A new supplier should be able to go from first phone call to approved, payable and correctly coded in Xero without anyone retyping a Word document. The ABN gets verified against the Australian Business Register rather than trusted because it was typed into a form. GST registration status is checked, so you know before the first invoice arrives whether that supplier can legitimately charge you GST. The certificate of currency is stored with its expiry date in a field, not buried in an inbox. The bank details are confirmed by a phone call to a number you sourced independently, and that call is logged against the supplier record. That whole sequence is buildable, and for a business adding more than a handful of suppliers a month it pays for itself in avoided rework before you even count the fraud exposure.
This is supplier master data, not invoice processing. The two get conflated because they sit next to each other in the finance workflow, but the tooling is different. AP capture products read documents that arrive; supplier onboarding is about the record those documents will eventually point at. Get the record wrong and every downstream control inherits the error.
The manual version, step by step
Most Australian SMEs run something close to this:
A project manager or buyer emails a new supplier a Word form. The supplier fills in business name, ABN, contact, payment terms and bank details, saves it, and emails it back, often as a scan or a photo. Someone in finance opens it, maybe checks the ABN on ABN Lookup, maybe does not. They create a contact in Xero by typing the fields across. The certificate of currency arrives as a separate PDF in a different email and gets saved to a shared drive, or does not. Nobody diarises its expiry. The bank details go straight from the emailed form into the Xero contact.
Three things reliably go wrong. First, duplicates: the supplier already exists in Xero under a trading name, an abbreviation, or with a trailing "Pty Ltd" that nobody searched for, so now there are two contacts and your spend-by-supplier reporting is wrong. Second, dead data: insurance expires, the ABN is cancelled, GST registration lapses, and nothing in the system notices. Third, and the expensive one: the bank details were never verified out of band. An email with a filled-in supplier form and an attached PDF is a trivially forgeable artefact, and business email compromise against onboarding forms is a known and recurring pattern in Australia.
What the automated version does at each step
Intake
Replace the Word document with a form the supplier completes themselves. A Retool-built internal tool can host the review queue while the supplier-facing form collects structured fields with validation at the point of entry: ABN must be 11 digits and pass the checksum, bank BSB must be six digits, the insurance certificate must be an upload rather than a promise. You get typed data instead of a document someone has to interpret.
ABN and GST verification
The Australian Business Register publishes a web service for ABN Lookup. A workflow calls it with the submitted ABN and returns the entity name, entity type, ABN status, the GST registration period and any registered business names. The automation compares the returned legal entity name against what the supplier typed, checks that the ABN is active, and records whether the supplier is registered for GST and from what date.
That last point matters commercially. If a supplier is not GST registered and invoices you with GST on it, you cannot claim the credit. Catching that at onboarding is far cheaper than catching it in a BAS review eighteen months later.
Duplicate detection
Before anything is written to Xero, the workflow queries existing contacts and scores candidates on ABN match first, then normalised name match, then bank account match. An exact ABN hit is a hard stop that routes to a human. A fuzzy name match is a soft flag. This is the step that quietly saves the most ongoing pain, because duplicate supplier records are much harder to merge after six months of transactions than to prevent on day one.
Insurance and licence documents
Certificates of currency get parsed for insurer, policy number, cover type, sum insured and expiry date, and that expiry lands in a date field. Thirty days out, the workflow emails the supplier asking for the renewal; at expiry, it flags or holds the supplier record. Scanned and photographed certificates are where extraction quality drops, which mirrors what Australian AP guidance has long said about document automation generally: the limiting factor is input data and layout variety rather than OCR in the abstract, with typical implementations needing to cope with dozens of supplier-specific document formats. Expect a human to confirm extracted dates on anything that is not a clean digital PDF.
Posting to Xero
Only after the checks pass does the workflow create the contact, write the ABN, tax setting, payment terms, default account code and contact details, and attach the supporting documents. Everything that happened along the way is recorded: who approved, which checks ran, what the ABR returned and when.
Stitching those API calls together, handling retries when ABN Lookup or the Xero API is unavailable, and routing anything ambiguous to a person is exactly the kind of multi-step workflow automation built on n8n that suits this problem, because the logic is mostly conditional branching across four or five systems rather than one heavy integration.
The step that stays human, deliberately
Bank details do not get accepted from the form. The workflow holds them as unverified, assigns a task, and the task is a phone call to the supplier on a number obtained independently of the onboarding email, confirming BSB and account number read back. The person who makes the call is not the person who can release payments. The call is logged with date, time, the number dialled and who confirmed.
The same control applies, with more force, to any later change of bank details on an existing supplier. Treat a change request as a new verification event regardless of how convincing the email looks, including one that appears to come from a known contact. Australian comparisons of AP platforms describe supplier bank-detail checks, duplicate detection and approval rules as standard controls, and they help, but none of them removes the need for segregation of duties and a human confirming an account change out of band. Automation's job here is to make the control impossible to skip and to leave a record that it happened.
What it costs
Two separate budgets.
Software is the smaller one. n8n can be self-hosted or cloud-hosted; Retool is per-user. ABN Lookup's web service is free to registered users. You are not buying an AP platform for this. For context on adjacent tooling, the Australian market's capture and AP products sit in a different bracket: as at pricing compared on 6 October 2026, Airwallex's Grow plan is listed at A$99 per month and Lightyear's Standard tier from A$255 per month, with three-way matching reserved for the higher tiers, while Dext's own pricing page lists A$33.58 per month excluding GST. Those tools process invoices. They do not verify an ABN or chase a certificate of currency.
Implementation is the larger budget and the one that gets underestimated. One Australian automation provider publishes a process and data audit at A$1,500 to A$5,000, build at A$5,000 to A$21,000 and rollout at A$1,500 to A$8,000, as at 15 October 2026. That is a services estimate for automation work generally rather than a quote for supplier onboarding specifically, but the shape is right: scoping and data cleanup are real line items, and budgeting only for the subscription is how projects stall.
The cleanup is usually the surprise. Most existing Xero supplier lists contain cancelled ABNs, duplicates, archived contacts that still hold bank details and suppliers with no ABN recorded at all. Deciding what to do with that history is a judgement call about your business, not a technical task, and it is worth settling before the new process goes live.
Failure modes worth planning for
- Trading name versus legal entity. The ABR returns the legal entity name; suppliers write the name on their invoice. Match on ABN, display both, and let a human resolve mismatches rather than auto-rejecting.
- Sole traders and partnerships. Valid ABN, no GST registration, sometimes no company structure. The workflow needs a path for them that does not treat "not GST registered" as an error.
- Form abandonment. Suppliers start the form and stop. Build the chaser into the workflow or your buyer ends up doing it by email anyway.
- Urgent one-off suppliers. Someone needs a plumber on site today. Without a fast lane with tighter payment limits, the process gets bypassed and the bypass becomes the norm.
- Data residency. Ask where submitted documents and extracted data are stored, who the subprocessors are, where backups live, and whether any AI provider in the chain uses your documents for model training. Supplier forms carry bank details and sometimes personal information about directors. For businesses that cannot let that data leave the country, Australian-hosted or self-hosted deployment is the answer, and it is worth deciding before the build rather than after.
Realistically, this runs as automation with exception handling rather than an unattended process, which is the same operating model Australian AP guidance recommends for invoices. Expect a tuning period, expect a meaningful share of submissions to need a human look in the first month, and expect that share to fall as the validation rules sharpen.
The first thing to do
Pull the last twenty supplier contacts created in Xero. For each one, check four things: is the ABN recorded and currently active, is the GST status what the supplier's invoices assume, is there a current certificate of currency with a known expiry date, and is there any evidence that someone verified the bank details by phone. Count how many fail. That number is your business case, and it takes an hour with the contacts export.
If it is worse than you expected, IOTAI can scope the build: the supplier-facing form, the ABR and Xero integration, the duplicate and expiry logic, the verification task that cannot be skipped, and a straight answer on whether your onboarding volume justifies the spend. Book an assessment and you will get a fixed scope, a cost and a delivery window, typically two to four weeks, along with an honest view of how much of your existing supplier list needs cleaning first.