loss of $300,000. An employee who resists a second review of one favored supplier is a signal to note.
A vendor passed the paperwork and failed one of the checks above?
Our team checks the court, licensing, and ownership records behind the company and the people running it.
See what a due diligence investigation covers
Confidential, with no obligation.
Each vendor needs due diligence in proportion to what the relationship could cost you if the vendor fails, lies, or gets impersonated. The federal guidance for banks takes the same position: relationships differ in risk, so they do not all need the same level of review.
The agencies describe critical activities as those that could cause significant risk if the third party fails, significantly affect customers, or significantly affect finances or operations. The table below applies that idea to three tiers.
| Vendor type | What is at stake | Depth of checks |
|---|---|---|
| Low risk: one-time or low-dollar purchases with no data access | A small, recoverable amount | Groups 1 and 7 |
| Moderate risk: recurring services, site access, or regular payments | Ongoing payments and access to your premises | Groups 1 through 5 and group 7 |
| High risk: handles customer data, moves money, or runs a function you cannot operate without | Customer harm, large losses, or a shutdown | All eight groups, plus independent verification of ownership and court history |
Conduct vendor due diligence ahead of signing, since declining costs nothing at that stage. Repeat the checks at renewal and whenever something material changes: new owners, a new bank account, a breach, or a lawsuit. The banking guidance treats monitoring as a continuing stage of the relationship and sets no fixed interval, so match your schedule to the vendor’s tier.
A vendor bank detail change is the request to verify every time, because criminals impersonate vendors you already trust.
If a payment already went to the wrong account: call your bank now and ask for a recall of the funds, then file a complaint at ic3.gov with the full transaction details. The FBI says time is critical and that its Recovery Asset Team may be able to help freeze funds. Save the original email and every invoice.
The FBI’s Internet Crime Complaint Center logged 24,768 business email compromise complaints and $3.05 billion in reported losses in 2025. The Bureau defines the scheme as one that targets businesses working with suppliers and making regular wire payments.
In a typical version, an attacker poses as a known supplier and sends an invoice or an email with new payment instructions. The business pays a criminal’s account believing the transaction is routine. Our work on vendor impersonation and ACH redirect cases traces how the fraud occurred and whether the breach started on your side or the vendor’s.
Recommended: Confirm every bank detail change by phone, using a number you had on file ahead of the request. Our guide to verification rules for payment requests explains why a familiar name and clean writing no longer prove who sent a message.
Bring in an investigator for vendor due diligence when the contract is large, the vendor is new or hard to trace, or a record contradicts what the vendor told you. Staff can run registration, sanctions, and insurance checks. Ownership behind layered entities, court history under prior names, and the background of the people in charge take investigative work.
Southern Recon Agency’s due diligence investigations look at work history including omissions and misrepresentations, national civil court history covering judgments, liens, foreclosures, and bankruptcies, regulatory records and professional licenses, undisclosed corporate ownership interests, and a trail of failed businesses. Every investigation is scoped to the situation.
When a client asks me whether a vendor is safe to sign, I ask which answers they confirmed and which ones they were told.
Southern Recon Agency is a Florida Licensed Private Investigation Agency, License A1400197, based in Orlando. Pricing for a vendor due diligence investigation is quoted after an assessment of the vendor, the entities involved, and the jurisdictions.
Recommended: Run groups 1 through 5 and group 7 yourself first. Bring the results, and any mismatch you found, to the first conversation so the investigation starts where your checks stopped.
A vendor due diligence checklist covers a supplier’s legal standing, ownership, finances, court and regulatory history, licenses, insurance, security, and payment setup. A filled-in questionnaire records the vendor’s claims, so each item needs an independent record behind it: state filings, court records, the OFAC search, the insurer, and a phone call for bank details. Match the depth to the vendor’s risk, repeat the checks when ownership or payment details change, and treat any bank detail change as unverified until you confirm it by phone.
Need the records behind a vendor ahead of a contract?
Southern Recon Agency investigates the company and the people running it, from court history and licenses to undisclosed ownership.
Request a confidential vendor review
Florida licensed agency A1400197. Call 844-307-7771.
U.S. law does not impose one checklist on every business. Regulated sectors face specific duties. The FTC Safeguards Rule requires covered financial institutions to select capable service providers, set security expectations by contract, and reassess them periodically. Banks follow interagency guidance on third-party risk. Rules vary by industry and state, so ask counsel about yours.
Vendor due diligence gathers and verifies facts about a supplier: who owns it, what its records show, and how it protects data. A vendor risk assessment uses those facts to decide how much exposure the relationship creates and what controls to require. Due diligence comes first, and the assessment sets how deep the next round of checks should go.
The timeline depends on scope. Your own staff can finish registration, sanctions, and insurance checks on a domestic vendor quickly. An investigation into ownership, court history, and principals takes longer, and its length depends on the number of entities, people, and jurisdictions involved. Set the deadline by your signing date and start early.
Re-check vendors on a schedule tied to risk, and again whenever ownership, bank details, or legal status changes. Federal guidance for banks describes monitoring as periodic or continuous and calls for more frequent review of relationships that support critical activities. A low-risk supplier may need a light review at renewal, while a vendor holding customer data needs closer attention.
The business hiring the vendor is responsible, even when it outsources part of the checking. Day to day, procurement or finance usually owns the checklist, with legal, IT, and compliance reviewing their sections. Federal banking guidance makes the same point for banks: using a third party does not reduce the organization’s own responsibility for the activity.
Yes. A licensed investigator can research a company and its principals through court records, corporate filings, regulatory and licensing records, and interviews, then report where the findings differ from what the vendor stated. Private investigation is licensed by state, so confirm the agency’s license. Results depend on what the records hold and how much history the vendor has.
Matt Aubin is the Founder and Managing Partner of Southern Recon Agency, a Florida Licensed Private Investigation Agency (License A1400197) based in Orlando. He started the firm in 2010. He is a Certified TSCM Technician, Certified Digital Forensics Examiner, and Florida Board Certified Investigator, and a court-qualified expert witness in cyber intelligence and cyber forensics. He is a member of the U.S. Secret Service Miami Electronic Crimes Task Force and FBI InfraGard Tampa.
Everything in this article is general information and is not legal or financial advice. For guidance on a specific vendor or contract, consult a licensed attorney in your state.