---
title: "Legal Due Diligence"
url: "https://mahouse.world/glossary/legal-due-diligence"
type: "glossary term"
topic: "Due diligence"
author: "Ihor Vlasov"
reviewed: "2026-09-20"
published: "2026-08-10"
---

# Legal Due Diligence

Legal due diligence is the buyer's lawyers' review of the target's legal position: its corporate records and share ownership, its material contracts and their change-of-control clauses, its licences and regulatory history, its employees and their terms, its intellectual property and its data protection, its litigation and disputes. It tells the buyer what it is legally acquiring, which consents it needs, and what the warranties and indemnities must cover.

**Also known as:** Legal DD, Legal review, Legal audit

## Key facts

- **Used at:** confirmatory diligence on every acquisition; for a licensed fintech, the regulatory workstream is the largest part
- **Binding:** no — a report to the buyer; its findings become the conditions precedent, the specific indemnities, the disclosure the seller must make, and sometimes the price
- **Typical scope:** corporate (title to shares, constitution, minutes, cap table); material contracts (top customers, suppliers, sponsor banks, schemes, processors, leases — with change-of-control and termination terms); regulatory (licences, permissions, correspondence, enforcement, safeguarding, AML); employment (contracts, incentives, disputes, contractor status); IP and technology (ownership of the code, open-source use, licences in and out); data protection; litigation; insurance; property
- **Typical output:** a red-flag report early — the issues that could stop the deal — and a full report with a risk table: issue, consequence, recommended action (condition, indemnity, price, warranty, walk)
- **Parties:** the buyer and its lawyers, the seller's lawyers who manage the data room and answer questions, and the target's management who supply what is missing

## How legal due diligence works in practice

The buyer's lawyers receive the data room and a question list goes back the same week. They read the constitution and the share register to confirm the sellers own what they are selling; the top fifty contracts for the clauses that matter — change of control, termination, exclusivity, liability caps, assignment; every letter from the regulator for the last five years; the employment terms of the top thirty people and the contractor arrangements that may be employment in disguise; the IP assignments from every developer who wrote the code; the privacy policy against what the systems actually do; and the litigation list against what the management interviews reveal.

The report is organised by consequence. Red flags are the deal-stoppers or the price-changers: a licence with an open enforcement action, a founder who never assigned the IP, a sponsor bank agreement terminable on change of control. Amber items become specific indemnities or conditions. The rest becomes the disclosure the seller must make against the warranties. For a fintech the regulatory findings drive the timetable: the lawyers also draft the change-of-control application, and what they found in diligence is what they must explain to the regulator.

The common failure is scope by budget: fifty contracts read out of five hundred, and the sponsor bank agreement is the fifty-first.

## Example

Legal diligence on a payments company finds: clean title and cap table; change-of-control clauses in 31 of 40 material contracts, four of them termination rights (a sponsor bank, a processor, two merchants); a regulator's letter of eleven months earlier requiring improvements to safeguarding, closed out in writing; three contractors in engineering with employee-like terms; open-source components under a licence incompatible with the target's commercial terms in one module; a €120,000 employment claim by a former salesperson; and no IP assignment from a co-founder who left in year two. Actions: sponsor bank and processor consents as conditions precedent; a specific indemnity for the employment claim and for the contractors' status; the departed co-founder's IP assignment obtained before signing for €30,000; the open-source module rewritten under a TSA-style undertaking; the safeguarding correspondence disclosed and warranted. Price unchanged; the deal signed with five conditions instead of one.

## Common mistakes

- Reading the largest contracts by value rather than by consequence — the sponsor bank agreement is small and decisive.
- Regulatory correspondence reviewed for enforcement only, not for the commitments the target made and may not have kept.
- IP ownership assumed because the company "wrote the code", when a departed founder or contractor did.
- Findings listed without consequences, so the deal team does not know which need a condition and which a warranty.
- A report delivered after the price is agreed and exclusivity is running out, when the buyer's leverage to act on it is gone.

## Related terms

- [Change of Control Clause](https://mahouse.world/glossary/change-of-control-clause.md)
- [Representations and Warranties](https://mahouse.world/glossary/representations-and-warranties.md)
- [Disclosure Letter](https://mahouse.world/glossary/disclosure-letter.md)
- [Financial Due Diligence](https://mahouse.world/glossary/financial-due-diligence.md)
- [Data Room](https://mahouse.world/glossary/data-room.md)
- [Bank Charter](https://mahouse.world/glossary/bank-charter.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-20. https://mahouse.world/authors/ihor-vlasov