Due Diligence
Due diligence is the investigation a buyer or investor conducts before committing to a transaction, to verify what the seller has presented and to find what the seller has not: the financial position and quality of earnings, the legal and contractual state, the commercial prospects, the technology, the people, the tax history and, for a regulated fintech, the licence, the compliance controls and the regulator's file. Its findings shape the price, the structure and the warranties.
- Also known as
- DD, Buyer due diligence, Vendor due diligence, Diligence process
- Used at
- acquisitions, investments, financings, and, in reverse, vendor due diligence commissioned by a seller to present findings before buyers ask; in fintech, regulatory and compliance diligence is a workstream of its own, and in AI deals, data provenance and model diligence joined the list
- Binding
- no rule requires it, but a board that approves an acquisition without it breaches its duties, a lender's terms require it, and the warranties in the purchase agreement are drafted around what it found and did not find; disclosure against warranties is the seller's mirror of the buyer's diligence
- Typical workstreams
- financial (accountants: earnings quality, working capital, net debt, forecasts); legal (lawyers: title, contracts, litigation, IP, employment, change-of-control clauses); commercial (market, customers, competition); tax; technology (architecture, security, technical debt); regulatory and compliance (licence, AML, capital, safeguarding, regulator correspondence); people; ESG; and, increasingly, data and AI (rights to data, model performance and governance)
- Typical scale
- four to eight weeks; fees of 1–3% of deal value for a mid-market transaction across all advisers; a data room of thousands of documents; a Q&A log of hundreds of questions; a red-flag report first, full reports later
- Parties
- the buyer and its advisers, the seller and its management (who answer while running the company), the vendor-diligence providers where used, the lenders who rely on the reports, and the insurers underwriting warranty cover on the strength of them
How due diligence works in practice
A buyer admitted to a payments company's process receives access to the data room and a management presentation. Its accountants rebuild the last three years of earnings from the ledgers — normalising one-offs, testing revenue recognition, tying cash to reported profit, computing normalised working capital — and produce a quality-of-earnings report that says what EBITDA really is. Its lawyers read every material contract for change-of-control clauses, every licence for conditions, the litigation list, the employment terms of the key people, and the IP chain. Its regulatory specialists read the safeguarding reconciliations, the AML controls, the last regulator visit's findings and the correspondence since. Its technology team reviews the architecture, the security posture and what the roadmap cost will be. Commercial diligence calls customers and tests the growth case. Each stream reports red flags within two weeks and full findings at the end; the buyer's deal team turns them into price adjustments, structural protections and warranty asks.
The findings decide the deal more often than the headline price does. A quality-of-earnings adjustment of 15% moves the price by the same. An open regulatory query becomes an escrow. A key contract with a change-of-control termination right becomes a condition. A gap in KYC files becomes a remediation cost and an indemnity. Sellers who commissioned vendor diligence know these before the buyers do and price or fix them; sellers who did not learn them from a buyer's lawyers, in the worst negotiating position. And diligence has limits: it verifies the past and samples the present; the future is the buyer's judgement, and the integration risk is the buyer's alone.
For a fintech seller, diligence is what the years of clean books, orderly licence files and documented controls were for; for a buyer, it is the only time the target's evidence is available on demand, and skipping a workstream to save time or fees is the most expensive economy in M&A.
Example
A buyer offers €70 million for a lending fintech on presented EBITDA of €9 million. Diligence: the accountants find €1.4 million of capitalised development cost that should have been expensed and a working-capital normalisation of €2 million; the lawyers find that the loan-funding facility terminates on change of control unless the funder consents; the regulatory team finds a written regulator request for a review of affordability checks, six months old and unanswered; the technology review finds the core platform on an unsupported framework with a €3 million rebuild ahead. Outcome: price €58 million, of which €8 million in escrow against the affordability review; funder consent as a condition; a specific indemnity for affordability remediation; and a post-closing rebuild budget. The seller, who had declined vendor diligence to save €200,000, learns each finding from the other side.
Common mistakes
- Skipping a workstream — usually regulatory or technology — to save fees or time. - Reading management's numbers rather than rebuilding them from the ledgers. - Change-of-control clauses found after signing. - A seller entering a process without vendor diligence on its own weak points. - Treating the diligence report as an assurance of the future; it verifies the past.