Onboarding a foreign supplier: an IT services firm's procurement checklist

Introduction

You've identified the right tech expert, but your procurement process stalls because they invoice from Dubai, Bali or another non-EU jurisdiction.

The topic isn't just administrative. For an IT services firm, onboarding a foreign supplier exposes several functions at once: procurement, finance, legal, compliance, delivery and sometimes the end client.

The risk rarely concerns the freelancer's competence. It concerns the supplier file.

Who signs the contract? Which entity invoices? Which KYC checks to run? How to handle VAT? How to document due diligence? How to avoid a relationship comparable to staff secondment? How to secure the purchase order without slowing the mission?

This article offers an operational method to onboard a foreign supplier in a firm context, with a procurement checklist, the compliance points to document, and the cases where a French contractual intermediary such as StelarWork can reduce friction.

Important note: this article is general information for IT services firms. It does not constitute personalised legal, tax or social advice. Situations must be validated with your usual advisers depending on the countries, contracts and flows involved.

Why onboarding a foreign supplier stalls on the firm's side

A foreign supplier can be technically excellent and commercially aligned, yet remain hard to reference.

The blocks often come from very concrete points:

• no entity registered in France;
• an invoice issued from a jurisdiction unfamiliar to accounting;
• incomplete or non-standard KYC documentation;
• uncertainty about the freelancer's genuine tax residence;
• difficulty obtaining certificates equivalent to French standards;
• contractual conditions not aligned with those of the end client;
• perceived risk on confidentiality, intellectual property or GDPR;
• difficulty framing a day-rate service without falling into a mere-secondment logic.

For the firm, the problem is therefore not just to "pay a foreign freelancer". The problem is to turn a delivery opportunity into a clean supplier relationship that is documented and acceptable to procurement.

That's exactly what an onboarding procedure must address.

Onboarding a foreign supplier: the three questions to settle first

Before collecting documents, you have to qualify the relationship.

Three questions structure the file.

1. Who is the firm's contractual supplier?

The firm must know which entity it's contracting with.

It can be:

• a foreign company owned by the freelancer;
• a sole trader established outside the EU;
• a French company acting in its own name and subcontracting part of the service to the foreign expert.

This distinction changes everything: KYC, invoicing, VAT, contractual liability, back-to-back clauses, dispute handling and procurement acceptability.

The key point is simple: the supplier signing with the firm must be legally identified, authorised to invoice and responsible for the service it sells.

2. Where is the service actually delivered?

The place of operational delivery matters.

A sound configuration assumes the freelancer genuinely works from their country of residence or from a remote environment consistent with their status.

Conversely, an abusive configuration would consist in presenting a freelancer as a non-EU resident while they actually work in an organised way from France, with a stable, recurring and undocumented presence.

Tax residence is not declared. It rests on facts: duration of presence, centre of interests, place of effective activity, work organisation, personal and economic ties.

You must therefore document the reality principle: genuine residence, genuine remote mission, absence of an organised presence in France, absence of an artificial structure created solely to circumvent the rules.

3. Is the service framed as a supplier outcome?

A firm can buy a service priced on a day rate. That's common.

But the day rate must not erase the nature of the supplier relationship.

The contract and the purchase order must describe:

• a service scope;
• deliverables or objectives;
• an expected level of expertise;
• validation terms;
• project governance;
• supplier responsibility;
• confidentiality and intellectual property rules.

The relationship must avoid indicators of an integration comparable to internal staff: subordination, direct hierarchical control, absence of autonomy, a mere resource assignment with no service responsibility.

The right reflex isn't to "place" a foreign consultant. The right reflex is to contract a supplier service, with a scope, deliverables, governance and a clear chain of responsibility.

Firm procurement checklist to onboard a foreign supplier

A firm's procurement checklist must be short but complete. It must allow you to decide quickly whether the supplier can be referenced directly or whether you need an intermediary contractual structure.

1. Supplier identification

To collect:

• legal name;
• legal form;
• country of registration;
• local registration number;
• registered or business address;
• identity of the legal representative;
• beneficial owners where the information is available;
• bank details in the supplier's name;
• proof of the company's existence or of independent activity.

Goal: verify that the supplier exists, is identifiable and can commit contractually.

For a foreign freelancer, documents vary greatly by country. You must therefore reason in terms of documentary equivalence, without mechanically requiring the same documents as in France.

2. KYC and compliance

KYC answers a simple question: who is the firm really working with?

The review can cover:

• the supplier's identity;
• the country of residence or establishment;
• consistency between address, bank and invoicing;
• international sanctions and asset-freeze lists;
• beneficial owners if a company;
• absence of any obvious red flag on the activity;
• consistency between LinkedIn profile, references, company and proposed mission;
• ability to provide a compliant invoice.

KYC isn't a decorative formality. It protects the firm, its end client and the contractual chain.

3. Due diligence and subcontracting

Due diligence, in the broad operational sense, consists in verifying that the firm isn't bringing an uncontrolled party into its supplier chain.

Depending on the case, you must document:

• the provider's identity;
• the absence of undeclared work under the applicable requirements;
• the subcontracting chain;
• confidentiality rules;
• security obligations;
• the accessible data;
• the restrictions imposed by the end client;
• any sector-specific requirements.

In a non-EU relationship, some French certificates don't exist. You then have to define a reasonable approach: equivalent documents, contractual declarations, warranties, documentary audit, right to terminate in the event of inaccurate information.

4. Taxation and VAT

Taxation is often the point that slows finance.

If the firm contracts directly with a foreign supplier, you must check:

• the supplier's country of establishment;
• the nature of the service;
• the place of taxation;
• the applicable VAT rules;
• reverse-charge obligations where relevant;
• the mandatory statements on the invoice;
• the accounting treatment by the firm;
• any withholding tax depending on the applicable countries and treaties.

No tax analysis should rely solely on the supplier's commercial promise.

The reality principle prevails: genuine residence, activity genuinely carried out outside France, absence of an organised presence in France, absence of a shell entity.

A sound configuration: a tech expert who is a genuine non-EU tax resident, effectively working remotely from their country of residence, with a consistent local company or status, and documented invoicing.

An abusive configuration: a structure created in a foreign jurisdiction while the activity is habitually carried out from France, with an organised presence and no substance. This type of arrangement must be ruled out.

StelarWork does not sell a tax advantage to the freelancer. If an expert is already a genuine non-EU tax resident, StelarWork removes an administrative friction on the firm's side by providing a French contractual supplier, but it doesn't artificially transform the provider's tax residence.

5. Contract

The contract must be suited to an international B2B service.

Points to check:

• the exact identity of the parties;
• the object of the service;
• deliverables or objectives;
• schedule;
• day rate or pricing terms;
• validation conditions;
• invoicing;
• liability;
• confidentiality;
• intellectual property;
• security;
• data protection;
• subcontracting;
• anti-corruption and sanctions compliance;
• governing law;
• dispute resolution;
• termination conditions.

The contract must also be consistent with the contract signed between the firm and its end client.

That's the back-to-back principle: the obligations the firm takes on towards its client must be passed down, to the relevant extent, to its supplier.

6. Purchase order

The purchase order is often the document that makes the relationship operational.

It must include:

• the framework-contract reference;
• the mission scope;
• the project name;
• the period;
• the day rate or fixed price;
• the budget cap;
• the deliverables;
• the validation terms;
• the operational contacts;
• the invoicing conditions;
• any end-client constraints.

A too-vague purchase order creates a risk.

"Senior developer — 6 months — day rate X" is generally insufficient if it isn't attached to a defined service.

A more solid purchase order specifies the context, the expected work, the milestones, the acceptance criteria or at least the monitoring and validation terms.

7. Security, confidentiality and GDPR

A foreign supplier can access code, documentation, environments, tickets, internal data or client information.

The firm must therefore check:

• the required access level;
• the authentication rules;
• the use of personal or provided equipment;
• the authorised environments;
• copy or export restrictions;
• confidentiality obligations;
• the possible location of the data;
• the supplier's GDPR role: processor, sub-processor or mere framed access;
• minimum security measures;
• end-of-mission rules: access revocation, return, deletion.

GDPR doesn't mean a non-EU supplier is impossible. It means the flows must be qualified and framed when personal data is involved.

The sensitive point: avoiding the false good idea of the "simple" foreign supplier

Some files seem easy at first.

The freelancer sends a foreign invoice. The firm pays. Delivery starts.

But without structured onboarding, several problems can appear later:

• an invoice rejected by accounting;
• an end client refusing the supplier chain;
• the absence of a usable intellectual-property clause;
• doubt about the tax residence;
• a VAT inconsistency;
• no KYC;
• difficulty terminating;
• a confidentiality problem;
• inability to justify the subcontracting in an audit.

The topic isn't to prevent the firm from working with international talent. The topic is to make this collaboration compatible with the procurement and compliance standards of a French firm.

When referencing a foreign supplier directly can work

Direct referencing can be relevant when the foreign supplier presents a robust file.

This is generally the case if:

• the foreign company is clearly registered;
• the beneficial owners are identifiable;
• the bank details are consistent;
• the invoices meet the firm's requirements;
• the country presents no particular difficulty for finance;
• the contract is accepted by the supplier;
• the intellectual property and confidentiality clauses are aligned;
• the service is genuinely delivered outside France;
• the end client accepts this supplier chain;
• the procurement teams know how to handle this type of file.

In this configuration, the key is documentation.

A well-documented foreign supplier can be onboarded cleanly. But the time required can be high, especially if each file is handled as an exception.

When a French intermediary supplier becomes useful

A French contractual intermediary becomes useful when the firm wants to work with a foreign expert but can't or won't reference their foreign entity directly.

This is typically the case when:

• procurement refuses non-EU suppliers;
• finance doesn't want to handle a foreign invoice;
• the end client requires a French contractual chain;
• foreign KYC is too heavy for a short mission;
• the contract proposed by the freelancer isn't acceptable;
• VAT or the reverse charge creates internal friction;
• referencing lead times are incompatible with the project start;
• the firm wants a more readable supplier relationship.

In this model, the firm contracts with a French company. That company invoices the firm, frames the service and contracts on its side with the foreign provider.

The important point: the intermediary must contract in its own name. It must not present itself as the freelancer's representative in France or conclude in the freelancer's name. This distinction notably limits the risks around permanent establishment and clarifies the chain of responsibility.

How StelarWork fits into this scheme

StelarWork is a French company (SASU) designed to smooth collaborations between French firms and tech freelancers based outside the EU.

Its role is contractual and operational.

StelarWork acts as the firm's French supplier, in its own name. It invoices the firm, contracts with the foreign provider, organises the necessary compliance documents, frames the relationship and pays the freelancer under the agreed conditions.

The firm thus gets a French supplier that's more readable for its procurement, instead of having to onboard a hard-to-reference foreign entity directly.

StelarWork doesn't create a foreign tax residence for the freelancer. It doesn't turn a French situation into an offshore one. The model targets cases where the freelancer is already genuinely based outside the EU, effectively works remotely, and has a situation consistent with their country of residence.

StelarWork doesn't position itself as the freelancer's agent. It doesn't sign in the freelancer's name. It contracts in its own name with the firm and then organises its supplier relationship with the foreign provider.

The scheme must remain that of a B2B service: scope, deliverables, validation conditions, confidentiality, intellectual property, compliance and invoicing.

For the firm, the interest isn't to bypass procurement. The interest is to present them with a French supplier, a usable contract, a clear purchase order and a compliance file that's simpler to process.

The documents to prepare before procurement validation

To speed up onboarding, prepare a standard file.

Supplier file

• registration extract or equivalent document;
• identity of the legal representative;
• invoicing details;
• bank details;
• beneficial-owner information where available;
• suitable certificates or compliance declarations;
• confidentiality policy or contractual commitment;
• administrative and operational contacts.

Service file

• mission description;
• project context;
• expected deliverables;
• level of expertise;
• validation terms;
• schedule;
• day rate or fixed price;
• order cap;
• reporting rules;
• end-client constraints.

Legal file

• framework contract;
• purchase order;
• confidentiality clauses;
• intellectual property clauses;
• security clauses;
• GDPR clauses if necessary;
• right to terminate;
• back-to-back obligations with the end client;
• subcontracting rules.

Tax and accounting file

• the supplier's country of establishment;
• the invoicing regime;
• invoice statements;
• VAT or reverse charge depending on the chosen scheme;
• currency;
• payment terms;
• consistency between supplier, bank and invoice.

This firm procurement checklist isn't meant to create heaviness. It avoids late back-and-forth, which often occurs after operational start.

The contractual clauses not to neglect

Object of the service

The object must describe a service, not just a presence.

Prefer a wording centred on the expected work: development of modules, technical audit, migration, architecture, bug fixing, automation, documentation, technical support on a defined scope.

Deliverables and validation

Even on a day rate, you can provide for:

• handled tickets;
• pull requests;
• audit reports;
• architecture documents;
• milestones;
• progress reports;
• monthly validation.

The goal isn't to rigidify the mission. The goal is to prove there is a monitored and validated service.

Intellectual property

Intellectual property is critical in tech missions.

The contract must specify the assignment or usage rights of the developments, documents, scripts, configurations, architectures and other elements produced in the mission.

These clauses must be consistent with the commitments the firm has made to its end client.

Confidentiality

The confidentiality clause must cover:

• the firm's information;
• the end client's information;
• the source code;
• access;
• data;
• technical documents;
• commercial information;
• the duration of the obligation.

Security

The security clause must provide for minimum rules:

• named access;
• no sharing of credentials;
• workstation protection;
• use of authorised tools;
• incident reporting;
• access revocation at the end of the mission.

Subcontracting

If the supplier can itself rely on a third party, this must be framed.

In many firm missions, it's preferable to prohibit unauthorised subcontracting or to make it subject to prior written agreement.

Termination

Termination must allow a clean exit in the event of:

• end-client refusal;
• documentary non-compliance;
• a security breach;
• a performance failure;
• loss of access;
• end of project;
• inaccurate KYC information.

Points of attention specific to freelancers based outside the EU

Genuine tax residence

A freelancer based outside the EU must be able to explain where they genuinely live and work.

A mere administrative address isn't enough. A foreign company with no substance, used while the activity is carried out from France, creates a significant risk.

The sound configuration rests on consistent facts: genuine residence, effective remote work, no organised presence in France, invoicing aligned with the activity.

Permanent establishment

Permanent establishment can become an issue if an activity is organised in France in a sufficiently characterised way, or if a person acts as a dependent agent concluding contracts in the foreign supplier's name.

In a clean scheme, the French intermediary company must not act in the foreign freelancer's name. It contracts in its own name with the firm and carries its own commercial relationship.

This separation must be reflected in the contracts, the invoices and the communication.

Presence in France

An occasional trip to France for an event or a meeting doesn't have the same significance as a regular, organised presence.

You must document the mission's real terms: remote, main country of execution, absence of a permanent workstation in France, absence of a lasting integration in the firm's or the end client's premises.

Operational relationship

The foreign freelancer can take part in project rituals. But governance must stay compatible with a supplier service.

Instructions must relate to the scope, priorities, deliverables and validations. They must not create a direct hierarchical relationship comparable to that of internal staff.

A workflow model to onboard a foreign supplier

Here's a simple workflow a firm can use.

Step 1: qualify the need

• Which project?
• Which end client?
• Which scope?
• What estimated duration?
• What access level?
• What pricing model: day rate, fixed price, milestones?
• Does the end client authorise subcontracting?

Step 2: qualify the supplier

• Direct foreign supplier or French intermediary supplier?
• Country of establishment?
• Available documents?
• The provider's genuine residence?
• Invoicing possible?
• Consistent bank account?
• Sanctions and KYC?

Step 3: choose the contractual scheme

Option 1: direct referencing of the foreign supplier. Option 2: contracting with a French supplier that frames the service.

The choice depends on procurement policy, urgency, the country, the end client and the level of documentation available.

Step 4: contract and purchase order

• Framework contract validated;
• back-to-back clauses with the end client;
• detailed purchase order;
• deliverables and validation terms;
• invoicing conditions;
• security and confidentiality.

Step 5: finance validation

• supplier created in the ERP;
• VAT handled according to the chosen scheme;
• currency validated;
• payment terms recorded;
• invoice-validation circuit defined.

Step 6: controlled start

• access limited to what's needed;
• security rules communicated;
• deliverable validation organised;
• a monitoring point scheduled;
• an end-of-mission process anticipated.

Common mistakes to avoid

Referencing the supplier after the start

This is a classic mistake.

Delivery starts, then the invoice arrives. Procurement discovers the country, finance blocks, legal asks for a contract, and the mission becomes a catch-up matter.

Onboarding must precede the effective start.

Accepting an invoice without a contract

An invoice doesn't replace a contract.

Without a contract, the firm may lack a clear basis on confidentiality, intellectual property, liability, security, termination and deliverables.

Confusing day rate with the absence of a deliverable

The day rate is a pricing method. It doesn't exempt you from defining a service.

Even in technical assistance, you need a clear scope, objectives and documented monitoring.

Ignoring the end client

The end client can impose restrictions: authorised countries, subcontracting, security, data access, contractual clauses, prior approval.

The firm must check these constraints before confirming the mission.

Treating taxation as a commercial argument

Taxation must be handled soberly, on documents and according to the facts.

A genuine non-EU residence can exist. An artificial situation must not be accepted.

The firm's role is to document, not to validate an arrangement whose reality it doesn't control.

What a good file must be able to prove

A solid onboarding file must answer five questions.

1. Does the supplier exist?

Identity documents, registration, contact details, bank, ability to invoice.

2. Is the service clear?

Scope, deliverables, validation, schedule, day rate or price.

3. Is the contractual chain under control?

Contract, purchase order, back-to-back clauses, end client, subcontracting.

4. Are the compliance risks addressed?

KYC, sanctions, confidentiality, security, GDPR, due diligence.

5. Is the tax and accounting scheme consistent?

VAT, reverse charge where relevant, invoicing, genuine residence, absence of an organised presence in France.

If any of these answers is vague, the file can still be improved before validation.

FAQ

How do you onboard a foreign supplier in a firm?

You must qualify the supplier, collect the KYC documents, verify the contractual chain, frame the service with a contract, issue a clear purchase order, handle VAT and document the confidentiality, security and GDPR obligations. All of this must be consistent with the end client's requirements.

What's the minimum firm procurement checklist?

The firm procurement checklist must cover supplier identification, KYC, bank details, the contract, the purchase order, taxation, VAT, confidentiality, intellectual property, GDPR, security and the back-to-back obligations with the end client.

Can you work with a freelancer based in Dubai or Bali?

Yes, if the situation is genuine and documented. The freelancer must effectively be a resident or established outside the EU, genuinely work remotely, invoice through a consistent structure or status, and have no organised presence in France. An artificial entity used to mask a French activity must be ruled out.

Do you always have to reference the foreign supplier directly?

No. Direct referencing can work if the file is robust and accepted by procurement. If the country, invoicing, KYC or end-client constraints create too much friction, the firm may prefer to contract with a French supplier that acts in its own name and frames the service.

What's StelarWork's role?

StelarWork acts as the firm's French supplier, contracts in its own name, invoices the firm, frames the relationship with the tech provider based outside the EU and organises the necessary compliance elements. The model aims to make the supplier relationship simpler for a firm to handle, without artificially creating a foreign tax situation.

Does StelarWork represent the freelancer in France?

No. StelarWork doesn't conclude any contract in the freelancer's name. It contracts in its own name with the firm and separately organises its relationship with the foreign provider. This distinction is important for contractual clarity and permanent-establishment matters.

Is the day rate compatible with a compliant service?

Yes, if the day rate remains a pricing method and not the only substance of the relationship. The contract and the purchase order must describe a service, objectives, deliverables or validation terms. The relationship must remain a supplier relationship, structured around a professional outcome.

What documents should you request from a foreign supplier?

Documents vary by country. In practice, you should seek proof of legal or professional existence, the representative's identity, invoicing details, bank details, available KYC information, confidentiality commitments, intellectual property clauses and the elements needed for tax and accounting treatment.

Conclusion

Onboarding a foreign supplier isn't a mere invoicing matter. For a firm, it's a matter of contractual chain, KYC, due diligence, taxation, security and delivery.

The right approach is to qualify the supplier, document the reality of the service, frame the contract, specify the purchase order and check consistency with the end client.

When directly referencing the foreign supplier is too heavy or too uncertain, a French supplier such as StelarWork can simplify the scheme: the firm has a French contractual counterpart, an invoice its processes can handle, and a framework designed to reduce compliance friction.

The right goal isn't to circumvent the rules. It's to make an international collaboration workable, documented and compliant with the B2B requirements of a French IT services firm.