A supplier verification process is a fixed sequence of checks a buyer runs before money moves: confirm the legal entity, confirm what the supplier actually is, confirm there is a real export record, match the bank beneficiary to the contracting party, inspect the goods, then re-check the supplier on a schedule. Six stages, in that order, because each is cheap enough to end a deal before the next one costs you anything. Most procurement teams already run three or four informally. Writing them down is what makes the outcome repeatable across categories, countries and whoever owns the sourcing.
The short version
- Run the stages in cost order: free registry checks first, inspection fees last.
- One legal name has to match on the quote, the licence, the bank details and the shipping documents.
- Validate certificates by number in an accredited registry. A PDF proves nothing.
- Trade activity is the hardest stage to fake: export record, distinct buyers, destination markets, last shipment date.
- Risk-tier the depth, then re-verify on a cadence. A bank-detail change is a trigger, not an admin update.
What is the supplier verification process?
It is the repeatable set of checks that confirms a supplier is real, active and correctly identified before a buyer commits money. Six stages: identity, capability, trade activity, payment, sample and inspection, then monitoring. Each produces evidence a buyer can file, not an impression.
- Identity: legal entity, registration number, registered address.
- Capability: factory or trader, capacity, certificates validated at source.
- Trade activity: export record, buyer count, markets, recency.
- Payment: beneficiary name match, terms set by exposure.
- Sample and inspection: golden sample, then pre-shipment inspection.
- Monitoring: scheduled re-verification and change triggers.
Stage 1 and 2: identity, then capability
Identity is the cheapest stage and the most skipped, because a scan of something official-looking already arrived. Work from the number, not the scan. In China the business licence carries an 18-character unified social credit code; run it through the National Enterprise Credit Information Publicity System (gsxt.gov.cn) and you get the registered name, status, legal representative and registered capital, all of which must match the licence exactly. The code set excludes easily confused letters, so an I or an O in one means a bad transcription or a bad document. In India, exporters hold a 10-digit Importer-Exporter Code, and the DGFT portal's View Any IEC lookup returns firm name, address, issue date, active status and any Denied Entity List flag.
Capability answers a different question: factory, or trading company reselling a factory you have never been introduced to? Neither is disqualifying. Being lied to about which one it is, is. Registered business scope, plant address against registered address, and the HS codes they actually export under all point the same way when the story is true. Certificates get the same treatment as licences. ISO 9001, 14001 and 45001 can be checked by certificate number in IAF CertSearch, which returns status, scope, certified sites, the certification body and the accreditation body behind it. Scope matters as much as validity: a certificate covering a trading office is not one covering a production line.
A certificate PDF proves someone owns a PDF. A certificate number that resolves in an accredited registry proves an audit happened.
Marketplace badges belong here. Alibaba's Verified Supplier status rests on a third-party on-site assessment by firms such as SGS or TÜV Rheinland, so it is real evidence about the premises but no guarantee of your order's quality. Gold Supplier is a paid membership tier, not an audit result.
Stage 3 and 4: trade activity, then payment
Stage three is where the vendor verification process stops relying on what the supplier hands over. Shipment records are produced by carriers and customs systems as a by-product of exporting, so they are awkward to manufacture. Four readings do most of the work: whether an export record exists at all, how many distinct buyers appear, which destination markets they ship to, and when the last shipment moved. A supplier with one buyer and nothing recorded in fourteen months is a different proposition from one shipping to nine buyers across four markets this quarter. For US-bound trade, import manifest and bill-of-lading data is legally public; for India, buyers work from mirrored licensed trade data.
Ask in parallel for a redacted document set from a comparable past shipment: commercial invoice, packing list, bill of lading, certificate of origin. The test is whether four documents from one shipment agree with each other, and with the entity you have been emailing.
Payment is stage four for a reason. By now you know the legal name, so the only acceptable beneficiary on the wire is that name. A third-party account, an offshore entity introduced late, or new bank details arriving by email mid-order are the standard shapes of business email compromise. The FBI's Internet Crime Complaint Center recorded $3.04 billion in reported BEC losses in 2025, up from $2.77 billion the year before, with 86% moved by wire or ACH. Confirm bank-detail changes by voice on a number you already held, and treat a mid-order change as a stop event.
Set terms by exposure, not by rapport. A full advance telegraphic transfer is the buyer carrying all the risk. A documentary letter of credit costs more and moves slower, but pays against documents you specified. Incoterms 2020 decides where cost and risk transfer, not whether the seller is honest, and is routinely read as if it did both.
Stage 5 and 6: sample, inspection, then monitoring
Approve a golden sample against a written specification with tolerances, and keep a sealed counter-sample on both sides. Without that reference, a quality dispute becomes an argument about memory. Then book pre-shipment inspection before the balance payment, not after. Third-party inspectors sample statistically under ISO 2859-1 and ANSI/ASQ Z1.4: lot size and inspection level set the sample size, General Inspection Level II is the usual default, AQL 2.5 is common for general consumer goods, and critical defects are normally set at zero. Inspection is charged per man-day, the one fee here that scales with how deep you go.
Stage six is what quietly fails inside otherwise disciplined supplier onboarding due diligence. Verification decays. Ownership changes, an export licence lapses, the plant moves, shipments stop. Set a re-verification cadence by tier, and add triggers that force an off-cycle check: changed bank details, changed registered address, a new contact claiming authority, a long gap in shipment activity, or a quote well below where the market sits.
A supplier verified 18 months ago is not a verified supplier. They are a supplier who passed a check 18 months ago.
What each stage of the supplier verification process proves, and what it costs
| Stage | What it proves | What it does not prove | Typical cost |
|---|---|---|---|
| 1. Identity | Entity is registered and named as claimed | That it trades, or can make your product | Free (public registries) |
| 2. Capability | Factory or trader, registered scope, certificate status | Quality on your order | Free to low |
| 3. Trade activity | Export history, buyer diversity, markets, recency | Solvency, or how they treat small buyers | Free; low for a deeper report |
| 4. Payment | Beneficiary matches the counterparty; terms fit exposure | That the goods will conform | Free, plus bank charges on an LC |
| 5. Sample and inspection | Conformance to spec before the balance is paid | Consistency on later runs | Inspection fee, per man-day |
| 6. Monitoring | Still the entity you verified, still active | That nothing changes between checks | Low, recurring |
Risk-tier it: a $2,000 first order is not a $200,000 one
Running every stage of the supplier verification process on every enquiry is how a supplier verification checklist gets abandoned in month two. Tier by exposure, and write the thresholds down so nobody negotiates them per deal. A small trial order justifies identity, trade activity and a sample, with risk capped by keeping the order small. A mid-size order adds capability checks, certificate validation at source and a pre-shipment inspection. A large order, custom tooling, a sole-source part or regulated goods earns all six stages, a third-party audit, documentary payment terms and re-verification on a fixed cycle.
Three details turn the document into a process: a named owner per stage, one piece of filed evidence per stage, and an explicit pass, fail or escalate. If a stage cannot fail a supplier, it is not a check. It is paperwork.
How TradeVerify helps
TradeVerify covers stage three of the supplier verification process, and feeds stages one and six. It is one input in due diligence, not a verdict on a company.
- Check the name before the call. Run a free check on the exporter to see whether a shipment record exists at all. When a supplier presents itself as an established exporter and nothing appears, that gap is the finding.
- Read the record, not just the score. A TradeScore report sets out export history, distinct buyer count, destination markets, activity recency and shipment trend, plus red-flag screens. The sample verification report shows the fields before you commit.
- Re-run it at your monitoring cadence. Recency and trend go stale fastest, and are the cheapest readings to refresh at renewal or on a trigger.
- Let suppliers bring their own record. A supplier can claim a verified supplier profile and show its trade record to buyers directly, which shortens the evidence loop both ways.
What the trade record cannot tell you: whether a factory treats workers well, whether it is solvent, whether quality holds on the third run, or whether the person emailing you is authorised to change bank details. Those need audits, financial checks, inspection and a phone call. Coverage is uneven by market too, so a thin record in a lightly reported jurisdiction is a prompt to look harder, not proof of anything. How we score, and who we are sits on its own page: a verification service that will not explain its basis is asking for the trust it tells you not to extend.