Written and maintained by CASRAI Editorial Board
Last updated
A vendor application form is the intake form a buyer asks a new supplier to complete before the supplier is set up to be paid. It may be called a vendor registration form, a new vendor form, a new vendor setup form or a supplier registration form. This guide is for purchasing, accounts-payable and lab or clinic managers who need to build or review such a form, and it shows which field exists to collect which document and which official source backs it. It does not provide a downloadable form; it gives you the fields and the checks to build one that fits your own policy.
Ask CASRAI · free to try
Ask about this guide — your first 2 questions are free.
Suggested question: “What is the difference between a vendor registration form and a vendor application form?”
Short answer
A vendor application form collects the supplier’s legal name, tax identification number (TIN), signature, contacts, payment details and any regulatory status your policy needs, so that a supplier record is created once, from verified information. The IRS says Form W-9 is used to request the TIN of a U.S. person, and a valid form must carry the payee’s name and TIN, signed and dated under penalties of perjury. Payment-detail changes should be confirmed through a second channel, as the FBI advises.
What a vendor application form is, and what it is not
The names above describe the same buyer-side document: the supplier tells you who they are and how to pay them, and you decide whether to create a vendor record. Three look-alikes are different documents:
- Event or market vendor applications ask a seller to take a booth or a slot. They are not procurement forms.
- A seller’s customer credit application is the form a supplier asks you to complete to open a trade account. See net-30 payment terms and vendor account verification.
- A resale certificate is a tax document, not an intake form. See resale certificate vs seller’s permit.
If you are unsure whether the company you are onboarding makes, distributes or resells, the comparison of supplier vs distributor explains the difference before you decide which fields apply. The broader packet of documents a buyer collects is covered in vendor onboarding documentation; this page is about the form that collects it.
Field table: what to collect and why
Each row below links a form field to the reason it is asked and the source that supports that reason. A field with no supporting source here is left out; add your own fields (contacts, categories, insurance) according to your institution’s policy.
| Field or attachment | Why it is asked | Source it rests on |
|---|---|---|
| Legal name and TIN, with signature and date (Form W-9) | The requester needs the payee’s correct name and TIN. A valid form or substitute must contain the name and TIN and be signed and dated under penalties of perjury. | IRS, Instructions for the Requester of Form W-9 |
| Name and TIN matching the payment record | If backup withholding applies, the payor must deduct, withhold and deposit 24% of reportable payments to that payee, and a requester who fails to collect may become liable for any uncollected amount. | IRS, Instructions for the Requester of Form W-9 |
| Payment details and who may change them | Business email compromise works by compromising legitimate email accounts through social engineering. The FBI advises using secondary channels or two-factor authentication to verify requests for changes in account information. | FBI IC3, Public Service Announcement I-091019-PSA |
| FDA establishment registration status (if the supplier makes or distributes devices) | Owners or operators of establishments involved in the production and distribution of medical devices are required to register annually with the FDA. | FDA, Device Registration and Listing |
| Consent to exclusion-list screening (if your policy requires it) | The OIG maintains the List of Excluded Individuals/Entities (LEIE), and says anyone who hires an individual or entity on it may be subject to civil monetary penalties. | HHS-OIG, Exclusions |
Verifying banking changes
The riskiest field on the form is the one that can change later. The FBI describes business email compromise as a scam that targets businesses by compromising legitimate email accounts, and advises that requests to change account information be verified through a secondary channel or two-factor authentication. It also advises checking that the URL in an email belongs to the business it claims to be from, and not supplying login credentials or personal information in response to emails. Build the form so that the payment-detail section names who at the supplier is authorised to change it, and treat any later change as a new request that goes through the same check.
Where it matters for labs and clinics
- Tax: the W-9 row is the one with a stated financial consequence for the buyer: uncollected-amount liability and 24% backup withholding.
- Device suppliers: FDA registration is annual and applies to owners or operators of establishments involved in the production and distribution of medical devices. The wording and limits of registration are explained in FDA-registered establishment.
- Exclusion screening: the OIG page speaks of hires and employees, so whether your institution applies the LEIE to contracted suppliers is a matter for your own compliance policy. The working method is in OIG exclusion list check for medical supply vendors and debarment and exclusion screening.
Before the first payment: a short checklist
- The form came from a contact you already know at the supplier, not from an unsolicited email.
- The name and TIN on the W-9 match what will appear on invoices and payments, and the form is signed and dated.
- Payment details were confirmed through a second channel, not only the email that delivered them.
- FDA registration and exclusion checks were done where your policy requires them.
- Any later change to payment details restarts step 3.
Common misunderstandings
- “The same form works for every supplier.” Fields such as FDA registration only apply to device makers and distributors; a courier or a software vendor has no use for them.
- “A completed form is a vetted supplier.” The form collects statements and documents. It becomes a check only when the rows above are verified against their sources.
- “The OIG page says every supplier must be screened.” It refers to new hires and current employees; supplier screening is set by your own policy.
Frequently asked questions
What is the difference between a vendor registration form and a vendor application form?
This guide uses the two names for the same buyer-side intake form. Check the wording of your own institution’s form instead of relying on the name.
What tax form does a new U.S. vendor complete?
The IRS states that Form W-9 is used to request the TIN of a U.S. person. The requester instructions, last revised March 2024, say a valid form must contain the payee’s name and TIN and be signed and dated under penalties of perjury.
How should a request to change bank details be handled?
Verify it through a secondary channel or two-factor authentication, as the FBI advises, and do not act on the emailed request alone.
Does a supplier need to be FDA-registered?
The FDA requires owners or operators of establishments involved in the production and distribution of medical devices to register annually. Whether a particular supplier is in scope depends on what it does.
Sources
- IRS, Instructions for the Requester of Form W-9 (revised March 2024); checked 2026-11-03.
- HHS Office of Inspector General, Exclusions; checked 2026-11-03.
- FBI Internet Crime Complaint Center, Public Service Announcement I-091019-PSA, Business Email Compromise (10 September 2019); checked 2026-11-03.
- U.S. Food and Drug Administration, Device Registration and Listing; checked 2026-11-03.
This guide gives general procurement information, not legal or tax advice.
