Guide
Supplier due diligence in the UK: a practical guide and checklist
How to check a UK supplier before you rely on it, how much checking each supplier needs, and how to show afterwards that you did it.
Last reviewed
What supplier due diligence is
Supplier due diligence is checking that a supplier is who it says it is, can deliver what you are buying, and does not expose you to financial, legal, ethical or security risk, then keeping a record of what you checked and what you decided.
For a UK company, most of the first questions are answered by public registers: whether it exists and is trading, whether it files on time, what its accounts show, who runs and owns it, and whether it is subject to insolvency proceedings, sanctions or enforcement action. Questions the registers cannot answer, such as how it handles your data or treats its own workers, need evidence from the supplier itself.
Due diligence should be proportionate. A stationery supplier and the company running your payroll do not need the same checks, and the effort should follow the risk.
Checking one company quickly? See how to check a UK company, ten checks you can run in a few minutes on free registers.
Why it matters in the UK now
Due diligence has always been good practice. Several recent changes make it something regulators, auditors and public buyers now expect to see.
Procurement Act 2023
In force since 24 February 2025. Public bodies must consider whether a bidder is excluded, and an exclusion ground can arise from a connected or associated person, including directors, parent companies and key subcontractors. Ministers keep a central debarment list that can bar a supplier from public contracts for up to five years.
GOV.UK: exclusion and debarment under the Procurement Act 2023
Failure to prevent fraud
In force since 1 September 2025 for large organisations (two of: more than 250 employees, more than £36 million turnover, more than £18 million total assets). The defence is having reasonable fraud prevention procedures, and due diligence on associated persons is one of the six principles in the government guidance.
Bribery Act 2010
An organisation commits an offence if a person performing services for it pays a bribe to win or keep business for it, unless it had adequate procedures to prevent bribery. Due diligence is one of the six principles in the Ministry of Justice guidance on adequate procedures.
Modern Slavery Act 2015
Commercial organisations with turnover of £36 million or more must publish an annual slavery and human trafficking statement, which may describe their due diligence in their supply chains.
Sanctions
Since 28 January 2026 the UK Sanctions List has been the only list of UK sanctions designations; the old OFSI Consolidated List is no longer updated. Screening should use the UK Sanctions List, covering the supplier and the people who own and run it.
GOV.UK: moving to a single list for UK sanctions designations
Companies House identity verification
Directors and people with significant control must now verify their identity with Companies House, with the transition for existing companies ending in November 2026. A supplier whose officers have not verified will be unable to file, which shows up on the register.
Senserity blog: what the identity verification deadline means for due diligence
Cyber Security and Resilience Bill
Before Parliament at the time of writing. It brings larger managed service providers into the scope of the network and information systems rules, which raises the bar for vetting IT suppliers.
Senserity blog: the Bill and vetting IT and managed service suppliers
This guide is general information about UK law as at 3 October 2026, not legal advice. Take advice on your own obligations.
How much due diligence to do
Sort suppliers into levels by what would happen if they failed or misbehaved: how much you spend, how hard they would be to replace, and what access they have to your data, systems, premises and customers. Then apply the checks for that level.
| Level | When it applies | What to check | Review |
|---|---|---|---|
| Basic | When it appliesLow spend, easily replaced, no access to your data, systems or premises. | What to checkThe company exists and is live, its filings are up to date, no insolvency or strike-off notices, and no sanctions match. | ReviewAt renewal, or once a year. |
| Standard | When it appliesMeaningful spend, or a supplier your operations would notice losing. | What to checkEverything in Basic, plus the latest accounts, charges, who runs and owns it, disqualified directors, any licence or registration its work needs, and its certifications. | ReviewStatus, filings and Gazette notices monitored continuously; a full review once a year. |
| Enhanced | When it appliesCritical to your operations, high spend, handles your data or systems, works on public contracts, or operates in a high-risk sector. | What to checkEverything in Standard, plus health, safety and environmental enforcement, cyber security, adverse media, a credit report, evidence from the supplier itself (questionnaires, policies, certificates) and contract terms such as audit and termination rights. | ReviewMonitored continuously; reviewed at least once a year and whenever something changes. |
The checklist
What to check for a UK company, where to look, and what a red flag looks like. Most of these sources are free to search. A red flag is a reason to ask questions, not an automatic rejection: many have harmless explanations, and the linked articles cover them.
| Check | Where to look | Red flags | More |
|---|---|---|---|
| The company exists and is live | Where to lookCompanies House register | Red flagsA status other than Active, or a company name and number that do not match the contract or invoices. | MoreCompany status |
| Filing discipline | Where to lookAccounts and confirmation statement due dates on the register | Red flagsAccounts or confirmation statement overdue, or late year after year. | MoreCompanies House data |
| Financial health | Where to lookLatest accounts filed at Companies House | Red flagsNegative net assets that are getting worse, falling cash, or accounts more than two years old. | MoreCompany accounts |
| Secured borrowing | Where to lookCharges register at Companies House | Red flagsA new all-assets debenture, or several new charges while the accounts deteriorate. | MoreCharges |
| Insolvency, petitions and strike-off | Where to lookThe Gazette | Red flagsA winding-up petition, administration, creditors' voluntary liquidation, moratorium or compulsory strike-off proposal. | MoreGazette notices |
| Who runs and owns it | Where to lookOfficers and persons with significant control at Companies House | Red flagsFrequent director changes, no registered controller, ownership through opaque chains, or directors linked to failed companies. | MorePersons with significant control |
| Disqualified directors | Where to lookCompanies House register of disqualified directors | Red flagsA director or controller who appears on it. Confirm it is the same person before acting. | |
| Sanctions | Where to lookUK Sanctions List | Red flagsA match on the company, its directors or its owners. Confirm the match before acting. | MoreSanctions screening |
| Health, safety and environment | Where to lookHealth and Safety Executive and Environment Agency public registers | Red flagsRecent enforcement notices or prosecutions, especially repeated ones. | MoreEnvironmental and social risk |
| Licences and registrations its work needs | Where to lookFCA register, CQC, food hygiene ratings, operator licences, ICO register of fee payers | Red flagsNot registered when it should be, a poor rating, or a licence held by a company in distress. | |
| Certifications | Where to lookThe certification body's own register (ISO, Cyber Essentials, health and safety schemes) | Red flagsA certificate that has expired, comes from an unaccredited body, or covers a different company. | |
| Cyber security | Where to lookPublic checks on the supplier's website and email domain | Red flagsNo email authentication, expired certificates, or exposed services. | MoreCyber risk |
| Reputation | Where to lookNews and adverse media | Red flagsFraud, regulatory action or serious incidents. Check it is the same company. | MoreAdverse media |
| Credit and payment behaviour | Where to lookA commercial credit report (paid) | Red flagsA low score, county court judgments, or paying suppliers late. | MoreCredit data |
What the UK register shows
Red flags are not rare. Across every UK company that files accounts at Companies House, a substantial share shows at least one publicly visible risk signal at any time, which is why a supplier passing a check last year says little about today.
More figures, by sector, area, company age and size, are in the UK Supplier Risk Index.
One-off checks and ongoing monitoring
A check is true on the day it is run. Status changes, Gazette notices, late filings, new charges and director changes are all published as they happen, so a supplier that passed in January can be facing a winding-up petition by June.
For Basic suppliers, a re-check at renewal is usually enough. For anything more important, watch the register and The Gazette continuously and act on changes, rather than waiting for the next annual review. Notices that often come first, such as winding-up petitions and strike-off proposals, give the most warning.
Evidence and the audit trail
If an auditor, regulator or public buyer asks how you vetted a supplier, the answer needs to be a record, not a recollection. For each supplier, keep:
- The supplier's legal name and company number, not just its trading name.
- The date each check was run, what was checked, and the source.
- What was found, and how anything of concern was resolved.
- The decision, who made it, and any conditions attached.
- The date of the next review.
A screenshot is evidence only if it shows the source and the date. Keep the record for the life of the contract and your normal retention period after it, and update it at each review.
Doing it with Senserity
Senserity runs these checks automatically for UK companies. Add a company and it is checked against Companies House, The Gazette, the UK Sanctions List, enforcement and licensing registers, certification bodies, cyber security checks and more, with an A–E risk grade and the evidence and source behind every finding. Paid plans monitor continuously and alert you when something changes, and PDF reports give you the dated record for the audit trail.
See the test catalogue for every check, the data sources, example profiles, and pricing, including a free plan.
Questions
Is supplier due diligence a legal requirement?
There is no single law requiring it of every business, but several expect it. The failure to prevent fraud and Bribery Act defences both rest on having proportionate procedures that include due diligence, larger organisations must report on their supply chains under the Modern Slavery Act, dealing with a sanctioned person can be an offence, and public bodies must consider exclusions under the Procurement Act. This guide is general information, not legal advice.
How often should I re-check a supplier?
It depends on the level. Basic suppliers can be re-checked at renewal; important ones should be monitored continuously, because a company can go from healthy-looking to a winding-up petition between two annual reviews.
Can I do it for free?
Most of the checklist, yes. Companies House, The Gazette, the UK Sanctions List and the HSE and Environment Agency registers are free to search. Credit reports cost money, and doing every check by hand for every supplier takes time, which is the gap tools fill.
What should I do if a check finds something?
Do not reject the supplier automatically. Many signals have harmless explanations. Ask the supplier, record the answer, and decide whether to proceed, proceed with conditions (shorter payment terms, closer monitoring, a parent company guarantee) or walk away.
What is the difference between due diligence and supplier onboarding?
Onboarding sets a supplier up to trade with you: bank details, tax status, contracts. Due diligence asks whether you should trade with them at all, and keeps asking for as long as you do.
Ready to get started?
Start free with a 30-day trial — 5 companies and 50 action credits included. No credit card required.