What vendor compliance documents (like W-9s) should I collect, keep current, and keep on file?

Which documents does a given payee need?

One list for everyone burdens simple suppliers or misses what matters for risky work, so start from what the payee is and what you buy:

Every payee also supplies remittance details, covered below. Form W-9 says to use it only if you are a U.S. person, including a resident alien, and tells a nonresident alien or foreign entity to give the requester the appropriate Form W-8 or Form 8233 instead, and the foreign owner of a disregarded entity to use Form W-8 even if it has a U.S. TIN. The IRS's requester instructions for Form W-9 say payments to foreign persons may be subject to separate withholding rules and that a review of Pub. 515 is essential for the details; keep a foreign payee not payable until a tax professional has confirmed what applies. Worker classification, and which payments are reportable and so need a W-9, belong to the related questions on contractor records and on tracking 1099-reportable vendors.

What does a W-9 establish, and what happens if you pay without a valid one?

Treasury's regulation 26 CFR 31.3406(h)-3 makes Form W-9 the form on which a U.S. payee certifies, under penalties of perjury, that its taxpayer identification number (TIN) is correct, that it is not subject to withholding due to notified payee underreporting, that it is an exempt recipient, or that it is awaiting a TIN.

The same regulation says a payor is not liable for the backup withholding tax if its failure to withhold is due to reasonable reliance on a Form W-9. Reliance fails if the form lacks the payee's name and TIN (or a statement that a TIN is awaited), is not signed and dated by the payee, has had its penalties-of-perjury wording deleted, or falls within the regulation's two cases on notified payee underreporting. So ask for a signed, dated form even where Form W-9 does not require the payee to sign.

Collect it before the first payment. The IRS's Instructions for the Requester of Form W-9 say a payor of certain reportable payments is subject to backup withholding if the payee fails to furnish a TIN, the IRS says the TIN is incorrect, there has been notified payee underreporting of interest or dividends, or the payee fails to certify that it is not subject to backup withholding. The payor must then deduct, withhold and deposit with the IRS a percentage of reportable payments to that payee, at the rate those instructions state, until the cause is remedied. Their temporary exemption for a payee awaiting a TIN covers only interest, dividends and certain payments on readily tradable instruments; any other reportable payment, such as nonemployee compensation, is subject to backup withholding immediately. A payor that does not collect backup withholding as required may become liable for any uncollected amount.

What must a certificate of insurance show, and who should be named on it?

IRMI's glossary defines a certificate of insurance as a document providing evidence that certain general types of coverage and limits have been purchased. Progressive's guide adds that it is not the policy itself and shows the insured, coverage types and any additional insureds, policy numbers, start and expiration dates, limits and the certificate holder. Check each certificate against your contract with the payee:

• Named insured. The insured is the payee named in your signed contract, the legal entity doing the work.
• Coverage. Every type and limit the contract requires appears.
• Dates. Coverage is in force on the day work starts; enter the expiration date in the currency check so a renewed certificate is requested before it.
• Your position. Where the contract makes you an additional insured, you hold the endorsement, not just a certificate naming you as holder.

Progressive's guide says the certificate holder does not have any rights to make claims under the policy, while an additional insured has been added to the policy and is covered for certain liabilities under it, by an endorsement stating the coverage type and limits it is entitled to.

The same guide tells policyholders to update certificates when they change the policy and at renewal, so read currency from the expiration dates and ask for a new certificate before each renewal. A certificate cannot show a change or cancellation made after it was issued. Ask the payee for a current certificate and for the carrier and agency that write the policy, and confirm with them at contact details you find yourself; they may not disclose everything. Where a regulator's license record shows insurance, as that of California's Contractors State License Board (CSLB) does, check it too. Confirm before on-site work starts and at each currency check for payees whose contract requires the coverage.

What changes when the work is on your premises or a customer's site?

Make insurance and license evidence a condition of letting the work start. Who must be named depends on your contracts: IRMI's glossary says a named insured may provide additional insured status to comply with a contractual agreement requiring it to do so, with project owners and customers among its examples, so your contract with a customer may require your subcontractors to name the customer too. CSLB's page on finding a licensed contractor says a California contractor with employees is required to carry workers' compensation insurance, and contractors in certain listed classifications must carry it, or have a valid certification of self-insurance on file with CSLB, whether or not they have employees. The same page tells hirers to ask for the contractor's insurance carrier and agency to verify that the contractor has insurance.

How do you find which license or registration the work requires?

For each payee whose work may be licensed, find the licensing authority for that work in the state and in the city or county where it is done, read that authority's statement of who must be licensed, look the payee up on its lookup, and record the license number, classification, status and expiration date.

CSLB's "What Kind of Contractor Do You Need?" page says that in California anyone who contracts to perform work on a project that requires a building permit, or uses employee labor, or contracts for work valued at or above the amount it states, counting labor and materials together, must hold a current, valid CSLB license. It adds that CSLB licenses by classification, from general contractors to trades such as electricians and plumbers, so check that the classification covers the work. New York City's Department of Consumer and Worker Protection says a person or business must have a Home Improvement Contractor license to do home improvement work on residential land or buildings in the city, a description it calls only a general explanation of who must have the license, and gives the license a fixed license period and expiration date.

Why are bank details a controlled document?

The FBI's Internet Crime Complaint Center advises using secondary channels or two-factor authentication to verify requests for changes in account information. A second channel works only if whoever sent the details cannot control it, so before the first payment to any payee, and before paying to any changed details, confirm the details with the payee by one of these routes:

• A phone number you held before the details arrived, such as one in your own record of an earlier confirmation
• A number on the payee's website, opened at a web address you had on record before the details arrived
• The payee in person, or a number the payee gave you in person

A number, link or address that arrived with the details, or in any message about them, cannot confirm them; until a change is confirmed by one of these routes, pay only to the details already confirmed. A new payee you cannot confirm this way is not paid.

Where staffing allows, someone other than the person who entered the details makes the confirmation, and details an outside bookkeeper enters are confirmed by you or your staff; in a one-person business the owner does both, so the confirmation is a separate step, made and recorded before release. Record the date, route, number or address used, and who confirmed. Handling a change request is covered in the related question on a vendor's new bank account.

What goes in the payee file, and who can open it?

Keep one file per payee under the payee's ID in your books, so its status shows on the payee record. It holds these items:

• The W-9, or Form W-8 or Form 8233 for a foreign payee
• The contract or terms
• Certificates of insurance and endorsements, current and superseded
• License records, with each dated lookup result
• Remittance details and each confirmation record
• The currency log of each check's date and result, and every re-request, escalation and override

The IRS's General Instructions for Certain Information Returns say you must keep identifying information obtained on a Form W-9 confidential and may use it only to comply with the tax laws. Keep the W-9 in a restricted part of the file opened only by whoever handles tax reporting; those who release payments see the payee's payable status, not the W-9. Let as few people as possible open the file, and fewer still change payee records, none of whom approve payments or overrides. In software, give each person their own login with a second sign-in factor, and at each currency check have someone who cannot edit payee records review their change history, including every change to payable since the last check, against the confirmation records and the filed documents; where nobody else exists, the owner reviews it against the bank statements.

What makes each document go stale?

Define currency per document class, not by one review date:

Form W-9 tells payees they must furnish a new form if the name or TIN changes for the account, and that a payee that claimed to be exempt must give updated information if it is no longer exempt and expects future reportable payments; for example, Form W-9 says a C corporation that elects to be an S corporation may need to. An IRS notice that a TIN is wrong is handled in the related question on name and TIN mismatches.

A document can also be within its dates and describe a different party. When a payee merges, is acquired, changes its name or changes entity form, such as a sole proprietor incorporating, re-collect the W-9, certificate, license and contract in the name of the entity now doing the work, and onboard a changed legal entity as a new payee. Detect these events by comparing the name and TIN on each invoice and request with the file, and by asking at each renewal whether the payee's name, form or ownership has changed.

How do you catch lapses across every payee before they happen?

Run one currency check over the whole payee base on a fixed schedule. Each run lists every document that has expired or will expire within a look-ahead window at least as long as the time the payee needs to get a renewal issued, plus the time your re-requests take, plus the interval between runs. It also lists every payee with an open change trigger, re-checks licenses on the regulator's lookup and required coverage with insurers, and sets any payee whose file is not current to not payable.

The file surface for one invented payee shows collection and currency together:

Harbor Electric LLC · Currency check last run: the 1st of this month · Payable: no, on hold

How should re-requests and escalation work?

Give the loop one named owner, usually whoever runs payables, plus a backup. Each item follows the same steps:

1. When a document enters the look-ahead window, ask the payee in writing for it, saying what it must show and by when.
2. Halfway between that request and expiry, send a second request and phone your usual contact.
3. If it is still missing, escalate to the person in your business who owns the relationship, who contacts the payee's management and decides whether new work may be assigned.
4. At expiry, set the payee to not payable, so the hold applies.

Log every step in the currency log.

How do you stop a payment to a payee whose file is not current?

COSO describes control activities as preventive or detective. A lapse report nobody must read before paying only detects, so put the hold before release, on every payment to every payee. Where your payables software supports a vendor hold, set it from the currency status. Where the payment process cannot see the file, the person releasing each run compares every payee on it with the current payable list and pulls any payee not marked payable. A payee is set to payable only by someone who does not prepare or release payments, after checking the filed documents; in a one-person business the owner records that change as a separate step.

When a payment is due and the file is not current, one of three paths applies:

COSO lists authorizations and approvals among control activities, so name in advance who may approve overrides. An override never waives backup withholding where it applies and never releases money to remittance details not confirmed by one of the routes above. Where segregation of duties is not practical, COSO says management selects and develops alternative control activities: in a one-person business, the owner records each override when made and personally reviews the bank and card statements for payments to any payee marked not payable. An owner with a bookkeeper keeps their own access to those statements and does the same review.

In what order should a new payee be onboarded?

Take these steps before the first payment:

1. Decide the document set from the table above, settling worker classification first if it is in question.
2. Request every document with your contract or order, stating that nothing is paid until the file is complete.
3. Check each document on arrival: the W-9 signed, dated and complete; the certificate and endorsement against the contract and with the insurer or agent; the license on the regulator's lookup. A W-9 showing the TIN as awaited does not make the payee payable in full: its reportable payments take the third path in the table above until the TIN is furnished.
4. Confirm the remittance details by one of the routes above.
5. File everything under the payee's ID, enter expiration dates in the currency check, and only then have the payee set to payable.

While documents are outstanding you may negotiate, sign the contract, place orders and enter bills; payment waits, and on-site work waits for the insurance and license evidence. Collecting after payments start gives away your leverage, and a paid payee who has moved on may never send a W-9.

What about payees you already pay?

Look up licenses first, since that needs nothing from payees. Then request documents in batches, highest exposure first, under one written override approved like any other, and hold any payee that misses its response date or fails its license lookup. That override never covers a payee that receives reportable payments and has not furnished its TIN: its payments take the third path in the table above at once. Reportable payments already made to such a payee without backup withholding may have left you liable for the uncollected amount, as the IRS's requester instructions state; ask a tax professional how to address that.

How long do you keep the file, and how do you dispose of it?

Treasury's regulation 26 CFR 31.3406(h)-3 requires a payor that receives a Form W-9 related to backup withholding to keep it for 3 years from the date the account is opened, a clock that starts with the relationship, not its end. The IRS's General Instructions for Certain Information Returns say generally to keep copies of information returns you filed, or the ability to reconstruct the data, for at least 3 years from their due date, and for 4 years if backup withholding was imposed. The W-9 is where that data comes from, so keep it until both periods have passed for the last return that relied on it, using the 4-year period where backup withholding was imposed.

The IRS page "How long should I keep records?" says not to discard records no longer needed for tax purposes until you check whether you must keep them longer for other purposes, such as for your insurance company or creditors. Ask your insurer, and your attorney if you have one, how long after the work ends a claim arising from it could be made, and keep certificates, endorsements, license records and contracts at least that long. Set their periods by the contract's terms and your insurer's requirements, in the written records retention policy the FTC advises where you keep information for business reasons or to comply with the law. The FTC also advises shredding, burning or pulverizing paper records before discarding them, and erasing old computers and storage devices with wipe utility programs. Apply the policy once every period has run after the relationship ends, and log what was destroyed and when.