Supplier Due Diligence Checklist for Indian Buyers

Most of the buyers I talk to do not skip due diligence because they are lazy. They skip it because they do not have a list. The supplier seems fine, the price is good, the quote needs an answer today, and "checking" feels vague — what do you even check, and where?

So here is the list. This is the checklist I would hand a procurement person on their first day: stage by stage, in the order you should run it, with each item written as something you can actually do rather than a principle to nod along to.

A word on how to use it. Not every order needs every step. I have flagged the quick wins — five minutes, do them every single time — separately from the deeper diligence you reserve for high-value orders, new relationships, or custom production where you cannot resell the goods if it goes wrong. Match the effort to what you would lose. A ₹30,000 sample order does not need a sanctions screen. An ₹8 lakh advance to a supplier you found last week does.

If you want the underlying reasoning behind any step, the pillar guide on how to verify an Indian supplier covers the why. This post is the do.

---

Stage 1: Identity and registration

The first question is the most basic and the most skipped: is this a real, registered business, and is it the business it claims to be? Everything here uses free government portals.

• Confirm the legal name and PAN. Get the exact registered name, not the brand or trade name on the WhatsApp catalogue. The PAN is the spine — GSTIN and most other records hang off it. (Quick win.)

• Verify the GSTIN on the GST portal. A GSTIN is 15 characters and encodes the state and the PAN. Look it up free on gst.gov.in under "Search Taxpayer." Check that the status is Active, that the legal name matches what you were told, and that the state code matches the address they gave you. A cancelled or suspended GSTIN is a hard stop. The full walkthrough is in how to verify a GST number of a supplier. (Quick win.)

• Check the IEC on the DGFT portal. If you are importing, or the supplier exports, they need an Importer Exporter Code issued by DGFT. You can confirm it on the DGFT portal — see how to check an IEC code on the DGFT portal. Match the name and address against everything else. No IEC for a company that claims to export directly is worth a question. (Quick win for importers.)

• Look up the company on MCA21. If the supplier is a Private Limited or LLP, it is registered with the Ministry of Corporate Affairs at mca.gov.in. Check incorporation date, registered office, directors, and whether the status is Active. A company "Under process of striking off" or "Dormant" is a flag. (Deeper diligence — but worth it on any large order.)

• Check Udyam / MSME registration. If they present themselves as an MSME, the Udyam registration is verifiable online. It is not proof of much on its own, but the registered activity and address should line up with what they sell. (Deeper diligence.)

The single most useful thing in this stage is cross-matching. One clean GSTIN proves little. A GSTIN, PAN, IEC, and MCA record that all point to the same legal name at the same address is what genuine looks like. When the names drift — "Sharma Exports" on the quote, "Sharma Trading Co Pvt Ltd" on the GSTIN, a third name on the bank account — slow down.

---

Stage 2: Operational reality

Registration proves a business exists on paper. This stage asks whether it exists in the real world, and whether it does what it says it does.

• Verify the physical address. Drop the registered and supplied addresses into Google Maps and Street View. A genuine manufacturer usually sits in an industrial area or estate. If a "factory" address resolves to a residential flat or an empty plot, that is a question worth asking out loud. (Quick win.)

• Check the Google presence. Search the company name plus the city. A real operating business tends to leave footprints — a Google Business listing, reviews, photos, a directory entry or two. A company doing lakhs in monthly trade with zero searchable history is unusual. (Quick win.)

• Check the website and domain age. Run a free WHOIS lookup on the domain. A supplier claiming twenty years in business with a domain registered four months ago is not impossible, but it is worth explaining. Also check that the website email domain matches the one they are writing from — fraud often comes from a free Gmail address while the "real" company has a proper domain. (Quick win.)

• Look at LinkedIn. Does the company have a page? Do the people you are dealing with have profiles that connect to it? Headcount that roughly matches the scale of business they claim? An exporter shipping containers monthly with no employees anywhere online is worth a second look. (Deeper diligence.)

• Cross-check B2B listings. IndiaMART, TradeIndia, ExportersIndia and similar platforms show how long a supplier has listed, what they list, and sometimes a verification badge. Consistency across platforms over time is reassuring; a brand-new listing with a huge claimed product range is not. (Deeper diligence.)

One specific check belongs here: are they actually the manufacturer, or a trader reselling? This matters for pricing, quality control, and recourse. If you want to know which you are dealing with, manufacturer or trader: how to tell in India lays out the signals. Neither is bad — but a trader quoting you "factory direct" prices has already been less than straight with you.

---

Stage 3: Risk

Stages 1 and 2 confirm the supplier is real. Stage 3 asks whether being real is enough — has this business, or these people, given anyone a reason for concern?

• Run a news and fraud scan. Search the company name and the directors' names alongside words like fraud, complaint, scam, cheating, and dispute. Check consumer-complaint forums and trade WhatsApp or Telegram groups in your sector. A pattern of unresolved complaints is data; one angry customer usually is not. (Quick win.)

• Ask for and actually call references. Request two or three current buyers and phone them. Ask boring, specific questions: Did orders arrive on time? Did quality match the sample? How did they handle a problem? A supplier who cannot produce a single reference for a large order is telling you something. (Deeper diligence.)

• Screen for sanctions on cross-border deals. If you are dealing with a global counterparty — a foreign buyer or a supplier outside India — check them against sanctions and denied-party lists before money or goods move. This is non-negotiable for international trade and irrelevant for a purely domestic purchase. (Deeper diligence, cross-border only.)

• Watch for the advance-payment red flags. Pressure to pay quickly, a price meaningfully below the market, a sudden change of bank account just before payment, a bank account in a name that does not match the company — these are the classic patterns. The detailed list is in advance payment fraud: supplier red flags in India. If you see two or more together, stop and re-verify everything. (Quick win to recognise; the response is deeper.)

For a broader judgment framework on how these signals add up, how to check if a supplier is genuine in India is the companion read.

---

Stage 4: Commercial

You have confirmed the supplier is real, operational, and not visibly risky. The last stage is structuring the deal so that even an honest mistake does not become your loss.

• Place a sample or small first order. Before any large commitment, buy small. A sample order tests quality, communication, packaging, and timeliness for a fraction of the exposure. How a supplier handles a ₹20,000 order tells you a lot about how they will handle a ₹5 lakh one. (Quick win — and the highest-value one in this stage.)

• Negotiate payment terms that share the risk. A 100% advance to a new supplier puts all the risk on you. Push for a structure that protects both sides — a smaller advance with the balance on dispatch or against documents, or for larger international deals, a letter of credit or escrow. The exact split is a negotiation; the principle is that you should not be the only one with skin in the game before goods exist. (Deeper diligence.)

• Confirm bank details against the legal name — twice. The account name must match the verified legal entity. Re-confirm on a phone call you initiate, using a number you already had, not a number sent in the same email as new bank details. Account-swap fraud lives in this gap. (Quick win — and skipping it is how good buyers still get caught.)

• Put it in a written contract or purchase order. Specifications, quantities, quality standards, delivery timeline, payment milestones, and what happens if something is wrong. A PO is not just paperwork; it is the only thing that makes "the quality wasn't what we agreed" a position rather than an opinion. (Deeper diligence — essential on high-value or custom orders.)

---

How this fits together

Run top to bottom, the four stages answer four questions in order: Is it real? Does it operate? Is it risky? Is the deal safe? Skip a stage and you are guessing on that question.

The quick wins — GSTIN status, IEC, address on Maps, domain age, Google presence, news scan, sample order, bank-name match — take well under twenty minutes combined and catch the large majority of bad actors, because most fraud does not survive even basic cross-matching. The deeper steps — MCA, references, sanctions, contracts — are what you add when the order is big enough that twenty minutes is no longer proportionate to what is at stake.

The honest limit: no checklist guarantees a good outcome. A clean record today does not promise good behaviour next quarter, and a determined fraudster can fake parts of a paper trail. What due diligence buys you is not certainty — it is dramatically better odds, and the ability to say you checked. That is the difference between bad luck and a bad decision.

If you would rather not run all of this by hand, that is exactly the gap we built Vetrade to close. You can verify a supplier and pull the registration and identity checks together in about twenty seconds — free to start. Use the tool for the fast layer, and reserve your own time for the references, the sample order, and the contract, where judgment still beats automation.

---

Summary. Supplier due diligence for Indian buyers runs in four stages: confirm identity and registration (PAN, GSTIN, IEC, MCA, Udyam), check operational reality (address, Google, domain, LinkedIn, B2B listings), assess risk (news scan, references, sanctions, advance-payment red flags), and lock down commercial terms (sample order, balanced payment, bank-name match, written contract). Do the quick wins every time; add the deeper steps when the order is large. Most fraud fails the basic cross-match — so run the list.