Due Diligence

Due diligence is the buyer's check that the company is what the seller says it is. Suppose a group agrees in principle to buy a logistics company. The price in the letter of intent rests on figures and statements supplied by the seller. Before signing a binding contract, the buyer wants to test them, and to find what nobody mentioned.

The work usually starts once a confidentiality agreement and a letter of intent or term sheet are in place. It runs until the main contract is signed, and sometimes up to closing. The buyer decides how much to investigate. That choice can have legal consequences: under some contracts and some national laws, a buyer cannot claim for a problem it knew about.

The main types are legal, financial, tax and commercial due diligence. Legal due diligence covers ownership of the shares and assets, the main contracts, employment, intellectual property, permits and disputes. Financial due diligence examines the accounts, the quality of earnings, debt and working capital. Tax due diligence reviews past filings and open exposures. Commercial due diligence looks at the market, the customers and the business plan.

Other reviews are added where the business calls for them, for example technical, environmental, IT security or data protection reviews. The buyer agrees the scope with its advisers, and often limits it to matters above a stated value.

The buyer's advisers do most of it, each in their own field. Lawyers carry out the legal review, accountants the financial review and tax advisers the tax review. The buyer's own team usually leads the commercial review and coordinates the others.

The advisers send the seller a list of requests. The seller uploads the documents to a virtual data room. Questions and answers then pass between the two sides in writing, and the target's management may be interviewed.

Due diligence produces a report for each area reviewed, and the decisions the buyer bases on it. A report states what was reviewed, sets out the findings, ranks them by seriousness and recommends how to deal with each.

The findings feed back into the deal in four ways. The price can be reduced. The contract can give the buyer a warranty or an indemnity for a specific risk. A problem can be made a condition that the seller must fix before closing. Or the buyer can walk away. A report is addressed to the buyer. Whether others, such as a lender, may rely on it depends on the adviser's terms and on the governing law. Advisers usually require a written reliance letter.

Due diligence on a target is a commercial investigation that a buyer chooses to carry out, while customer due diligence is a set of checks that a firm must carry out on its own clients under anti-money laundering law. The points to look for are who is examined and whether the law requires it.

The two meet in one place. An adviser that is an obliged entity, such as a law firm acting on the purchase of a business or an accounting practice, has to carry out customer due diligence on the client who gives the instruction. Article 19(1)(a) ties that duty to the start of the business relationship. Under Article 2(1)(19), the relationship can exist without a written contract, so it may begin before any engagement letter. The regulation applies from 10 July 2027. Until then, the national laws that implement the EU anti-money laundering directives apply.

Employment contracts, payroll records and customer lists all contain personal data, so the GDPR applies to the seller that discloses them and to the buyer and advisers who read them. A non-disclosure agreement does not change that. Article 5(1)(c) of the GDPR limits what is shared to what the purpose requires. Sellers therefore commonly mask names, give employee data in aggregated form and release individual records only at a late stage. Each party also needs one of the legal grounds in Article 6(1) for its own processing.

The data room provider usually hosts the documents on the seller's behalf. Article 28(3) then requires a contract between the seller and the provider. Its required content includes processing only on documented instructions and confidentiality commitments from the people who handle the data.

Yes, in principle. Due diligence itself is not signed, but several documents around it are: the confidentiality agreement, the advisers' engagement letters and any letter that lets a third party rely on a report. Article 25(1) of the eIDAS Regulation says that an electronic signature cannot be denied legal effect or refused as evidence solely because it is electronic. Article 2(3) leaves national rules on form in place, so the governing law of each document decides.