How to Verify a Federal Vendor Is Legitimate Before Awarding

Published April 2026. Checklist for federal contracting officers, state and local procurement staff, and commercial buyers with federal flow-down obligations who need to verify a vendor is legitimate before awarding.

Every federal contracting officer runs a version of this checklist in their head before awarding to a vendor they haven't worked with. The process has been formalized in FAR Subpart 9.1 as a "responsibility determination" — but the day-to-day version is pattern recognition: can I actually trust this company to deliver? Are they real? Are their claims verifiable? Will they still exist in six months when warranty claims come in?

This guide is the version of that checklist we use internally when Stokvane evaluates our own suppliers, framed for procurement officers evaluating us (or any other vendor) before award.

The five-minute gut check

Before you open any verification tool, two observations tell you most of what you need to know:

  1. Does the vendor's website list a real physical address, a real legal entity name, and a real business email domain (not a Gmail / Outlook personal address)?
  2. When you click through their policies (shipping, returns, privacy), is the language specific to their operation or generic templated text?

Legitimate businesses get these right without effort. Dropshippers, fronts, and actual scams routinely fail one or both. Before running a single verification query, a 60-second look at the footer of a vendor's site eliminates most fraud.

Step 1: SAM.gov registration and status

Every entity that wants to receive federal contracts must be registered in the System for Award Management (SAM.gov). Free, required, unavoidable. Start here.

Visit sam.gov → click "Entity Status Tracker" (under Entity Management) → search by entity name or UEI. Confirm:

  • Registration status is "Active." Not "Expired," not "Submitted," not "Work in Progress."
  • Purpose of Registration includes "All Awards" (not just "Federal Assistance Awards Only" — the latter is grant recipients only, not contractors).
  • Expiration date is far enough out to cover your period of performance. SAM registration is annual; an expired registration means the entity is temporarily ineligible for new awards.
  • Legal business name matches the name on the vendor's quote, proposal, and invoice. Any mismatch is a red flag — DBAs should be documented in SAM.

Step 2: UEI and CAGE code verification

The Unique Entity Identifier (UEI) replaced the DUNS number on April 4, 2022. It's a 12-character alphanumeric ID assigned by SAM.gov itself (free, self-service).

The Commercial and Government Entity (CAGE) code is a five-character code assigned by the Defense Logistics Agency (DLA DLIS), also free. CAGE is required for any entity receiving DoD contracts, but increasingly requested by civilian agencies too.

Both UEI and CAGE appear on the entity's SAM.gov profile. A legitimate vendor can share both on request. If a vendor can't give you their UEI, they're not actively registered in SAM.gov — disqualifying for most federal contracts.

Step 3: Exclusions check

The SAM.gov Exclusions database (formerly the Excluded Parties List System — EPLS) lists entities and individuals barred from receiving federal contracts, grants, and other benefits. Debarment, suspension, and "proposed for debarment" all appear here.

At sam.gov, search the "Exclusions" section by entity name and by each key principal's name. Award to an excluded entity is a violation of FAR Subpart 9.4 and exposes the agency to audit findings. Always run this check — even on vendors you've worked with before, exclusions can appear between your prior award and this one.

Step 4: Small business certifications — verify in DSBS, not by vendor claim

If a vendor claims small business status, small-disadvantaged, 8(a), HUBZone, WOSB, EDWOSB, SDVOSB, or VOSB certification, verify against SBA's Dynamic Small Business Search (DSBS) at dsbs.sba.gov. This is the authoritative list of SBA-certified small businesses.

Check the certification type, certification number, and expiration date. A certification expired three months ago does NOT entitle the vendor to any small-business preference on your current award.

For HUBZone specifically: the vendor's principal office address should fall within a HUBZone per the SBA HUBZone map. "HUBZone-qualified location" is not the same as "HUBZone-certified firm" — the latter requires SBA's formal certification. (Full HUBZone explainer here.)

Step 5: Section 889 representation — request the signed form

Vendors representing Section 889 compliance must have a current FAR 52.204-24 representation signed by an authorized company officer. Representations are valid for 12 months from signature.

Request a copy in writing. The document should include both Part A ("Does the offeror provide covered telecommunications equipment or services") and Part B ("Does the offeror use covered telecommunications equipment") with their respective "Does not" boxes checked, dated, and signed. Note the signature date — if more than 12 months old, the representation is stale.

(Full Section 889 explainer here. TAA guide here.)

Step 6: State business registration

Every state has a Secretary of State business registry. A legitimate federal vendor is registered in at least one state as a corporation, LLC, or other registered entity. The registration should be in "Active" or "Good Standing" status, not "Administratively Dissolved," "Delinquent," or "Revoked."

State registries are free and searchable by anyone. For example, Oklahoma's is at sos.ok.gov; Delaware's at icis.corp.delaware.gov. Confirm the legal entity name matches SAM.gov and the vendor's quote.

Step 7: FAR 9.1 responsibility factors

FAR Subpart 9.104-1 lists what the contracting officer must affirmatively determine before award. Beyond the specific checks above, the broader responsibility test includes:

  • Adequate financial resources (or ability to obtain them)
  • Satisfactory record of integrity and business ethics
  • Necessary organization, experience, accounting and operational controls, and technical skills
  • Necessary production, construction, and technical equipment (or ability to obtain them)
  • Otherwise qualified and eligible to receive the award under applicable laws

For small orders and commercial-off-the-shelf (COTS) buys, these factors are satisfied by the earlier steps. For larger or more complex awards, additional documentation may be requested — audited financial statements, past performance references, facility tours.

Red flags that should kill an award

  • SAM.gov status isn't Active — expired, submitted, or missing = not eligible.
  • UEI can't be provided on request — they're not really registered.
  • Exclusions match on the entity or key principals — disqualifying per FAR.
  • Small business certification claimed but not in DSBS — likely fraud or expired.
  • Section 889 representation can't be provided or is >12 months old — noncurrent.
  • Legal entity name doesn't match across SAM, state registry, and vendor's quote — shell company or misrepresentation.
  • No physical address or only a PO box on the vendor's site + SAM.gov — physical presence is a responsibility factor.
  • Website was registered within the last 90 days for a "large supplier of federal products" — check whois creation date.
  • Wildly below-market pricing on covered electronics — grey market, counterfeit, or the vendor is running a fraud scheme.

How Stokvane expects to be verified

Because we actively pursue federal business, we expect — and welcome — this verification process. Our vendor record:

  • Legal entity: TyTred Services LLC DBA Stokvane (formed 2023, Oklahoma)
  • Principal office: 13032 Cliff Road, Kingston, Oklahoma 73439
  • SAM.gov: Registration in progress (UEI will be available once registration is Active)
  • SBA certifications: SupplierGateway Supplier Impact Certification SG10244138712402, Digital Identity Verified, Small Business, valid February 2026 through February 2027. Verifiable at suppliergateway.com/verifycert. SBA HUBZone certification application in progress (principal office location is in a Qualified HUBZone under the Indian Country designation).
  • Section 889: FAR 52.204-24 representation signed April 2026, valid 12 months, Parts A and B marked "Does not"

Any procurement officer, federal cardholder, or SLED buyer who wants a formal documentation package — signed 889 rep, SupplierGateway cert, HUBZone location attestation, W-9 — can request it by emailing support@stokvane.com with subject "Procurement documentation package". Response within one business day.

Full government-buyer-ready information is on our Government Buyers page.

Sources: SAM.gov (System for Award Management), SBA Dynamic Small Business Search, FAR Subpart 9.1 — Responsible Prospective Contractors, FAR Subpart 9.4 — Debarment, Suspension, and Ineligibility.

Back to blog