2026-09-03
Supplier Legitimacy Signals: What Procurement Checks Before an RFQ
Before sending a request for quotation (RFQ), experienced procurement teams always look for supplier legitimacy signals procurement checks before rfq—the quick, trust-building indicators that separate real manufacturers from empty storefronts. Scanning a supplier’s website, domain ownership, certifications, and contact transparency can save weeks of dead-end conversations and protect a supply chain from fraud, IP leakage, or quality disasters. This guide walks through the exact signals buyers evaluate and the red flags they scan for in under 60 seconds.
Why Procurement Checks Supplier Legitimacy Before an RFQ
An RFQ reveals detailed capacity, pricing, and process information. Sending it to an unverified entity carries real risk: design theft, fake certifications, or simply a trading desk posing as a factory. By vetting legitimacy signals first, procurement teams reduce the chance of negotiating with a ghost supplier. A 2023 survey by the Chartered Institute of Procurement & Supply found that 47% of buyers had encountered a supplier whose claimed credentials did not match public records, leading to project delays and forced re-sourcing. The cost of a quick pre‑RFQ scan is a few minutes; the cost of skipping it can be a failed audit or a lost shipment. That’s why the most reliable supplier legitimacy signals procurement checks before rfq are baked into the initial sourcing workflow—before any numbers are shared.
The Supplier Website as a Legitimacy Signal
A supplier’s own website is one of the first legitimacy signals procurement checks before an RFQ, often carrying more weight than a marketplace storefront. A dedicated domain signals that the manufacturer has invested in a permanent, independent presence. Buyers examine the domain age (easily checked via whois), SSL certificate validity, and the “About” page for a verifiable company history. A site that lists a physical production address, a landline phone number, and a real team photo—not stock imagery—communicates operational transparency. Google’s search quality guidelines reward legitimate business sites that demonstrate clear ownership, and procurement teams have adopted a similar eye. A thin, managed site that answers the five W’s (who, what, where, when, and how) with clean, factual content regularly outperforms a bloated, template-heavy portal in trust-building. Even a simple, fast-loading presence with a genuine domain tells a buyer: “I am a real business, and I am easy to contact.”
Certifications, Registrations, and Proof Points That Matter
Beyond the website, buyers cross‑check formal credentials. The table below lists the most common legitimacy signals and how a procurement officer verifies them quickly.
| Signal | What It Proves | How to Verify |
|---|---|---|
| ISO 9001 / 14001 / 45001 | Quality, environmental, or safety management system | Check the certificate number on the issuing body’s public database (e.g., UKAS, ANAB). |
| CE, UL, FCC marks | Product compliance for target markets | Request a test report; cross‑reference with the notified body number. |
| Business registration number | Legal existence and registered address | Search national company registries (e.g., Companies House, China’s NCR, MCA India). |
| Third‑party audit (SGS, Bureau Veritas, TÜV) | Factory capability and social compliance | Ask for a recent audit report with a visible report ID. |
| BSCI, Sedex, SA8000 | Ethical sourcing and labor standards | Validate membership on the platform’s public directory. |
Procurement professionals also check industry‑specific registrations: FDA registration for medical devices, IATF 16949 for automotive, or GMP for pharmaceuticals. A supplier who proactively publishes certificate numbers—and links to the verification portal—saves buyers the effort of chasing documentation and signals confidence in their own compliance.
Red Flags Procurement Scans for on a Supplier’s Site
Even without a formal audit, a trained eye catches warning signs within seconds. The following checklist is common among sourcing teams when evaluating supplier legitimacy signals procurement checks before an RFQ is sent:
- No physical address or a PO‑box only. Legitimate manufacturers proudly show their factory location, often with a pinned map.
- Free email addresses (Gmail, Yahoo, 163.com) as the sole contact. Business email on the company domain is a basic signal of operation.
- Generic stock photos or watermarked images from other websites. Reverse image search often reveals the same picture used by dozens of “suppliers.”
- Missing SSL certificate (no HTTPS). Browsers flag the site as insecure, eroding trust instantly.
- Cloned product descriptions. Copied text from Alibaba or competitor sites suggests a reseller with no in‑house knowledge.
- No company registration number or about‑page. A site that hides its legal identity is a hard pass for most procurement departments.
- Unrealistic capability claims. A small workshop claiming to produce 10,000 complex units per day without evidence raises an immediate red flag.
FAQ
How can I verify a supplier’s business license online?
Most countries maintain a public corporate registry. In China, you can search the National Enterprise Credit Information Publicity System (NCR) by the supplier’s unified social credit code. In the UK, Companies House offers free company search. In India, the Ministry of Corporate Affairs portal provides master data. Enter the registration number exactly as it appears on the supplier’s website or certificate; a mismatch is a strong reason to pause the RFQ.
Is a supplier’s website alone enough to confirm legitimacy before sending an RFQ?
A website is a strong first filter, but procurement teams never rely on it alone. It confirms the supplier has at least invested in a public presence. However, the site must be combined with a certificate check, a quick domain history look‑up (via whois), and, for high‑value orders, a video call that shows the factory floor. The website is the starting point, not the final verdict.
What free tools can procurement use to check a supplier’s domain history?
ICANN’s WHOIS lookup (free) reveals domain registration date, owner country, and registrant organization. The Wayback Machine (archive.org) shows how long the site has been live and whether it previously sold unrelated products. Google’s Transparency Report can also indicate if the site has been flagged for security issues. These tools take less than two minutes to run and often expose shell companies or recently created domains posing as decade‑old factories.
What if a supplier has no website at all?
A supplier without any own‑domain presence is a significant risk for overseas buyers, especially when the RFQ involves proprietary designs. While a marketplace storefront is better than nothing, lacking a dedicated site often means the business is either very small, purely transaction‑focused, or unwilling to invest in transparency. In such cases, procurement teams typically request additional verification steps—like a live video tour of the facility—before releasing any detailed specifications.