Landing a large customer feels like the hard part is over. You have survived the pitch, the pilot, the security questionnaire and the procurement call. Then someone from vendor onboarding sends a list of documents, and the deal quietly stalls for six weeks while you try to produce them. Nobody warned you about this stage because nobody talks about it. It is not sales, it is not legal, and it does not appear in any fundraising advice. It is the moment a company you have never met decides whether your business is real.
Startups lose deals here more often than they admit, and rarely for the reason they assume. The product was fine. The problem was that a compliance team asked a routine question and the answer took a month to assemble.
Why Big Companies Investigate Small Ones
It helps to understand that none of this is personal, and it is not skepticism about your business specifically. Large organizations must know who they are paying. Anti-money laundering rules, sanctions screening obligations, and internal audit requirements all converge on the same demand: Before money moves, the counterparty must be identified and documented.
The person asking is usually not empowered to make exceptions. They have a checklist, an auditor who will review their work, and no incentive whatsoever to approve a vendor whose paperwork is incomplete. Founders often try to solve this with charm or by escalating to an internal champion. It rarely works, because the constraint is procedural rather than social.
There is also a scale mismatch nobody acknowledges. The enterprise has a department for this. You have a founder doing it between customer calls, which is why the same request that takes them ten minutes to send can take you three weeks to satisfy.
What They Actually Ask For
The specific list varies by industry and country, but the pattern is consistent. Expect some combination of proof that the company legally exists, evidence of who owns it, confirmation of who is authorized to sign contracts on its behalf, tax registration details, bank account verification in the company name, and increasingly insurance certificates.
Two of these catch founders out repeatedly. The first is ownership. If your cap table runs through a holding company, or an early investor holds shares through a vehicle, expect questions about beneficial ownership that you may not be able to answer quickly. The second is signing authority, because the person negotiating the deal is frequently not the person the register lists as authorized to bind the company, and that mismatch stops contracts cold.
The requests are also time-sensitive in a way founders do not anticipate. Many compliance teams will not accept documentation older than three or six months, so the certificate you obtained for a bank account last year is often useless.
The Problem Is Format, Not Information
Here is the part that surprises people most. Almost everything being requested is already public. Company registers in most developed countries publish the legal name, registration number, address, directors, and often the accounts. The information is not hidden. The compliance team doesn’t need the information. It is the information in a form they can file, in a language their auditor reads, certified in a way their internal rules recognize. A link to a public register, however authoritative, is not something they can attach to a case file. Depending on where the customer sits, that can mean an official extract from the register, a sworn translation, notarisation, and a certificate under the Hague Convention confirming the document is valid for use abroad.
This is why founders describe the process as absurd, and in a narrow sense they are right. But the requirement exists because no institution can audit another country’s systems directly, and the delay is real regardless of whether the rule is sensible. Firms that handle certified company documentation for cross-border use routinely observe that the work is rarely about obtaining any single document. It is knowing which combination the destination requires and running the steps in parallel rather than discovering them one at a time.
What to Do Before You Need It
The founders who move through vendor onboarding quickly are not better connected. They prepared, usually because a previous deal taught them to.
Ask early. As soon as a large deal looks likely, ask your contact what their vendor onboarding process requires and request the list in writing. This single question buys you weeks, and it signals competence rather than inexperience.
Keep a current pack. Maintain a folder with your registration certificate, ownership structure, board and signing authority, tax registrations and insurance certificates, and refresh anything with an expiry date every few months.
Know your own structure. If you cannot explain your ownership chain in two sentences, a compliance officer will not be able to either, and you will spend a fortnight producing what should have been immediate.
Fix the signing authority problem in advance. Confirm that whoever will sign is properly authorized in the register, or that a documented delegation exists.
The Wider Point for Founders
Startups are trained to think risk lives in the market: will anyone want this, can we build it, can we afford to. Administrative risk gets no attention at all, and among the operational lessons experienced founders share, it is one of the most consistently underrated, because it does not feel like risk. It feels like paperwork.
But a deal that dies in vendor onboarding is just as dead as one lost to a competitor, and it is considerably more annoying, because you had already won. The good news is that this is the cheapest problem on your list to solve. It costs an afternoon of preparation and one well-timed question. Very little else in company building offers that ratio.
