All posts

Compliance operations and audit

The W-9 is where vendor onboarding stalls, and it is not because vendors will not send it

A mismatched name and TIN produces a B-notice a year later and backup withholding you have to explain. Validating it at onboarding costs nothing.

The IDCore Team8 min read

A vendor sends you a W-9 with the business name on line 1 and the owner's SSN in the TIN box.

You accept it, pay them $84,000 over the year, and file a 1099. Fourteen months later the IRS sends a CP2100 notice saying the name and TIN do not match, and you are now responsible for starting backup withholding at 24% on a vendor who is already annoyed about something else.

That whole sequence is preventable in about ninety seconds at onboarding, and almost nobody does it.

The mismatch is a line-1 problem, not a dishonesty problem

Vendors are not trying to hide anything. The form is genuinely confusing, and the confusion is concentrated in one place.

Line 1 has to be the name that appears on the tax return associated with the TIN. Line 2 is the business or trade name. For a single-member LLC that has not elected corporate taxation, line 1 is the owner's individual name and the TIN is the owner's SSN, with the LLC name on line 2.

Almost every single-member LLC gets this backward, because putting the company name on line 1 is the intuitive thing to do. The result is an EIN or SSN that does not match the name the IRS has, and the mismatch surfaces at year end when it is expensive to fix.

Reading line 1 against the box checked in the federal tax classification section catches most of it. An LLC box checked with a business name on line 1 and an SSN in the TIN field is the specific pattern to look for.

The IRS gives you a free matching service and most operators never use it

The TIN Matching program inside the IRS e-Services platform lets a filer submit a name and TIN combination and get back whether it matches IRS records. Interactive matching handles up to 25 at a time, and bulk matching handles large files.

Running it at onboarding rather than at year end converts a CP2100 notice and a backup withholding obligation into an email asking the vendor to correct one line.

The reason it goes unused is that it lives on the AP side while onboarding lives on the compliance side, and neither team owns the handoff.

Which vendors need a 1099 and which do not

The general rule for property management: $600 or more in a calendar year for services from an unincorporated payee requires a 1099-NEC.

The exceptions people get wrong:

Corporations generally do not get a 1099-NEC. C corps and S corps are excluded, which is why the federal tax classification checkbox on the W-9 matters operationally rather than just informationally.

Attorneys get one regardless of entity type. Payments to a law firm are reportable even if the firm is a corporation.

Rent paid to a landlord goes on a 1099-MISC rather than a NEC, which matters for master-leased or third-party-managed arrangements.

Payments made by card or through a third-party network are reported by the processor, so you do not also report them. Double reporting is its own cleanup.

The classification checkbox on the W-9 is what drives all of these, and it is the field most likely to be left blank on a form that otherwise looks complete.

Collect the whole set at once or you will chase it three times

Vendor onboarding tends to happen in waves: insurance first, because somebody is blocked on getting the vendor on site, then the W-9 when AP tries to pay them, then the banking details when the first payment fails.

Each wave is a separate round of emails to the same vendor, and each one adds days before the vendor can work.

The set that should arrive together:

W-9, with line 1 and the classification box validated on receipt. Certificate of insurance, matched against the requirement set for that trade. Signed vendor agreement with the insurance and indemnity provisions. Business license or trade license where the trade requires one. Banking details for ACH, validated through whatever process your controls require. Sanctions and debarment screening, which is a real requirement on federally assisted properties and is frequently skipped.

Requesting all of it in one intake is not more work for the vendor than requesting it three times. It is less.

The reason this is a compliance problem rather than an AP problem

Time to first work.

Every day a vendor spends in onboarding is a day the work does not happen, and for anything urgent that delay has a cost that dwarfs the administrative savings from doing it in waves. A mold remediation vendor who cannot start for nine days because their W-9 was rejected twice is a liability accruing daily.

Which is why the measure worth tracking is not documents collected. It is days from vendor identified to vendor cleared for work. IDCore customers see roughly 10 days off that number, and the mechanism is a single intake with validation at the point of submission rather than at the point of failure.

ResProp's project manager put the operational version of this plainly, sourcing a mold remediation vendor under time pressure: each day they were not working, liability was climbing.

Where IDCore sits and where it does not

Vendor onboarding with a configurable required-document set, per-trade insurance requirements, AI reading of the ACORD form, expiration tracking, and automated vendor reminders. W-9 collection and expiration-tracked document storage alongside the insurance record.

Where it stops, stated because the boundary matters:

We do not run IRS TIN matching. The W-9 is collected and stored as a required document, and validating the name and TIN combination against IRS records is a step you run on the AP side. That is a genuine gap and worth naming rather than implying.

We do not issue 1099s, and we are not the system of record for tax filing. That is your accounting system.

Sanctions and debarment screening is not something we perform. If you operate federally assisted properties, that check belongs somewhere in your process and it is not here.

Pull ten W-9s

Take ten from vendors you paid last year. Check two fields on each: is line 1 consistent with the TIN type, and is the federal tax classification box filled in.

Whatever fraction fails is roughly your CP2100 exposure for next filing season.

How many of the ten were clean?

Keep reading

Compliance operations and audit

What a lapsed vendor COI actually costs

A policy expires in March and the file still reads compliant. The claim arrives in September. Here is how the exposure builds and what the arithmetic looks like.

7 min read
Schedule a Demo