In a sale, the vendor is the seller; in third party risk, the supplier a firm will depend on. Reading VDD as research into potential buyers gets the sale sense backwards: the seller's business is the subject, the buyers are the readers. At Extreme Networks, a deal review that missed who owned one customer ended in a $1,529,685 OFAC settlement on 27 October 2026 (OFAC enforcement release).
What does vendor due diligence mean?
In mergers and acquisitions, vendor due diligence means sell side due diligence: the seller hires accountants and lawyers to review its own business and gives every bidder one report, which deal teams call vendor DD. Picture a payments company sold to five bidders: one report in the data room instead of five teams asking the same questions.
Outside a sale, the definition shifts to a firm's check on a company it will depend on, like a card processor. Banks call it third party due diligence. Buyers say supplier due diligence. For identity and ownership, the firm runs the registry lookups and owner tracing of KYB and UBO verification on the vendor.
What goes into a vendor due diligence report, and who relies on it?
A vendor due diligence report covers what a buyer would otherwise check itself, in four workstreams: financial, tax, legal and commercial. The vendor due diligence objectives are the seller's benefits: one checked set of facts for all bidders and problems found in time to fix or disclose them.
In corporate finance, the vendor due diligence process runs in six steps:
- Scope. Seller and advisers agree the workstreams and period.
- Data room. The seller uploads documents; advisers test them.
- Report to bidders. It reaches every bidder before bids are due.
- Confirmatory review. The preferred bidder rechecks what its price depends on.
- Reliance at signing. The buyer and its lenders may rely on the report, usually under the adviser's reliance letter (market practice).
- Closing. The deal completes; the report stays true only as of its cut off date.
Why do sanctions and AML findings belong in a VDD?
In March 2018, Extreme's Russian subsidiary bought the customer accounts and contracts of a Russian networking business that specialized in business communications. One contract named MMZA as end user, a defense maker majority owned by Almaz Antey (designated 16 July 2014), so MMZA was blocked years before its own listing in June 2022. Extreme's compliance team reviewed the purchase agreement but "did not conduct sufficient due diligence to recognize that MMZA was blocked". Nine apparent violations followed, September 2018 to March 2022.
In OFAC's words, "an acquisition target's preexisting customer relationship with a blocked person ... quickly gave rise to multiple apparent violations" (p. 4). Its Framework for OFAC Compliance Commitments of 2 May 2019 wants merger sanctions issues "addressed prior to the conclusion of any transaction".
For the buyer's anti money laundering (AML) and counter terrorist financing (CTF) review, a sale file screens the target, its subsidiaries, its owners up to natural persons and any politically exposed persons (PEPs) among them, plus customers, contracts and end users. Adverse media on each is searched for money laundering and fraud.
A company blocked through its owner need not appear on any list, so complead, formerly Sanction Scanner, traces a company's owners, parents and controlling entities until natural persons are reached, follows its subsidiaries downward and runs sanctions, PEP screening, watchlist and adverse media checks on every party.
A sale report or vendor file is true on its date, and sanctions risk often sits one step further out than the file looked, so the file is screened again after signing.
What does vendor due diligence cover when a firm takes on a third party?
For financial firms, vendor due diligence best practices sit in supervisory texts. Picture a bank outsourcing card processing: the US banking agencies' 2023 guidance on third party relationships has it ask about the processor's "beneficial ownership" and "whether the third party itself or any owners are subject to sanctions" by OFAC (88 FR 37929).
- Criticality. It sets the depth of every check; DORA requires the test and due diligence before ICT contracts (Article 28(4)(a), (d)).
- Ownership. Beneficial owners traced and screened; the EBA lists "ownership and group" structure (final report, para 78(a)).
- Finances and people. Accounts, track record and checks on key personnel.
- Information security. A provider's breach becomes the firm's breach.
- Subcontractors. For material outsourcing, the PRA's list covers the providers a vendor outsources to, beside its ownership structure (SS2/21, para 5.19).
- Contract. Audit rights let the firm verify what it could only ask before.
- Ongoing monitoring. A stage of its own in the 2023 guidance; sanctions and owners are checked again once the contract runs.
- Register and exit. DORA requires a register of ICT contracts (28(3)) and exit strategies for critical functions (28(8)).
Until the EBA's new guidelines apply, its 2019 guidelines on outsourcing arrangements remain applicable.
Which vendor due diligence rules changed in 2026?
- 18 March. The PRA published a new SS2/21, effective 18 March 2027; the November 2024 text applies until then (PRA page).
- 15 September. The OCC, Federal Reserve, FDIC and NCUA proposed guidance to take the place of the 2023 text, which applies meanwhile. Comments close 16 November 2026, and the proposal never mentions sanctions or ownership (Federal Register).
- 18 September. The EBA issued final guidelines on third party risk for services other than ICT, not yet applicable (EBA page).
How is VDD different from buyer due diligence, CDD and KYS?
Table 1. Vendor due diligence beside buyer due diligence, know your supplier and customer due diligence (as of October 2026).
| Check | Who commissions it | Whom it is about | Who relies on it | When | What it covers | Rule or practice |
|---|---|---|---|---|---|---|
| VDD in a sale | The seller | The seller's own business | Bidders, then the buyer and its lenders | Before bids; reliance at signing | Financial, tax, legal and commercial findings, sanctions and AML among them | Market practice (reliance letter) |
| Buyer due diligence | A bidder | The target | The bidder and its lenders | After the VDD report, before signing | What the bidder's price depends on, often as a confirmatory review | Market practice |
| VDD on a third party | A firm taking on a vendor | The vendor, its owners and subcontractors | The firm, answerable to its supervisor | Before the contract, then ongoing | Criticality, ownership, sanctions, finances, security, contract, exit | 2023 US guidance, factor b; DORA Article 28 |
| Know your supplier | A company buying goods or services | A supplier and its owners | The buyer's compliance team | Before buying, then while buying | Sanctions, debarment, bribery, origin of goods | Sanctions, anti bribery and forced labor laws |
| Customer due diligence | A regulated firm | Its own customer | The firm, answerable to its supervisor | At onboarding, then ongoing | Identity, beneficial owner, purpose of the relationship, monitoring | FATF Recommendation 10; national AML law |
Know your supplier is the financial crime part of supplier checks: sanctions, bribery and the origin of goods. Customer due diligence is a regulated firm's duty on its own customers.
CDD runs at enhanced due diligence depth when risk is high. A vendor doing part of that work is no reliance third party: FATF's Recommendation 17 "does not apply to outsourcing or agency relationships" (interpretive note, para 1).
On your next sale or vendor file:
- Screen the customers and contract end users as well as the target; Extreme's merger checks now include "comprehensive screening of the target entity and its customers" (p. 3).
- Ask who owns each customer, since MMZA's block came from its owner.
- Book a rescreen for after signing.
Related terms
- Know your supplier. The financial crime checks on a company a firm buys from.
- Customer due diligence. A regulated firm's checks on who its customers are and what risk they carry.
- Ultimate beneficial owner. The individual who ultimately owns or controls a company, however many layers sit between.
- Enhanced due diligence. Deeper checks where a customer or relationship carries high risk.
- Corruption. The misuse of entrusted power for private gain, such as a bribe passed through a third party.
- Procurement fraud. Schemes that cheat a company's buying process, often through a vendor.
How this entry was checked. On 28 October 2026 every source named here was opened at its publisher: OFAC's Extreme Networks enforcement release (27 October 2026) and its Framework for OFAC Compliance Commitments (2 May 2019); the US banking agencies' interagency guidance on third party relationships (6 June 2023) and their proposal of 15 September 2026; Regulation (EU) 2022/2554 (DORA), applied from 17 January 2025; the EBA's final report on third party risk guidelines (18 September 2026) and its outsourcing guidelines of 25 February 2019; the PRA's SS2/21 in its November 2024 text and its March 2026 version; and the FATF Recommendations in their June 2026 text. Statuses are those of October 2026, and the six sale steps describe market practice, which no regulator sets. Author: Melis Alparslan, Regional Sales Manager, complead. Fact checker: Fatih Coşkun, Founder and CEO, complead. Last reviewed: 28 October 2026.
