Friday, 4:40 pm. A boiler fails at a 96-unit building and the contracted vendor cannot come until Tuesday. The property accountant finds a second firm that can come Saturday morning, sets it up in the payment system in nine minutes, and the heat is back by noon. The invoice arrives Monday and is paid Wednesday because the residents had heat and the manager is grateful.
It is now the following March. The accountant is chasing that vendor for a W-9 it never sent, discovers the certificate of insurance on file belongs to a different company with a similar name, and finds that the bank account the invoice was paid to was given by email and never verified. The vendor has done eleven more jobs since. None of the bargaining power the property had on that Friday exists anymore, because the only moment a property holds all the cards with a vendor is before the first invoice is paid.
That is what a vendor onboarding checklist is for. It is not administration; it is the control point of the whole vendor relationship, and this post lays it out row by row: identity and tax (W-9, 1099 and the UK's CIS), insurance minimums by trade, licences, bank verification and the call-back rule that stops payment fraud, contract and SLA, system access, safety induction, property rules and the first work order. Then it covers the emergency vendor roster, which is onboarding done in advance, in daylight, for the vendors you will need at 4:40 on a Friday.
Definition
Vendor onboarding in property management is the set of checks and records completed between the decision to use a vendor and the first work order or payment: identity and tax status, insurance, licences, verified banking details, the signed agreement and service levels, system access, safety and property rules. RIOO's rule is Day 0 readiness: a vendor is not dispatched and not paid until every row of the onboarding checklist is complete, because onboarding is the only stage at which the property holds all the cards. It is stage 4 of RIOO's eight-stage vendor lifecycle.
At a glance
| Question | Answer |
|---|---|
| What is on a vendor onboarding checklist? | Identity and entity; tax forms (W-9 and 1099 status in the US, CIS verification in the UK); insurance to the trade minimums with the right endorsements; licences; verified bank details; signed contract and SLA; system access; safety induction; property rules; a first work order |
| What is the 1099 threshold for 2026? | $2,000 in payments to a non-corporate vendor in the year (raised from $600 for payments made after 31 December 2025); backup withholding at 24% applies if no valid TIN is on file |
| What insurance should a trade vendor carry? | Typically general liability of $1 million per occurrence and $2 million aggregate, workers' compensation to statutory limits, auto liability of $1 million, with the property named as additional insured; higher limits and umbrella cover for roofing, elevators and structural work |
| What is the call-back rule? | Any new or changed bank details are confirmed by phoning a number already on file for the vendor, never a number in the email that requested the change |
| What is an emergency vendor roster? | A pre-onboarded list of a primary and a secondary vendor for each emergency trade at each property, with 24/7 numbers, agreed emergency rates and a verification date |
| Why does it matter? | After the first invoice is paid the property has no hold over the vendor; every document not collected at onboarding is chased for years or never obtained |
Why onboarding is the control point
Every other stage of the vendor lifecycle depends on something the vendor wants from the property. Before onboarding, the vendor wants the work. After the first payment, the vendor has the work and the property wants the paperwork. The order of those two facts decides who chases whom, which is why the vendor onboarding property management teams take seriously is front-loaded rather than caught up later.
The practical rule is Day 0 readiness: the vendor record is not activated for dispatch or for payment until every row of the checklist is green. That sounds strict for a Friday-afternoon boiler, and it is the reason the emergency roster exists (see below): the vendor you need on Friday should have been onboarded in April. Where a true one-off emergency forces the use of an unonboarded vendor, the record is created in a restricted status that allows a single work order and no payment, and the payment is released only when the checklist is complete. That is the difference between a vendor who sends the W-9 on Monday and a vendor who sends it never.
There is also a fraud dimension. Vendor payment fraud (a fake vendor set up with a plausible name, or a real vendor's bank details changed by a spoofed email) works because the set-up happens in a hurry and nobody verifies. Business email compromise remains one of the most costly categories of fraud reported to the FBI's Internet Crime Complaint Center year after year, and property management, with its high volume of vendor payments and its dispersed approvers, is a target. The onboarding checklist is where the verification happens; the call-back rule below is the single control that stops most of it.
The checklist below is the vendor setup form in substance. Whether it is a paper form, a portal page or a record in the property system, it should ask for exactly these items and nothing that will not be checked.
The vendor onboarding checklist
| # | Item | What to collect or do | Verify by | Owner | Blocks dispatch? |
|---|---|---|---|---|---|
| 1 | Legal identity | Legal name, trading name, entity type, registered address, company number (UK) or state registration (US), principal contact, escalation contact, 24/7 number for emergency trades | Company registry lookup; match to the name on insurance and bank documents | Accountant | Yes |
| 2 | US tax: W-9 vendor setup | Form W-9 signed by the vendor with name, entity type and TIN; record whether the vendor is 1099-reportable (sole proprietors, partnerships and LLCs taxed as such are; corporations generally are not, except attorneys and medical providers) | TIN matching where available; W-9 dated within the year | Accountant | Yes: no W-9, no payment |
| 3 | US tax: 1099 vendor flag | Flag the vendor record as a 1099 vendor (1099-NEC reportable); note the 2026 threshold of $2,000 in annual payments and that backup withholding at 24% applies where no valid TIN is on file | Annual 1099 run reconciles to flagged vendors | Accountant | No, but blocks year-end |
| 4 | UK tax: CIS | For construction operations, verify the subcontractor with HMRC under the Construction Industry Scheme and record the deduction rate (20% registered, 30% unverified, 0% gross payment status); record VAT number and whether the domestic reverse charge applies | HMRC verification reference on file | Accountant | Yes for construction work |
| 5 | Insurance | Certificate of insurance showing general liability, workers' compensation, auto and any umbrella to the trade minimums (table below); the property, manager and owner named as additional insured on GL with a waiver of subrogation; expiry dates recorded | Read the certificate and the endorsements, not just the cover page; our COI tracking guide explains what a certificate does and does not prove | Manager or compliance | Yes |
| 6 | Licences and certifications | Trade licence number, issuing body and expiry; trade certifications (EPA 608 for refrigerants, Gas Safe in the UK, electrical licence); business licence where the city requires one | Licensing board lookup | Manager | Yes for licensed trades |
| 7 | Banking | Remittance details on the vendor's letterhead or a voided cheque, submitted by the vendor's known contact | The call-back rule (below), recorded with date, number called and person spoken to | Accountant, second person approves | Yes: no verified bank, no payment |
| 8 | Contract and rate card | Signed agreement (per-work-order terms, scheduled service contract or project contract); rate card with hourly rates by time band, trip charge, materials markup, minimum charge and emergency multiplier; payment terms | Counter-signed copy on the record; rate card dated | Manager | Yes |
| 9 | Service levels | The SLA schedule with priority levels and the three clocks, where the trade warrants it (see the vendor SLA template) | Attached to the contract | Manager | For contracted services |
| 10 | System access | Portal or app user created; keys, fobs, gate codes and alarm codes issued and logged by number; any BMS or controller credentials issued individually, never shared | Access log with issue date and the person who holds each item | Coordinator | No, but must precede first visit |
| 11 | Safety induction | Site safety rules acknowledged; permit-to-work process for hot works, roof, confined space, electrical isolation; incident reporting procedure; the vendor's own safety statement or method statements for higher-risk trades | Signed acknowledgement | Coordinator | Yes for high-risk trades |
| 12 | Property rules | Hours of work, noise, parking, resident and tenant contact protocol, photo and evidence requirements on completion, invoicing instructions (one work order per invoice, PO number required) | Signed acknowledgement | Coordinator | No |
| 13 | Conduct and data | Code of conduct or vendor policy (anti-bribery, conflicts, treatment of residents); data handling where the vendor sees resident or tenant information | Signed acknowledgement | Manager | No |
| 14 | First work order | A supervised, low-risk first job with a full completion record, reviewed before the vendor moves to normal dispatch | Completion note, photos, invoice matched to work order | Coordinator | The gate to normal status |
| 15 | Record status | Vendor record moved from onboarding to active, with the date, the person who approved it and the review date for insurance and licence expiries | Status field with audit trail | Accountant | The activation itself |
Two items are the ones most often skipped and most often regretted. Row 7, banking, because the vendor sent the details and they looked fine. Row 14, the first work order, because the vendor was needed and it seemed bureaucratic to supervise a plumber. The first is how money leaves; the second is how a vendor with a good sales pitch and a poor crew gets thirty work orders before anyone looks at one.
Insurance minimums by trade
The figures below are planning ranges used widely in US property management for contracted trades; they are not statutory minimums, they vary by state, owner agreement and lender requirement, and UK and other portfolios will use different products (public liability and employers' liability) and different limits. Use them as a starting point for your own schedule and confirm it with your broker.
| Trade | General liability (per occurrence / aggregate) | Workers' compensation | Auto liability | Umbrella or excess | Notes |
|---|---|---|---|---|---|
| Cleaning, landscaping, pest, general handyman | $1M / $2M | Statutory; employer's liability $500k | $1M combined single limit | Not usually | Confirm the workers' comp covers all crew, not only the owner |
| Plumbing, electrical, HVAC, locksmith | $1M / $2M | Statutory; employer's liability $500k to $1M | $1M CSL | $1M to $2M for larger portfolios | Pollution liability for HVAC refrigerant and fuel work is worth asking about |
| Roofing, structural, scaffolding, demolition | $2M / $4M (or $1M / $2M plus umbrella) | Statutory; employer's liability $1M | $1M CSL | $5M | Highest injury and property-damage exposure; check the policy has no roofing or height exclusion |
| Elevator maintenance | $2M / $4M | Statutory; employer's liability $1M | $1M CSL | $5M to $10M | Often written into the maintenance contract by the elevator company; verify limits match |
| Fire and life safety | $1M / $2M | Statutory | $1M CSL | $2M to $5M | Professional liability where the vendor designs or certifies systems |
| Snow and ice | $1M / $2M with no snow exclusion | Statutory | $1M CSL | $1M to $2M | Slip-and-fall claims land here; the additional insured endorsement matters most |
| Professional services (engineering, environmental, legal) | $1M / $2M | Statutory | As applicable | Not usually | Professional (errors and omissions) liability of $1M to $2M in place of or in addition to GL |
Whatever the limits, three things have to be true for the insurance to protect the property: the certificate must be current, the property (and manager and owner) must be named as additional insured on the general liability policy by endorsement, and the endorsement must be on file, because the certificate itself confers no rights. Our guide to vendor compliance covers why a binder of certificates is not a compliance programme.
The call-back rule for bank details
The single control that stops most vendor payment fraud is a rule, not a system.
The call-back rule. New bank details, and any change to existing bank details, are confirmed by telephone to a number for the vendor that was already on file before the request arrived, speaking to a named person, before the details are entered or changed. The call is recorded on the vendor record with the date, the number called, the person spoken to and the accountant who made the call. A second person approves the change. No exceptions for urgency, for the size of the vendor, or for an email that appears to come from the vendor's owner.
The rule works because the fraud depends on the email. A spoofed message from "the vendor's accounts team" asking to update remittance details will pass every check that looks at the email, and fail the one check that does not. The number on file came from the original onboarding, verified against the company's public listing, before anyone had a reason to fake it.
Three supporting practices make the rule hold in practice. Bank changes are handled only through the vendor's onboarding contact, never through whoever emails. The vendor is told at onboarding that the rule exists, so a real change request expects the call. And the vendor record carries the verification date, so an auditor or a new accountant can see at a glance which vendors' details have been verified and which were "set up in a hurry in 2023".
Where a portfolio wants a system control as well, the equivalent is a restriction that prevents payment to a vendor whose bank details were changed within the last few days without a second approval, which turns the call-back from a habit into a gate.
The emergency vendor roster
The Friday boiler is not a surprise. Every property will lose heat, water, power or a lift at some point outside business hours, and the trades that fix those things are known in advance. The emergency vendor list is the set of vendors who have been fully onboarded, with emergency rates agreed, before they are needed, so that the 4:40 call goes to a verified number and produces a verified invoice.
The roster is kept per property (or per cluster of properties within a drive time), with a primary and a secondary vendor for each emergency trade, and it is re-verified on a schedule, because a roster with a vendor who closed last year is worse than no roster.
| Trade | Primary vendor | Secondary vendor | 24/7 number | Emergency rate (agreed) | Attend time (agreed) | Onboarding complete | Last verified | Next verify |
|---|---|---|---|---|---|---|---|---|
| Plumbing (leak, no water, sewage) | e.g. 1.5× standard, 2-hour minimum | e.g. 2 hours | ✓ / ✗ | date | date | |||
| Electrical (power loss, arcing) | ||||||||
| HVAC (no heat, no cooling) | ||||||||
| Locksmith and access control | ||||||||
| Elevator (entrapment, lift out) | usually under the maintenance contract | 30 to 60 minutes for entrapment | ||||||
| Glazing and board-up | ||||||||
| Water damage restoration | ||||||||
| Fire and life safety | ||||||||
| Gas (call the utility first) | ||||||||
| Snow and ice (seasonal) | trigger depth and time-to-clear |
Rules for the roster. Every vendor on it has completed the full onboarding checklist, including the call-back verification; the roster is the place where "we'll sort the paperwork later" is not allowed to start. The emergency rate is agreed in writing at onboarding, because a rate negotiated at midnight is not a negotiation; the hub's worked example shows what an unplanned emergency premium costs. The 24/7 number is tested at each verification, by calling it. The secondary vendor exists because the primary will one day be on another job, and a roster with one name per trade is a concentration risk, not a plan. And the roster is issued to whoever answers the after-hours line, in whatever form they will actually use at 4:40 on a Friday: the answering service's script, the on-call manager's phone, the dispatch screen.
Verification cadence: quarterly for the 24/7 numbers and insurance expiries, annually for rates and the full checklist, and immediately after any failed emergency call.
Key facts
- A vendor onboarding checklist for property management has fifteen rows, and the vendor is not dispatched or paid until every row that blocks dispatch is complete (RIOO's Day 0 readiness rule).
- For US vendors, a signed Form W-9 is required before the first payment; for the 2026 tax year, Form 1099-NEC is required where payments to a non-corporate vendor reach $2,000 in the year, and backup withholding at 24% applies where no valid TIN is on file.
- For UK construction work, the subcontractor is verified with HMRC under the Construction Industry Scheme and tax is deducted at 20% (registered), 30% (unverified) or 0% (gross payment status).
- Typical general liability minimums for trade vendors are $1 million per occurrence and $2 million aggregate, rising to $2 million / $4 million plus a $5 million umbrella for roofing, structural and elevator work; the property must be named as additional insured by endorsement.
- The call-back rule: new or changed bank details are confirmed by phone to a number already on file, never to a number in the requesting email, with a second person approving the change.
- The emergency vendor roster lists a fully onboarded primary and secondary vendor per emergency trade per property, with agreed emergency rates, a tested 24/7 number and a verification date, re-verified quarterly.
- The first work order is supervised and reviewed before the vendor moves to normal dispatch status.
Onboarding in the system
The checklist is a control only if the system enforces it. A spreadsheet checklist next to a payment system that will pay anyone with a vendor number is two documents that disagree. The design that works: the vendor record has a status, the status is set to active only when the checklist rows are complete, and both dispatch and payment check the status.
The same record then carries the expiries. Insurance and licence expiry dates are set at onboarding and generate a reminder before the date and a block after it, so that a vendor whose certificate lapsed in March is not dispatched in April on the strength of last year's file. The bank verification date, the person who made the call and the approver are fields, not a note in an email. And the emergency roster is a view of active vendors filtered by trade, property and emergency flag, rather than a separate list that drifts.
In RIOO on NetSuite, the vendor management and accounts payable module holds each supplier's profile with its contacts, bank details, payment terms, purchase history and past payments, routes purchase requests through approval to a purchase order, matches invoices to the PO and receipt, flags duplicates before they enter the approval workflow, and applies custom roles, permissions and approval paths. Vendor communication, documentation and task assignments are centralised in service request and task management, which is where work orders are created, assigned to technicians or vendors and monitored to completion. Setting the vendor record up inside NetSuite specifically is covered in our NetSuite vendor management guide for real estate.
Put the checklist to work. Run the fifteen rows against your ten highest-spend vendors this month; the rows that come back blank are the ones to fix first, starting with bank verification. To see how vendor records, approvals and payments sit in one system, book a walkthrough of RIOO's vendor management and AP module.
Frequently asked questions
Q1. What should a vendor onboarding checklist for property management include?
Fifteen items: legal identity; W-9 and 1099 status (US) or CIS verification (UK construction); a certificate of insurance to the trade minimums with the property named as additional insured by endorsement; licences and certifications; bank details verified by the call-back rule; signed contract and rate card; the SLA where applicable; system access and keys logged; safety induction; property rules; conduct and data policies; a supervised first work order; and the record status set to active with a review date.
Q2. What is the 1099 threshold for vendors in 2026?
$2,000. For payments made after 31 December 2025, a Form 1099-NEC is required where total payments to a non-corporate vendor for services reach $2,000 in the calendar year (the previous threshold was $600), with the figure indexed for inflation from 2027. A Form W-9 should be on file before the first payment regardless of amount, and backup withholding at 24% applies where a valid TIN is not provided.
Q3. What insurance should a maintenance vendor have?
As a planning range for US trade vendors: general liability of $1 million per occurrence and $2 million aggregate, workers' compensation to statutory limits with employer's liability of $500,000 to $1 million, and auto liability of $1 million combined single limit. Roofing, structural and elevator vendors typically carry $2 million / $4 million plus a $5 million umbrella. In every case the property, manager and owner should be named as additional insured on the general liability policy by endorsement, and the endorsement should be on file, not just the certificate.
Q4. How do you prevent vendor payment fraud?
Apply the call-back rule: confirm any new or changed bank details by phoning a number already on file for the vendor (not a number in the email that made the request), speak to a named person, record the call on the vendor record, and have a second person approve the change. Tell vendors at onboarding that the rule exists, and restrict payments to vendors whose bank details changed recently until the second approval is in place.
Q5. What is an emergency vendor roster?
A per-property list of a primary and a secondary vendor for each emergency trade (plumbing, electrical, HVAC, locksmith, elevator, glazing, water restoration, fire and life safety, snow), each fully onboarded in advance with an agreed emergency rate and attend time, a tested 24/7 number and a verification date. It is re-verified quarterly and issued to whoever answers the after-hours line.
Note : US tax references are to the 2026 tax year rules; UK references are to the Construction Industry Scheme as published by HMRC. Insurance figures are planning ranges, not legal minimums; confirm with your broker and your owner agreements.
Related reading
- Vendor management in property management: the lifecycle guide
- COI tracking for property managers: what a certificate actually proves
- Vendor compliance in property management: why the COI on file is not enough
- Vendor SLA for property management: template with the three clocks
- The vendor you cannot replace: concentration risk in property operations
- Understanding property management accounts payable basics
- NetSuite vendor management for real estate: a complete guide
