Accounting
ERP
Financial Management
Vendor Master Data Management: Keeping Supplier Records Clean in Your ERP
Last updated: October 7, 2026 · Independent guide · We do not sell rankings or coverage.
Vendor master data management is the set of controls that decides who can create a supplier record in your ERP, what evidence that record needs, how changes are approved, and how often the file is reviewed and cleaned. For an AP team, the goal is one active record per legal supplier, with a verified tax ID and a bank account confirmed through a channel the requester did not supply. Those three controls address the common causes of duplicate payments and payment-redirection fraud.
In the 2025 AFP Payments Fraud and Control Survey, 79% of organizations reported attempted or actual payments fraud in 2024, and vendor impersonation was reported by 45% of respondents, up 11 percentage points from the prior survey (AFP, April 15, 2025). The FBI’s Internet Crime Complaint Center recorded 21,442 business email compromise complaints in 2024 with reported losses of $2,770,151,146 (FBI IC3 2024 Internet Crime Report, no date shown).
The vendor master process at a glance
- Request and intake. A business user requests a supplier, and the supplier submits legal, tax and payment details.
- Verification. AP validates the legal name, tax ID and bank account against independent sources.
- Duplicate check. AP searches the existing file before anything is created.
- Approval and activation. A second person approves the record, and only then can purchase orders and payments use it.
- Change control. Changes to sensitive fields, above all bank details, go through verification and a second approval.
- Periodic review and cleanup. Dormant records are blocked, duplicates retired, and tax and bank data re-checked.
Who owns each stage
The table below is a common split for a mid-sized US company with a central AP function. Adjust it to your structure, but keep one rule: the person who requests or edits a record never approves it.
| Stage | Responsible | Accountable | Consulted / informed |
|---|---|---|---|
| Request and intake | Requesting department or procurement | Procurement manager | AP (informed) |
| Verification | Vendor master specialist in AP | AP manager | Tax team (consulted on W-9 and W-8 issues) |
| Duplicate check | Vendor master specialist | AP manager | Requester (consulted if a match is found) |
| Approval and activation | Second approver in AP or finance | Controller | Treasury (informed of new payees) |
| Change control | Vendor master specialist | AP manager | Treasury and internal audit (informed) |
| Review and cleanup | AP with ERP administrator | Controller | Procurement and internal audit (consulted) |
The ERP administrator owns the configuration: who holds create and edit permissions, which fields are sensitive, and how data imports behave. Changes to that configuration need their own ticket and approval.
Stage 1: Request and intake
The input is a request from a buyer or budget holder, plus the supplier’s own submission: legal name, doing-business-as name, remit-to address, Form W-9 (or a W-8 form for foreign payees), bank details on the supplier’s letterhead or through a supplier portal, and a named contact. The output is a complete request package, not a vendor record.
The main control is a single intake channel. A form in your ERP, procurement suite or ticketing system gives you a timestamp, a requester and an attachment trail, which email and chat requests do not. Make the business justification a required field.
What goes wrong: requesters forward bank details they received by email. Treat those details as unverified until Stage 2 confirms them.
Stage 2: Verification of identity, tax ID and bank account
The vendor master specialist checks that the legal name matches public records such as the state business registry, that the name and TIN on the W-9 match IRS records, and that the bank account exists and belongs to that supplier.
For the tax ID, the IRS On-Line TIN Matching Program is open to payers of reportable payments subject to backup withholding under Internal Revenue Code section 3406. Interactive matching checks up to 25 name and TIN combinations at a time with immediate results, and bulk matching accepts up to 100,000 combinations with results within 24 hours. You must register for IRS e-Services before applying (IRS, June 18, 2026). A mismatch matters because backup withholding applies at 24% when a payee does not provide a correct TIN (IRS, June 28, 2026).
For the bank account, the strongest manual control is a callback to a phone number you already hold or have found independently, never the number in the request or the email signature. Record who called, the number used, the date and the name of the person who confirmed the account. Automated account validation services can confirm that an account is open and that the owner name matches.
What goes wrong: teams verify the TIN once at onboarding and never again, and they accept a voided check or bank letter as proof without confirming it with the supplier.
Stage 3: Duplicate check
Before creating anything, search the existing file. Match on more than the name. Search by TIN, bank account number, remit-to address, phone and email domain, because the same supplier often appears as “ABC Supply Inc.”, “ABC Supply Co” and “A.B.C. Supply”. A match on TIN or bank account across two differently named vendors is also a fraud signal, since two unrelated suppliers should not share a bank account.
The output is a documented decision: no match, so create; match found, so extend the existing record (for example, add a new company code or subsidiary); or partial match, so escalate. Keep naming standards written down. For example: legal name as it appears on the W-9, no punctuation, standard abbreviations.
What goes wrong: a search returns no exact match, or one business unit cannot see another’s records. Duplicates split spend reporting and 1099 totals, and they defeat duplicate invoice checks that compare invoices within a single vendor.
Stage 4: Approval and activation
A second person reviews the package and the verification evidence and approves the record. Until approval, the record should exist only as a proposal or in a blocked status that cannot receive purchase orders or payments.
Segregation of duties is the core control here. The person who can create or edit vendors should not be able to approve them, enter invoices for them or release payments. If your team is too small to split those duties, compensate with a review of a vendor change report by someone outside AP, such as the controller. Our guide to internal controls in accounting software covers role design in more detail.
What goes wrong: emergency vendors created outside the workflow and never verified. Define an emergency path in advance with a lower payment limit and a mandatory review within a fixed number of days.
Stage 5: Change control, especially bank details
Changes to the remit-to address, bank account, payment method, tax ID and legal name are the highest-risk edits in the vendor file. Each needs the same verification as a new vendor, a second approval, and ideally a payment hold until confirmed.
Use this sequence for any bank detail change request:
- Log the request with how it arrived and who sent it.
- Call the supplier using contact details already on file from before the request, not details in the request.
- Confirm the new account through a validation service where you have one.
- Have a second person approve the change in the system.
- Notify the supplier at its previously known contact that the change was made.
- Review the first payment to the new account before release.
This also supports ACH compliance. Nacha’s fraud monitoring amendments require non-consumer originators to implement risk-based processes to identify ACH entries initiated under false pretenses and to review them annually. Phase one took effect on March 20, 2026 for originators with more than 6 million ACH originations in 2023, and phase two applies to everyone else. Nacha set the phase two date as June 19, 2026, a federal holiday, so it took effect in practice on the next banking day, June 22, 2026 (Nacha, no date shown; U.S. Bank, May 23, 2025; U.S. Bank sells treasury and ACH services).
What goes wrong: data imports. An approval workflow in the user interface does not always cover spreadsheet uploads or integrations. Dynamics 365 Finance, for example, offers an import setting that allows changes without approval. Check how your system treats bulk updates before you rely on the workflow.
Stage 6: Periodic review and cleanup
Routine maintenance means blocking vendors with no activity for a set period (for example, 12 or 18 months), running a duplicate report, and reviewing a log of every sensitive field change since the last review. A deeper review, often annual or before year-end 1099 filing, re-runs TIN matching across active vendors and confirms bank details for high-value suppliers.
Block rather than delete, because deleting a vendor with history breaks the audit trail. When merging duplicates, pick a surviving record, move open items and purchase orders to it, and block the other. For a wider view of how master data governance applies across customers, items and the chart of accounts, see our ERP master data governance playbook.
What goes wrong: one-off cleanups after an audit finding. Put the review on the close calendar with a named owner.
Metrics to track
- Duplicate rate: suspected duplicate pairs as a share of active vendors.
- Active vendor count and dormant share: vendors with no payment in 12 months as a share of active records.
- TIN match rate: share of active US vendors with a confirmed IRS name and TIN match.
- Bank changes verified: share of bank detail changes with documented callback or validation evidence. The target is 100%.
- Onboarding cycle time: days from complete request to active record.
- Exceptions: emergency vendors created, approvals overridden and sensitive fields changed through imports.
As an illustration, a company with 4,000 active vendors that finds 160 suspected duplicate pairs has a 4% duplicate rate. Track the trend each quarter.
How software supports each stage
SAP S/4HANA manages suppliers as business partners, one partner with several roles. It can warn users about likely duplicates using address data matching, and its four-eyes principle lets you configure sensitive fields so that a change blocks the supplier for payment until a different authorized user confirms it. A user can never confirm their own change (SAP Learning, no date shown).
Microsoft Dynamics 365 Finance offers a proposed vendor changes workflow. You flag the fields that need approval under Accounts payable > Setup > Accounts payable parameters, and edits to those fields are held as proposals until approved (Microsoft Learn, June 11, 2026). A separate vendor bank account workflow, available from version 10.0.32, keeps new bank accounts unavailable until approved and lets you choose whether data entity imports are allowed, rejected or converted into change proposals (Microsoft Learn, April 23, 2024).
Oracle NetSuite includes duplicate detection for vendor, customer, contact and partner records, set up at Setup > Company > Duplicate Detection. It matches on email by default with configurable criteria, and records can be merged only if they share a tax registration number or neither has one. In OneWorld, records in different subsidiaries cannot be merged (Oracle NetSuite Help, no date shown).
Oracle Fusion Cloud Procurement can validate supplier bank accounts during registration and, from release 25D, in supplier profile change requests, using JPMorgan’s account validation service for US accounts only. The result is shown to approvers but is informational and does not block payments (Oracle Cloud Readiness 25D, no date shown).
Add-on tools fill gaps. Trustpair validates vendor bank accounts in 190 countries, monitors vendor files and verifies payment files, with connectors for SAP S/4HANA, Oracle ERP Cloud and Coupa. It does not publish pricing (Trustpair, no date shown). Tipalti, an AP automation vendor, collects W-9 and W-8 forms during supplier self-registration and integrates with the IRS TIN matching service; that page shows no prices (Tipalti, no date shown). Early-payment programs rely on the same clean bank data, as our guide to dynamic discounting in AP software explains.
How we researched this
We read the top-ranking pages for “vendor master data management” in October 2026 (mostly vendor blogs) and found that few explain bank detail change procedures, IRS TIN matching limits or named ERP features. We then checked vendor documentation from SAP, Microsoft, Oracle NetSuite and Oracle Fusion, IRS and Nacha-related guidance, and fraud data from AFP and the FBI. Product capabilities come from each vendor’s own documentation. No vendor paid for inclusion.
Related guides
- Duplicate Payment Detection in AP: Causes and Fixes
- Positive Pay: How It Stops Check Fraud (2026)
- Procure-to-Pay Process: Steps, Controls and Software
Frequently asked questions
What is vendor master data?
Vendor master data is the set of records in your ERP that describes each supplier you buy from and pay. It typically includes legal name, tax ID, addresses, payment terms, payment method and bank details. An error in one record repeats in every purchase order, invoice and payment that uses it.
How do I find duplicate vendors in my ERP?
Run a report that groups active vendors by TIN, bank account number, remit-to address and phone, then review any group with more than one record. Many ERPs also flag likely duplicates. SAP S/4HANA warns at the point of entry, and NetSuite flags possible duplicate records with a notice after its duplicate search runs.
How should we verify a vendor’s bank account change request?
Call the supplier on a phone number you held before the request arrived, confirm the change with a known contact, and record the call. Have a second person approve the change in the system and review the first payment to the new account.
How often should the vendor master file be cleaned up?
Run a duplicate report and a review of sensitive field changes at least quarterly, and block vendors with no activity for 12 to 18 months. Do a fuller review once a year, ideally before 1099 season, including TIN re-matching for active US vendors.
Do we need separate software for vendor master data management?
Not always. ERPs such as SAP S/4HANA and Dynamics 365 Finance include approval workflows and sensitive-field controls, and NetSuite includes duplicate detection, if you configure them. Add-on tools are most useful for automated bank account validation, international suppliers and continuous monitoring of a large vendor file.
Sources
- Association for Financial Professionals, Survey: 79 percent of organizations were victims of attempted or actual payments fraud activity in 2024, April 15, 2025. financialprofessionals.org
- FBI Internet Crime Complaint Center, 2024 Internet Crime Report, no date shown (released April 23, 2025, according to Nacha). ic3.gov
- Nacha, FBI’s IC3 finds almost $8.5 billion lost to business email compromise in last three years, April 24, 2025. nacha.org
- IRS, Taxpayer identification number (TIN) matching tools, June 18, 2026. irs.gov
- IRS, Backup withholding, June 28, 2026. irs.gov
- Nacha, Risk management topics: Fraud monitoring phase 2, no date shown. nacha.org
- U.S. Bank, Nacha fraud monitoring rule changes, May 23, 2025 (U.S. Bank sells ACH and treasury services). usbank.com
- SAP Learning, Discovering supplier master data creation and maintenance methods, no date shown. learning.sap.com
- Microsoft Learn, Proposed vendor changes workflow, June 11, 2026. learn.microsoft.com
- Microsoft Learn, Vendor bank account workflow, April 23, 2024. learn.microsoft.com
- Oracle NetSuite Help, Setting up duplicate detection, no date shown. docs.oracle.com
- Oracle Cloud Readiness, Procurement 25D: Redwood: Validate supplier bank accounts, no date shown. docs.oracle.com
- Trustpair, product home page, no date shown (Trustpair sells vendor validation software). trustpair.com
- Tipalti, Automated tax compliance, no date shown (Tipalti sells AP automation software). tipalti.com
Sherman Hsieh
Independent analysis of enterprise software — ERP, CRM and more
