Carrier vetting checklist: verify authority, insurance and identity

For US freight brokers, shippers and 3PLs of roughly 20 to 200 people, a carrier packet rarely looks like fraud when it arrives. A setup form, a certificate of insurance (COI), a W-9 and a payment form land in an inbox, a load needs covering by the afternoon, and the checks cover what time allows. The Transportation Intermediaries Association (TIA) lists a rushed verification among its red flags, observing that many fraudsters hurry brokers through it (TIA).

What is a carrier vetting checklist for freight brokers and shippers?

A carrier vetting checklist is the set of checks a broker, shipper or third-party logistics provider (3PL) completes on a trucking company before it is tendered its first load. Carrier onboarding is the larger process that adds the agreement, payment setup and monitoring afterward. A complete vetting confirms five things:

1. The company is who it says it is.
2. It holds the operating authority for the work.
3. Its insurance meets the federal minimum and your contract.
4. Its safety record fits your policy.
5. Payments will reach the right party.

The regulatory spine in the US is short. The Federal Motor Carrier Safety Administration (FMCSA) says it "will not grant operating authority registration until the registrant has in effect the minimum levels of financial responsibility on file with FMCSA", and that once authority is granted the entity must "maintain proof of insurance and designation of agents for process on file with FMCSA to avoid revocation proceedings" (FMCSA). Under 49 CFR 387.7, "No motor carrier shall operate a motor vehicle until the motor carrier has obtained and has in effect the minimum levels of financial responsibility" set in section 387.9 (49 CFR Part 387).

What insurance must a motor carrier have, and how do you verify it?

In the US, a for-hire motor carrier must hold federal minimum liability insurance on file with FMCSA before it operates, and the insurance has its own cancellation rule. FMCSA's filing chart also treats carriers and brokers differently, so the authority type on the record should match the agreement being signed.

To verify insurance, compare the certificate of insurance with the filing on record at FMCSA, and confirm the policy with the insurer or agent when something looks off. A certificate collected in March says nothing about June, so repeat the check before each expiry date.

Which fields must match when vetting a carrier?

The packet, the FMCSA record, the COI and the W-9 describe the same company but come from different parties. These are the comparisons that matter.

The insurance limits and the cancellation rule in the table above give the liability check a hard number. Names matter to FMCSA too. It warns that the business name and address in earlier filings, such as secretary of state records, must "match exactly" the operating authority application, and that any deviation delays the grant. TIA's red flags include generic email domains, numbers that do not match the company name or address, and zero work history.

The W-9 is the IRS form used "to request the taxpayer identification number (TIN) of a U.S. person (including a resident alien) and to request certain certifications and claims for exemption" (IRS). The IRS also offers TIN matching, which lets payors that file information returns check name and TIN combinations against IRS records.

Where does carrier vetting data come from?

Four places rarely agree. The carrier packet arrives by email or portal as PDFs: the setup form, a signed broker-carrier agreement, the W-9, the COI and payment details, plus an NOA if a factoring company is paid. The COI comes from the carrier's insurance agent. The authority and insurance record comes from FMCSA's public lookups, such as the SAFER company snapshot and the Licensing and Insurance system. Your side holds the TMS carrier record, the ERP vendor master (NetSuite or SAP, for example) and any monitoring service you already pay for.

FMCSA states that a "financial responsibility provider must file the appropriate insurance form(s) on behalf of the applicant", which is why the filing on record is a separate check from the certificate in the packet. FMCSA is also moving to a new registration system, Motus, which is rolling out through 2026, so confirm which lookup your team should treat as authoritative. Reading the packet PDFs is a document processing task, covered in AI document processing for invoices, contracts and forms.

How can AI automate carrier vetting?

A workflow can watch the onboarding inbox or portal, collect the packet into one record and read each document into fields: legal name, TIN and address from the W-9; insurer, policy number, limits, dates, named insured and certificate holder from the COI; bank details and any NOA from the payment form. It then looks up the carrier's USDOT or MC number in the FMCSA source you use and compares every field in the table, recording which agree, which differ and which could not be read.

AI helps most with messy PDFs and with spotting patterns: a generic email domain, a phone number that differs from the FMCSA record, a COI whose named insured differs from the W-9, a policy that expires within the month. The comparisons and the limit check are ordinary rules. The same workflow can create the carrier in the TMS in a pending state so dispatch cannot tender until a named person approves it, and draft the request for each missing item, such as a corrected COI from the agent.

After approval, the workflow can re-check authority and insurance status on a schedule and ahead of each expiry date, and alert carrier compliance when a policy is cancelled or authority changes status.

How do you spot double brokering and carrier identity theft?

Double brokering and carrier identity theft usually show up as inconsistencies in the packet, which is why the field comparisons above matter. TIA's carrier vetting guidance names these red flags:

• A rushed verification process, since fraudsters often hurry brokers to hide what would reveal them.
• Missing USDOT or MC numbers, or numbers that do not match the company name or address.
• A generic email domain such as Gmail or Yahoo, when carrier email should match the company's domain.
• A phone number that goes straight to voicemail.
• Zero work history, which calls for caution even though hiring a carrier new to the industry is not wrong in itself.
• No proof of insurance.

Add one check of your own: confirm any new or changed payee and bank detail by calling a number from the FMCSA record or your own file, never the one on the new form.

Who should receive each exception?

Route by type, with the deadline tied to the first thing that could go wrong, usually a tender or a payment.

1. Carrier compliance or carrier relations: authority, insurance and safety gaps, expiring certificates and requests to the carrier or its agent for corrected documents. Resolve before any tender. For renewals, start a set number of days before expiry, as your policy defines.
2. Fraud or risk lead: identity mismatches such as changed contact details, a generic email domain, numbers that do not fit the name or address, or pressure to skip steps. Resolve before the first rate confirmation is sent.
3. AP or finance: the W-9, bank details and any NOA. Confirm with a call to a number from the FMCSA record or your own file, not the one on the new form, before the first payment.
4. Dispatch or the load owner: receives the status "not approved, do not tender" and the expected decision time, so the load can go to an approved carrier before pickup.
5. Your insurance broker or risk manager: coverage questions compliance cannot settle, such as cargo exclusions or limits below your contract. Resolve before the agreement is signed.

Which carrier vetting decisions should stay with a person?

Carrier vetting prepares a decision that carries fraud, liability and payment risk, and people make it.

Approving or rejecting a carrier. A named person signs off. The workflow records the evidence behind the decision.

Conditional safety ratings and out-of-service history. Whether a record is acceptable depends on your freight, your customers and your policy.

Exceptions to insurance minimums. The federal minimum is not yours to waive, but limits above it in your contract are a risk decision for your leadership and your insurance broker.

Fraud determinations. A pattern raises a flag. Deciding that a carrier is a double broker or an impostor, and adding it to a do-not-use list, is a person's call.

Verifying bank detail changes. A person calls a known number. No email or portal request is accepted on its own.

Contract terms. The broker-carrier agreement, indemnity and claims terms are negotiated by people and reviewed by counsel.

Illustrative example: Consider a freight broker that must cover a load for pickup the next morning and receives a packet from a carrier it has never used. A workflow reads the packet and checks the FMCSA record. The COI names the insured as an LLC while the FMCSA record and W-9 show an Inc., the authority was granted 38 days ago against a 90 day minimum in the broker's own policy, the email uses a generic domain, and the payment form sends funds to a factoring company with no NOA attached. The workflow marks the carrier pending, blocks tendering in the TMS, and sends the name mismatch and authority age to carrier compliance, the contact flags to the fraud lead and the missing NOA to AP. The fraud lead calls the number on the FMCSA record, not the one in the packet, and reaches someone who says no one there applied. The carrier is not approved, the load goes to an existing carrier, and the case is logged.

How do you know carrier vetting automation is working?

Judge the checks by the problems they catch before a load moves, not by the number of packets processed.

Mismatches caught before the first load, against those found after a load moved is the core measure.

Lapses caught in monitoring tracks the time between a cancelled policy or changed authority and the carrier being suspended in the TMS.

Payment changes verified before the first payment is the share of new or changed bank details confirmed by a call to a known number before money moved.

Time from a complete packet to a decision shows whether exceptions are routed or sitting.

Carriers active with expired insurance or inactive authority should be none on any audit date, which makes it the clearest check.

For a baseline, review recent onboardings and count how many had a mismatch that surfaced only later.

How do you start automating carrier vetting?

1. Choose one carrier type, such as new spot market carriers for brokered truckload, and one document set: packet, COI and W-9.
2. List the checks the team runs by hand today, and agree which failures are hard stops (inactive authority, insurance below the federal minimum or your contract, an identity mismatch) and which are policy tolerances (authority age, a preferred cargo limit).
3. Gather a sample of past packets, approved and rejected, including the incomplete ones, to test reading accuracy and see what the manual process missed.
4. Have the workflow and your carrier team check the same new carriers for a set period, then compare which gaps each one caught.
5. Add routing, deadlines and the monitoring schedule once the findings hold up, and name the owner of each exception type. How to design the sign-off step is covered in AI agents with human approval.
6. Extend to contracted carriers and renewals when the first set is stable. How to rank candidates is covered in Which business processes to automate first.

How Kastling approaches carrier onboarding checks

Kastling treats carrier onboarding as a workflow to understand before anything is built, as part of the AI Integration & Automation service. It starts with a free discovery call. A separately scoped paid audit is common next for logistics teams, reviewing how packets arrive, which lookups and systems hold the authority, insurance and payment records, and where gaps get through today.

The checks connect to the TMS, ERP and monitoring tools you already use. Comparison rules are agreed with the people who approve carriers, every exception goes to a named owner, and approval, fraud determinations and bank detail changes stay with your people. We agree up front how success will be measured and test the workflow on your real packets before it affects a live tender.