Business Partner Due Diligence: Vetting Customers, Suppliers, and Partners

Why should you vet business partners at all?

The order is the biggest of the year. The customer is new, friendly, and pushing for a quick start. You deliver, send the invoice, and wait. After eight weeks, instead of the money, a letter from the insolvency administrator arrives. Such cases are not rare, and they hit small businesses harder than large ones.

Germany's Federal Statistical Office (Destatis) counted a total of 24,064 corporate insolvency filings in Germany for 2025. That was 10.3 percent more than in the previous year. The local courts put creditors' claims at around 47.9 billion euros.

Behind each of these insolvencies are suppliers and service providers waiting for their money. And defaults travel onward. Berloco and colleagues (2021) analyzed the payment flows between more than 600,000 corporate clients of a major Italian bank from October 2016 to March 2018, on average around 23 million transactions a year. They describe how companies typically respond to late payments from their customers by paying late themselves. The task was to predict which of a good 100,000 larger firms with revenue of 2.5 million euros or more would run into distress within three months. Even a model that knew only the network of business partners identified a large share of these cases. Two limitations belong in the picture: a poor internal bank rating also counted as a default, and the bank initially saw on average only 16 percent of a firm's revenue. Whoever delivers and waits for an invoice to be paid is extending credit. They should know to whom, and keep an eye on how their customer's customers are doing.

Payment default is only one risk. A supplier can fail, a sales partner can damage your name, a service provider can be careless with your customer data. Due diligence, literally the care that is due, means the checking you do before entering a commitment in order to make such surprises less likely. The guiding question of this guide is: how thoroughly should you vet a business partner without slowing your business down? To answer it, we first calculate what a bad debt costs, then introduce the three-tier check and the basic check using public sources, go through customers, suppliers, and sales partners, and finally clarify when you need to check again.

What does a bad debt really cost?

Many owners underestimate the damage because they equate the loss with the invoice amount. What matters is how much additional revenue you need to recover the loss. That depends on your margin.

Half an hour of checking before an order worth 10,000 euros is therefore set against weeks or months of additional work. Seen that way, checking is one of the best-paid activities in the business.

The three-tier check: how thoroughly do you need to vet?

Nobody can screen every business partner in depth. Nor is that necessary. The effort should match the stakes. I call the approach the three-tier check. You determine the stakes with three questions: How much money is at risk? How dependent are you making yourself? What happens to your reputation if it goes wrong?

The thresholds in the table are an example. Set your own and write them down. What matters is that the tier is fixed before the contract is signed and does not depend on how likeable the person across the table was.

That a simple, documented scheme can be enough is shown by a proposal from research on money laundering prevention. Luchkov and Velinova-Sokolova (2026) rate counterparties on three factors on a scale of one to five and multiply the values: how exposed you are to the partner, how heavily a transaction weighs, and how vulnerable your own controls are. They applied the model to 25 anonymized profiles and themselves stress that it claims no predictive accuracy. Its value lies in making every rating traceable.

Basic check in 20 minutes: which public sources help?

For the first tier you do not need a service provider. In Germany and the EU, much information about companies is public and free of charge. Go through it in this order.

1. Does the company exist, and who represents it?

   In the joint register portal of the German states at handelsregister.de (the commercial register) you will find legal form, registered office, management, and authority to represent. Retrieval has been free of charge since August 2022. Check that the person signing is actually allowed to.

2. What is its financial position?

   The Unternehmensregister (Germany's company register) makes the annual financial statements of companies subject to disclosure available. Look at equity, losses, and whether statements were filed on time.

3. Are insolvency proceedings under way?

   The German states' portal insolvenzbekanntmachungen.de shows current notices from the insolvency courts.

4. Is the VAT identification number valid?

   The EU Commission's VIES system or Germany's Federal Central Tax Office can be used to check whether a number is valid. For cross-border business this is standard procedure anyway.

5. Does the presence match the claim?

   Legal notice, address, phone number, age of the website, reviews, press coverage. A firm that wants to award orders worth millions and gives only a mobile number deserves a follow-up question.

6. Where there is a foreign connection: is the partner on a sanctions list?

   The EU publishes its sanctions in a searchable overview. Business with listed persons and firms is prohibited. If in doubt, seek specialist advice.

Financial service providers are a special case. Anyone who processes payments for you or holds money generally needs authorization from the supervisor. This also applies to providers dealing with crypto-assets, as the article on crypto as a means of payment in your business describes. Whether an authorization exists can be looked up in the financial supervisor's company database.

How do you vet customers without slowing down sales?

In sales, checking is often seen as distrust toward the customer and as a brake on closing. Both can be avoided if the check becomes a fixed step in the workflow and not an exception for suspicious cases. It sits best where a decision is made anyway about whether an inquiry deserves time. The guide on lead qualification describes that point.

For customers, what counts most is ability and willingness to pay. From the second tier upward, a report from a credit reference agency is worthwhile. Depending on provider and scope it costs a manageable amount and supplies the payment experience of other suppliers. From it you derive a credit limit: the amount up to which you allow open invoices with this customer.

For everything above that there are safeguards that are used surprisingly rarely in day-to-day business. Olkiewicz (2025) examined the five largest electricity sellers in Poland for the years 2018 to 2023. Receivables there rose steadily. Tangible collateral, personal guarantees, special forms of payment, and insurance were available but were hardly used because of the costs and formalities. These are large companies in a single industry. The pattern will probably still seem familiar to many small businesses.

• Deposit or progress invoices: They reduce the amount at risk and show early how a customer pays.
• Shorter payment terms for new customers: 14 days on the first order, longer terms after good experience.
• Retention of title: The goods remain your property until paid for. The clause belongs in the quote and the terms and conditions, and in the hands of a lawyer.
• Delivery stop when in arrears: A clear rule on how many days overdue stops further deliveries takes the individual decision away from sales.

Incoming payments also belong in your regular figures. How long customers take on average to pay is an early warning sign that fits into the overview from sales metrics for SMEs. How to run the handover from quote to order so that terms do not get lost is shown in the guide on optimizing order processing.

How do you vet suppliers and sales partners?

With suppliers you carry a different risk. In the worst case you receive nothing although you have paid or firmly planned on it. Alongside the financial position, the check therefore focuses on ability to deliver: capacity, dependence on their own upstream suppliers, quality, replacement in case of failure. For critical parts, the grid from the article on geopolitics as a business risk helps.

With service providers and sales partners, reputation comes on top. Anyone who acts in your name, approaches customers, or gains access to your data can cause damage that appears on no invoice. For agencies there are specific questions in the article on choosing an agency.

Do not rely on self-disclosure alone. Tropotel (2025) reviewed the literature on due diligence in supply chains. Self-assessment questionnaires and audits are widely used, the review finds, but repeatedly deliver only limited and often unreliable insight into partners' actual practices. The work refers to human rights and environmental risks in global supply chains. The underlying idea applies generally: an answer in a questionnaire is a claim, and claims are checked against evidence.

In business, trust is the result of a check and not a substitute for one.

When do you need to check again?

A check is a snapshot. A customer who was solid two years ago may be in difficulty today. So define triggers for a new check and a rhythm for the most important partners.

• Payment behavior changes: Invoices are paid later, partial payments pile up, direct debits bounce.
• The stakes rise: An order is much larger than before, or a partner moves into a higher tier.
• Your customer is waiting for money itself: If it loses an important buyer or reports late payers, the risk travels on to you.
• Owners or management change: New people mean new decisions.
• Public signals: Press reports, layoffs, site closures, new register entries.
• Once a year: All tier three partners and the ten largest open items.

Record the result in a few lines each time: date, tier, what was checked, result, decision. It takes two minutes and ensures that knowledge does not depend on one person.

How to get started

Start with what you already have. The biggest risks rarely lie with the partners you win tomorrow. They lie with those you have worked with for years without checking.

• List the ten largest open receivables and the five most important suppliers.
• Decide for each entry which of the three tiers applies.
• Carry out the basic check for the three partners with the highest stakes and file the result with a date.
• Write down your own thresholds for tiers two and three in euros and as a percentage of revenue.
• Set a credit limit for new customers and tell sales.
• Build the basic check into the workflow as a fixed step before the first quote or the first purchase order.
• Write the triggers for a new check on one page and enter an annual date in the calendar.

The question at the outset was how thoroughly you should vet a business partner without slowing your business down. The answer depends on the stakes: the more money, dependence, or reputation is at risk, the more thorough the tier. For many partners, a basic check of around 20 minutes is enough, built into the workflow as a fixed step and repeated when certain events occur. Whoever delivers on invoice is extending credit, so this care is not distrust but part of doing business.