Workstream by workstream, verified August 2026

M&A Due Diligence Checklist: Due Diligence for Mergers and Acquisitions and the Buy Side Process

M&A due diligence is the period between a signed letter of intent and a signed purchase agreement in which you verify, at your own expense, that the business you agreed to buy is the business that exists. It runs as a set of parallel workstreams rather than a single list: financial, tax, legal, commercial, customer, technology, people, and integration. Each one has a small number of documents that genuinely prove something and a much larger number that merely look reassuring, and the whole skill is knowing which is which.

See how it works → See the comparison ↓

Verified metrics · published multiples · vetted buyers · escrow-backed closes

AI SaaS deal deck Sample

Sort

Max asking Min MRR

No deals match those filters yet. Widen your range.

Sample cards showing the listing format · not live listings

Verified MRR / ARR Published multiples Vetted, capital-qualified buyers Escrow-backed closes AI-SaaS-native

The two questions buyers ask first are how long it takes and what it costs, and neither has a published answer. We checked the SBA guidance, the IBBA research library and the major deal room vendors in August 2026, and no US body publishes a standard diligence period or a surveyed cost. What can be checked is what the vendors disclose, and the finding there is blunt: of the five virtual data room providers we read firsthand on 30 August 2026, four publish no price at all, and Datasite's own page titled how much does a data room cost answers that pricing varies widely without giving a figure. Everything on this page that carries a number is either read from a primary source and dated, or labelled as our own arithmetic. Buyouts is a marketplace for AI SaaS where verified MRR, ARR, growth and churn are published before a listing goes live, which moves part of the financial workstream before your LOI rather than after it. Browsing is free, buyer membership is planned rather than currently on sale, listings shown here are illustrative product UI, and nothing on this page is legal, tax or investment advice.

Diligence does not fail because a buyer forgot a document. It fails because the buyer verified the profit and loss statement against a spreadsheet the seller also produced, and never once tied a revenue number back to a bank account.

The checklist

The M&A due diligence checklist, workstream by workstream

Twelve workstreams, the documents that actually prove the claim rather than restate it, and the specific finding in each one that most often ends a deal. Work the source column, not the summary column: a seller-prepared profit and loss statement is a claim, and a bank statement is evidence.

Swipe to see every column →

Workstream	What you request	What it proves	The finding that kills deals
Revenue quality	Three years of bank statements, the payment processor export, and the subscription ledger, all for the same months	That money described as revenue actually arrived, from the customers named, on the dates claimed	Revenue recognised on invoicing that never converted to cash, or one-off consulting booked as recurring
Financial statements	Three to five years of profit and loss, balance sheet and cash flow, plus the underlying general ledger	How earnings were built, and whether the add-backs the seller claims are genuinely non-recurring	Owner add-backs that are really operating costs the next owner still has to pay
Quality of earnings	An independent quality of earnings report prepared for the lender, not for the seller	Normalised earnings, working capital and the cash proof behind the reported profit	Normalised EBITDA landing materially below the figure the price was agreed on
Working capital	Twelve to twenty four months of monthly balance sheets and the ageing schedules for receivables and payables	The normal level of working capital the business needs to keep running after you own it	A price agreed cash free and debt free with no peg set, so the adjustment is argued at closing
Tax	Federal and state returns for three years, payroll tax filings, sales tax registrations and nexus analysis	That no liability is sitting unrecorded, and that the entity is compliant where it actually sells	Unregistered sales tax nexus in states where the business has been collecting nothing for years
Customer concentration	Revenue by customer by month, contract end dates, and notice and termination clauses	Whether the earnings are a portfolio or a handful of relationships with the founder	One customer above 20% of revenue whose contract ends inside your first year
Contracts and legal	All customer, supplier, lease and financing agreements, plus any litigation history	What transfers on a sale, and what needs a third party to consent to it first	Change of control clauses that let major customers exit the moment you close
Intellectual property	Assignment agreements from every developer and contractor, trademark filings, and the open source licence inventory	That the company, not a former contractor, owns the thing you are buying	Core code written by a contractor with no signed assignment, which is unfixable after close
Technology	Architecture overview, hosting and vendor bills, security incident history, and the dependency list	The real cost of running the product and the size of the deferred maintenance bill	A single unsupported dependency or a hosting arrangement in a personal account
People	Org chart, employment agreements, compensation, contractor classification, and retention terms for key staff	Whether the team that produced these numbers stays, and what it costs to keep them	Earnings that depend on one person who has already decided to leave
Key person and owner role	A written account of how the owner spends a week, and what happens to each task after close	How much of the profit is really unpaid owner labour you will have to hire back	A business that needs a full time operator when the model assumed an absentee owner
Integration and day one	Access inventory: domains, registrars, code repositories, payment processors, ad accounts, support tools	That everything can actually be transferred to you on the day you pay	Assets held in a personal account that cannot be transferred without the seller's continued goodwill

This checklist reflects standard US buy side practice on lower middle market deals and is not legal, tax or accounting advice. It is deliberately weighted towards small acquisitions, where the buyer runs most of the work personally, rather than towards corporate transactions with an advisory team. Scope your own diligence to the deal: a $200,000 purchase does not justify the same workstreams as a $5,000,000 one, and the judgement about what to cut is the buyer's. Have an attorney and an accountant review anything that carries a liability.

Read firsthand, 30 August 2026

How much diligence you have to run, venue by venue

The size of the job depends entirely on what was verified before you arrived. On some venues the revenue has already been tied to source and the financial workstream shrinks; on others every number in the listing is a screenshot the seller produced. Everything below was read on each provider's own pages, and where a provider publishes nothing this table says so rather than guessing.

Swipe to see every column →

Where you are buying	Verified before you start	You must verify yourself	Practical diligence load
Empire Flippers	Listings are vetted before publication. Its scoreboard reported 2,670 businesses sold and an average 125 days from listing to sold when read on 30 August 2026	Everything specific to your thesis: customer concentration, contracts, IP assignment and the owner's real weekly role	Reduced on financials. Note there is no LOI stage on a listed buy: it is Buy It Now and a bank wire, and all sales are final
Acquire.com (formerly MicroAcquire)	Startups are listed with founder-supplied metrics. Paid members can build, sign and send LOIs and APAs on the platform, with Escrow.com wired in	The financial workstream in full, because the numbers are founder reported rather than verified at source	Full. Budget for the whole checklist above
Flippa	Stated financials are vetted above $50,000 according to its July 2026 published position. Its pricing and process pages return a Cloudflare challenge to automated requests	Everything below that threshold, and everything non-financial at any size	Full, and heavier at the small end where nothing is vetted
Curated brokers: Website Closers, Quiet Light, FE International	A broker-prepared information memorandum and a seller-side financial recast	That the recast is honest. A broker package is a sales document prepared for the seller, not an independent audit	Full, and the recast itself needs checking against source records
BizBuySell and classified listings	Nothing. Listings are advertisements and the parties transact entirely off the platform	All twelve workstreams, with no intermediary and no escrow unless you arrange it	Maximum. This is where a quality of earnings report earns its fee
Off-market, direct from the owner	Nothing, and often no financial statements exist in a usable form at all	All twelve workstreams, starting with reconstructing the accounts from bank and processor data	Maximum, plus the cost of building the records the seller never kept
Buyouts	Verified MRR, ARR, growth and churn are published before a listing goes live, so the revenue quality workstream starts before your offer rather than after it	The legal, IP, people and integration workstreams, which no marketplace can verify for you	Reduced on revenue quality. Listings and metrics shown are illustrative product UI and membership is planned, not on sale

Empire Flippers scoreboard figures were re-read on 30 August 2026 and move every few days. Acquire.com LOI and APA functionality and the Escrow.com integration were read on its pricing page on 31 August 2026. The Flippa $50,000 vetting threshold is from its July 2026 published position; its pricing pages have returned a Cloudflare challenge to every automated request since, so it is recorded as of that date rather than refreshed. Website Closers, Quiet Light and FE International publish no diligence or verification policy on their public pages. Providers change their processes, so confirm before you rely on any row.

Side by side

Running diligence on a verified listing versus an unverified one

A fair look at what each does well. Both are useful. Here is where they differ.

Feature	Buyouts	Taking the seller's numbers on trust
Where the revenue number comes from	Verified MRR, ARR, growth and churn published before the listing went live	A seller-prepared profit and loss statement and a dashboard screenshot
When you find out the revenue is wrong	Before you make an offer, at no cost to you	In week five of diligence, after you have paid for it
What the financial workstream costs you	Less, because the tie back to source is already done	The largest single line in your diligence budget
Workstreams you still run yourself	Legal, IP, contracts, people and integration, which no marketplace can verify for you	All twelve, including rebuilding the financials from scratch
Exclusivity window you need to ask for	Shorter, because there is less to discover	Longer, which is exactly what sellers resist granting
Most common reason the deal dies	Price disagreement, which surfaces early and cheaply	Revenue that will not reconcile against the bank statements
What you can transact on today	Browsing is free and membership is planned rather than on sale	A live listing you can buy right now, which is a real advantage they have

Comparison reflects general, publicly understood positioning. Capabilities change, so check each marketplace for the latest. Trademarks belong to their owners.

Why founders and buyers pick Buyouts

One deal room built specifically for AI SaaS

Tie every revenue claim to a bank account, or you have not done diligence

Most first-time buyers run the financial workstream backwards. They receive a profit and loss statement, check that it adds up, compare it to a summary spreadsheet the seller also produced, find the two agree, and conclude the revenue is real. All they have confirmed is that the seller is internally consistent. The only step that proves anything is the tie back to source: take a specific month, take the revenue figure claimed for that month, and trace it to deposits in a bank statement and to settlements in the payment processor export. Do it for three months chosen by you rather than offered by the seller, and include a month the seller has no reason to expect you to pick. What this catches is not usually fraud. It is optimistic accounting, which is far more common and does just as much damage to your model. Revenue recognised when an invoice was raised rather than when it was paid. A one-time migration or setup project booked into the recurring line, so the multiple gets applied to money that will never repeat. Refunds and chargebacks netted somewhere you were not looking. Related party revenue from a business the seller also owns, which stops the day you close. Each of these makes the earnings look better than they are, and none of them shows up if you only ever compare seller documents to other seller documents. The same discipline applies to the expense side, where the risk runs the other way. Add-backs are the adjustments a seller makes to show what the business would have earned without their personal spending, and some are entirely legitimate: a one-off legal case, the owner's salary above market, a vehicle the business does not need. Others are operating costs wearing a disguise. If the add-back list includes contractor payments, software subscriptions the product actually runs on, or marketing spend that was producing the growth in the top line, you are not looking at owner discretion, you are looking at a cost you will still be paying in month one. Every dollar wrongly added back is multiplied by the deal multiple, so on a three times multiple a $20,000 add-back that should not be there is a $60,000 error in the price.

What diligence actually costs, and why nobody publishes a number

There is no surveyed figure for what buy side due diligence costs on a small US acquisition, and the reason is that the scope is set by the buyer rather than by a standard. What can be verified is the price of each component, and those are published. On the legal side, the ContractsCounsel marketplace publishes averages from completed engagements together with the sample size: an asset purchase agreement averaged $1,290 to draft and $800 to review across 134 projects, and a business purchase agreement averaged $980 to draft and $1,050 to review across 105 projects, all read firsthand in August 2026. Its published hourly ladder runs from $100 to $350 for a standard practitioner up to $700 to $1,200 for a large firm partner. On the accounting side, a quality of earnings report is the single largest line and the one buyers most often skip on deals where it would have paid for itself several times over. The one cost that is about to stop being optional is worth planning around now. Under SBA SOP 50 10 8.1, which applies to applications issued an SBA loan number on or after 1 October 2026, a quality of earnings report becomes mandatory on an acquisition where the purchase price is $3,000,000 or more, measured before buyer equity or seller debt, and it must be prepared for the lender and contain a cash proof. Every change of ownership also requires an independent business valuation from an accredited Qualified Source, requested by and prepared for the lender, which means a valuation you or the seller commissioned is unusable. Both are your cost as the buyer, and both sit in the diligence window rather than at closing. The practical consequence is that a buyer financing a $3,000,000 deal after 1 October 2026 should budget for the report from the day the LOI is signed, because ordering it late is the single most common way an exclusivity window runs out. The deal room is the cost buyers most often assume and least often price. When we read the five major providers firsthand on 30 August 2026, four of them published no price whatsoever, and the fifth published its ladder in euros rather than dollars. On a small acquisition you may not need one at all, because the seller can share a folder with controlled access, but on anything with employees, contracts and regulated data the audit trail is worth having.

The workstreams small buyers skip, and which of them actually matters

On a lower middle market deal nobody runs all twelve workstreams to corporate depth, and pretending otherwise produces a checklist that gets abandoned in week two. The honest question is which ones you can compress and which ones carry consequences that survive the closing. Three are effectively non-negotiable regardless of deal size. Intellectual property assignment is first, because it is the only finding on this list that cannot be fixed after close: if core code was written by a contractor who never signed an assignment, that contractor owns it, and no amount of purchase price adjustment gets it back. Ask for signed assignments from every developer and contractor who touched the product, and treat a missing one as a condition to closing rather than a detail. Second is the tax registration position, because liability for uncollected sales tax follows the business in most structures and can predate you by years. Third is the access inventory, which is unglamorous and is the workstream that most often ruins the first week of ownership: domains held in a registrar account tied to the seller's personal email, a payment processor in the seller's name, an ad account inside a personal business manager. None of these is a valuation issue and all of them are operational disasters if you find them on day one instead of day thirty. What you can legitimately compress is depth rather than coverage. On a $200,000 acquisition, three months of tied-back revenue is defensible where a full quality of earnings report is not. A single read of every contract above a materiality threshold you set is defensible where a clause by clause legal review of all of them is not. Customer concentration can be settled with a revenue by customer by month export rather than a commercial diligence exercise. The workstream that deserves more attention than its size suggests is the owner's role, because it is where small deals are most often mispriced. Ask the seller to write out how they spent last week, hour by hour, and then price each task at what it would cost to hire someone to do it. If the answer is thirty hours a week of work that the model assumed was free, the earnings you are buying a multiple of are partly the seller's unpaid labour, and the multiple should reflect that. That single exercise costs nothing and changes more purchase prices than any other item on this page.

Good questions

M&A due diligence, answered

Twelve workstreams on a typical buy side deal: revenue quality, financial statements, quality of earnings, working capital, tax, customer concentration, contracts and legal, intellectual property, technology, people, the owner's role, and integration access. Each one has a small set of documents that prove the claim rather than restate it. The table above lists the specific request and the finding that most often ends a deal in each workstream.

No US body publishes a standard period, so the honest answer is that it is set by your exclusivity clause rather than by a norm. On small US deals the diligence window is usually negotiated in the letter of intent alongside the exclusivity period, and the binding constraint is rarely the review itself. It is the lender reaching a decision and third parties returning consents on assigned contracts.

There is no surveyed figure, because scope is set by the buyer. The components are priced though. ContractsCounsel published a $980 to $1,290 average to draft a purchase agreement and an hourly ladder of $100 to $1,200 depending on firm size, read firsthand in August 2026. A quality of earnings report is usually the largest single line, and becomes mandatory on SBA deals of $3,000,000 or more from 1 October 2026.

Financial, tax, legal, commercial, operational, technology, human resources and environmental are the standard headings. On small software acquisitions the environmental workstream is usually irrelevant and the technology and intellectual property workstreams carry most of the risk. On a services or physical business the weighting reverses, which is why copying a corporate checklist unedited wastes most of your diligence budget.

The buyer, in almost every case, and the letter of intent normally states it explicitly in the expenses clause. That clause is one of the few in an LOI that binds you at signature. On an SBA financed deal the independent business valuation and any required quality of earnings report are also the buyer's cost, even though both are prepared for the lender rather than for you.

Diligence run by and for the buyer, to verify what the seller has claimed before the purchase agreement is signed. It is distinct from sell side or vendor due diligence, which a seller commissions in advance to present to buyers. A vendor report is useful context and is not a substitute for your own work, because it was scoped and paid for by the person selling you the business.

Start with the four that prove rather than describe: bank statements, the payment processor export, tax returns, and revenue by customer by month. Together they let you tie claimed revenue to money that actually arrived, confirm the entity is compliant, and see concentration. Everything else in a diligence list is important but secondary, because it explains the business rather than verifying it.

Financial due diligence is the whole workstream. A quality of earnings report is the specific deliverable an accounting firm produces within it, normalising earnings, testing add-backs and evidencing that reported profit converted to cash. Lenders increasingly want the report rather than your own analysis, and SBA loans of $3,000,000 or more require one prepared for the lender from 1 October 2026.

Usually yes, because the commercial terms of a letter of intent are deliberately non-binding. What you cannot escape are the clauses that do bind at signature: confidentiality, exclusivity, expenses and governing law. So walking away during diligence typically costs you the money you have already spent rather than the purchase price, provided the purchase agreement has not yet been signed.

Revenue that will not reconcile to bank deposits, add-backs that are really operating costs, one customer above 20% of revenue with a contract ending inside your first year, core code with no signed contractor assignment, and unregistered sales tax nexus. The first is the most common and the fourth is the only one that cannot be fixed after close.

On a small acquisition, often not. A controlled shared folder does the job when there are few documents and few reviewers. A data room earns its cost when you need a per-document audit trail, multiple advisers with different access, or regulated data. Four of the five major providers we read on 30 August 2026 publish no price, so budget by quote rather than by list price.

The most productive single question is how the owner spent last week, hour by hour. It surfaces how much of the reported profit is unpaid owner labour, which is the most common mispricing on small deals. After that: which customers could leave without warning, what breaks if the founder stops answering, and which assets sit in someone's personal account.

The weighting shifts. Revenue quality becomes churn and expansion analysis rather than a single annual figure, intellectual property assignment becomes the highest-consequence workstream, and hosting and dependency review replaces most of what would be operational diligence elsewhere. Environmental and inventory workstreams drop out entirely. Metrics like net revenue retention and gross margin do work that a profit and loss statement cannot.

Yes, in three published ways. Every change of ownership needs an independent valuation from an accredited Qualified Source requested by and prepared for the lender, so a valuation you commissioned is unusable. From 1 October 2026 a quality of earnings report is mandatory at $3,000,000 or more. And a partial change of ownership must be structured as a stock purchase rather than an asset purchase.

The findings feed the definitive purchase agreement. Anything you discovered becomes either a price adjustment, a specific indemnity, a condition to closing, or a reason to walk. A finding you raise and then fail to write into the agreement has no effect once you sign, which is why the diligence report and the drafting need to overlap rather than run in sequence.

As a starting point, then cut it hard. Most published checklists are written for corporate transactions and include workstreams that are irrelevant to a $500,000 acquisition, which is why buyers abandon them in week two. Keep every item that could produce a liability surviving the close, compress the rest, and add whatever is specific to how this particular business actually makes money.

More comparisons

See how Buyouts compares

vs Acquire.com

Acquire.com alternative

An AI-SaaS-native marketplace with verified metrics, published multiples and vetted buyers, not a generalist startup listing wall.

vs Flippa

Flippa alternative

A curated, metrics-verified, vetted-buyer marketplace for AI SaaS, not a high-volume auction wall.

vs Earnout agreement

Earnout agreement

The three mechanisms that move a purchase price after the handshake, what each one costs to paper, and the sample size that tells you how rare earnouts really are.

vs Purchase price allocation

Purchase price allocation

The seven asset classes, the residual method, and what each class is actually worth to a buyer versus a seller, read from the statute and the IRS instructions.

vs Business partner buyout

Business partner buyout

How a partner buyout is structured, what the SBA actually requires you to put down, and the clause in your partnership agreement that decides the tax.

vs ROBS 401k

ROBS 401k

How a ROBS 401k actually works, what the IRS says about it in its own words, what the providers charge to set it up, and the exit fee none of them put in the brochure.

See how buying works See how selling works See pricing

The deal room for AI SaaS, not a yard sale

Buy with verified metrics, published multiples and escrow-backed closes, or list your AI SaaS to a pool of vetted, capital-qualified buyers.

Listings, metrics and buyers shown are illustrative product UI · valuation content is educational, not a guaranteed sale price or return · trademarks belong to their owners