Finance package

Vendor onboarding with KYC

Screen new vendors for sanctions, registry and adverse media, tier the risk, review and verify bank details, then create the vendor in the ERP.

Starts from a formIntermediate~20 min setupv1.0.0
Download .utpkg 17 KBHow to install

About this package

What it does

Vendor onboarding with KYC is a controlled path for adding a supplier. Procurement fills in the start form with the vendor's legal name, registration number, country, website, bank account, contact email, spend category and expected annual spend.

The workflow reads the country rating from the Country risk table and sends the company to your KYC screening service for sanctions, registry and adverse-media checks. The Vendor risk tier decision table turns the results and the expected spend into a tier (low, medium, high or blocked), the approvals needed and when to re-screen. Blocked vendors stop with an email to the requester. Medium and high risk vendors go to a compliance review, which can approve, approve with conditions or reject.

Every approved vendor then goes to finance to verify the bank account by calling a number from an independent source; the step repeats until the call-back is recorded. The vendor is created in the ERP with its tier and re-screen date, and the vendor contact gets a welcome email. Adapt the country ratings, the tier rules and the two API calls to your providers.

Starts from a form

Starts from a form: procurement fills in the vendor details (Run dialog in the app, or your supplier request page posting to the start API).

Someone fills in a form to start it: the workflow inputs are the start form (Run dialog in the app, or your own portal posting to the API), and people complete User Task forms along the way.

The flow

Step by step

  1. 1

    Vendor requested

    Procurement enters the legal name, registration number, country, website, bank account, contact, spend category and expected spend.

  2. 2

    Screen the company

    The country rating comes from the Country risk table; the KYC service checks sanctions, the registry and adverse media and returns a score.

  3. 3

    Set the risk tier

    The Vendor risk tier decision table returns low, medium, high or blocked, the approvals needed and the re-screen interval.

  4. 4

    Compliance review

    Medium and high risk vendors are reviewed: approve, approve with conditions or reject. Blocked vendors stop here.

  5. 5

    Verify the bank account

    Finance confirms the account by call-back on an independently sourced number; the step repeats until it is confirmed.

  6. 6

    Create the vendor

    The vendor is created in the ERP with its tier and re-screen date and the vendor contact gets a welcome email.

Vendor onboarding — Procurement submits a new vendor; the KYC service screens it, the risk tier rules decide the approvals, compliance reviews medium and high risk vendors, finance verifies the bank account by call-back, and the vendor is created in the ERP. The same canvas you get in the designer after installing.

Forms

The start form and the task forms

The workflow inputs are the start form: the Run dialog renders them, and your own portal can post the same fields. User Tasks show their fields and outcome buttons to the assignee.

Start form

Vendor onboarding

Filled in by whoever starts the process

Legal name * legal_name · textRegistered legal name of the company
Registration number * registration_number · textCompany registration number in its home registry
Country * country · select
NZAUGBUSDESG+6
Country of registration (ISO code)
Website website · urlhttps://…Company website
Bank account (IBAN) * iban · textBank account (IBAN or local account number) from the vendor's bank letter
Vendor contact email * contact_email · emailname@company.comAccounts contact at the vendor: receives the welcome email
Vendor phone (independent source) contact_phone · textPhone number from an independent source (not the bank letter), used for the call-back
Spend category * spend_category · select
LogisticsIT hardwareSoftwareProfessional servicesFacilitiesMarketing+1
What you will buy from this vendor
Expected annual spend * expected_annual_spend · number0Expected spend in the first 12 months
Your email requester_email · emailname@company.comWho in procurement asked for the vendor: gets the outcome
Compliance reviewer (user id) compliance_reviewer_id · textOptional: user id of the compliance reviewer (overrides the install-time default)
Finance verifier (user id) finance_verifier_id · textOptional: user id of the finance verifier (overrides the install-time default)

User Task

Compliance review

Review vendor {{legal_name}} ({{risk_tier}} risk, score {{risk_score}})

Enhanced due diligence completed edd_completed · boolean
Beneficial owners checked beneficial_owners_checked · boolean
Conditions (spend cap, prepayment ban…) conditions · text
Next review date next_review_date · datePrefilled: {{next_review_date}}
Review notes * review_notes · text
ApproveApprove with conditionsReject

User Task

Verify bank details

Verify bank details: {{legal_name}}

Verified by call-back * verified_by_callback · boolean
Person who confirmed (name and role) * verified_contact · text
Confirmed account * iban · textPrefilled: {{iban}}
Notes notes · text
VerifiedDetails do not match

From your code

Start a run over the API

Every workflow can be started over REST, MCP or the CLI, whatever its trigger, with the sample input below. Runs start straight away on the published version; replace <workflow id> with the id the install created.

REST

shell
curl -X POST "$USERTASKS_URL/api/v1/workflows/start" \
  -H "Authorization: Bearer $USERTASKS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"workflow_id":"<workflow id>","variables":{"legal_name":"Harbourline Logistics Limited","registration_number":"5123987","country":"NZ","website":"https://harbourline.example.com","iban":"NZ12-3456-7890123-00","contact_email":"accounts@harbourline.example.com","contact_phone":"+64 9 555 0142","spend_category":"Logistics","expected_annual_spend":120000,"requester_email":"casey.ng@example.com"}}'

CLI

shell
usertasks workflows inputs <workflow id>          # the start form: keys, types, required
usertasks workflows run <workflow id> --input legal_name="Harbourline Logistics Limited" --input registration_number=5123987 --input country=NZ --input website=https://harbourline.example.com … --wait

Inbound webhook

shell
usertasks webhooks create <workflow id>          # prints the hook slug and secret once
curl -X POST "$USERTASKS_URL/api/webhooks/inbound?hook=<slug>" \
  -H "Authorization: Bearer <webhook secret>" -H "Content-Type: application/json" \
  -d '{"legal_name":"Harbourline Logistics Limited","registration_number":"5123987","country":"NZ","website":"https://harbourline.example.com","iban":"NZ12-3456-7890123-00","contact_email":"accounts@harbourline.example.com","contact_phone":"+64 9 555 0142","spend_category":"Logistics","expected_annual_spend":120000,"requester_email":"casey.ng@example.com"}'

What's included

9 assets, ready to adapt

TypeNameDetails
Email templateVendor onboarding declinedSent to the requester when screening blocks the vendor or a reviewer declines it.
Email templateVendor welcomeSent to the vendor contact when the vendor record is live.
Data tableCountry riskCountry risk rating used by the vendor risk tier rules. Align it with your sanctions and anti-corruption policy; unlisted countries are treated as high risk.
IntegrationERP
IntegrationKYC screening service
API referenceCompany checksPOST /kyc/company-checks — Screen a company: sanctions and watch lists, the company registry and adverse media, returning a combined risk score and flags.
API referenceCreate vendorPOST /vendors — Create the vendor master record in the ERP with its verified bank account and risk tier.
Decision tableVendor risk tier9 rules — Risk tier and the approvals a new vendor needs, from country risk, screening results and expected spend. First matching rule wins.
WorkflowVendor onboarding25 steps — Procurement submits a new vendor; the KYC service screens it, the risk tier rules decide the approvals, compliance reviews medium and high risk vendors, finance verifies the bank account by call-back, and the vendor is created in the ERP.

Country risk · 11 sample rows

Country codeCountryRisk ratingNotes

Requirements

What you connect it to

Credentials never travel in a package. The install wizard asks for what your environment must provide, or installs it incomplete until you finish setup.

Needs

  • REST API — A REST API integration: set its base URL and credentials on install.
  • Assignees — People in your workspace to receive the User Tasks (picked on install).
  • Email — Email delivery configured for the instance (EMAIL_PROVIDER), used for notifications.

After installing

  1. KYC screening service: set the base URL and API token of your screening provider. Company checks posts to /kyc/company-checks; map its request and response model to your provider in Integrations.
  2. ERP integration: set the base URL and API token of your ERP. Create vendor posts to /vendors.
  3. Assignees: pick the default compliance reviewer and the finance verifier for the bank call-back (runs can pass compliance_reviewer_id and finance_verifier_id).
  4. Edit the Country risk rows and the Vendor risk tier rules to your sanctions, anti-corruption and third-party risk policy.
  5. Email: configure EMAIL_PROVIDER so the welcome and declined emails are delivered (the steps continue on error).

Asked for on install

  • Integration “ERP”Required

    • Tokenconfig.auth_config.token
    • Base urlconfig.base_urldefault https://erp.example.com/api· optional

  • Integration “KYC screening service”Required

    • Tokenconfig.auth_config.token
    • Base urlconfig.base_urldefault https://kyc.example.com/v1· optional

  • Workflow “Vendor onboarding” assigneesRequired

    • User for step “Compliance review”nodes.12.config.assignee_id
    • User for step “Verify bank details”nodes.15.config.assignee_id

Install

Install it in your workspace

Works on UserTasks cloud and on any self-hosted instance. Installing creates the assets above; nothing runs until you complete setup and start it.

In the app

  1. Download vendor-onboarding-kyc-1.0.0.utpkg.
  2. Open Automations → Packages and drag the file onto the page (or choose Import package). Browse gallery there lists every gallery package without downloading by hand.
  3. Pick the file. The wizard verifies the checksum, every file hash and the signature, and shows the readme.
  4. Review the changes (what is created) and the data rows.
  5. Fill in the requirements, or tick Keep incomplete and finish later with Complete setup.
  6. Done: the workflow is published and active once setup is complete.

With the CLI

shell
curl -fLO https://usertasks.com/gallery/vendor-onboarding-kyc-1.0.0.utpkg
usertasks packages inspect vendor-onboarding-kyc-1.0.0.utpkg       # offline: checksum, hashes, signature
usertasks packages install vendor-onboarding-kyc-1.0.0.utpkg --dry-run
usertasks packages install vendor-onboarding-kyc-1.0.0.utpkg       # prompts for each requirement
usertasks packages install vendor-onboarding-kyc-1.0.0.utpkg --keep-incomplete --yes   # in CI; finish with:
usertasks packages complete vendor-onboarding-kyc -f values.yaml

Verify the download

File SHA-256
b8b675673d7968a265f32ddf520565b807c2c42187476cefc02869163864fe12
Package checksum (what is signed)
sha256:d7d431b90adb555c5252b75f239b8f03c46d7c0c2c6edc437ee705406cde2799
Signer
Unsigned preview build — compare the SHA-256 above

shasum -a 256 vendor-onboarding-kyc-1.0.0.utpkg should print the file SHA-256. How gallery packages are signed.

Versions

Version 1.0.0

  1. v1.0.02026-10-26First release.

Installing a newer version upgrades in place: local credentials and requirement values are kept, and changes you made are flagged first. How packages work

More packages

Related

Browse the whole gallery