Summary
Summary
- Diligence runs in five streams: pre-LOI screening, commercial, financial, technical and legal.
- Pre-LOI items are about killing bad deals early, before legal and accounting fees start.
- The most common post-close surprises are revenue quality, change-of-control clauses and IP title.
- Each red flag should map to a price, structure or contract response, not just a note in a report.
01 · Research
Overview
Structured diligence is the difference between a successful acquisition and a value-destroying one. This checklist covers the four primary diligence streams for digital asset transactions: pre-LOI screening, commercial diligence, technical diligence, and legal diligence. Each section is designed to surface the issues that most commonly affect post-close performance.
02 · Research
Pre-LOI Checklist
| Item | Purpose |
|---|---|
| 3 years P&L and balance sheet | Assess financial trajectory and margin structure. |
| MRR/ARR breakdown by product and cohort | Understand revenue composition and growth quality. |
| Customer count and churn data | Validate retention claims. |
| Revenue by channel and geography | Identify concentration risks early. |
| Traffic analytics (12 months) | Assess traffic quality and platform dependency. |
| Cap table and ownership structure | Confirm clean title and identify any encumbrances. |
03 · Research
Commercial Diligence
| Item | Purpose |
|---|---|
| Total Addressable Market (TAM) validation | Confirm the market is large enough to support growth projections. |
| Competitive positioning analysis | Identify defensibility and moat. |
| Customer retention cohort analysis | Validate long-term revenue quality. |
| Customer interviews (3-5 reference calls) | Confirm product value and switching costs. |
| Pricing history and sensitivity | Assess pricing power and future expansion potential. |
04 · Research
Technical Diligence
| Item | Purpose |
|---|---|
| Codebase review and architecture assessment | Identify technical debt and scalability constraints. |
| Data security and compliance audit | Assess GDPR, CCPA, and data breach risk. |
| Third-party integrations and API dependencies | Identify platform concentration risk in the tech stack. |
| Infrastructure costs and scalability | Understand the unit economics of growth. |
| Disaster recovery and uptime history | Assess operational resilience. |
05 · Research
Legal Diligence
| Item | Purpose |
|---|---|
| IP ownership and assignment chain | Confirm clean title to all intellectual property. |
| Key customer and supplier contracts | Identify change-of-control provisions and termination rights. |
| Employment agreements and contractor status | Assess employment liabilities and key person risk. |
| Regulatory licences and compliance status | Confirm all required licences are held and current. |
| Litigation history and outstanding claims | Identify contingent liabilities. |
| Data privacy compliance documentation | Assess GDPR/CCPA exposure. |
06 · Research
Financial Diligence
Financial diligence tests whether the earnings you are paying for are real and repeatable. On smaller deals this is often a quality of earnings review; on larger deals it is a full report from an accounting firm.
| Item | Purpose |
|---|---|
| Quality of earnings (QoE) review | Rebuild EBITDA or SDE from the ledger and test every add-back. |
| Bank statement to revenue reconciliation | Confirm reported revenue actually landed in the bank. |
| Monthly management accounts (24 to 36 months) | Expose seasonality, one-offs and trend breaks hidden in annual figures. |
| Working capital analysis | Set a fair peg and spot cash being pulled forward before close. |
| Deferred revenue and refunds | Confirm obligations you inherit for cash the seller already collected. |
| Tax filings and sales tax / VAT exposure | Identify unpaid liabilities that follow the company in a share sale. |
Add-backs are where most valuation disputes start. See the EBITDA Add-Back Standard for the evidence buyers expect for each one.
07 · Research
Red Flags and How to Respond
| Red flag | Where it shows up | Typical response |
|---|---|---|
| Top 3 customers above 30% of revenue | Pre-LOI / commercial | Price adjustment, earnout tied to retention, or key customer consent before close. |
| Revenue that does not reconcile to bank deposits | Financial | Stop until explained. Unexplained gaps are a walk-away issue. |
| Over 50% of traffic from one platform | Technical / commercial | Discount or escrow. See [Platform Concentration Risk](/research/platform-concentration-risk/). |
| Contractor-built code without IP assignment | Legal | Assignment deeds signed as a condition of closing. |
| Change-of-control clauses in key contracts | Legal | Counterparty consent as a condition precedent. |
| Founder holds all key relationships | Commercial | Transition services agreement, rollover or earnout. |
08 · Research
Running the Streams in the Right Order
- 01Before LOIPre-LOI screen and a light commercial read. The goal is a confident price range, not certainty.
- 02Weeks 1 to 3 of exclusivityFinancial diligence first. If the earnings do not hold, nothing else matters.
- 03Weeks 2 to 6Commercial and technical streams in parallel, including customer calls.
- 04Weeks 4 to 8Legal diligence and purchase agreement drafting, with findings fed into warranties and indemnities.
Use the Acquiry tools to test what an offer is really worth once structure and risk are priced in.
09 · Research
Work with Acquiry
Acquiry runs buy-side and sell-side mandates for digital businesses. We are not limited to the sectors or markets covered here: any sector, any market, bring it to us anyway. Start a mandate (opens in a new tab).
Reference
Frequently asked questions
What should be in a buyer due diligence checklist?
Pre-LOI screening, commercial, financial, technical and legal items. At minimum: three years of financials, revenue by customer and channel, traffic analytics, a quality of earnings review, IP ownership, key contracts and licences.
What diligence happens before an LOI?
A screen of headline financials, revenue mix, churn, traffic sources and ownership. It is designed to rule out bad deals before committing to legal and accounting costs.
How long does due diligence take on a digital acquisition?
Commonly 4 to 10 weeks of exclusivity, depending on deal size, data room quality and whether regulatory approvals are needed.
What is the biggest diligence risk in digital M&A?
Revenue quality. Concentrated customers, platform dependency and unsupported add-backs are the most common reasons a price is renegotiated.
Keep reading
Related analysis
Research · Research
Deal Team Operating Model
Our repeatable process architecture for executing buy-side and sell-side mandates from intake to close.
Research · Research
International Deal Structuring Notes
High-level notes on M&A mechanics in key global markets for digital assets.
Research · Research
Platform Concentration Risk
Scoring and mitigating dependency on major platforms in digital asset M&A.
About the analyst
Joash Boyton
Founder and Managing Director, Acquiry · Melbourne, Australia · Global coverage
Joash Boyton is the Founder and Managing Director of Acquiry, a specialist M&A advisory firm focused on the acquisition and sale of businesses. He executes buy-side and sell-side mandates from USD $1M to $500M across technology, SaaS, fintech, payments, gaming, blockchain and emerging verticals, and is not limited to them. Any sector, any market.