Vendor Master Data Management

Group Policy & Procedure	Document No.	P-POL-020
Group Supply Chain	Ver. No. | Rev Date	0.4 | 08 APR 2026
Title: Vendor Master Data Management	Effective Date	08 April 2026

BUKHATIR GROUP

Strength through Diversity

Group Policy and Procedure

Group Supply Chain (GSC)

Vendor Master Data Management

Oracle Vendor Records, Registration & Quality

Document No: P-POL-020

Copyright © 2026 Bukhatir Group

Revision Control

This document is issued under the authority of Bukhatir Group and applies when carrying out the activities described. Revisions may be issued as necessary under the authority of the Group Head of Procurement. Revision history is recorded below with every revised policy.

Revision History

Ver. No.	Effective Date	Description
02	September 2016	Original Procurement Policy
0.3	March 2026	Procurement Policy – Vendor Master Data Management
0.4	08 April 2026	Redesign, content modernization & flowcharts – Vendor Master Data Management

Revision Sign-Off

Approving Committee	Name	Signature
Endorsed by — Group Head of Supply Chain	Mohamad Koussa
Reviewed by — BIIL CEO	Mr. Ayman Ismail
Reviewed by — Group Chief Financial Officer	Mohamad Adnaan Sait
Approved by — Group Vice Chairman & Group CEO	Mr. Salah Bukhatir

Distribution List

#	Departments
1	Business Unit Procurement Departments
2	Group Supply Chain (GSC)
3	Finance, Legal, Compliance, Internal Audit
4	Business Unit Management

1. Purpose & Objective

This policy establishes governance over Oracle vendor records and the vendor master database. It defines mandatory vendor registration workflows, data quality standards, and ownership responsibilities across the Group.

2. Scope

Applies to all vendor creation, maintenance, and deactivation activities across Bukhatir Group Business Units and Group Supply Chain.

3. Vendor Registration Workflow

Vendor registration follows a standardized four-step workflow in Oracle:

1. BU Procurement submits vendor registration request with supporting documentation.

2. GSC validates completeness of application and compliance with mandatory fields.

3. Finance assigns payment terms, payment method and banking details.

4. Oracle vendor master record is created and activated in the system.

Average processing time: 5 business days. All steps are tracked in Oracle and escalated if delayed beyond 7 days.

4. Mandatory Fields & Documentation

Every vendor registration request must include the following mandatory fields and supporting documents:

Field	Required For	Documentation
Trade Licence / Business Registration	All vendors	Valid trade licence (PDF, verified)
VAT Registration Number	Vendors with annual spend > AED 100K	UAE FTA VAT certificate
Bank Account Details	All vendors	Original bank letter with IBAN, SWIFT code
Category Classification	All vendors	Procurement category code from Oracle taxonomy
Legal Entity Name & Structure	All vendors	Registered legal name, entity type (LLC, LLC/S, PSC, etc.)
Principal Contact & Email	All vendors	Primary contact name, phone, email for correspondence

5. Data Ownership & Stewardship

GSC MASTER DATABASE OWNERSHIP Group Supply Chain is the custodian and owner of the Oracle Vendor Master Database. All vendor master data is governed at the Group level. No Business Unit may create or modify vendor records without GSC validation and approval. Changes to vendor payment terms, banking details, or classifications must be logged and traceable in Oracle audit trails.

6. Annual Vendor Data Cleansing

Each calendar year (December–January), GSC executes a mandatory vendor data cleansing exercise:

5. All active vendors are reviewed for transaction activity in the preceding 24 months.

6. Vendors with zero Purchase Orders or invoices in 24 months are flagged as 'Inactive' in Oracle.

7. Inactive vendors are reviewed for archival; those retained must justify business rationale.

8. Archival follows GSC Head approval; archived vendors cannot receive new POs without re-activation.

Cleansing results are reported to BU Heads and Finance. Participation in the cleansing exercise is tracked as a compliance KPI.

7. Duplicate Vendor Detection & Merge

GSC maintains protocols for identifying and consolidating duplicate vendor records:

• Monthly automated matching report: vendor names (fuzzy match), bank account numbers, VAT numbers, contact emails.

• Suspected duplicates are investigated by GSC; confirmed duplicates are merged into a single master record.

• Prior to merge, all transactions (POs, invoices, payments) are re-mapped to the master record by Finance.

• Merged records are documented in the Vendor Consolidation Log; BUs are notified.

• Target: duplicate rate <1% of active vendors. Monthly KPI tracked by GSC.

8. Bank Detail Change Controls

DUAL AUTHORIZATION FOR BANK CHANGES Changes to a vendor's bank account details are considered high-risk and require dual authorization: (1) BU Procurement or GSC initiates the request with supporting bank letter, and (2) Finance verifies the new bank account via a confirmation call to the vendor's registered phone number before updating Oracle. A detailed audit trail is maintained.

9. Vendor Portal & Self-Service (Roadmap)

The Group is planning deployment of a vendor self-service portal (future phase) enabling vendors to:

• Register and maintain their own master data (trade licence, banking, contact details).

• Submit required documents and attestations (e.g., compliance with Supplier Code of Conduct).

• Update payment banking information.

Portal launch is scheduled for Q3 2026. BU Procurement and Finance will be notified of timeline and change management plan.

10. Data Quality KPIs

GSC tracks the following data quality metrics monthly and reports to CFO:

KPI	Definition	Target	Responsibility
Duplicate Rate	% of active vendors identified as duplicates of an existing record	< 1%	GSC
Field Completeness	% of active vendors with all mandatory fields populated	≥ 98%	GSC + BUs
Bank Detail Validation	% of vendors with bank details verified by confirmation call	≥ 99%	Finance
Inactive Vendor Ratio	% of archived vs. active vendors	Target: 5–10%	GSC

11. Oracle Configuration & Access

GSC maintains the following system controls in Oracle:

• Vendor Master creation rights restricted to GSC and authorized BU Procurement.

• Bank account changes require dual sign-off in Oracle approval workflow.

• Mandatory fields enforced at system level (cannot save a vendor record without them).

• Audit trail logs all vendor master data changes (create, modify, deactivate) with timestamp and user ID.

• Monthly data quality reports extracted from Oracle and reconciled against backing documentation.

Input Tax Credit (ITC) Compliance — FTA Decision No. 13 of 2026

Effective 1 October 2026, the vendor master data record must include ITC verification status fields per FTA Decision No. 13 of 2026 and P-POL-032.

Mandatory ITC Fields in Vendor Master:

• ITC Verification Status: Active / Expired / Pending / Not Required

• Last ITC Verification Date

• Next ITC Verification Due Date (12-month cycle)

• ITC Verification Tier: Standard (< AED 375K) / Enhanced (≥ AED 375K)

• Bank Confirmation on File: Yes / No / N/A

• Risk Indicator Flags: Address changes / Employee turnover / Transaction alerts

Vendor Registration Workflow Updates:

• The Vendor Registration Request Form (F-VMD-01) must be accompanied by a completed Supplier ITC Verification Checklist (Form F-ITC-01) for all new vendors.

• Vendors with expired ITC verification (> 12 months) must be flagged in Oracle and blocked from new PO creation until re-verified.

• Vendor data change requests affecting address or key contacts must trigger a review of the FTA risk indicators under Article 3.3.

12. Reference Forms

• Form — Vendor Registration Request

• Form — Vendor Master Data Change Request

• Form — Vendor Data Cleansing Approval

• Form F-ITC-01 — Supplier ITC Verification Checklist

• Form F-ITC-02 — Supply ITC Verification Checklist

13. Definitions & Acronyms

Acronym / Term	Definition
ASL	Approved Supplier List
BU	Business Unit
IBAN	International Bank Account Number
GSC	Group Supply Chain
KPI	Key Performance Indicator
Oracle	Enterprise Resource Planning System
PO	Purchase Order
VAT	Value Added Tax