How often should vendor due diligence be repeated?

Procurement Checklist· 30 items

Vendor Due Diligence Checklist for Indian Enterprises (2026)

A comprehensive, risk-tiered vendor due diligence checklist for Indian enterprises — from company registration to director background checks and DPDP data processor assessment.

Company Registration & Existence

5 items

Verify MCA (Ministry of Corporate Affairs) registration — company exists and is active

Confirm company name, CIN, and registered address match documents

Check company type (Pvt Ltd, LLP, Public Ltd) and authorised share capital

Verify GST registration number and filing status (GST portal)

Confirm bank account and IFSC (basic account verification)

Director Background Verification

6 items

Verify DIN (Director Identification Number) for all directors

Check director disqualification status (MCA Section 164 disqualification list)

Run identity verification on all named directors

Conduct criminal record check on key directors

Check for pending insolvency proceedings (IBBI portal)

Verify company associations — check track record of other companies

Compliance Status

5 items

Verify GST return filing history (regular filer or lapsed?)

Check Income Tax return filing history

Verify PF (EPFO) and ESI compliance for vendors with employees

Confirm relevant industry licences (FSSAI, drug licence, PSARA, etc.)

Check for any SEBI/RBI regulatory actions if applicable

Financial Health

5 items

Check CIBIL Commercial Credit Report for credit rating

Review for NPA (Non-Performing Asset) status with banks

Check for pending insolvency or NCLT proceedings (IBBI)

Review for significant outstanding tax demands or disputes

Check for lien or attachment notices in public records

Data Security (for vendors with data access)

5 items

Confirm vendor has signed a DPDP-compliant Data Processing Agreement

Verify vendor's information security certifications (ISO 27001 preferred)

Assess vendor's data breach notification capabilities

Confirm vendor does not share data with unauthorised sub-processors

Review vendor's employee BGV policy for staff with data access

Personnel Verification (for vendors with physical access)

4 items

Require vendor to certify all deployed personnel have been BGV-verified

Confirm personnel BGV scope matches your internal employee standards

Obtain list of personnel with access to your premises/systems

Establish process for replacing personnel who fail verification

Free Download

Download as PDF

Get the complete guide as a professionally designed PDF — free for HR teams.

Download Free

Frequently Asked Questions

Tier 1 (strategic) vendors: annually. Tier 2 (significant) vendors: every 2 years or at contract renewal. Tier 3 (routine) vendors: at contract renewal or every 3 years. Triggered re-verification: any time there's a material change (ownership change, major lawsuit, adverse media, or when the vendor moves to a higher tier).

Back to Checklists