Philippines AP staffing guide
Vendor onboarding checklist for a Philippines AP team
Use a clear vendor packet, bank check, access limit, and approval path when a Filipino AP assistant prepares new vendor records.
Direct answer
What this role should do
A Filipino AP assistant can collect vendor forms, check that required fields are present, log open items, and prepare a vendor packet. A named employee inside your company should verify bank details through a known contact, approve the vendor record, approve any later change, and keep payment release.
What the reports show
The email risk reaches the payment desk
AP control table
Match each request with a check and an owner
Swipe or scroll the table sideways on a small screen.
| Request | Risk clue | Assistant action | Owner action |
|---|---|---|---|
| Create a new vendor | Requester and business need are not recorded | Collect the packet and list each missing item | Confirm the request and approve the vendor record |
| Add bank details | Account data arrives only by email | Pause the field and log the source message | Verify through a known contact and record approval |
| Accept a tax form | Name and tax fields do not match the packet | Flag the mismatch without correcting it | Decide whether the record can be accepted |
| Open portal access | The role asks for broad finance permissions | Request only the fields needed for the assigned task | Approve the access role and review date |
| Change an active vendor | Urgent request bypasses the normal owner | Keep the current record and raise an exception | Repeat the known-contact check before any change |
FBI complaint data
Reported BEC losses stayed above $2.7 billion
Swipe or scroll the chart sideways on a small screen.
Method: Values come from the FBI IC3 three-year complaint-loss table and are rounded to the nearest million for the chart. IC3 records reports submitted to the bureau; the figures are not an AP-only loss count and do not prove every complaint.
Separate graphic
A safer path for a changed payment instruction
Swipe or scroll the steps sideways on a small screen.
This graphic is a sample control path, not a claim about how every company works. Put the known vendor contact and named company approver in your own written procedure.
"Last year saw a new record for losses reported to IC3, totaling a staggering $16.6 billion."
B. Chad Yarbrough, Operations Director for Criminal and Cyber, FBI, 2024 IC3 Annual Report
Give every vendor packet one owner
A vendor packet can pass through email, a form, an accounting system, and a bank check before the first invoice is ready. Name one employee inside your company who owns the final vendor decision, even when a Filipino AP assistant prepares most of the record.
The assistant can collect documents, check required fields, compare names across the packet, and list what is missing. The assistant should not approve the vendor, decide whether a mismatch is harmless, or release a payment tied to the new record.
Start with the business reason and requester
Before asking for bank or tax details, record who requested the vendor and why the company needs it. The request should name the department, service or product, expected invoice path, and employee who will confirm the work was received.
This first note gives the assistant a source inside your company. If a vendor appears without a known requester, the assistant can stop before collecting sensitive records or creating a nearly complete profile that feels ready to approve.
Collect tax records without making a tax decision
For a US person, the IRS says Form W-9 gives the requester the correct taxpayer identification number and certification. A Filipino AP assistant may send the approved request, collect the returned form, and check whether the required name and identification fields are present.
The assistant should not guess at a tax classification or repair a mismatch by changing the vendor record. Put unclear names, blank fields, altered forms, and conflicting addresses on the exception list for the company owner or tax adviser.
Store the form in the approved vendor system rather than a personal inbox or local folder. Limit who can open it, keep the source file with the packet, and follow your company retention rules after the record is accepted or rejected.
Verify bank details outside the request
A new vendor packet can be real while one message inside it is not. Bank details deserve a second path because an attacker may copy a vendor name, use a similar domain, or join an email thread that already contains real invoice facts.
The assistant should save the message, leave the bank field unchanged, and route the item to the named company owner. That owner should call a known number from an earlier contract, approved directory, or independently confirmed company site instead of using a number supplied in the bank-change message.
CISA tells readers to be suspicious of unexpected messages and to confirm the source through a trusted path. Put the approved contact source in the checklist so verification does not turn into a web search made while an urgent request is waiting.
Keep creation, approval, and payment apart
One login should not be able to create the vendor, replace bank details, approve the invoice, and release the payment. The written checklist and software roles should both separate preparation from the company decisions that move money.
NIST defines least privilege as limiting access to the minimum resources needed for assigned work. For the assistant, that may mean one company entity, vendor queue, or document area rather than broad access across the accounting system.
Start with read-only access when the task allows it. If the assistant must enter a draft record, keep approval and activation with another role, then review access when the task or worker changes.
Review the packet before activation
The final review should compare the internal request, legal name, tax record, address, bank verification note, payment terms in the approved agreement, and named invoice approver. It should also show who checked each item and when the check happened.
Do not let a complete-looking packet hide a mismatch. A different legal name, a changed domain, a bank account in another name, or an employee who cannot confirm the vendor should keep the record in review.
Repeat the check when details change
Onboarding is not the last time a vendor record needs care. A new bank account, address, tax detail, contact, or ownership notice should reopen the related check instead of quietly replacing the approved field.
Ask the assistant to keep the old record, log the requested change, and identify the employee who owns the decision. The owner repeats the trusted-contact check and records the source, result, and approval before the record changes.
Copy-ready messages
Two scripts for common AP stops
Put these messages in the SOP and change the bracketed fields. The wording keeps the assistant in a preparation role while the right owner makes the decision.
Missing vendor record request
"Hi [name], I am preparing the vendor packet for [vendor]. The record still needs [missing item]. Please send it through [approved path] or tell me which company owner should review the exception. I will keep the vendor in review until that step is complete."
Bank-detail verification hold
"Hi [name], I received new payment details for [vendor]. I have saved the request and left the current record unchanged. [Company owner] will verify the details through our known vendor contact and record the decision before any update is made."
Vendor onboarding packet check
- Internal requester and business reason are recorded
- Required company and tax records are present
- Bank details were checked through a known contact path
- Assistant access matches the preparation task
- A named employee approved the vendor record
- Later changes reopen the matching check
Keep planning
Related AP role pages
Use the service pages to narrow the first task lane before you contact a staffing provider. The onboarding guide can then turn that lane into a first-week review plan.
Common questions
Accounts payable virtual assistant FAQs
What can a Filipino AP assistant do during vendor onboarding?
The assistant can collect approved forms, check required fields, organize source records, track missing items, and prepare a draft vendor packet. Your company should keep vendor approval, bank-detail approval, invoice approval, and payment release.
Who should verify a new vendor bank account?
A named employee inside your company should verify it through a known vendor contact that did not come from the bank-detail request. The assistant can pause the record and prepare the evidence for that check.
Can the assistant decide whether a tax form is correct?
The assistant can check that required fields are present and flag visible mismatches. Tax classification and acceptance decisions should follow your company process and stay with the responsible company owner or adviser.
How much system access should the assistant receive?
Give only the access needed to collect records or prepare the assigned vendor fields. Keep activation, approval, broad administration, and payment release in separate company roles.
What happens when an existing vendor changes bank details?
Keep the old record, log the request, and repeat the known-contact verification. A named company owner should approve the change before anyone updates the active payment record.
Factual checks
Sources
These sources support the tax-form, access-control, and phishing guidance in this article. The planning numbers above are labeled examples and do not come from these sources.
- 1. FBI IC3, 2024 Annual ReportReports 21,442 BEC complaints in 2024, compared with 21,489 in 2023 and 21,832 in 2022. Its loss table supplies the chart values, and its introduction contains Yarbrough's exact quote.
- 2. FBI IC3, Business Email Compromise: The $55 Billion ScamReports 305,033 BEC incidents and $55,499,915,582 in exposed loss from October 2013 through December 2023.
- 3. IRS, Form W-9The form says a US person gives the requester a correct taxpayer identification number and certification. This source does not apply to every vendor or country.
- 4. NIST CSRC Glossary, Least PrivilegeDefines least privilege as restricting access to the minimum system resources needed for assigned work.
- 5. CISA, Avoiding Social Engineering and Phishing AttacksLists common phishing clues and recommends checking suspicious messages through a trusted source.