What is vendor due diligence?

Vendor due diligence is the process of verifying and risk-assessing a supplier, contractor, distributor or service provider before it is approved, and of refreshing that view during the relationship. It is a focused form of due diligence aimed at third parties that receive money from, or act for, the organisation.

Most vendor fraud and much procurement fraud depends on a vendor that should never have been approved: a shell entity, a company secretly owned by an employee, or a supplier with a record of bribery or insolvency. Checking before the first purchase order is far cheaper than investigating after the money has gone.

What does vendor due diligence check?

A proportionate review usually covers six areas:

• Existence and identity. Company registration on the MCA records, GST and PAN details, registered and operating addresses, website age and physical presence.
• Ownership and control. Directors, shareholders and beneficial ownership, with a search for links to the organisation's own employees, directors or their relatives.
• Legal and regulatory record. Litigation, insolvency proceedings, regulatory orders, debarment from public procurement and defaults.
• Integrity and reputation. Adverse media, sanctions and politically exposed person screening, and allegations of bribery, fraud or labour abuses.
• Financial standing. Filed accounts, charges registered against assets and signs of stress that could disrupt supply.
• Capability. Whether the vendor can actually deliver what it is being paid for, at the scale quoted.

The depth depends on risk. A stationery supplier needs basic checks; a customs agent, a distributor in a high-risk market or a contractor paid large advances may warrant integrity due diligence with discreet source enquiries.

When is it used?

Vendor due diligence is applied at onboarding, at contract renewal, on a change of ownership, and whenever a red flag appears. It is also used after an incident: when a fraud or kickback scheme is suspected, investigators review the vendor master to find other entities with shared addresses, bank accounts, phone numbers or directors.

What is the Indian legal and regulatory context?

No single Indian law requires every company to vet its suppliers, but several legal duties depend on it:

• Companies Act 2013. Contracts with related parties, defined in s. 2(76), need Board approval under s. 188 and, above prescribed thresholds, shareholder approval. A vendor secretly connected to a director is a related-party problem as well as a fraud risk.
• Prevention of Corruption Act 1988. Under s. 9, as amended in 2018, a commercial organisation is liable if a person associated with it, which can include an agent or supplier acting on its behalf, bribes a public servant to obtain or retain business. The defence is having "adequate procedures", but the Central Government has not yet notified the guidelines, so companies benchmark their own programmes.
• Foreign laws. The UK Bribery Act 2010 s. 7 and the US FCPA can reach Indian suppliers of UK- or US-linked groups. UK Ministry of Justice guidance names due diligence as one of six principles of adequate procedures.
• Regulated entities. Banks and other reporting entities identify beneficial owners under the PMLA framework and the RBI KYC Directions, 2025.

What red flags should prompt a deeper review?

• The vendor was incorporated shortly before it was onboarded, or shares an address or bank account with another vendor or an employee.
• Directors or shareholders are relatives or associates of the person who sponsored the vendor.
• The vendor resists providing ownership information or asks to be paid into a third-party or offshore account.
• Pricing is well above market, invoices are round-sum, or the vendor appears only in single-source purchases.
• The vendor's commission or fee is unusually high relative to the service, especially where it deals with officials.

How does it differ from related terms?

Vendor due diligence is narrower than general due diligence, which also covers acquisitions, investors and customers. It is lighter than integrity due diligence, which adds human-source enquiries into reputation and conduct. And it differs from a vendor audit, which tests past transactions rather than the vendor's profile. For a practical checklist on business partners, see due diligence on business partners in India, and on supplier scams see vendor fraud.

Spectra Forensics' integrity due diligence service covers vendor screening, ownership mapping and enhanced reviews of high-risk third parties.