Guide · Mexico

Supplier due diligence guide for SMEs

Service risk → identity → capacity → integrity → continuity → controls → monitoring.

Last reviewed: August 17, 2026Editorial direction: Christian Zarur EliasReading: 6–9 min

Short answer

What you should know before deciding

The depth of the review should follow the risk: amount, down payment, data access, operational dependency, outsourcing and regulatory exposure. A critical supplier requires more evidence, contractual controls and monitoring than an occasional low-impact purchase.

01

Work sequence

Service risk → identity → capacity → integrity → continuity → controls → monitoring.

The sequence avoids opening indiscriminate searches: each step must answer a question, produce evidence and leave a verifiable conclusion.

  1. 01
    Classifies criticality, access and amount.

    Define in writing the objective, scope and criteria that will be used to decide.

  2. 02
    Verify company, relevant beneficiaries and representative.

    Record who provided the information, how it was validated, the cutoff date, and any differences that require clarification.

  3. 03
    Evaluates technical capacity and references.

    Record who provided the information, how it was validated, the cutoff date, and any differences that require clarification.

  4. 04
    Review relevant fiscal, judicial and regulatory signals.

    Record who provided the information, how it was validated, the cutoff date, and any differences that require clarification.

  5. 05
    Defines contractual and operational mitigants.

    Record who provided the information, how it was validated, the cutoff date, and any differences that require clarification.

  6. 06
    Update the review when the risk changes.

    Conclude with confirmed facts, open items, limitations, and actions; avoid an opaque score.

Practical application

What to check and what to ask

Useful documents or evidence

  • Tax and corporate identity of the exact counterparty.
  • Powers of the signatory and bank account of the same entity.
  • Experience, references and evidence of technical capacity.
  • Permits, insurance, certifications or policies required by the service.
  • Information about subcontractors and data processing when applicable.

Control questions

  • What happens if the provider fails or disappears?
  • Will you have access to money, systems, facilities or personal data?
  • Do advance payments and dependency require guarantees or partial deliveries?
  • What signs should be monitored during the relationship?

Frequent errors

  • Apply the same questionnaire to all suppliers.
  • Rely only on a commercial opinion or tax evidence.
  • Paying to a different person's account without documented explanation.
  • Close the review upon signing and skip subsequent risky changes.

Scope and limits of this information

This content is educational and does not constitute legal advice for a specific case. A match does not confirm identity; a lawsuit is not equivalent to a sentence; a publication must be read in its state and date; The absence of findings only describes the sources reviewed and does not guarantee absence of risk.

Availability, coverage and updating of records vary. Before making a material decision, allow clarification, preserve evidence and request specialized advice when the result depends on a legal, fiscal, registry or contractual interpretation.

Next step

Apply an investigation proportional to your decision

ZLI verifies sources, reduces homonyms, and documents facts, boundaries, and points to clarify.

Request investigation →