Key Person Risk When Buying a SaaS Business: How to Spot It, Price It and Structure Around It

Short answer: key person risk is the chance that a business stops working when one specific person leaves it. In a SaaS acquisition that person is almost always the founder, and the risk is unusually severe because software companies hide it well. Revenue looks recurring and automated right up to the moment you discover that one person was doing the selling, the shipping and the support. Last updated August 2026. Educational only, not financial or investment advice.

It is also the risk buyers price most crudely. Concentration in customers gets a spreadsheet; concentration in people gets a gut feeling. The useful move is to treat founder dependency as something you can measure before you make an offer, because what you can measure you can structure around.

What is key person risk?

Key person risk is the exposure created when a single individual holds knowledge, relationships or authority that the business cannot replace quickly. It is not about whether someone is talented. It is about whether the operation degrades if they stop answering messages. In a small SaaS business the founder often is the product roadmap, the only person who has ever spoken to the top ten accounts, and the only one who knows why a particular cron job must run before billing.

For an acquirer the question has a narrow, cash-shaped form: if the founder disappears ninety days after close, what breaks, how fast, and what does fixing it cost? Everything else is commentary.

What is key man risk?

Key man risk is the same concept under an older name, still common in lending and insurance documents. You will see key person risk, key man risk and key person dependency used interchangeably in deal paperwork. There is no technical difference between them. If a lender or an insurer uses the older phrasing, they mean exactly what the term above means.

How do you assess key person risk before buying?

Work through what the person actually does rather than what the org chart says. The questions below are the ones that reliably separate a business that runs from a business that is being carried.

Two of these deserve extra weight because they are cheap for a seller to fix and therefore telling when unfixed. Vendor accounts on a personal email are a transfer problem you will inherit on day one. A single committer with no written runbook means the first incident after close is an emergency rather than a ticket. If the founder was also the only person watching the systems, budget for the monitoring layer they never needed: someone has to notice when a pipeline silently stops delivering data, and inheriting a stack where nobody is alerted when a data feed goes stale is a common and avoidable surprise in the first quarter.

The lean team paradox

Here is the tension that makes this risk hard to price. Efficiency and key person risk are the same fact viewed from two sides.

A tiny team producing real revenue scores brilliantly on every efficiency measure. Private SaaS companies run a median of $141,125 of revenue per employee, and AI-native startups have been reported in the $2M to $4M range. Those numbers get quoted as proof of a superb business, and often they are. But revenue produced by three people is revenue that depends on three people. The same leanness that lifts margin concentrates knowledge.

So when a listing boasts about how few staff it needs, read it as two claims at once: the cost base is genuinely low, and the replacement cost of any single person is genuinely high. Both are true. Only one of them is in the pitch.

How do you mitigate key person risk in an acquisition?

You cannot remove it before closing. You contain it with structure, and structure is what most of the negotiation is really about.

A transition period with defined deliverables. Thirty days of vague availability is worth very little. A written handover covering deployment, billing, the top twenty accounts and every vendor credential is worth a lot. Specify the deliverables, not the hours.

An earnout or holdback tied to what you are actually worried about. If the concern is that the founder's relationships carry the revenue, tie a portion of consideration to retention over the following two to four quarters. This is the same tool used for customer concentration risk, applied to people instead of accounts, and it works for the same reason: it moves the risk back to the person who knows whether it is real.

A consulting agreement with a real scope. Useful when you need the founder's technical knowledge but not their time. Price it properly and keep it short. An open-ended arrangement tends to preserve the dependency rather than unwind it.

Documentation as a closing condition. The cheapest mitigation available. Make runbooks, credential transfer and an architecture overview conditions of close rather than post-close promises. A seller who resists this is telling you something useful.

Does keeping the founder on affect SBA financing?

Yes, and it catches buyers out. If you structure a partial change of ownership so the founder keeps equity, which is a common way to hold a key person in place, the SBA's SOP 50 10 8, effective 1 June 2025, requires personal guarantees from all equity holders for at least two years. That means the founder personally guarantees your acquisition loan. Some founders accept it; many refuse once they understand it, and the deal has to be restructured late.

A complete change of ownership works differently: guarantees are not required from investors holding under 20%. If you are financing with an SBA 7(a) loan, decide early whether the founder is staying on as an owner or as an employee, because those are different transactions to a lender. The wider mechanics are covered in our guide to using an SBA loan to buy a SaaS business.

What is key person insurance and does it help?

Key person insurance is a policy the company holds on an individual, paying out to the business if that person dies or becomes disabled. It is genuinely useful and frequently misunderstood, because it covers the two things least likely to happen. It does not pay out when a founder gets bored, takes a job, starts a competitor or simply stops caring six months after being paid.

For acquisition purposes, insurance is a backstop for catastrophe and contract is the tool for everything else. Non-compete and non-solicit terms, a defined transition, and consideration held back against retention do more practical work than a policy will. Buy the policy if a lender requires it or if one person truly is irreplaceable, and do not treat it as having solved the problem.

Does key person risk reduce the valuation?

It changes the structure before it changes the headline number. Sellers tend to expect a discount and instead meet a deferral: the multiple survives, but a slice of the money moves behind an earnout or a holdback. That is usually the right outcome for both sides, because the seller keeps their price if the business performs and the buyer stops paying today for continuity that has not been demonstrated.

Where it does hit price directly is in financed deals. A lender assessing a business that depends on one person will look harder at the debt service, and a buyer who has to service acquisition debt cannot absorb a bad first year. If you are working out what a business should be worth before you get into structure, our SaaS valuation calculator and the current SaaS valuation multiples give you the baseline that this risk then adjusts.

What should a seller do about it?

Reduce it before you list, because it is one of the few risks a seller can genuinely fix in a quarter. Move vendor accounts to company-owned credentials. Write the runbook. Get a second person deploying. Route customer email through a shared inbox rather than your personal one. Record how you actually make the decisions you make.

None of that changes revenue, and all of it changes how the business reads in diligence. The work also shortens the process, which matters more than sellers expect given how long these transactions take. Buyers can only move quickly on businesses they can understand quickly, and the rest of the diligence sequence is set out in our SaaS due diligence checklist.

The honest summary

Key person risk is the one item in SaaS diligence with no benchmark to hide behind. There is no published percentage, no median, no threshold that separates acceptable from unacceptable. What exists is a set of observable facts about who does what, and a set of structures that shift the exposure back onto whoever is best placed to judge it. Gather the facts, pick the structure, and price the business on what it does without the person selling it to you.