Vetting a startup funding vendor for identity, permissions, fees and continuity

Use this checklist before giving a supplier access to investor contacts, cap tables, financial models or diligence files. Adapt depth to the service and risk. A grant researcher and a cloud data-room provider need different evidence, but neither should be selected from a testimonial alone.

What to take away

Match trading name, legal entity, company number and contract address before granting any supplier access.
An FCA entry does not mean every service from the firm or its group is regulated.
Score mandatory controls separately from preferences and record who accepts residual risk.
A successful sales demonstration does not prove the purchased edition or company configuration will behave identically.
Use clear triggers for suspension, remediation and exit, and do not wait until renewal to test retrieval.

Identity and ownership

Match trading name, legal entity, company number and contract address.
Check status, officers and filings through Companies House.
Identify group companies and the party that supplies each service.
Record ownership changes, insolvency indicators and material litigation disclosed.
Verify references independently and obtain permission before contact.

Companies House data is a filed public record, not an endorsement or credit assessment.

Verify vendor identity

Match trading name, entity, company number
Check status, officers, filings
Identify group companies and suppliers
Record ownership changes and litigation
Verify references independently

Scope and people

Define activities, deliverables, exclusions and acceptance criteria.
Name the people assigned and check relevant qualifications or experience.
Separate research, administration, introductions and advice.
Record who can change scope and approve extra cost.
Test whether capacity matches the promised timetable.

Regulatory and claim checks

Describe the actual activity before deciding whether regulation may apply.
Check the FCA Register where relevant.
Obtain qualified interpretation of permissions and exemptions.
Trace success rates, market figures and case studies to evidence.
Reject investment, grant or tax guarantees.

An FCA entry does not mean every service from the firm or its group is regulated. Save the entity, permission and search date.

Fees and conflicts

Calculate setup, fixed, recurring, success, tail and termination charges.
State VAT and expense assumptions.
Identify commissions, lender or investor referrals and paid placement.
Check whether remuneration changes recommendations or ordering.
Compare price using one documented company scenario.

Data and security

List personal and confidential data the vendor will receive.
Determine controller, processor or joint-controller roles from practice.
Review hosting, sub-processors, transfers, access and encryption.
Examine incident notification, restoration, audit and deletion.
Test return and export before live use.

The ICO's IT supplier relationships toolkit recommends risk assessment before access, security terms, periodic review and planned exit. The NCSC's cloud security principles provide a structure for examining provider and customer controls.

Contract and continuity

Review service levels, support, liability, confidentiality and intellectual property.
Address subcontracting, change control and business continuity.
Define correction, complaint, suspension and termination routes.
Secure editable work, evidence records and administrator ownership.
Name the fallback if the service is unavailable near a deadline.

Decision record

Score mandatory controls separately from preferences. Record unknowns, exceptions, advice and the person accepting residual risk. Set review dates for permissions, security evidence, insurance and renewal.

Trial and acceptance

Use a bounded trial where the risk permits. Give each supplier the same realistic task, deadline and acceptance criteria. Use invented records until contracts, access and privacy controls are approved. Ask internal users to test the result without supplier coaching.

Check whether research links resolve, figures reconcile, permissions behave correctly and exports preserve meaning. Record errors and the supplier's correction. A successful sales demonstration does not prove the purchased edition or company configuration will behave identically.

Ongoing monitoring

Assign an internal contract and service owner. Review deliverables, access, complaints, security notices, sub-processor changes, invoices and conflicts. Recheck FCA status when relevant and company identity after a material ownership or group change.

Use clear triggers for suspension, remediation and exit. If a vendor holds live diligence data during an incident, preserve evidence, restrict exposure and follow the agreed reporting process. Do not wait until renewal to discover that the company cannot retrieve an editable record.

This checklist contains no live internal links and remains on hold for legal, regulatory, security and privacy review.

Before you act

Match trading name, legal entity, company number and contract address.
Define activities, deliverables, exclusions and acceptance criteria.
Calculate setup, fixed, recurring, success, tail and termination charges.
List personal and confidential data the vendor will receive.
Review service levels, support, liability, confidentiality and intellectual property.
Give each supplier the same realistic task, deadline and acceptance criteria.

Common questions

How should a reader check a vendor's identity and ownership?

Match the trading name, legal entity, company number and contract address. Check status, officers and filings through Companies House. Identify group companies and the party supplying each service. Record ownership changes, insolvency indicators and material litigation disclosed. Verify references independently and obtain permission before contact. Companies House data is a filed public record, not an endorsement or credit assessment.

What should a reader examine in the vendor's fees and conflicts?

Calculate setup, fixed, recurring, success, tail and termination charges. State VAT and expense assumptions. Identify commissions, lender or investor referrals and paid placement. Check whether remuneration changes recommendations or ordering. Compare price using one documented company scenario. This keeps the comparison consistent and exposes charges that only appear later.

How should a reader handle a trial and ongoing monitoring?

Use a bounded trial where risk permits, giving each supplier the same realistic task, deadline and acceptance criteria. Use invented records until contracts, access and privacy controls are approved. Ask internal users to test the result without supplier coaching. Then assign an internal contract and service owner, and review deliverables, access, complaints, security notices, sub-processor changes, invoices and conflicts.