Due Diligence: What It Is and How It Works in the UK

Due diligence is the investigation a buyer, investor or lender carries out before committing money or signing a contract. The aim is to test whether the business, asset or person in front of them is what it claims to be. In a UK company deal it covers the financials, contracts, tax, people, legal position and commercial prospects. In regulated firms, the same phrase also describes the identity checks made on customers.

This guide covers both meanings, then concentrates on the one that matters most to founders and owners: the deal process. You will see what is checked, in what order, how long it takes and what you can do before anyone asks.

TL;DR

• Due diligence is verification before commitment: the other side tests every claim you have made about your business, usually against documents.
• In deals it splits into financial, legal, tax, commercial, operational and people strands. Financial due diligence is normally the one that moves price.
• Separately, UK regulated firms must carry out customer due diligence (CDD), with enhanced checks for higher-risk customers.
• A sale process typically runs 6 to 12 weeks in due diligence, depending on complexity, so preparation beforehand saves real time and value.
• SaaS businesses are judged on whether ARR, churn and retention figures survive testing against the underlying data.

Table of Contents

• What due diligence means
• The main types of due diligence in a UK deal
• Financial due diligence: where price is won or lost
• Due diligence for SaaS companies
• Customer due diligence: the regulatory meaning
• The “4 Ps” and other frameworks
• How a due diligence process runs
• Perspective: what we see founders get wrong
• How to prepare before a buyer or investor asks
• Seller-side or vendor due diligence
• How we help
• FAQ
• Sources

What due diligence means

The phrase comes from the idea of reasonable care. If you spend serious money on something, you are expected to look properly first. “Doing your due diligence” has drifted into everyday speech, meaning anything from reading reviews to checking a landlord, but in business it has a precise meaning: a structured review that tests representations made by the other party.

Due Diligence is described as the pre-close investigation that verifies what a seller, target company or fund manager has said, testing financial statements against documentary evidence. That is the most useful way to think about it. Nobody is asking whether your story is good. They are asking whether it is true, and whether it will stay true after they own a share of it.

There are two common contexts in the UK:

1. Transaction due diligence: an acquirer, investor or lender examines a business before buying, investing or lending.
2. Customer due diligence: a regulated firm verifies who its customers are, as required by financial crime rules.

The rest of this article spends most of its time on the first, with a clear section on the second so you can see where the two differ.

The main types of due diligence in a UK deal

A buyer rarely commissions one review. They commission several, run in parallel by different specialists. The names vary by adviser, but the strands are consistent.

One source worth reading before you start is the Acquisitiv due diligence checklist for buying a UK business. It makes the point that buyers often tackle the work in the wrong order. As a seller, you can use the same logic in reverse: expect the early questions to decide whether the later, more expensive ones are ever asked.

Financial due diligence: where price is won or lost

Financial due diligence (FDD) is the strand that most often changes a deal. It checks the quality of earnings, the net debt and debt-like items, the working capital the business needs, and the credibility of the forecast.

The ICAEW financial due diligence guideline sets out the what, why, who and how of FDD and how it interacts with other areas of due diligence. It is written for practitioners, but a founder will learn a lot from the structure.

In practice, FDD tends to focus on four questions:

• Quality of earnings. Are there one-off gains, owner expenses or unusual costs that distort EBITDA? Adjustments in either direction change the valuation multiple’s base.
• Cash conversion. Does profit turn into cash, or is it trapped in debtors and stock?
• Net debt and debt-like items. Deferred income, overdue tax, director loans and leases can all reduce what the seller receives.
• Forecast credibility. Is the plan built from drivers that can be traced to evidence, or is it a top-down growth percentage?

If you are on the buying side, our own practical guide to financial due diligence for UK buyers and the page on financial due diligence for acquisitions go through the buyer’s workflow. If you run a smaller company, the complete UK guide to financial due diligence for SMEs is the better starting point.

Technology and judgement

FDD has changed with data tooling. In its November 2024 announcement of the guideline, ICAEW said technology has revolutionised the process while bringing risks that practitioners must manage carefully. The practical consequence for sellers is that reviewers can now test full transaction populations rather than samples. Inconsistencies that once hid in a sample are more likely to surface.

It also means the human layer matters. Data can show that a number moved; only a professional can judge why, and whether it will happen again. The same applies to people data. Headcount, skills and attrition figures feed the operational strand, and if you are cleaning those records before a deal, AI-driven workforce analytics is a useful way to think about getting HR data right before you scale.

Due diligence for SaaS companies

Software businesses are examined differently, because the accounts alone say little about the quality of recurring revenue. A buyer will want the accounts and the subscription data to agree.

Investors do not read metrics in isolation. As Mercia Ventures explains in its SaaS metrics note, headline figures like ARR need support from other indicators, such as usage and NPS, and a business with net revenue retention above 100% is favoured because customers evidently keep finding value. High churn tends to be read as a symptom of weak onboarding or product-market fit.

So the questions a SaaS diligence team will ask are specific:

• Does ARR reconcile to invoiced and recognised revenue, month by month?
• How is churn defined, and is it measured by logo or by value?
• What share of revenue comes from the top ten customers, and on what contract terms?
• Are capitalised development costs defensible?
• Is gross margin calculated consistently, with hosting and support costs allocated properly?

We have written these up in more depth. See what your SaaS metrics must prove, the UK guide to SaaS financial due diligence, and how buyers test ARR, churn and revenue quality. To check your own numbers against market norms first, use the SaaS financial benchmarks for 2026.

The underlying model matters as much as the metrics. If your forecast cannot be traced back to a bottom-up revenue engine built from MRR and ARR, expect challenge. The same goes for the unit economics that show SaaS health.

Customer due diligence: the regulatory meaning

If you landed here from a compliance angle, the term means something narrower. UK financial crime rules require regulated firms to know their customers. The FCA’s guide to protecting your business from financial crime frames the three levels:

• Customer due diligence (CDD): identifying and verifying customers and beneficial owners, and understanding the purpose of the business relationship.
• Enhanced due diligence (EDD): applied to higher-risk situations, such as a customer who is a politically exposed person. It requires establishing source of wealth and source of funds, and senior management approval.
• Simplified due diligence (SDD): permitted only for low-risk customers.

If you are a supervised business under HMRC, its guidance on policies, controls and procedures explains that these must follow from your own risk assessment of money laundering, terrorist financing and proliferation financing. Check the current text before relying on it, as regulations are updated. KYC teams and compliance officers are the right people to confirm which level applies to a specific customer.

This is a different exercise from a deal review, though the two meet in one place: an acquirer will check that the target’s own AML procedures are in order.

The “4 Ps” and other frameworks

People often ask about the four Ps of due diligence. In investment settings, the framework as described by Neotas usually covers:

1. People: experience, integrity and track record.
2. Performance: a verifiable financial record, including quality of EBITDA.
3. Philosophy: strategy and alignment of interests.
4. Process: repeatable decision-making and operational controls.

Variants exist, so treat it as a way to organise evidence rather than a standard. It is mostly used when assessing fund managers and investment opportunities, not for a typical trade sale. For a company sale, the strands in the table earlier are the practical working frame.

How a due diligence process runs

The sequence is fairly consistent, even if the length is not.

1. Heads of terms agreed. The headline price is conditional on diligence. Exclusivity usually starts here.
2. Request list issued. The buyer’s advisers send a long list of documents, often hundreds of items.
3. Data room populated. The seller uploads documents to a secure online space and answers questions through it.
4. Management sessions. Advisers interview the finance lead and founders on anything the documents do not explain.
5. Draft findings. Issues are flagged, such as earnings adjustments, tax exposures or contract risks.
6. Renegotiation or confirmation. The price, the warranties and indemnities, or the structure change, or the deal proceeds as agreed.

For timing, NewOwner’s 2026 guide to selling a UK business puts this phase at 6 to 12 weeks, depending on complexity. That is a guide, not a promise: slow answers from the seller are the most common cause of delay we see described in the market, and each week gives a buyer more time to reconsider.

Perspective: what we see founders get wrong

We work with high-growth SaaS companies and ambitious UK SMEs, usually when they lack a senior finance lead during rapid growth. The pattern is consistent. Founders treat due diligence as an event that begins when a buyer arrives. Buyers treat it as a test of whether the founder’s management information has ever been under scrutiny.

Two things move outcomes more than anything else. The first is a single reconciled version of the numbers: revenue in the accounts, in the billing system and in the board pack should tell one story. The second is a forecast with visible logic. Investors forgive a cautious plan far more readily than a plan whose assumptions cannot be explained.

That is why we build diligence readiness into regular finance leadership rather than a last-minute scramble. A fractional CFO who owns the monthly numbers, the model and the data room preparation means that the diligence request list is mostly answered before it arrives. The ICAEW chartered accountant standard, Big Four rigour and investment banking discipline we bring are there for one reason: so the numbers hold up when somebody else tests them.

— Kishen Patel

How to prepare before a buyer or investor asks

A good readiness exercise takes weeks, not days, and the order matters.

Start with the numbers

Reconcile revenue across the accounts, bank and billing records. Produce monthly management accounts for at least the last two to three years, with a clear bridge from statutory profit to adjusted EBITDA. Be ready to defend every adjustment with evidence.

Tidy the paper

Check that contracts are signed, IP is assigned to the company, share records are accurate, and employment terms match what staff actually do. Gaps here do not always cost money directly, but they cost credibility.

Rebuild the forecast

A model that ties to historical performance and flexes by scenario is far easier to defend. Our guidance on investor-grade financial modelling and the five modelling mistakes that put funding at risk is a good checklist for self-review.

Pre-empt the weak points

Do not wait for the buyer to find the customer concentration, the late filing or the unexplained margin dip. Raise it, explain it and show the fix. Surprises reduce price more than known issues do.

Decide who is the single point of contact

A data room run by a founder who is also closing sales rarely stays up to date. Assign one person, or an adviser, to coordinate requests and keep a log.

Seller-side or vendor due diligence

Some sellers commission their own review before going to market, so that problems are found and fixed on their timetable. This is sometimes called vendor due diligence or sell-side readiness. It helps most when the business has complicated accounts, recent acquisitions or a subscription model needing careful revenue analysis. Its limit is that buyers will usually still do their own work, but a clean sell-side report shortens it.

If a sale is one to three years away, a longer runway helps further. Our guides to exit preparation for UK business owners and a 90-day exit readiness plan show how that preparation can be structured. Your valuation also shapes the conversation, and our explanation of EBITDA, profit and cash in UK valuations shows how diligence adjustments feed through.

How we help

Consult EFC offers financial due diligence for buyers and due diligence preparation for sellers and fundraisers, led by ICAEW Chartered Accountant Kishen Patel. If you want finance leadership in place before a transaction, our fractional CFO services give you senior oversight without a full-time hire. Where a valuation is the starting point, our business valuation service starts from £2,500 as a one-off fee. Other services are scoped individually, so talk to us first about what your deal needs.

FAQ

What does “do your due diligence” mean?

It means checking the facts thoroughly before you commit money, time or trust. In business, that normally involves verifying claims with documents and independent evidence rather than relying on what the other party says. The more you stand to lose, the more formal the checking should be.

What are the three pillars of due diligence?

There is no single official trio. In a deal, people usually mean financial, legal and commercial due diligence, with tax and operational reviews added as needed. In compliance, the three levels are simplified, standard (customer) and enhanced due diligence, as described by the FCA.

What is the difference between EDD and CDD in KYC?

CDD is the standard process of identifying and verifying a customer and any beneficial owners. EDD applies when the risk is higher, for example with a politically exposed person, and adds checks on source of wealth and funds plus senior sign-off. Simplified checks are only for low-risk customers.

How long does due diligence take when selling a business?

One UK guide puts the buyer’s review at 6 to 12 weeks, depending on complexity. Well-organised financial records and a prepared data room are the main things within your control. Slow or inconsistent answers lengthen it and can weaken your negotiating position.

Who pays for due diligence?

Buyers normally pay for their own advisers’ reviews. Sellers pay for their own preparation, and for any vendor due diligence they choose to commission. The cost depends on the size and complexity of the business, so ask advisers for a scoped fee before you start.

Recommended

• Due Diligence Preparation Services | Financial Readiness
• Financial Due Diligence for SMEs: The Complete UK Guide
• Financial Due Diligence: A Practical Guide
• Due Diligence Issues in UK Business Sales & How to Fix Them

This article is for general information only and is not professional advice.

Kish Patel ACA, ICAEW · Founder, Consult EFC

Over 12 years across Big Four audit, Investment Banking, and corporate advisory. Kish works with SaaS founders, tech companies, and ambitious UK SMEs from £1M to £50M in revenue on fundraising, valuations, exit planning, and financial strategy. ICAEW regulated. Big Four trained. Based in London.