W-9 Collection: Automate IRS TIN Matching Before CP2100 Notices

Collect a properly completed, signed W-9, validate the payee’s TIN, and store the record. This workflow prevents backup withholding exposure and CP2100 notices. IRS guidance sets the rules for acceptable submission methods, TIN Matching confirms the name and number match IRS records, and a platform like TaxFormHero now automates each step.

---

TL;DR:

• During the 60 days after a payee marks a TIN as Applied For, withholding relief applies only to certain interest, dividend, and similar payments.
• Electronic submissions need access logs, identity checks, paper equivalent fields, exportable copies, and a final signature tied to the perjury statement.
• Enroll in IRS online services, then use interactive matching for small checks or bulk matching for up to 100,000 name and TIN pairs per file.
• After a CP2100 notice, send the required first B notice within 15 business days; begin 24% backup withholding on future reportable payments when required.
• Keep each form, matching result, notice, and response together in the vendor file for at least four years, including an accessible copy of electronic submissions.

---

Step-by-Step W-9 Collection Checklist for AP and Finance Teams

Every W-9 collection process starts with a decision: which payees require a form. We recommend requesting a W-9 from contractors, freelancers, and vendors when needed for your reporting and compliance process, along with any payee whose business structure is unclear. Build a standard request packet once and reuse it for every new vendor.

The checklist below reflects the order most AP teams follow during onboarding.

• Identify which new payees need a W-9 before adding them to your vendor master file.
• Send the W-9 request before or at the time of first payment, attaching the current Form W-9 and brief instructions.
• Accept the form through a documented channel: paper, an IRS-compliant substitute form, or an electronic system that logs access and signature events.
• Check that the name, TIN, address, tax classification box, and signature are all present and legible.
• Record the date received in your vendor file, along with who submitted it.
• Flag any form marked “Applied For” so you can track the applicable TIN-submission period.
• Store the completed form securely and log the result of any TIN validation you perform.

Our W-9 request process guide walks through what to ask for and when, which pairs well with this checklist if you are building onboarding steps from scratch.

A missing signature or an illegible TIN is the most common reason a W-9 gets rejected during review. Build a short verification pause into your intake process so a staff member checks each field before the form gets filed away. Teams that skip this step often discover the error only when a CP2100 notice arrives, at which point the fix is far more expensive than the original request would have been.

Pro Tip: Set a calendar reminder during the “Applied For” period so you have time to follow up before backup withholding may become necessary.

Once a W-9 is on file, treat it as a living record rather than a one-time task. Vendors change business structures, update addresses, or correct a TIN after a bank rejects a direct deposit. Re-request a W-9 whenever you have reason to believe the information on file is outdated, and note the update in the same vendor record rather than creating a duplicate file.

Filing one yourself? You can e-file Form 1099-NEC online with TaxFormHero, an IRS-authorized e-filing platform.

When to Collect a W-9: Timing Rules and the 60-Day Applied-For Window

Timing determines how much risk you carry. Requesting a W-9 before or at the first payment gives you the chance to correct problems before any money moves and before a payment gets reported under an unverified TIN.

The 60-day rule applies when a payee writes “Applied For” in the TIN field because they have submitted an application to the IRS or Social Security Administration but have not yet received the number. The instructions for the requester of Form W-9 specify that this status covers certain interest, dividend, and similar payments, during which the payer may hold off on backup withholding while the payee secures a TIN. Outside of that specific window, “Applied For” does not excuse withholding on other reportable payment types.

• During the applicable period, track the payee’s commitment to supply a TIN and check the IRS instructions for the payment type.
• If no TIN arrives within the applicable period, follow IRS guidance on backup withholding for future reportable payments.
• If the TIN never arrives or turns out to be incorrect, the payment and TIN mismatch can trigger an IRS CP2100 or CP2100A notice after you file your information returns.

A CP2100 notice means the IRS found a name and TIN combination on a filed return that does not match its records. Receiving one starts a chain of obligations, including the B-notice process covered later in this article, so the cleanest way to avoid it is to catch a TIN mismatch during collection rather than after filing.

How to Request a W-9: Acceptable Methods and Substitute Forms

You have more flexibility than many finance teams realize when it comes to how you collect a W-9, as long as the method meets IRS content and signature standards.

1. Paper Form W-9. Send the official Form W-9 as a PDF attachment or printed copy, have the payee complete and sign it, and return it by mail, scan, or secure upload.
2. Substitute forms. You may create your own version of the form as long as its content is substantially similar to the official Form W-9 and it carries the same name, TIN, classification, and signature requirements, as confirmed in the requester instructions.
3. Secure electronic upload. A portal or onboarding system can collect the same data points electronically, provided it meets the IRS standards for electronic systems described in the next section.
4. Agent-transmitted W-9s. A third-party payroll provider or procurement platform may collect the form on your behalf, as long as the data it passes to you matches what the payee actually submitted.

A valid substitute form needs the payee’s name, business name if applicable, federal tax classification, TIN, and a signature made under penalties of perjury. Dropping any of these fields to “simplify” your own version invalidates the substitute and puts you back at square one if the IRS later questions the record.

Most finance teams get the biggest efficiency gain by embedding the W-9 request directly into vendor setup rather than treating it as a separate task. When procurement, HR, or AP onboarding already requires a new vendor record, adding a required W-9 field to that same workflow means no payment can be scheduled until the form is on file. This single change eliminates the most common failure mode: a vendor gets paid before anyone circles back to request tax paperwork.

Electronic W-9 Submission Rules and Signature Requirements

Collecting W-9s electronically is fully permitted, but the system you use has to meet specific IRS standards. The instructions for the requester of Form W-9 require that an electronic system ensure the information received is exactly the information the payee sent, with no alteration in transit.

A compliant electronic system must also:

• Document each submission, including who accessed the form and when.
• Make it reasonably certain that the person submitting the form is the payee identified on it.
• Provide the same data fields and content as the paper Form W-9.
• Produce a hard copy of the submitted form on request.
• Capture an electronic signature that serves as the final entry on the form and carries the penalties-of-perjury statement, except in the rare cases where a signature is not required.

That last point matters more than it might appear. A checkbox or typed name alone does not meet the standard. The signature needs to function as the final, binding act of the submission process, tied to the perjury statement the same way a handwritten signature would be on paper.

Pro Tip: Before adopting any electronic W-9 tool, ask the vendor to show you the audit trail a single submission generates. If it cannot show access logs and a timestamped signature event, it does not meet the IRS standard.

When evaluating or building an electronic collection system, check for these capabilities: real-time field validation that catches a malformed TIN or missing signature before submission, an access log tied to each form, identical data capture to the paper form, and the ability to export a hard copy on demand. A system missing any of these pieces creates a compliance gap that only surfaces when the IRS asks for documentation you do not have.

Validate TINs: How IRS TIN Matching Works

A completed W-9 only tells you what the payee claims their TIN is. TIN Matching confirms whether that name and number combination actually matches IRS records before you file an information return.

Publication 2108 describes two ways to run this check. Interactive TIN Matching lets you submit a small batch in real time and get an immediate match indicator back. Bulk TIN Matching accepts up to 100,000 name and TIN combinations in a single formatted file, which suits payers processing large vendor files (Publication 2108).

• Register for e-Services and complete the TIN Matching application before you can submit any combinations.
• Choose interactive matching for small, time-sensitive checks or bulk matching for high-volume vendor onboarding.
• Review the match indicator returned for each submission and correct any mismatch with the payee before filing.
• Keep the match results on file, since they can support a reasonable-cause argument under section 6724(a) if a notice arrives later.

Enrollment requires an active e-Services account and, for most payers, a history of filing the applicable information returns. Participation in TIN Matching is one of the more direct ways to document reasonable cause if the IRS later questions a TIN on a filed return, because it shows you checked the number before relying on it.

If your organization cannot access TIN Matching directly, whether due to filing volume thresholds or e-Services account limitations, you still have options. Document a signed payee certification on every W-9 you accept, build an internal cross-check against prior-year filings for returning vendors, and consider a third-party verification service built for this purpose. None of these alternatives replace TIN Matching entirely, but each adds a layer of documentation that helps if a mismatch surfaces later.

Handling Missing or Incorrect TINs: CP2100 Notices and Backup Withholding

A CP2100 or CP2100A notice arrives after you have already filed information returns, telling you that a name and TIN combination did not match IRS records. Receiving one is not a request to close out that account by paying it off, it is the start of a specific correction process defined by the IRS backup withholding B program.

• Send a First B Notice to the affected payee within 15 business days of receiving the CP2100, along with a new Form W-9 and a copy of the notice if required.
• If the same payee appears on a second notice within the IRS’s three-year period, send a Second B Notice, which requires the payee to provide a copy of their Social Security card or an IRS-issued verification letter rather than simply resubmitting a W-9.
• Begin backup withholding at 24% on future reportable payments when required, continuing until the issue is resolved (IRS backup withholding guidance).
• Document every notice sent, every response received, and every withholding decision in the vendor file, since this record is what demonstrates compliance if the IRS reviews the account later.

Failing to begin backup withholding when required can leave your organization liable for the uncollected amount, so the re-request and documentation steps above are not optional once a notice arrives. Our contractor refusal guide covers a related scenario: what to do when a payee will not cooperate with the correction process at all.

Recordkeeping and Audit Readiness for W-9 Files

A completed W-9 only protects you if you can produce it later. Retain every W-9 and its related correspondence for at least four years.

• Keep W-9s on file for a minimum of four years, even after a vendor relationship ends.
• Maintain accessible hard copies for any electronic submission, since the IRS can request one even when the original was collected digitally.
• Log TIN Matching results alongside the W-9 they correspond to, not in a separate system that is easy to lose track of.
• File copies of any B-notice sent, the date it was sent, and the payee’s response in the same vendor record.

Our 1099 compliance checklist extends this recordkeeping discipline into the filing season itself, covering the reporting steps that follow once your W-9 files are in order.

Pro Tip: Store the access log for each electronic W-9 submission next to the form itself. If the IRS or a payee disputes when a form was received, that timestamp is your evidence.

A vendor file that separates the W-9, the TIN check, and any notice history across different systems is harder to defend during an audit than one consolidated record. Centralizing these documents by vendor, rather than by document type, saves time when you need to respond to an inquiry quickly.

Why Automation Changes the W-9 Collection Process

Passive collection, meaning sending a PDF and waiting for a reply, commonly produces illegible handwriting, missing signatures, or TINs typed in the wrong format. Each of these errors increases the odds of a CP2100 notice months later, after the return has already been filed.

Automated collection systems address this by validating fields in real time, before the form is ever accepted. A payee cannot submit a W-9 with a malformed TIN or a missing signature field, because the system flags the problem immediately rather than passing it through to your filing team.

• Real-time field validation catches formatting errors before the form reaches your records.
• Integrated TIN checks at the point of collection replace a separate verification step later.
• Encrypted storage protects the payee’s TIN and personal information at rest.
• Exportable audit logs give you the access and signature history an examiner or payee dispute might require.

Because TIN Matching results can support a reasonable-cause argument under section 6724(a), running the check automatically at the point of collection, rather than as an afterthought before filing, gives you documentation exactly when you need it. We built our own platform around this sequence: IRS-authorized e-filing, TIN verification support, and a SOC 2 Type I attestation that reflects the controls around how that data is handled.

How to Securely Store and Protect W-9 Form Data

A W-9 contains a Social Security number or EIN, a legal name, and an address, which makes it sensitive data that deserves the same protection as any other financial record. Store completed forms in an encrypted system rather than a shared drive or unprotected email inbox, and restrict access to the finance or AP staff who actually need it.

Limit who can view or export W-9 data, and keep a log of who accessed each record and when. This access log becomes part of your audit trail if a payee later disputes when or how their information was submitted.

Avoid storing W-9s as loose attachments in email threads, since this makes both the retention requirement and the access control requirement difficult to meet. A dedicated vendor management system, whether built in-house or through a platform designed for this purpose, keeps the form, the TIN validation result, and the access history together in one place.

When the retention period ends, dispose of the records in a way that destroys the sensitive data rather than simply deleting the file reference, since a deleted reference can often still be recovered. Treat W-9 storage as a data privacy obligation as much as a tax compliance one, because the SSN or EIN on the form carries the same exposure risk as any other piece of personally identifiable information your organization holds.

Steps to Take If a Payee Refuses to Provide a W-9

A payee’s refusal to provide a W-9 does not relieve you of your reporting obligation, so the correct response is to document the refusal and begin backup withholding rather than skip the payment or the filing. Make at least one documented, written request before treating the situation as a refusal, since a payee who simply missed the first request is different from one who is actively declining.

Once a refusal is confirmed, begin withholding at the standard backup withholding rate on reportable payments going forward, and keep a record of the date and method of your request alongside the payee’s response. You can still file the required information return using whatever information you have, noting the missing TIN, rather than leaving the payee off your filing entirely.

Before classifying a worker as a vendor who should be providing a W-9 in the first place, confirm the relationship is actually a contractor arrangement rather than an employment relationship, since the two carry different reporting rules. A contractor versus employee resource can help HR and finance teams sort out that distinction during onboarding, before a W-9 request even becomes necessary.

Prevention Beats Remediation in W-9 Collection

The pattern we see across AP and finance teams is consistent: organizations that treat W-9 collection as a one-time intake task spend far more time later chasing corrections than those that build validation into the process from the start. A rejected form, a mismatched TIN, or a B-notice cycle all cost more in staff hours than the few minutes it takes to verify a form correctly the first time.

Secure collection and TIN validation are not separate compliance checkboxes, they are the two controls that prevent almost every downstream problem covered in this article. When a W-9 is collected through a system that validates fields and checks the TIN at intake, the CP2100 and B-notice process becomes something you read about rather than something you manage.

We think the highest-leverage move any finance team can make this year is moving W-9 collection out of email threads and into a system built for it.

— Nazrul

How TaxFormHero Supports W-9 Collection and TIN Verification

We now offer automated W-9 collection, built to support the workflow this article describes.

Our platform supports electronic W-9 collection. We also offer TIN Check at current prices, so you can check a name and TIN match as part of your workflow. Once your W-9s are collected and verified, filing moves straight into 1099-NEC e-filing; current prices are on our pricing page. Add-ons like print and mail delivery or encrypted e-delivery are available per form if you need to send recipient copies alongside your filing, detailed on our pricing page.

If your current W-9 process still runs through email attachments and spreadsheets, moving the request, collection, and TIN check into one system is the fastest way to close the gaps covered in this article. Visit our 1099-NEC filing page to see how collection and filing connect in one workflow.

FAQ

Why does a bank collect a W-9?

A bank or financial institution collects a W-9 to confirm the correct name and taxpayer identification number tied to an account before reporting interest or other income to the IRS. Without a valid W-9 on file, the institution may be required to apply backup withholding on payments made to that account.

How do you fill out a W-9 step by step?

A payee enters their name, business name if applicable, federal tax classification, address, and taxpayer identification number, then signs and dates the form under penalties of perjury. The official Form W-9 includes line-by-line instructions for each field, and the form is not valid without a signature where one is required.

How long does it take to get a W-9?

There is no fixed IRS timeline for how quickly a payee must return a W-9, so the turnaround depends on how promptly your request is sent and how the payee responds. Requesting the form before or at the time of first payment, through a system that prompts for immediate completion, typically shortens this window considerably compared to an email request left unanswered.

What happens when you fill out a W-9 form?

Once a payee submits a completed W-9, the requester uses the name and TIN to prepare information returns like Form 1099-NEC and may run a TIN Matching check to confirm the information against IRS records. The requester should retain the completed form for at least four years and may need to begin backup withholding if the TIN is later found to be missing or incorrect.

Sources

• Form W-9 (Rev. June 2026)

Recommended

• IRS TIN Matching Guide for Tax Professionals: 2026
• TIN Matching & Verification
• The W-9 Request Process: What to Ask For and When
• $2,000 Threshold: Generate 1099-NEC via IRIS for U.S. Contractors