Anchored to UK statute. Last verified 21 June 2026. View source-of-record.

maduediligencechecklist.co.uk

The UK M&A Due Diligence Checklist

VDD pack

Vendor due diligence (sell-side) checklist

Sell-side VDD anticipates the buyer's investigator. Every severity-A and severity-B item below should be addressed in the data room, the VDD report, or pre-empted in the seller's disclosure letter. Items left unaddressed surface as price-chips in the second round.

Direct answer

A UK vendor due diligence (VDD) checklist pre-builds the same artefact a buyer's FDD provider would have to assemble: full statutory and management financials, QoE adjustments, working-capital normalisation, tax computations, customer concentration, IP register and material-contract change-of-control map. Commissioned correctly, VDD compresses the buy-side timeline by 2-3 weeks and protects price.

What to pre-empt by Schedule

Schedule I - Corporate

  • I.1
    Obtain certificate of incorporation and any change-of-name certificates from Companies House.[Companies House]
    Severity B
  • I.2
    Review current articles of association and prior versions adopted within the last six years.[CA 2006 s.18]
    Severity A
  • I.4
    Review statutory registers (members, PSC, directors, secretaries, charges).[CA 2006 s.113]
    Severity A
  • I.5
    Verify PSC register against the Companies House public record and identify any discrepancies.[ECCTA 2023 Part 1]
    Severity A
  • I.6
    Reconcile issued share capital against share-certificate counterfoils and Companies House SH01 filings.[CA 2006 s.554]
    Severity A
  • I.7
    Trace each historic share allotment, transfer and buyback for the last six years.[CA 2006 s.770]
    Severity B

+14 more in Schedule I

Schedule II - Financial

  • II.1
    Obtain audited statutory accounts for the last three financial years.
    Severity A
  • II.2
    Obtain management accounts to the most recent month-end (P&L, balance sheet, cash flow).
    Severity A
  • II.3
    Tie management accounts back to audited results; explain any variance > 2%.
    Severity A
  • II.4
    Obtain trial balance and chart of accounts; map to FDD reporting structure.
    Severity B
  • II.5
    Test revenue recognition policy against FRS 102 or IFRS 15 as applicable.[FRC]
    Severity A
  • II.6
    Identify and quantify all QoE adjustments (non-recurring, owner remuneration, normalisations).
    Severity A

+16 more in Schedule II

Schedule III - Tax

  • III.1
    Obtain corporation-tax computations and CT600 returns for the last six years.[CTA 2009]
    Severity A
  • III.2
    Identify any open HMRC enquiries, discovery assessments or pending litigation.
    Severity A
  • III.3
    Confirm tax-losses carried forward and any restriction on use (CIR, group, change-of-ownership).
    Severity B
  • III.4
    Review group-relief surrenders / claims for the last six years.
    Severity B
  • III.5
    Review R&D tax-credit claims: methodology, supporting file, advance assurance.[HMRC R&D]
    Severity A
  • III.7
    Obtain VAT returns for the last four years; reconcile to ledger.
    Severity B

+11 more in Schedule III

Schedule IV - Commercial

  • IV.1
    Obtain top-10 customer revenue concentration for the last three years.
    Severity A
  • IV.2
    Test annual customer churn (logo and revenue) over the last three years.
    Severity A
  • IV.3
    Review pipeline and weighted-pipeline conversion history.
    Severity B
  • IV.4
    Sample top-20 customer contracts for term, renewal, change-of-control and exclusivity.
    Severity A
  • IV.5
    Identify customers with MFN, audit, benchmarking or most-favoured-pricing clauses.
    Severity B
  • IV.6
    Confirm change-of-control consent requirements in top-customer contracts.
    Severity A

+8 more in Schedule IV

Schedule V - Legal

  • V.1
    Obtain schedule of all current and threatened litigation; quantify exposures.
    Severity A
  • V.2
    Review correspondence on any pending dispute > £25 000.
    Severity B
  • V.3
    Confirm registered IP: trade marks, patents, design rights, registered domain names.[UK IPO]
    Severity B
  • V.4
    Confirm assignment of IP from founders, contractors and former employees.
    Severity A
  • V.5
    Review licence-in and licence-out agreements for material IP.
    Severity B
  • V.6
    Identify any open-source software dependencies and licence compatibility.
    Severity B

+9 more in Schedule V

Schedule VI - Employment

  • VI.1
    Obtain employee census: headcount, role, location, FT/PT, start date.
    Severity A
  • VI.2
    Sample employment contracts for top-20 by remuneration; identify non-standard terms.
    Severity B
  • VI.3
    Confirm right-to-work checks held for every employee and contractor.
    Severity A
  • VI.4
    Review any settlement agreements, NDAs or restrictive covenants in force.
    Severity B
  • VI.5
    Confirm holiday accrual liability and any unpaid balances.
    Severity B
  • VI.6
    Identify any current grievance, disciplinary or tribunal claim.
    Severity A

+10 more in Schedule VI

Schedule VII - Data privacy

  • VII.1
    Confirm UK GDPR / DPA 2018 governance: appointed DPO or accountable lead identified.[DPA 2018]
    Severity B
  • VII.2
    Obtain Record of Processing Activities (ROPA) and confirm currency.[DPA 2018]
    Severity B
  • VII.3
    Review DPIA register for high-risk processing.
    Severity B
  • VII.4
    Confirm ICO data-protection fee paid for the current year (Tier 1 £52 / Tier 2 £78 / Tier 3 £3 763 inc £5 DD discount).[ICO fee]
    Severity B
  • VII.5
    Confirm DUAA 2025 Part 5 alignment for any digital-verification or smart-data processing (in force 5 Feb 2026).[DUAA 2025]
    Severity B
  • VII.6
    Obtain processor agreements (Art 28) for all material data processors.
    Severity B

+5 more in Schedule VII

Schedule VIII - IT and cyber

  • VIII.1
    Obtain application inventory with licence type, user count and renewal date.
    Severity B
  • VIII.2
    Identify any SaaS or licensing true-up exposure.
    Severity B
  • VIII.3
    Review infrastructure topology: cloud accounts, on-prem, hybrid.
    Severity B
  • VIII.4
    Confirm Cyber Essentials Plus or ISO 27001 certification status.[NCSC CE]
    Severity B
  • VIII.5
    Obtain most recent penetration-test report and remediation evidence.
    Severity A
  • VIII.6
    Review security-incident log for the last three years and ICO notifications.
    Severity A

+8 more in Schedule VIII

Schedule IX - Regulatory

  • IX.1
    Confirm whether the target operates in one of the 17 NSI Act sensitive sectors.[NSI Act 2021]
    Severity A
  • IX.4
    Assess CMA merger jurisdiction: target UK turnover > £70m or 25% share of supply.[CMA]
    Severity A
  • IX.6
    If target is FCA-authorised, confirm Part XII FSMA change-of-control approval window (60 working days).[FCA change-of-control]
    Severity A
  • IX.7
    Confirm threshold conditions and any current FCA supervisory action.
    Severity A
  • IX.8
    Identify sector regulator notifications (Ofcom, Ofgem, Ofwat, CQC, SRA).
    Severity B
  • IX.9
    Confirm CQC registrations and inspection ratings (healthcare).[CQC]
    Severity A

+4 more in Schedule IX

Schedule X - Real estate

  • X.1
    Obtain schedule of all freehold and leasehold property held by the group.
    Severity A
  • X.2
    Pull Land Registry official copies for each freehold title.
    Severity B
  • X.3
    Review each lease: term, break, rent review, alienation, change-of-control.[LTA 1954]
    Severity A
  • X.4
    Confirm whether the lease is contracted in or out of LTA 1954 Part II security of tenure.[LTA 1954]
    Severity B
  • X.5
    Obtain landlord consents required for change of control or assignment.
    Severity A
  • X.6
    Quantify dilapidations liability with a current condition survey.
    Severity B

+5 more in Schedule X

Schedule XI - Environmental

  • XI.1
    Commission Phase I ESA on every owned and leased operational site.
    Severity A
  • XI.3
    Review Part IIA EPA 1990 contaminated-land risk and any local-authority notices.[EPA 1990]
    Severity A
  • XI.4
    Obtain environmental permits (EPR 2016) and confirm compliance history.[EPR 2016]
    Severity B
  • XI.5
    Confirm any EA enforcement, prosecution or improvement notice.[Environment Agency]
    Severity A
  • XI.6
    Review waste-carrier and waste-management licences.
    Severity B
  • XI.7
    Confirm UKETS / SECR compliance and reporting cycle.[SECR]
    Severity B

+2 more in Schedule XI

Schedule XII - Insurance

  • XII.1
    Obtain schedules for all in-force policies (PI, PL, EL, D&O, cyber, property).
    Severity B
  • XII.2
    Confirm sums-insured adequacy against current exposures.
    Severity B
  • XII.3
    Review claims history for the last six years across all classes.
    Severity B
  • XII.4
    Confirm any policy exclusion or aggregate erosion that affects buyer.
    Severity A
  • XII.5
    Identify run-off cover requirements for D&O and PI post-completion.
    Severity B
  • XII.6
    Assess W&I (warranty and indemnity) procurement: typical premium 0.7-1.5% of cover.
    Severity B

+2 more in Schedule XII

Schedule XIII - ECCTA fraud and anti-bribery

  • XIII.1
    Confirm whether target meets the large-organisation test under ECCTA 2023 s.199.[ECCTA 2023 s.199]
    Severity A
  • XIII.2
    Review failure-to-prevent-fraud reasonable-procedures framework (in force 1 Sep 2025).[ECCTA 2023 s.199]
    Severity A
  • XIII.3
    Confirm board-level ownership of the fraud-prevention programme.
    Severity B
  • XIII.4
    Confirm Bribery Act 2010 s.7 adequate-procedures programme.[Bribery Act 2010 s.7]
    Severity A
  • XIII.5
    Review hospitality, gifts and political-donation policies and registers.
    Severity B
  • XIII.6
    Confirm sanctions-screening of customers, suppliers and counterparties (OFSI list).
    Severity A

+5 more in Schedule XIII

Schedule XIV - ESG

  • XIV.1
    Confirm Modern Slavery Act s.54 statement filed (turnover ≥ £36m).[MSA 2015 s.54]
    Severity B
  • XIV.2
    Review supply-chain due-diligence framework and supplier-onboarding controls.
    Severity B
  • XIV.3
    Confirm SECR-aligned energy and carbon reporting.[SECR]
    Severity B
  • XIV.8
    Identify any pending ESG litigation, activist campaign or regulator engagement.
    Severity B
  • XIV.9
    Confirm sanctions-jurisdiction exposure in supplier base.
    Severity B
Reviewed by Oliver Wakefield-Smith, Founder, Digital SignetLast verified 21 June 2026

This page is anchored to UK primary legislation and named regulator guidance only. Not legal advice. Confirm position with your appointed adviser before signing.