Due Diligence

When you're buying, selling, or lending on a company, the two riskiest moments are: the moment you commit to the term sheet without knowing the real issues, and the moment you close having missed them. Due diligence closes that gap. But not all diligence is the same. Generic checklists miss what actually moves price in your sector—the IP that was never assigned, the customer concentration that kills growth, the DPDP breach exposure that could cost ₹250 crore. Structured diligence across five workstreams—legal, tax, financial, commercial and IT/data—surfaces deal-killers in the first two weeks and quantifies every material finding into terms-sheet language and SPA clauses.

The timeline matters too. A red-flag report at day 10–14 lets you walk, re-price or restructure before you're locked into a bad deal. A final report at week 6 with specific warranties, indemnity carve-outs and escrow holdback sizing means every finding has teeth. You're not reading a narrative note at closing; you're reading the exact SPA clause that protects you if that risk materializes.

At a Glance

• Deal Scope Mid-market or large-cap acquisitions, sales or lending. Buy-side, sell-side and lender diligence calibrated to your role and the leverage at stake.
• Five Workstreams Legal, tax, financial, commercial and IT/data run in parallel—no delays, one weekly memo, one final report with aligned findings across all teams.
• Timeline 4–8 weeks for a mid-market deal. Delays usually come from incomplete data rooms, not from sector complexity.
• Red-Flag Report Day 10–14 deliverable surfacing deal-killers, re-pricing triggers and restructure options before the term sheet window closes.
• VDR Setup iDeals, Datasite or Drooms with role-based access, watermarking, Q&A workflow and full audit trail. Data stays secure and litigation-ready.
• Sector Overlays Fintech, SaaS, D2C, healthcare, manufacturing, real estate—not a generic checklist, the actual licences and risks that move price in your sector.
• SPA Translation Each DD finding becomes a specific warranty, condition precedent, indemnity carve-out or escrow holdback. Real contractual protection, not narrative notes.

What's New for FY 2026–27

Diligence has become more complex and more consequential. Here's what's changed since last year and how it affects your deal timeline and risk profile.

• DPDP Act 2023 is Now a Material DD Line Data breach exposure and privacy compliance are no longer back-office risks. A single undisclosed incident can cost ₹250 crore in penalties and kill the deal. IT/data workstream identifies all breaches in the last 3 years, customer data exposure and gaps in privacy by design.
• CERT-In Incident Reporting is Mandatory Disclosure Cyber-incident log for the last 3 years is a standard DD ask. Any incident reported to CERT-In post-close will trigger indemnity claims. Buyers are asking for a clean bill of health; sellers who don't proactively disclose face fraud allegations.
• IT/Data Diligence is Now a Separate Workstream IP assignment chains, open-source compliance, DPDP readiness and CERT-In history can no longer be tacked onto commercial or legal DD. They need dedicated diligence with engineering and privacy counsel because the exposures are material and technical.
• Sector Overlays Are Hardened Fintech (RBI AML/CFT rules), SaaS (DPDP, open-source), healthcare (clinical SOPs) and D2C (consumer data) each have mandatory compliance layers before commercial diligence begins.

Who Needs Due Diligence

• Acquirers: Test Price & Negotiate Reps You're betting ₹50–500 crore on this acquisition. Hidden IP gaps, customer concentration, tax disputes or DPDP breaches will haunt you post-close. Diligence confirms the price is right and gets you reps and indemnities to protect yourself.
• Sellers: Clean Up Before Market Going to market with known issues gives buyers leverage to re-price. Sell-side DD surfaces problems while you own the company and can fix them. By closing, the price delta is ₹5–10 crore lower if you clean proactively.
• Lenders & Financial Investors A bank or NBFC sanctioning debt needs to know cash-flow survives downturns, security is perfected and there are no hidden litigation landmines. Lender DD is tighter than M&A DD because the lender has no upside, only downside.
• PE & Strategic Buyers Private equity and strategic acquirers run multiple workstreams because one issue in IT/data or regulatory compliance can sink a deal or force restructure. They budget 6–8 weeks because it saves ₹20–30 crore in lawyer fees and price adjustments later.
• First-Time & HNI Acquirers HNI acquirers often skip diligence to save cost, then discover tax issues, IP problems or litigation at closing. Diligence is the biggest cost-saver for infrequent acquirers because the questions asked are the ones that absolutely matter.
• Founders & MBO Teams If you're buying your company back from VC or PE, or doing a go-private, diligence tells you what you're really taking on and what to renegotiate in the purchase agreement.

How It Actually Works

Diligence is structured as five parallel workstreams, coordinated through a single deal team. Here's the rhythm from mandate to closing.

Step 1: Mandate Brief & Scoping (2–3 Days)

Deal context, transaction perimeter, materiality thresholds, sector overlays, timeline and reporting cadence are agreed. Is this a strategic acquisition (full overlays) or a consolidation play (lighter commercial)? Is the seller a startup (IP risks) or mature (tax and litigation focus)? Engagement letter executed with sign-off on scope, budget and timeline.

Step 2: VDR Setup & Information Request List (2–3 Days)

Virtual data room established on the seller's platform (iDeals, Datasite or Drooms). Tiered information request list issued across five buckets: corporate records, financial and tax, contracts and commercial, litigation and regulatory, IT/data and IP. Role-based access prevents the lender workstream from seeing customer data. Q&A workflow opened so the seller can clarify requests.

Step 3: Parallel Workstream Execution (3–5 Weeks)

Legal, tax, financial, commercial and IT/data workstreams run in parallel. Legal reviews corporate records, litigation and IP assignments. Tax analyzes income-tax returns, GST filings and transfer pricing. Financial audits revenue recognition and contingent liabilities. Commercial interviews top customers and vendors, analyzes concentration and contract terms. IT/data maps the tech stack, traces IP assignments, tests open-source compliance and evaluates DPDP readiness. Weekly syncs ensure findings in one workstream (e.g., customer concentration) are tested against another (revenue concentration in financials).

Step 4: Red-Flag Report (Day 10–14)

Top issues circulated to the deal team: deal-killer issues (material litigation, regulatory licence at risk, IP catastrophe, DPDP breach with ₹250 cr exposure), re-pricing triggers (customer concentration, margin pressure, tax contingency >5% EBITDA) and restructure options (earn-out, escrow, two-step close). This report is separate because the deal team needs to act while they still have leverage. If the term sheet expires before this report, the buyer walks, re-prices or pivots.

Step 5: Final DD Report & Recommendations (Week 4–6)

Workstream-wise final report with quantified exposures, recommended condition precedent list, specific warranty language, indemnity carve-outs and escrow/holdback sizing. Each finding is tagged red (material, must be addressed pre-close), amber (material, can be indemnified with escrow) or green (manageable, disclosed in SPA reps). For each red or amber finding, the report recommends the exact SPA clause, the escrow amount and the holdback period.

Step 6: SPA/SHA Negotiation Support & Closing (Weeks 6–8)

DD findings are translated into SPA and share purchase agreement clauses. The diligence team works directly with deal counsel through markup rounds so each finding has a real protection mechanism. Closing checklist is tracked against condition precedent satisfaction.

A Real Example: ₹100 Crore SaaS Acquisition

Here's how diligence quantifies findings into SPA clauses. A buyer acquires a SaaS company (₹100 cr annual revenue, ₹20 cr EBITDA) for ₹100 cr enterprise value (5x revenue multiple). Six-month escrow: 10% (₹10 cr). Diligence runs for 6 weeks.

• IP Assignment Gap Founder and CTO never formally assigned IP rights to the company. Developer contracts lack IP assignment clauses. Remediation: Retroactive IP assignment agreements required pre-close, with founder and CTO personal guarantees. Result: ₹5 crore escrow carve-out for IP indemnity.
• DPDP Compliance Gap No data processing agreement with customers, no privacy by design in the product, no DPDP audit conducted. Open-source GPL licence in the product undisclosed. Result: ₹8 crore escrow carve-out capped for DPDP indemnity (theoretical exposure ₹250 cr if breach discovered). Condition precedent: DPDP audit clearance and legal notice to customers pre-close.
• Customer Concentration Top 5 customers represent 60% of revenue. Three are month-to-month contracts; two renew in 6 months. Buyer's integration plan assumes revenue stability post-close. Result: Condition precedent on 3-year customer consent; ₹3 crore holdback if consent slips to post-close.
• Tax Transfer Pricing Exposure TP study is 3 years old; recent income-tax audit questioned methodology. Appeal pending. Result: ₹2 crore escrow carve-out for any tax exposure >₹50 lakh from the appeal outcome. Buyer walks or re-prices by ₹10–15 crore if red flags confirmed in final DD.

This is why structured diligence with sector overlays matters. A generic checklist would miss the DPDP exposure entirely and catch customer concentration only in commercial analysis, not in financial cross-checks.

Post-Closing Compliance & Escrow Administration

Diligence continues after closing. SPA conditions are tracked, escrow claims are administered, and new regulatory issues are handled under the indemnity framework.

• CP Satisfaction & Escrow Release Conditions precedent are tracked on a rolling basis. CPs that don't satisfy by the outside date become escrow draws unless waived in writing.
• Indemnity Claims & Dispute Resolution If post-close issues relate to pre-close events (tax assessments, CERT-In incidents, regulatory sanctions), the buyer lodges indemnity claims within the claim period (typically 18–36 months). Escrow funds cover the indemnified loss up to the cap.
• DPDP & Data Breach Follow-Up Data breach discovery can occur months or years after closing. DPDP indemnities are typically carved separately with a longer tail period (up to 36 months) because the exposure window is long.
• Earn-Out & Milestone Tracking Deferred purchase price is released on hitting post-close milestones (revenue, retention, no new litigation). Clear metrics reduce earn-out disputes at release time.

Where Diligence Gets Derailed

We see the same missteps kill timelines and surface issues too late. Here's what to avoid.

• Late or Incomplete Data Room Sellers who batch-upload documents lose 2–3 weeks. The first two weeks are most intensive. Late uploads push red-flag findings to the final report, when the deal team has already committed and has no leverage to renegotiate.
• Sector Overlays Added Late Fintech regulatory checks, SaaS DPDP audits and healthcare protocol reviews should be in the IRL upfront, not added at week 3. Late overlays delay the final report and often surface material issues with no time to fix them.
• Weak IP Assignment Diligence Many buyers assume IP is properly assigned by default. It's not. Founders and contractors often retain rights. By the time you discover this at closing, you're out of leverage to demand retroactive assignment or higher escrow.
• DPDP Exposure Underestimated The ₹250 crore penalty cap makes data breach discovery existential. Buyers who don't deep-dive into DPDP compliance pre-close are betting the company has had zero breaches—a risky assumption.
• No Cross-Check on Concentration Commercial DD reviews top customers; financial DD reviews revenue concentration. Without explicit cross-checks, concentration in one doesn't surface in the other. >50% concentration should trigger reps, condition precedents and escrow.
• SPA Clauses Don't Map to Findings Some diligence reports are narrative—'we found a risk'—but the SPA has no specific warranty or indemnity for that risk. At closing, there's no recovery mechanism.

What You Receive at the End

• Workstream-wise final DD report (legal, tax, financial, commercial, IT/data) with executive summary
• Red-flag report (day 10–14) surfacing deal-killers, re-pricing triggers and restructure options
• Quantified exposure summary showing impact on deal price for each material finding
• Recommended condition precedent list with outside dates and remediation timelines
• Specific warranty and representation language ready for SPA negotiation
• Indemnity carve-out schedule with caps, baskets, holdback periods and release triggers
• Escrow holdback sizing and release schedule by finding category
• VDR with full audit trail, watermarked downloads and Q&A transcript
• Management interview summaries and site-visit notes with key findings
• Sector-specific risk matrix mapping regulatory, commercial and operational risks to materiality

How to Get Started

To start, we need deal context: the target company, the acquisition or lending scenario, key timelines and your priority workstreams. If it's a strategic acquisition, we'll run a full five-workstream diligence; if it's a consolidation or add-on, we can lighten the commercial or financial layers. Once we understand the mandate, we'll scope the workstreams, propose a timeline (typically 4–8 weeks) and send an engagement letter for sign-off.

Your project will be led by a partner-level diligence lead with dedicated workstream heads from legal, tax, financial, commercial and IT/data. Weekly sync calls keep everyone aligned; the red-flag report at day 10–14 kicks off term-sheet recalibration; and the final report at week 4–6 gives you everything you need for SPA negotiation and closing. One dedicated contact manages the entire workstream so you don't have to coordinate across multiple firms.