TRW & Co · M&A and private capital
Legal Due Diligence Checklist for UK Acquisitions
A legal due diligence checklist for a UK acquisition should cover corporate records, contracts, employment and pensions, property, IP, data, tax, litigation and compliance. The aim is not volume but value: finding the issues that should change price, structure or the decision to proceed, and turning each into an indemnity, condition or fix before completion.
Key pointMatters fairly disclosed generally cannot found a warranty claim, so every diligence finding needs its own contractual response, such as a specific indemnity, condition or price change.
At a glance
Buyer must ask
English law imposes no general duty on a seller to volunteer problems, so the buyer's protection comes from diligence, warranties, indemnities and the disclosure letter.
Change of control clauses
Customer, supplier, lease and finance contracts that allow termination on change of control are among the most valuable findings in any review.
Companies House verification
Identity verification for directors and people with significant control became mandatory from 18 November 2025 under the Economic Crime and Corporate Transparency Act 2023.
Failure to prevent fraud
The corporate offence came into force on 1 September 2025 for large organisations, so buyers should review fraud prevention procedures alongside anti-bribery controls.
Employment law in transition
The Employment Rights Act 2025 received Royal Assent on 18 December 2025 and is commencing in stages, so readiness should be tested in diligence.
Swipe or scroll →
The short answer: what a legal due diligence checklist should cover
A legal due diligence checklist for a UK acquisition should cover the target's corporate records and ownership, material contracts, employees and pensions, property, intellectual property, data protection, tax, litigation and regulatory compliance. For each area the buyer asks for documents, raises enquiries and flags anything that affects price, structure or the decision to proceed.
The purpose is not to produce a long report. It is to find the issues that should change the deal: a change-of-control clause that lets a key customer walk away, an unregistered share transfer, a misclassified workforce or an unresolved data breach. Each finding should end up in the price, a specific indemnity, a condition or a pre-completion fix.
This guide sets out what to request, what to red-flag and how to run the process efficiently. It sits alongside our walkthrough of the M&A process in the UK.
Why diligence matters under English law
English law gives buyers limited protection by default. There is no general duty on a seller to volunteer problems, so the buyer must ask. The buyer's contractual protection then comes from warranties and indemnities in the sale agreement, qualified by the seller's disclosure letter.
That creates a trade-off. Matters fairly disclosed against the warranties generally cannot found a warranty claim, so discovering an issue in diligence can reduce the buyer's later remedies unless it negotiates a specific indemnity or a price reduction. Diligence and drafting must therefore be run together; see our guide to warranties and indemnities.
Diligence also supports financing and insurance. Lenders usually rely on legal due diligence reports, and warranty and indemnity insurers underwrite against them. A thin or poorly scoped report can narrow insurance cover or delay funding.
How the diligence process works in practice
- Scope and materiality. Agree with the buyer which areas matter and set a materiality threshold for contracts and disputes, so the review focuses on value rather than volume.
- Issue the request list. Send a tailored legal due diligence checklist to the seller, mapped to the data room index. Generic lists slow the process and irritate sellers.
- Review the data room. Review documents against the request list and log gaps. Check public registers independently rather than relying on copies supplied.
- Raise enquiries. Ask targeted follow-up questions and hold management calls on key topics such as customers, disputes and employees.
- Report by exception. Produce a red-flag report highlighting issues that matter, with a recommended contractual response for each.
- Feed into the documents. Translate findings into warranties, specific indemnities, conditions, pre-completion covenants or price adjustments.
- Bring-down before completion. Where signing and completion are split, refresh key searches and enquiries before completion.
The legal due diligence checklist by area
The table below summarises the core requests and the most common red flags in each area. Tailor it to the target's sector and size.
| Area | What to request | Typical red flags |
|---|---|---|
| Corporate | Articles, statutory registers, PSC register, Companies House filings, shareholder agreements, board minutes | Gaps in the share chain, unfiled allotments, pre-emption breaches, options or rights not reflected on the register |
| Commercial contracts | Top customer and supplier contracts, framework and agency agreements, guarantees | Change-of-control termination rights, exclusivity, uncapped liability, most-favoured-customer clauses |
| Employment | Senior contracts, standard terms, handbook, contractor arrangements, disputes, consultation records | Misclassified contractors, restrictive covenants that are unenforceable, tribunal claims, collective consultation failures |
| Pensions | Scheme documents, latest valuation, employer covenant information | Defined benefit deficits, Pensions Regulator involvement, historic transfers out |
| Property | Title documents, leases, licences, planning, environmental reports | Landlord consent to change of control or assignment, break clauses, dilapidations, unregistered interests |
| Intellectual property | Registered rights, licences in and out, employee and contractor IP assignments, open-source use | IP owned by founders or contractors, lapsed registrations, copyleft licences in core software |
| Data and cyber | Privacy notices, records of processing, breach log, international transfer arrangements, ICO correspondence | Unreported breaches, no transfer mechanism, consent-based marketing without valid consent |
| Litigation and compliance | Claims, threatened claims, regulatory correspondence, anti-bribery and sanctions policies | Investigations, sanctions exposure, no fraud or bribery prevention procedures |
Corporate and ownership
Confirm that the seller owns what it is selling. Trace every allotment and transfer since incorporation and check that pre-emption rights, shareholder consents and filings were properly dealt with. Compare the register of people with significant control with the real ownership position.
Companies House identity verification under the Economic Crime and Corporate Transparency Act 2023 became mandatory for directors and people with significant control from 18 November 2025, with a phased transition for existing companies. Check whether the target and its officers have complied, since non-compliance can delay post-completion filings.
Commercial contracts
Review contracts above the materiality threshold and every contract with a key customer or supplier. The most important clauses are change of control, assignment, exclusivity, non-compete, liability caps and termination for convenience. In an asset deal each contract will need to be novated or assigned, which changes the analysis; see share purchase vs asset purchase.
Employment and pensions
Review senior contracts, standard terms, incentive arrangements and any use of contractors or agency workers. The Employment Rights Act 2025 received Royal Assent on 18 December 2025 and is being brought into force in stages, so buyers should test the target's readiness for provisions already in force and those scheduled. Our employment team can assess exposure.
For defined benefit pension schemes, obtain the latest actuarial valuation and recovery plan. The Pensions Regulator has powers to seek contributions from connected parties in some circumstances, so scheme deficits can follow the group.
Property
Check title for freeholds and leases, and identify leases requiring landlord consent to a change of control. Review break dates, rent reviews and repair obligations. In asset deals, Stamp Duty Land Tax and the mechanics of transferring each property become significant.
Intellectual property, data and technology
Confirm that the target owns its key IP, including software written by founders, employees and contractors. Without written assignments, contractor-created IP may belong to the contractor. Check open-source licences used in core products.
For data, review UK GDPR compliance, breach history and international transfers. The Information Commissioner's Office guidance is the starting point. The Data (Use and Access) Act 2025 amends parts of the regime, so check which changes are in force at the date of review. See our data protection page.
Tax, litigation and compliance
Tax diligence is normally led by accountants, with lawyers handling the tax covenant. On the legal side, review current and threatened claims, regulatory correspondence and investigations.
Corporate criminal exposure is increasingly important. The failure to prevent fraud offence introduced by the Economic Crime and Corporate Transparency Act 2023 came into force on 1 September 2025 for large organisations, alongside the existing failure to prevent bribery offence. The government guidance on the fraud offence describes the reasonable procedures expected. Ask for the target's policies, training records and any whistleblowing reports.
Regulatory licences, consents and screening
Identify every licence, permission or registration the target needs to trade, and check whether a change of control requires the regulator's prior approval or notification. FCA-authorised firms are the obvious example, but similar regimes apply in energy, telecoms, healthcare, gambling and other sectors.
Diligence should also confirm whether the deal itself needs government clearance. The National Security and Investment Act 2021 requires mandatory notification of acquisitions of entities active in specified sensitive sectors, and completing a notifiable acquisition without approval makes it void. Ask for a description of the target's activities detailed enough to test against the sector definitions, and check UK and international sanctions lists against the target's owners, customers and counterparties.
A legal due diligence checklist is only as good as its follow-through. For every red flag, record the recommended response: walk away, reduce price, seek a specific indemnity, make it a condition, or require a fix before completion. Unresolved findings that rely only on general warranties are a common source of post-deal disputes.
Red flags and how to respond
Not every issue justifies the same response. A useful approach is to classify findings into three tiers.
- Deal-breakers. Defective title to shares or core IP, sanctions exposure, or a regulatory issue that could remove a licence. These may justify walking away or restructuring the deal.
- Price and indemnity items. Quantifiable liabilities such as a tax exposure, a live claim or a pension deficit. Address through price or a specific indemnity, possibly backed by escrow or retention.
- Housekeeping. Missing filings or registers, minor contract gaps. Require rectification before completion or as a post-completion covenant.
Sector-specific additions to the checklist
A core legal due diligence checklist works for most targets, but some sectors need additional workstreams. Building these in at the scoping stage avoids late surprises.
- Financial services and fintech. Regulatory permissions, regulatory capital, complaints data, Consumer Duty implementation and correspondence with the FCA. Change-in-control approval is usually a condition.
- Technology and software. Source code ownership, open-source compliance, escrow arrangements, cyber incidents and dependency on third-party platforms.
- Real estate-heavy businesses. Title, planning, building safety, environmental contamination and energy performance compliance across the portfolio.
- Healthcare and life sciences. Registrations with the relevant regulator, clinical and product liability, and regulatory approvals tied to specific sites or persons.
- Consumer-facing businesses. Consumer protection compliance, pricing practices, subscription terms and marketing consents, given the strengthened enforcement powers under the Digital Markets, Competition and Consumers Act 2024.
- Businesses with public sector customers. Procurement compliance, contract terms on change of control, and any exclusion or debarment risk.
For each additional workstream, decide early whether specialist advisers are needed, and allow for that in the timetable and budget.
An illustrative scenario
Illustrative only; the parties are generic. A private equity buyer is acquiring a UK software company. The buyer's legal due diligence checklist reveals three issues: the core platform was partly written by an overseas contractor with no IP assignment; the largest customer contract allows termination on change of control; and a former employee has threatened a whistleblowing claim.
The buyer requires a confirmatory IP assignment from the contractor as a condition, asks the seller to obtain a waiver from the customer before signing, and negotiates a specific indemnity for the threatened claim. Because the W&I insurer will exclude known matters, the buyer keeps these items outside the insurance policy; see W&I insurance.
Common mistakes in legal due diligence
Using a generic request list
Sending a long, generic legal due diligence checklist to a small target wastes time and signals inexperience. Sellers respond slowly, and important requests get lost among irrelevant ones. Tailor the list to the target's sector, size and structure, prioritise the items that drive value, and map requests to the data room index so gaps are obvious. Revisit the list after an initial review rather than front-loading every conceivable question.
Relying on seller copies of public records
Data room copies of statutory registers, filings and title documents can be out of date or incomplete. Run independent searches at Companies House, HM Land Registry, the Intellectual Property Office and relevant court registers. Discrepancies between seller documents and public records often reveal the most important issues, such as an unfiled allotment or a charge that has not been released.
Reviewing contracts without a materiality threshold
Reviewing every contract equally is slow and expensive. Agree a value threshold, add any contract with a key counterparty regardless of value, and focus on clauses that affect the deal: change of control, exclusivity, liability and termination. Sample standard-form contracts rather than reviewing each one, and flag non-standard terms.
Ignoring the gap between signing and completion
Where clearance or consents delay completion, new issues can arise. A key customer may give notice, a claim may be issued, or a regulator may write. Build bring-down searches and enquiries into the completion process, and make sure the agreement gives the buyer appropriate rights if material adverse matters arise before completion.
Leaving key employees and incentives until late
Founders and senior managers are often central to value, yet their contracts, incentive arrangements and restrictive covenants are sometimes reviewed last. Check whether options or growth shares vest or accelerate on a sale, whether bonuses are triggered, and whether post-termination restrictions are likely to be enforceable. If retention matters, negotiate new service agreements or rollover arrangements in parallel with the main documents rather than after signing.
Cross-border targets and Bangladesh links
Where the target has subsidiaries abroad, diligence must cover local corporate records, licences, employment and tax under local law. English-law warranties will not cure defects in a foreign subsidiary's share title.
Targets with suppliers or operations in Bangladesh raise specific issues: foreign ownership and repatriation rules, labour and building safety standards in the supply chain, and the enforceability of contracts. TRW & Co works from London and Dhaka on UK–Bangladesh matters and can run local diligence in parallel with the UK review.
Next steps for buyers
- Set scope and materiality before issuing requests.
- Tailor your legal due diligence checklist to the sector and structure.
- Run independent public-register searches.
- Report by exception with a recommended response for each red flag.
- Align diligence with the warranty package, indemnities and insurance.
- Plan bring-down checks if signing and completion are split.
To discuss a transaction or a diligence exercise, contact our London office or see our M&A practice.
Frequently asked questions
01What is included in legal due diligence?
Legal due diligence reviews the target's legal position: corporate records and ownership, material contracts, employees and pensions, property, intellectual property, data protection, litigation, regulatory compliance and, alongside accountants, tax. The buyer's lawyers review documents in the data room, run public-register searches, raise enquiries and report on issues that affect value or risk. Findings feed into the sale agreement through warranties, specific indemnities, conditions and price adjustments. The scope should be tailored to the target's sector, size and structure rather than taken from a generic list.
02How long does legal due diligence take?
It depends on the size and complexity of the target, the quality of its records and how quickly the seller responds. A focused review of a small company can be completed in a few weeks, while a multi-jurisdiction group can take considerably longer. Delays usually come from incomplete data rooms and slow responses to enquiries rather than from the review itself. Agreeing scope and a materiality threshold at the outset, and tailoring the request list, are the most effective ways to shorten the timetable.
03What are the biggest red flags in due diligence?
The most serious red flags are defects in title to the shares or core assets, especially intellectual property; change-of-control rights in key customer, supplier, lease or finance contracts; material litigation or regulatory investigations; sanctions or bribery exposure; significant pension deficits; and unreported data breaches. Each should be assessed for its impact on value and dealt with through price, a specific indemnity, a condition, a pre-completion fix or, in serious cases, a decision not to proceed.
04Who pays for legal due diligence?
Usually each party bears its own costs, so the buyer pays for its own legal due diligence. Heads of terms sometimes include a costs provision, for example requiring the seller to contribute if it withdraws during exclusivity, but this is a matter for negotiation. In auction sales, sellers often commission vendor due diligence reports that are then made available to bidders, sometimes with reliance extended to the successful buyer and its lenders.
05Does a share purchase need more due diligence than an asset purchase?
Generally yes. In a share purchase the buyer acquires the company with all its history and liabilities, known and unknown, so diligence must be broad. In an asset purchase the buyer chooses which assets and liabilities to take, which narrows the scope, but some liabilities still transfer, notably employees under TUPE. Asset deals also require diligence on the transferability of each contract, licence and property, because each must be assigned or novated individually.
06What is a red flag report?
A red flag report summarises only the material issues found in diligence rather than describing every document. It is shorter and more decision-focused than a full report and is common where time or budget is limited. A good red flag report explains each issue, assesses its likely impact and recommends a contractual or practical response. Lenders and W&I insurers may require a fuller report, so check their requirements before agreeing the format.
Sources and official materials
- Economic Crime and Corporate Transparency Act 2023 — Companies House reforms and the failure to prevent fraud offence
- Offence of failure to prevent fraud: guidance — Government guidance on reasonable fraud prevention procedures
- Employment Rights Act 2025 — Statutory text of the 2025 employment reforms
- ICO guidance for organisations — UK GDPR and data protection compliance guidance
- Transfer of Undertakings (Protection of Employment) Regulations 2006 — Employee transfers on business and asset sales
- Companies House — Public register of company filings and officers
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.