Sell-side due diligence checklist: what to prepare before buyers ask

Why prepare sell-side due diligence before the first buyer call

Sell-side due diligence is the seller's own review of the company, done before buyers start asking, so every document an acquirer will request is located, current and explainable. Done early, it shortens confirmatory diligence after the LOI and removes the surprises that cause retrades. Sellers whose last deal collapsed in diligence will recognize the pattern from when a business sale falls through.

Request lists cover the same workstreams in most deals: financial, legal, HR, IT and customer contracts. What changes is how hard each document is to find. This checklist maps each item to the system that usually holds it and adds a data-rights section that matters both to acquirers and to any license of the company's records. It sits alongside the broader selling a business checklist, which covers the whole sale.

Where each diligence document actually lives

Give every workstream an owner inside the company before the data room opens.

The sell-side due diligence checklist

Mark each line ready, missing or needs explaining.

Financial

• Three or more years of financial statements, with the accountant's reports where they exist
• Monthly management accounts reconciled to the annual figures
• An add-back schedule with support for every adjustment
• Working capital trend and receivables aging by customer
• Tax returns and any open notices

Customers and revenue

• Signed copies of every material customer contract, with amendments
• Change-of-control and assignment clauses flagged contract by contract
• Revenue by customer over time, showing concentration
• Renewal dates, pricing terms and any most-favored-customer clauses

Legal and corporate

• Formation documents, ownership records and board or member consents
• Pending or threatened claims and settlement history
• Licenses, permits and insurance policies
• Material vendor agreements and leases

People

• Employee census with roles, start dates and pay
• Signed confidentiality and IP assignment agreements for employees
• Written agreements with IP assignment for contractors and agencies that produced work product
• Retention plans for key people

IT and systems

• A list of every business system, the years of history it holds and who administers it
• Software subscription inventory, including archived tools
• Security policies and incident history
• Backup and retention settings, so nothing is purged mid-process

Data rights

• Customer contracts reviewed for confidentiality and data-use clauses that limit what the company may do with client data or deliverables
• Current and past privacy notices and terms of service, with dates
• Notices given for call recordings and transcripts
• A note of where consumer, patient or EU-resident personal data sits, if anywhere
• A list of any data already licensed or shared with third parties

Ownership is the first data-rights question. Work an employee creates within the scope of the job is generally a work made for hire owned by the employer, while commissioned work from outside contractors qualifies only in listed categories and with a signed written agreement, as the Copyright Office explains in Circular 30. That is why contractor assignments are on the list.

Promises are the second. A January 2024 FTC staff post says a company's promises not to use customer data for undisclosed purposes, such as training or updating AI models, are enforceable whether they appear in privacy policies, terms of service, promotional materials or marketplaces (FTC staff, January 2024). It is staff guidance, not a rule, but it tells you what to look for. If the company does business in California, counsel should also check whether it meets any of the applicability tests in the California Consumer Privacy Act. This is general information, not legal, tax or financial advice. Confirm with deal counsel before relying on it.

How to use the results

Why the data-rights section pays off twice

Acquirers ask data-rights questions because they need to know what they are buying and what they may do with it, especially if they plan their own analytics or AI projects. The same answers decide whether the company could license its operational records for AI training before or alongside a sale.

Under a SourceX license the company keeps ownership of its records and licenses them for an agreed term, usually exclusively for AI training. Redaction and de-identification rules are agreed with the company before any work starts, and nothing is delivered without an executed agreement. A signed license is also a contract acquirers will want to read, so it belongs in the data room. The three-year preparation plan covers when to make that decision.

How an advisor refers a client using metadata only

M&A advisors already see the system list and headcount during preparation, so they can spot a fit early. The referral itself needs no records.

1. Check the basics: a US company that reached 50+ full-time employees at peak (contractors excluded), with several years of operating history and an owner or executive able to sponsor a license. The who qualifies page has the full baseline.
2. Get the client's permission to make the introduction.
3. Share only fit information: industry, approximate headcount, years in operation and the names of the main systems. Never export, upload or describe confidential records.
4. Introduce the company through your partner referral link or the referral form. SourceX then handles qualification, the inventory, pricing, buyer review and delivery directly with the company.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, payable only after the buyer pays and SourceX receives its fee. The reward comes out of SourceX's fee, never the seller's proceeds, and no reward is guaranteed. Check your engagement letter and any firm or registration rules that apply to you, and disclose the arrangement to the client. The M&A advisor partner page explains how the program fits a sell-side practice.

Red flags that stall diligence and block a license

• Client deliverables or client data held under contracts that reserve them to the client
• Contractors who built core systems with no written IP assignment
• Archives deleted in a system migration, or tools cancelled without an export
• Consumer personal data or protected health information with no clear basis for reuse
• A lender, trustee or court controlling the assets
• The same records already licensed to someone else for AI training

Next step

Run the checklist with the client's CFO before the teaser goes out. If the company also looks like a licensing fit, register as a partner and introduce it, or give the owner your referral link to apply at sourcex.si/apply.