Due Diligence and Legal Preparation for a Startup Exit: The Founder’s Checklist

Due diligence is the part of a startup exit founders underestimate most. You negotiate a price in the letter of intent, you celebrate, and then a team of twenty lawyers, accountants and engineers spends eight to twelve weeks reading everything your company has ever signed. Every gap they find becomes a price chip, a special indemnity, a larger escrow or, in the worst case, a reason to walk. The deal you close is the deal that survives diligence, not the one on the term sheet.

This article is the legal pillar of the Founder Exit Playbook. It covers who runs diligence and what each team examines, the full data-room checklist by workstream, how to run reverse diligence on yourself a year before you sell, the anatomy of the letter of intent and the definitive agreement, the approvals and regulatory filings that gate closing, and the specific findings that most often kill or reprice startup deals. It applies whether you are selling to a strategic acquirer, a private equity fund, or preparing for an IPO, where the underwriters and the regulator run a version of the same process.

One caveat throughout: deal mechanics vary by jurisdiction. The vocabulary below is mostly US and UK because that is where most startup M&A documentation originates, but we flag EU, Indian and Turkish touchpoints where they matter. Nothing here is legal or tax advice. Your deal counsel, engaged early, is the only person who can tell you how these mechanics apply to your company.

Where do you stand today?

What is due diligence and who actually runs it?

Due diligence is the buyer's structured investigation of your company before it commits to pay. Its purpose is threefold: to confirm that what you told them in the pitch is true, to price the risks they find, and to build the factual record that the reps, warranties and indemnities in the purchase agreement will rest on. From your side it has a fourth purpose: everything you disclose in the data room and the disclosure schedules becomes a shield against later claims. Full disclosure is your friend; a surprise discovered after closing is your liability.

The team is larger than most founders expect. The buyer's M&A counsel coordinates legal diligence and drafts the agreement. A financial team, often a Big Four firm or a specialist such as Alvarez & Marsal, produces a quality of earnings (QoE) report that restates your revenue, margins and working capital on the buyer's terms. A technology and IP team reviews your code, architecture, open-source usage and patent position. Cyber specialists test your security posture and incident history. HR advisers check employment contracts, benefits and classification. Tax advisers model exposures in every country you operate in. On larger deals an ESG or sanctions team screens customers and suppliers.

Each workstream reports findings in a red-flag memo, and those memos drive three outputs. First, price: a QoE that finds 15% of your ARR is non-recurring services revenue reprices the deal. Second, contract terms: a finding becomes a specific representation you must give, or a special indemnity you must fund. Third, closing conditions: an unresolved problem becomes something you must fix before the buyer is obliged to pay. Understanding this chain is why reverse diligence matters: a problem you find and fix in month minus-twelve costs you an invoice; the same problem found by the buyer costs you a percentage of the price.

What goes in the data room, workstream by workstream?

A virtual data room (Datasite, Intralinks, DealRoom, or a well-organised secure drive for smaller deals) is the single source of truth for the process. Organise it by the buyer's workstreams rather than your own filing habits, index every document, and keep a Q&A log so answers given to one bidder are consistent with answers given to another. The checklist below is the core for a software or technology company; a regulated, hardware or life-sciences business adds its own layers.

Corporate records and equity. Certificate of incorporation and amendments, articles or bylaws, board and shareholder consents for every financing, grant and material contract, the shareholders' and investor-rights agreements, and good standing in every jurisdiction. Then a fully diluted cap table reconciled to the share register and to every stock purchase agreement, note, SAFE, warrant and option grant, with exercise records, 83(b) elections and every 409A report (US) or HMRC valuation (UK EMI). The buyer models the waterfall from your documents, not your spreadsheet; article 02 shows how.

Intellectual property. Signed invention assignments from every founder, employee and contractor who ever touched the product, including the freelancer who wrote the first version. Patent, trademark and domain registrations with chain of title. A software bill of materials and open-source audit: Black Duck's 2025 OSSRA report found licence conflicts in 56% of audited codebases, and copyleft code such as GPL inside a proprietary product is a genuine deal issue. Inbound licences for third-party components, and AI training-data or model-licence terms if you ship ML features.

Commercial contracts and HR. Every customer and supplier contract above a materiality threshold, flagged for change-of-control, anti-assignment, exclusivity, MFN pricing, termination for convenience and uncapped liability, plus revenue concentration by customer. The buyer's question is which of your top twenty customers can walk because you were acquired. On the people side: employment and contractor agreements, benefit and commission plans, immigration files and a headcount census by country. Misclassification is a recurring finding: a full-time 'contractor' in Germany, the UK or California is, in many regimes, an employee with back-taxes and benefits owing.

Data protection, litigation, regulatory and tax. Privacy policies, processing records, DPAs, transfer mechanisms and breach history; GDPR and UK GDPR exposures travel with the company, and India's DPDP Act and Turkey's KVKK add local layers. Litigation pending, threatened and settled; insurance and claims; licences, sanctions and export controls. Tax returns for every open year in every country, VAT and sales-tax nexus analysis, transfer-pricing files, payroll compliance and R&D credit support. US sales-tax nexus after Wayfair and unregistered EU VAT on B2C digital sales surface in almost every SaaS diligence and are routinely covered by a special indemnity. Finally, audited or reviewed financials, management accounts, the revenue-recognition policy and the deferred-revenue schedule.

What real exits teach: three cases

How do you run reverse diligence twelve months before you sell?

Reverse diligence, sometimes called vendor or sell-side diligence, means running the buyer's process on yourself first, with the time to fix what you find. Twelve months is the comfortable minimum because the fixes have long lead times: chasing a departed contractor for an IP assignment, re-papering a misclassified team as employees, filing back sales-tax returns under a voluntary disclosure programme, or replacing a GPL component take quarters, not weeks.

Start with the three things buyers always find. Rebuild the cap table from source documents and have counsel confirm every grant was validly authorised, priced against a contemporaneous valuation and properly exercised; where a grant is defective, fix it now by board ratification or regrant while you control the timeline. Collect every IP assignment and get signed confirmatory assignments from anyone missing, including founders who contributed code before incorporation. Run an open-source scan and remediate anything copyleft in distributed code.

Then commission a sell-side QoE from an accounting firm. It costs real money, typically a low six-figure sum for a $20M to $100M company, but it finds the revenue-recognition issues and working-capital normalisations before the buyer does, and gives you a defensible adjusted EBITDA or ARR that becomes the starting point for negotiation rather than something the buyer's team tears down. Preparing your startup for acquisition operationally runs in parallel with this legal and financial clean-up.

Finally, assemble the disclosure schedule drafts now. The schedules are where you list every exception to the reps you will give: every lawsuit, every contract with a change-of-control clause, every employee without a signed agreement. Drafting them a year early tells you exactly where your exposures are, and it means that when the buyer's first draft SPA lands with a 48-hour turnaround request, your counsel is editing rather than discovering.

What does the LOI commit you to, and what should it say about price and structure?

The letter of intent (or term sheet, or heads of terms in the UK) is mostly non-binding, with two important exceptions that are binding: exclusivity and confidentiality. Exclusivity, typically 30 to 60 days and extendable, stops you talking to other buyers while this one spends money on diligence. It is the buyer's main leverage. Once you are exclusive, every finding becomes a request for a price reduction that you can no longer test against a competing bid. Negotiate the shortest exclusivity you can, tie extensions to the buyer meeting milestones, and never sign an LOI before you have run a process that gives you at least two credible alternatives.

On price, the LOI should state the headline enterprise value, whether it is cash-free debt-free, and the mechanism for adjusting it at closing: a working-capital peg with a true-up, or a locked-box with a fixed balance-sheet date and a daily ticking fee, which is the common European construct. State the form of consideration (cash, buyer stock, a mix), how any stock is valued, and whether part of the price is deferred or contingent in an earnout. Ambiguity on any of these points is resolved in the buyer's favour later, when you are exclusive and tired.

On structure, the LOI usually names the form: a share purchase, an asset purchase, or a statutory merger (US). Structure drives tax for you and your shareholders, which contracts need consent, and which liabilities transfer. A buyer who insists on an asset deal is often trying to leave liabilities behind; a founder who wants a share deal is often protecting a capital-gains or qualified small business stock position. The LOI should also set the diligence timetable, the expected signing and closing dates, who pays which fees, and the headline shape of the indemnity package: whether the buyer intends to use representations and warranties insurance, and the expected escrow percentage.

What is inside the definitive agreement, clause by clause?

The definitive agreement is a share purchase agreement (SPA), an asset purchase agreement (APA) or, for US corporations, a merger agreement; the mechanics are similar. It states what is being bought for how much, allocates the risk of the unknown between you and the buyer, and sets the conditions under which either side can refuse to close. Representations and warranties are your factual statements about the company, from 'the shares are validly issued' to 'the financial statements fairly present the business'; the disclosure schedules list every exception, and an undisclosed false rep is a claim. Negotiate knowledge and materiality qualifiers where you cannot verify, and resist a '10b-5' or 'full disclosure' rep: SRS Acquiom's 2026 study found 95% of RWI-backed deals exclude both.

Indemnification: caps, baskets, survival. The indemnity package sets how much you can lose if a rep is breached. The cap limits total exposure, often 10% of price in a traditional deal and as low as 0.5% to 1% where RWI is used; fundamental reps (title, authority, capitalisation) and fraud are typically uncapped or capped at the full price. The basket is the threshold below which small claims are ignored: SRS Acquiom found deductible baskets in 32% of 2025 deals, first-dollar (tipping) baskets in 40% and no basket at all in 28%. Survival is how long the buyer can bring claims, commonly 12 to 24 months for general reps and longer for tax and fundamentals.

Escrow versus RWI. Traditionally the buyer secured the indemnity by holding back part of the price in escrow. SRS Acquiom's 2026 study reports a median escrow of 10% of deal value where no RWI is used, and 2.8% where it is. Representations and warranties insurance shifts the risk to an insurer: the buyer claims against the policy, your escrow shrinks, and your exposure is limited to a small retention. The ABA's 2025 Private Target Deal Points study found 64% of agreements referenced RWI, up from 55% in 2023. On deals above roughly $25M, insist the buyer price an RWI option; on small deals the premium and retention make it uneconomic.

MAC clauses and closing conditions. Between signing and closing the buyer can usually walk if a material adverse change (MAC or MAE) occurs. Define it narrowly, with carve-outs for general economic, industry and pandemic events, and require that it be disproportionate to your peers. Delaware courts have only once found a MAC (Akorn, 2018), which is why Twitter could force Elon Musk to close. Other conditions include regulatory approvals, third-party consents, key-employee retention, bring-down of the reps at closing, and absence of litigation; the ABA found a stand-alone litigation condition in 34% of 2025 deals, the lowest since 2006.

Earnouts, covenants and tax items. Earnouts appeared in 24% of SRS Acquiom's 2025 deals, with a median potential of 34% of the closing payment. If you accept one, negotiate objective metrics, operating covenants on the buyer, acceleration on sale or breach, and audit rights. Non-compete and non-solicit covenants of two to five years are standard for founders, though California enforces them only within narrow sale-of-business exceptions. In the US, Section 280G can impose a 20% excise tax on change-of-control payments to founders of a private company unless holders of more than 75% of shares approve them in a specific vote; run that calculation before signing. Key-employee retention pools, often 5% to 15% of price, are negotiated alongside. Governing law (Delaware, English, or arbitration for cross-border deals) decides how all of this is read and whether specific performance is available; fix it in the LOI.

Which approvals, antitrust and FDI filings gate the closing?

Internally, you need board approval and shareholder approval in the proportions your charter and shareholders' agreement require, which usually means a preferred-stock class vote as well as a common majority. Drag-along provisions let a defined majority force minority holders to sell on the same terms; check the threshold and the notice mechanics now, because a drag that was never properly adopted leaves hold-outs with leverage. In Delaware mergers, non-consenting holders may have appraisal (dissenters') rights to ask a court for fair value; buyers typically make it a closing condition that holders of no more than 5% to 10% of shares seek appraisal. English law companies rely on drag-along in the articles and, for public targets, schemes of arrangement.

Externally, merger control is the first gate. In the US, the Hart-Scott-Rodino Act requires pre-closing notification when a transaction exceeds $133.9 million for 2026, per the FTC adjustment summarised by Cleary Gottlieb, with a size-of-person test ($26.8M and $267.8M in sales or assets) between $133.9M and $535.5M; fees start at $35,000 and the waiting period is 30 days. The EU Merger Regulation applies above combined worldwide turnover of €5 billion with EU turnover tests, and member-state regimes catch smaller deals. The UK CMA has jurisdiction where the target's UK turnover exceeds £70 million or there is a 25% share of supply, and the UK regime is voluntary but with call-in powers. China's SAMR thresholds, raised in January 2024, require filing where combined worldwide turnover exceeds RMB 12 billion or China turnover exceeds RMB 4 billion, with two parties each above RMB 800 million in China.

Most startup exits fall below these numbers, but two trends catch more of them. Regulators increasingly review below-threshold acquisitions of innovative targets by large platforms, which is how the UK and EU examined Adobe's purchase of Figma. And acqui-hire and licensing structures designed to avoid filings, such as the 2024 Microsoft–Inflection and Amazon–Adept arrangements, have drawn FTC and CMA scrutiny. If your buyer is a large technology company, assume a filing analysis is needed whatever the price.

Foreign direct investment screening is the second gate and has grown faster than merger control. In the US, CFIUS reviews foreign acquisitions of businesses touching critical technology, infrastructure or sensitive personal data, with mandatory filings in defined cases. The UK National Security and Investment Act requires notification when a buyer crosses 25%, 50% or 75% in a company active in 17 sensitive sectors (19 after the March 2026 reforms add water and split out semiconductors and critical minerals), with a voluntary route and a five-year call-in power for everything else.

In December 2025 the EU Council and Parliament reached political agreement on a revised FDI Screening Regulation that will require every member state to operate a screening mechanism with a common minimum sector list, applying 18 months after entry into force. India requires government approval for investment from land-bordering countries under Press Note 3, and Turkey's Competition Authority runs a turnover-based merger regime whose thresholds are waived for technology undertakings, so small Turkish tech targets are often notifiable. Each filing adds four to twelve weeks; several in parallel can add a quarter to your timeline and a regulatory-risk clause to your SPA.

Which findings most often kill or reprice a startup deal?

Experienced deal lawyers see the same five findings over and over. The first is unassigned IP. A contractor or early collaborator who wrote core code without a written assignment owns that code in most jurisdictions, and you are selling something you do not fully own. The fix is a confirmatory assignment, which gets expensive if the person has left on bad terms or cannot be found. Buyers will not close without it, or will demand a special indemnity and a holdback sized to the cost of rewriting the code.

The second is cap table error: options granted without board approval, exercise prices set without a contemporaneous valuation, missed 83(b) elections, unsigned stock purchase agreements, or notes and SAFEs whose conversion mechanics were never run. Each is fixable, but each requires the holder's cooperation, and a holder who realises the deal depends on their signature has leverage. Reconcile the register to the documents a year early, while the leverage is yours.

Third, revenue recognition and financial quality. The QoE team will reclassify one-time implementation fees out of ARR, flag customers on free or heavily discounted terms, normalise working capital and strip out founder-related expenses. A 10% to 20% haircut to adjusted ARR or EBITDA at a 6× multiple is a direct and proportional cut to price. Fourth, unpaid indirect tax: US sales tax in states where you have economic nexus, EU VAT on B2C digital sales, Indian GST, Turkish KDV. The exposure is quantifiable and the buyer will quantify it, usually as a special indemnity with its own escrow. Fifth, misclassified staff, with back payroll taxes, social contributions and in some countries statutory severance.

Each of these also feeds the reputational test every buyer applies: does the data room look like a company that knows itself? A clean, indexed room with consistent answers earns trust that translates into fewer special indemnities, a smaller escrow and a faster close. A chaotic room signals hidden problems and invites the buyer to price for them. The findings are the same in every exit route; the acqui-hire buyer and the MBO lender run lighter versions of the same checklist.

The process, step by step

Red flags and founder risks

Frequently asked questions

Related reads from Kurums

Winding Down a Startup: Asset Sales, Fire Sales and the Orderly Shutdown

Oct 14, 2026

The exit nobody pitches at demo day but most founders eventually run. How to decide, which wind-down route preserves value, who gets paid in what order, and how to shut down without personal liability.

read more

Management Buyouts and Employee Ownership: Exiting Without Selling to an Outsider

Oct 14, 2026

The insider exit family explained for founders: who buys you out, how the debt gets paid, what trustees and lenders will accept as a price, and what reaches your account when the buyer is your own team.

read more

Taking Your Startup Public: IPO, Direct Listing and SPAC as a Founder Exit

Oct 14, 2026

An IPO does not cash you out; it changes the currency you hold. This guide covers readiness, process, cost, the three listing formats and how founders actually sell after the bell rings.

read more