New Vendor Gate: Don't Pay Until Onboarding Clears

A Slack thread can approve spend in seconds: vendor, amount, why, thumbs-up. That is useful. It is also incomplete when the supplier is brand new.

Approving a purchase says the company is willing to commit money. Vendor onboarding says the company knows who it is paying, has the tax paperwork, and has verified where the money should go. Those are different controls. Mixing them up is how teams create a payable record from an invoice PDF, wire to an unverified account, and scramble for a W-9 in January.

This is a process post for Slack-first teams that already book in QuickBooks or Xero. Day-of news was thin on this niche, so the guidance below is grounded in recent AP / vendor-authentication write-ups rather than a single headline.

Purchase approval ≠ vendor activation

Purchase approval answers: Should we buy this? Vendor onboarding answers: Is this payee real, documented, and safe to pay?

Stampli frames vendor onboarding as the controlled path that turns a new supplier into a payable vendor record — tax forms (W-9 or W-8), banking details, compliance docs, validation, approvals, then create in the system of record — ideally before the first invoice (Stampli). Autopayables puts the same idea bluntly: onboarding is the cheapest place to stop duplicate payments, fraudulent bank changes, and paying a supplier you never authorized (Autopayables, Jul 2026).

PaymentWorks separates "setup" (get them into the system) from authentication (confirm identity, payment data, and that the submitter was authorized) — and argues authentication must finish before the first payment (PaymentWorks, Sep 11, 2026).

If your Slack workflow only stores "approved $4,200 for Acme Consulting," you still need a gate before cash moves.

The minimum gate before first payment

You do not need an enterprise vendor portal on day one. You do need a hard stop: incomplete onboarding = not payable.

1. Structured intake (not an email pile)

Capture in one place (Slack request fields + a short form is fine):

• Legal name and DBA
• Remit-to / physical address
• Primary and AP contacts (phone on file matters later)
• Business justification and requester
• W-9 (US) or W-8 (foreign)
• Bank routing and account (or how you pay them)
• Whether this is a one-time vendor under a defined threshold

Stampli's setup advice: one intake point, define what is required before activation, one owner for validation, an approver who is not the requester, then "no complete onboarding, no payment" (Stampli).

2. Tax form before the first dollar

Collect a signed W-9 before the first payment, not after. Beancount's onboarding playbook treats W-9 collection as a hard gate — same idea as gating a first paycheck on an I-9 — because missing TINs drive backup withholding and messy year-end 1099 work (Beancount, Jul 2026).

Validate before you file it away:

• Signature and date
• Completed TIN (SSN or EIN)
• Federal tax classification checked
• Name on line 1 consistent with the TIN type

Entity type also tells you whether a 1099 is usually required. Beancount notes that for payments on or after January 1, 2026 the Form 1099-NEC filing threshold rose from $600 to $2,000 per vendor per year (with inflation adjustments), but that does not mean you can skip the W-9: you often cannot know at first engagement whether the vendor will cross the threshold later (Beancount, Jul 2026).

If a vendor refuses a TIN, the same playbook says you still have filing duties and may need to begin backup withholding at 24% until a valid TIN is provided — and to document your requests (Beancount, Jul 2026).

3. Authenticate banking out of band

Accepting bank details from an email or form and typing them into QuickBooks or Xero is collection, not authentication (PaymentWorks, Sep 11, 2026).

Practical rule used across recent AP guidance:

• Confirm routing/account through a channel independent of the submission (call a phone number you already trust — not a number in the same email)
• Confirm the account belongs to the vendor entity, not only that the numbers look real
• Document who collected, how, what was checked, and when
• Do not activate for payment until banking authentication is done
• Treat later bank-detail changes with the same rigor as first setup — BEC fraud loves the weaker "update" path (PaymentWorks; Autopayables)

4. Duplicate check + segregation of duties

Before creating the vendor in QuickBooks or Xero, search for an existing record. Match on tax ID and bank account, not only name — duplicates are how the same invoice gets paid twice when invoice-number controls fail across two vendor IDs (Autopayables).

Split roles:

1. Requester documents the business need
2. Validator (AP / ops) checks docs, duplicates, banking
3. Approver who is neither requester nor validator activates the vendor for payment

That split is the classic anti-fraud control: the person who creates vendors should not also be the only person who can pay them (Autopayables; Stampli).

5. Optional but worth it for higher risk

For higher spend, international payees, or sensitive categories, add:

• Entity existence / active status check
• TIN matching against IRS records before activation (PaymentWorks treats a mismatch as a hard stop; Beancount also recommends IRS TIN Matching before 1099 season) (PaymentWorks; Beancount)
• OFAC / relevant watchlist screening with a timestamped result (PaymentWorks)

How this fits a Slack → books workflow

For a Slack-first team:

1. Spend request in Slack — amount, category, why, quote. Route by your threshold matrix.
2. If vendor is new (or bank details changed) — open the onboarding checklist in parallel. Do not treat the spend "yes" as payment authorization until the vendor file is complete.
3. Park invoices that arrive with no W-9 / unverified banking — Stampli's advice is to hold payment and send onboarding using contacts from an independent source, not only the invoice (Stampli).
4. Sync the clean vendor + commitment into QuickBooks or Xero so bill approval and payment release confirm a known payee, not invent one under deadline pressure.
5. Emergencies get a fast lane, not a bypass — same required data, compressed timeline, documented verbal-then-written approvals, full review flagged within a set window (Stampli).

If a contractor already started work without onboarding, onboard immediately and hold payment until the record is complete — leverage is highest while money is still owed (Stampli).

How this maps to BuyFlow

BuyFlow is built for the pre-commit decision in Slack and the handoff into QuickBooks or Xero — not a new corporate card or payment rail. That spend trail is necessary. For brand-new vendors, pair it with this onboarding gate so the books never see a payable payee that finance would not defend under audit or after a fraud attempt.

Card platforms often bundle vendor controls with their rails. Many small teams already have Slack plus QuickBooks or Xero. What they need is a decision trail and a payable vendor file — before the wire, ACH, or bill pay run.

Checklist for this week

• Write a one-page "new vendor = not payable until…" policy (W-9/W-8, bank verification, duplicate check, second approver).
• Add a New vendor? flag to your Slack purchase intake. If yes, attach or link the onboarding packet before final payment authorization.
• Capture a trusted vendor phone number at first setup — that number is what you call for bank changes later.
• Pull the last 10 new vendors in QuickBooks or Xero. How many have a signed W-9 and documented bank verification on file?
• Define the emergency lane (same docs, faster clock) so urgency cannot become "just pay them."
• Treat every banking change like a new onboarding event.

A Slack approval without a vendor gate approves intent. Month-end, tax season, and fraud cases care about the payee record. Close that gate before the first payment clears.