Due Diligence Checklist

Due diligence is the point where a promising listing becomes a real acquisition case. The purpose is not to produce a long report. The purpose is to verify what matters, surface hidden risk, and decide whether the deal should move forward, be repriced, or stop.

This checklist is designed for smaller digital acquisitions across Saudi Arabia, the GCC, and broader MENA markets.

1. Commercial diligence

Confirm how the business wins and whether that advantage is likely to last.

• Core products or services sold
• Target customer segments and geography mix
• Main acquisition channels
• Key competitors and substitutes
• Pricing history and discounting behavior
• Sales pipeline reliability
• Renewal or repeat purchase trends

Questions to answer:

• Why do customers buy this business instead of the alternative?
• What would cause sales to slow over the next year?
• Is growth broad-based or concentrated in one channel or campaign?

2. Financial diligence

This is where buyers often find the biggest gap between presentation and reality.

• Monthly revenue by channel and product line
• Gross margin and contribution margin
• Refunds, chargebacks, and bad debt
• Verified bank and processor statements
• Seller add-backs and normalization logic
• Tax filings or equivalent statutory records
• Deferred revenue or outstanding liabilities

Red flags:

• Revenue numbers that do not reconcile across systems
• Large unexplained swings in margin
• Add-backs that are really recurring owner activity
• Cash leakage through informal or untracked channels

3. Customer and retention diligence

You need to know how fragile the revenue base is.

• Top customer concentration
• Cohort retention or repeat purchase behavior
• Contract terms and renewal mechanics
• Support load and complaint patterns
• Customer acquisition cost trends
• Net promoter or satisfaction indicators if available

High-quality revenue is diversified, repeatable, and not overly dependent on one client relationship.

4. Traffic, channel, and platform diligence

Digital businesses can be damaged quickly when one channel breaks.

• Organic search dependence
• Paid media account stability
• Marketplace account health
• Social audience ownership versus rented distribution
• Email list quality and engagement
• Attribution quality and analytics setup

Ask directly:

• What happens if the top channel loses 30 percent of volume next quarter?
• Can the team recover through other channels?

5. Product and technology diligence

Even small acquisitions need enough technical review to understand maintenance risk.

• Code repository ownership and access
• Hosting, infrastructure, and deployment process
• Security incidents and backup procedures
• Key third-party integrations
• Technical debt backlog
• Documentation quality
• Product roadmap realism

For no-code or low-code products, confirm who controls the stack and whether critical automation depends on one contractor.

6. Legal and compliance diligence

The legal work should match the size of the deal, but it should never be skipped.

• Corporate documents and cap table, if relevant
• IP ownership and contractor assignment
• Commercial contracts and key terms
• Employment or freelance agreements
• Privacy policy, terms, and data handling practices
• Regulatory exposure in core markets
• Open disputes, claims, or unpaid obligations

Cross-border buyers should verify what actually transfers with the sale: entity, assets, contracts, merchant accounts, domains, code, and customer data.

7. Operations and transition diligence

The best business on paper can still fail after closing if transfer is weak.

• SOPs for sales, support, fulfillment, and reporting
• Team structure and replacement risk
• Vendor contracts and service dependencies
• Domain, hosting, email, analytics, CRM, and payment account transfer steps
• Founder transition expectations
• Handover timeline and training plan

Ask for a practical 30-day transition schedule before signing final documents.

8. Deal and structure diligence

Even when the business is sound, the transaction still needs protection.

• Asset purchase versus share purchase logic
• Holdback or escrow design
• Earn-out triggers
• Working capital treatment
• Non-compete and non-solicit scope
• Reps, warranties, and disclosure schedules

9. Red flags that should change the price or terms

Revisit valuation when you see:

• Customer concentration beyond what was disclosed
• Unstable channel economics
• Weak evidence for reported earnings
• Poor code transfer readiness
• Unclear ownership of assets or IP
• Founder dependence that cannot be replaced quickly
• Compliance issues that could block operations after transfer

10. Final diligence decision

At the end of diligence, classify the deal in one of three buckets:

• Confirmed: fundamentals support the agreed price and structure
• Reprice: the business is real, but risk requires lower value or protective terms
• Reject: the transfer, financial quality, or legal exposure is worse than acceptable

FAQ

How deep should diligence go on a small deal?

Deep enough to validate the core value drivers and the transfer path. Small deals do not need big-company process, but they still need disciplined verification.

Should buyers always ask for full analytics access?

Not on day one. Serious diligence, though, should include direct evidence from primary systems rather than screenshots alone.

What is the most common diligence miss?

Underestimating founder dependence. Many businesses look stable until the buyer discovers that sales, vendor management, and product decisions all flow through one person.