Make.com Vendor Onboarding Workflow: AI KYC, Contracts & ERP Sync
Problem Context
Vendor onboarding is often slow and error-prone: manual document handling, inconsistent identity and risk checks, contract delays, and missing or mismatched vendor data in the ERP. The objective is a Make.com scenario that accepts vendor submissions, extracts and validates documents, runs AI-assisted KYC/risk screening, produces a contract from a template and e-signs it, then synchronizes a verified vendor master to the ERP — all with deterministic error handling and finance-ready acceptance criteria.
Implementation Workflow
The implementation is a set of modular Make.com scenarios/subflows. Each module uses an intake ID (idempotency key) passed through the pipeline so retries do not create duplicates.
- Intake & Document Capture
- Trigger: Webhook module receives a vendor submission from a form or vendor portal (Typeform/Google Forms). Files are uploaded to a secure cloud folder (Google Drive/S3) via Make modules and linked to the intake ID.
- Create a canonical draft vendor record in a lightweight store (Airtable/Google Sheets/Make DB) capturing raw inputs and file paths.
- OCR & Field Extraction
- Invoke OCR (Google Vision via HTTP module or a dedicated OCR API) to extract structured fields: company name, registration numbers, tax IDs, bank details, and authorized signer data.
- Write OCR outputs and confidence scores back to the draft record. If required fields are missing or confidence is low, route the record to human review (Slack/email with file attachments and an action button to correct).
- AI KYC & Risk Screening
- Use OpenAI modules following a strict JSON-output prompt pattern to normalize names and addresses, then call sanctions/PEP APIs (or combined third-party vendor) to look for exact and fuzzy matches.
- Aggregate results into a risk score with attached rationale tokens (matched-list ID, fuzzy-match confidence, adverse-media flag). Persist the raw evidence snapshot for audit.
- Decision logic: auto-approve if risk < low threshold; route to compliance when medium; block and auto-notify vendor when risk > high threshold. All escalations require human sign-off before blocking.
- Contract Generation & E-Sign
- For approved vendors, generate a contract using DocsAutomator/TemplateDocs or Google Docs templates. Feed vendor fields, risk tier, and conditional clauses (e.g., additional indemnities for certain jurisdictions) into the template population module.
- Produce a PDF and initiate e-sign via DocuSign/HelloSign connector. Track signer audit trail and PDF storage location on the vendor record. If e-sign fails, retry transiently; if persistent, route to legal for manual signing.
- ERP/Accounting Sync
- Once contract is signed and finance acceptance is recorded, push vendor master data to the ERP using a native Make connector or REST API module. Use a staging-create-then-promote flow: create in ERP staging endpoint and validate returned ERP ID before promoting to production vendor master.
- Map critical fields: vendor name, legal entity, tax ID, bank token (never raw account numbers in logs), payment terms, default GL mapping, and onboarding tag. Persist ERP ID and last-sync timestamp.
- Notifications & Audit Trail
- Send templated notifications to procurement, compliance, and finance at each critical milestone. Maintain a secure archive of all artifacts (OCR output, KYC report, contract versions, sign audit) linked to the vendor record for compliance and internal audit.
Error-Handling & Supervisor Pattern
- Idempotency: generate a unique intake ID at first touch and include it in all downstream API calls to prevent duplicate vendor creation.
- Retries: standard exponential backoff for transient network/API errors. Implement Make scenario-level retry and a supervisor subflow that attempts N retries then escalates with payload context.
- Error routing: each failure writes a detailed entry (module name, payload snapshot, error text) to an error queue (Airtable/DB). Automated remediation steps and a link to jump to human remediation UI should be included.
- Dead-letter handling: records stalled in review for configurable time (e.g., 72 hours) auto-escalate to a manager with recommended remediation actions.
Acceptance Criteria for Finance
- Mandatory fields: validated tax ID, ERP vendor ID, signed contract PDF with audit trail, payment terms, currency, and GL code mapping. Any missing required field flags the vendor as “payment-disabled”.
- Bank verification: bank account must be token-verified (micro-deposit or third-party account-verify) before payment-enabled flag is set.
- Auditability: every onboarding decision must have stored evidence (OCR outputs, KYC report, contract version) accessible from the vendor record for at least the retention period required by finance/regulation.
- SLAs: low-risk vendors fully onboarded <48 hours; medium-risk within 5 business days with compliance sign-off tracked in the record.
Architecture Notes
- Keep Make scenarios modular: Intake, OCR, KYC, Contracting, ERP Sync, and Error Supervisor as separate scenarios to simplify monitoring and reusability.
- Data model: canonical vendor draft with version history and immutable audit artifacts. Store secrets and tokens in a secrets manager and do not log raw PII or banking details.
- Prefer native Make connectors for Google Drive, DocuSign, and supported ERPs. For unsupported ERPs use secure REST modules with sandbox-first testing and idempotent endpoints.
- Observability: emit structured events (module, latency, risk score) to a logging/monitoring workspace for trend analysis and SLA reporting.
Risks and Guardrails
- LLM hallucination: require strict JSON schema outputs and post-validate LLM responses against deterministic checks (regex, list lookups). Never rely solely on LLM output for deny decisions.
- Privacy: encrypt PII at rest, redact logs, and obtain vendor consent at intake. Minimize PII in LLM prompts; use identifiers or hashed values where possible.
- Regulatory: keep humans in the loop for adverse actions; retain full audit trails for compliance reviews.
- Operational exceptions: support a manual intake path for legacy suppliers and ensure the same approvals, audit, and ERP sync gates apply.
What To Do Next
- Workshop the minimal canonical vendor data model with procurement, finance, and compliance to align required fields and SLAs.
- Build modular Make scenarios in sandbox: Intake → OCR → KYC → Contract → ERP Sync. Test each step with synthetic and pilot vendor data.
- Run a controlled pilot with a segment of vendors, measure SLA and error outcomes, tune AI thresholds, and expand after meeting finance acceptance targets.
Sources
- Make Developer Hub — Make API documentation: https://developers.make.com/api-documentation
- Make Apps Documentation — Make modules & connections: https://apps.make.com/make
- OpenAI modules for Make: https://apps.make.com/openai-modules
- Google Docs + OpenAI integration examples: https://www.make.com/en/integrations/google-docs/openai-gpt-3
- DocsAutomator — templated documents in Make: https://apps.make.com/docsautomator
- TemplateDocs integration with Make: https://templatedocs.io/docs/integrations/make
- Cadmon Systems partner examples for ERP integrations: https://www.make.com/en/partners-directory/cadmon-systems
- Scalevise case study on Make onboarding automation: https://scalevise.com/resources/automating-onboarding-with-make-from-2-weeks-to-2-hours/
