Legal due diligence preparation before a startup becomes the sell-side in M&A
Hello, this is Legal Agent.
M&A is a major growth strategy for many startups, whether structured as a sale to a strategic acquirer or a business transfer. On the sell side, the company will face the buyer's legal due diligence, which overlaps with fundraising due diligence but often goes deeper, since the buyer is taking on the company's risk. This article covers what to prepare, in order: shares, key contracts, IP and data.
Items to surface before a sale
- defects in the shareholder register, corporate register or past share issuances, and how unexercised or departed-employee stock options will be treated
- whether key contracts contain a change-of-control clause, and which ones need the counterparty's prior consent before a sale
- whether source code, trademarks or know-how touched by contractors or side-project members have had their rights properly transferred to the company
- how customer and user data will be handled, which differs between a share sale and a business transfer
- running a self-DD early, at the point a sale is first being considered, rather than waiting for the buyer's questions
Organising shares and stock options
In a share sale, the buyer checks who the shareholders are, how many shares each holds, whether past issuances had defects, and the status of stock options, using the shareholder register, corporate register and any shareholders' agreement. Unexercised options or grants to former employees should have their M&A treatment settled beforehand, and verbal equity agreements among founders tend to surface as problems mid-negotiation, affecting price or schedule.
Consent clauses in key contracts
Change-of-control clauses requiring the counterparty's prior consent are a common issue, appearing in major customer, vendor or loan agreements; many such contracts add work before closing. Termination clauses, non-compete provisions and IP ownership are checked too, since the buyer wants assurance the business can continue after acquisition.
IP and outsourced development
IP ownership is central to startup due diligence: whether source code, trademarks and training data properly belong to the company, and where contractors or side-project members were involved, whether rights have transferred and moral-rights waivers exist. Where generative AI was used, the AI service's terms and third-party rights risk may be checked too.
Personal data and data transfer
In a share sale the company continues as the same legal entity, so personal data transfer is viewed differently than in a business transfer, where individual consent or contractual approval for transferring data can become an issue. Either way, the privacy policy, terms of use and external services should be checked, since data is often central to an AI or SaaS company's value.
Run a self-DD early
Legal due diligence becomes heavier once it only starts in response to the buyer's questions. Running a simplified self-DD as soon as a sale is under consideration surfaces missing documents and risk, making it easier to explain the company to the buyer and leaving more room in negotiations; a problem found mid-DD can instead affect price or indemnity terms.