Legal risks when buying a small business fall into a few recurring categories: liabilities that don't show up on a casual review, contracts that limit what you can actually do with the business after closing, and a deal structure that either shields you from those risks or leaves you fully exposed to them. None of this requires a law degree to understand, but it does require knowing what to actually look for before you sign.
This guide walks through the hidden liabilities, the contract clauses that most often surprise buyers, how deal structure manages exposure, the escrow and indemnification mechanics that protect you after closing, and the industry-specific risks worth flagging early.
Key takeaways
- Hidden liabilities like loan guarantees, pending litigation, and off-balance-sheet obligations rarely show up in a standard financial review; they require specific document requests.
- Change-of-control and anti-assignment clauses in supplier, customer, and lease contracts can give a counterparty leverage to renegotiate terms the moment they learn ownership is changing.
- Asset purchases let a buyer choose which liabilities to assume; equity purchases transfer the whole entity, known and unknown liabilities included, unless specifically carved out.
- The median indemnity escrow on non-insured deals runs roughly 9 to 10% of purchase price per 2025 deal-terms data, held for a typical 12 to 18 month survival period.
- Keeping an acquired business in its own legal entity, rather than merging it into an existing structure, isolates that business's liabilities from the rest of your holdings.
Hidden Liabilities a Casual Review Won't Catch
The biggest legal risks in an SMB acquisition are rarely on the P&L. Request documentation specifically for loan and credit-line guarantees the seller has personally backed (which may need to be released or replaced at closing), any pending or threatened litigation, warranty claims tied to past work or products, and off-balance-sheet obligations like operating leases, employee benefit commitments, or informal side agreements a small business owner may never have formalized in writing. A casual read of the P&L and balance sheet won't surface any of these. A specific, itemized document request will.
A concrete example of how this bites: a seller who personally guaranteed a $150,000 equipment loan five years ago may have long since stopped thinking about it as a live liability, since it doesn't show up as a red flag on the day-to-day financials the business runs on. If that guarantee isn't identified and released or restructured at closing, the buyer can inherit a lender relationship that was never disclosed as a deal term, discovered only when a payment issue surfaces months later. The same pattern applies to pending litigation the seller considers minor or nuisance-level and simply doesn't think to mention unless specifically asked. If your target has faced any customer disputes, employment claims, or regulatory inquiries in the past three years, get the documentation directly rather than relying on a verbal "nothing to worry about."
Problem Contracts to Flag Before You Sign
Existing contracts are one of the most overlooked risk areas because they look like assets right up until they become a liability. Review every material supplier, customer, and lease agreement for four things: auto-renewal clauses that lock in unfavorable terms if not cancelled by a specific deadline, termination penalties that make exiting a bad contract expensive, restrictive covenants that limit what the business can do going forward, and change-of-control or anti-assignment provisions.
That last category deserves special attention. A change-of-control clause gives the other party (a landlord, a key supplier, a major customer) the right to terminate or require consent when ownership changes. Anti-assignment clauses work similarly for asset purchases specifically: since the contract itself is being assigned to a new legal owner, the counterparty's consent may be required, and that consent requirement is leverage. A landlord or supplier who realizes you need their sign-off to keep an existing deal in place can use that moment to push for better terms, a price increase, or a shorter renewal, right when you have the least ability to walk away. Identify every contract with this kind of clause before you're mid-negotiation, not after.
The mechanics play out predictably: you're two weeks from a target closing date, the landlord on the business's main location learns a required consent-to-assign has to be signed, and suddenly a lease renewal that would have been routine becomes a negotiation over a rent increase, because the landlord correctly understands you have very little leverage to walk away at that point. The same dynamic applies to a key supplier who represents a large share of the business's cost of goods sold. The fix isn't avoiding these clauses (most commercial contracts have some version of one), it's identifying every contract that contains one early enough in diligence that you can either negotiate a resolution before you're locked into a closing date, or price the risk into your offer if the counterparty is unwilling to cooperate.
Related to change-of-control provisions, watch for material adverse change (MAC) clauses in the purchase agreement itself, which can let a buyer walk away if something materially damages the target's business between signing and closing. Our guide on material adverse change clauses covers how these are negotiated and what actually qualifies as "material" in practice.
Asset Purchase vs. Equity Purchase: Deal Structure as a Liability Shield
The choice between buying assets or buying equity is one of the most consequential liability-management decisions in the deal. In an asset purchase, you can generally choose which specific assets and liabilities to assume, leaving undisclosed or unwanted liabilities behind with the seller's entity, and you get a stepped-up tax basis on the assets acquired. The tradeoff is administrative: contracts, leases, and licenses often need individual re-titling or consent to transfer.
In an equity or stock purchase, the target entity itself changes hands, which is administratively simpler since existing contracts generally continue without requiring third-party consent, unless a specific change-of-control clause says otherwise. The cost of that simplicity is that you inherit the entity's full liability history, known and unknown, unless specifically carved out and backed by indemnification. Our dedicated guide on asset purchase vs. stock purchase covers the tax and structural tradeoffs in full detail.
Indemnities, Escrows, and Holdbacks
Indemnification provisions and escrow holdbacks are how buyers get protected after closing, when a liability you didn't know about at the signing table turns up six months later.
| Deal characteristic | Typical escrow/holdback | Typical survival period |
|---|---|---|
| Non-insured deal, general market median | ~9-10% of purchase price | 12-18 months |
| Sub-$10M SMB deal | Often 10-15%, reflecting thinner diligence | 12-18 months |
| Deal backed by representation and warranty insurance | As low as ~0.3% of purchase price | Varies by policy |
Per SRS Acquiom's 2025 M&A Deal Terms Study, the median indemnity escrow across non-insured deals sits around 9 to 10% of purchase price, with sub-$10M deals commonly running higher (10 to 15%) given greater relative uncertainty and lighter diligence than larger transactions. Representation and warranty insurance, which shifts indemnification risk to an insurer, has compressed escrow requirements dramatically on deals where it's used, but it's often cost-prohibitive or simply unavailable at the $1M to $25M deal size Clef's buyers operate in, which means a meaningful cash holdback remains the standard protection mechanism for most of this market.
Why Acquirers Keep the Target as a Separate Legal Entity
Most experienced acquirers, especially anyone planning more than one acquisition, keep each business in its own legal entity rather than folding it into an existing structure. If a lawsuit, an undisclosed liability, or a regulatory issue surfaces tied to one acquired business, keeping it in its own LLC or corporation generally contains that exposure to that entity alone, rather than putting your other holdings at risk, provided you maintain normal corporate formalities (separate books, separate bank accounts, adequate capitalization) rather than treating the entities as interchangeable. This becomes especially important once you own more than one business, since commingling that liability protection away by treating everything as one operation defeats the purpose of structuring it separately in the first place.
A Systematic Contract Review Process
Rather than reading every contract in isolation and hoping you catch what matters, work through a repeatable sequence:
- Inventory every material contract: suppliers, customers, leases, financing agreements, and employment agreements above a reasonable dollar or duration threshold.
- Flag every assignment or change-of-control clause and note which ones require third-party consent to transfer.
- Flag every auto-renewal and termination-penalty clause, along with the specific cancellation deadline and notice period required.
- Verify guarantees: confirm whether the seller has personally guaranteed any loan, lease, or credit line, and what needs to happen at closing to release or replace that guarantee.
- Cross-reference against your target close date so consent requests and renewal deadlines don't get missed in the closing timeline crunch.
This process is what a full legal due diligence review formalizes, but a buyer can and should work through this checklist themselves before ever engaging counsel, so you know what to ask for and why. Our broader due diligence checklist covers the rest of the document requests that pair with this contract review.
Industry-Specific Regulatory Risk
Some industries carry contractual and compliance risk well beyond the generic categories above. Healthcare is the clearest example: acquiring a healthcare-adjacent business means inheriting HIPAA obligations as a covered entity or business associate, and the data-breach exposure in this sector is real money, not theoretical risk. IBM's 2025 Cost of a Data Breach Report puts the average healthcare industry breach cost at $7.42 million, the highest of any industry for the fourteenth consecutive year, even as the global average across all industries declined to $4.44 million. Healthcare's outsized cost reflects both the sensitivity of the data involved and the regulatory penalties layered on top of the breach itself. If your target handles protected health information in any form, confirm its Business Associate Agreements and HIPAA compliance posture as a distinct diligence workstream, not a subset of general IT review.
Beyond healthcare, any business handling significant customer data, processing payments, or operating in a licensed profession carries its own regulatory diligence checklist. A business that stores customer payment data is subject to PCI-DSS compliance obligations regardless of its size, and a business in a licensed trade (contracting, food service, transportation) inherits whatever state and local licensing requirements apply, some of which may not transfer automatically to a new owner and require reapplication. The general principle holds regardless of industry: identify what regulatory regime applies to the specific target before closing, not after an inspector or a plaintiff's attorney identifies it for you.
This is also where representation and warranty insurance (RWI) comes up as a potential protection, though it's worth understanding its limits at this deal size. RWI shifts indemnification risk from the seller to an insurer, and where it's used, it has compressed typical escrow requirements to a fraction of a percent of purchase price. The catch is availability: RWI carriers generally have minimum deal-size thresholds and premium structures that make it cost-effective mainly for larger transactions, which means most buyers acquiring a $1M to $25M business won't have it as a realistic option and should plan on a cash escrow as the primary protection mechanism instead.
How Clef Helps
None of this replaces legal counsel for the actual contract review and closing documents. What Clef does is get you to that point faster and better prepared: an aggregated feed of more than 120,000 business-for-sale listings so you're evaluating more candidates in less time, an AI assistant to help screen listings against your criteria, and a deal pipeline to keep every open item, including the contract review checklist above, organized as you move from first look to close.
Frequently asked questions
What legal risks should I check before buying a small business?
Focus on four areas: hidden liabilities not visible on a casual financial review (pending lawsuits, loan guarantees, off-balance-sheet obligations), problem clauses in existing contracts (auto-renewals, termination penalties, change-of-control provisions), whether an asset or equity purchase structure better limits what liabilities transfer to you, and industry-specific regulatory exposure if the target operates in a regulated space like healthcare.
What happens to existing contracts when you buy a business?
In an asset purchase, contracts generally don't transfer automatically; each one may need the counterparty's consent to assign, which gives suppliers, landlords, and key customers leverage to renegotiate terms mid-deal. In an equity or stock purchase, the acquired entity's contracts generally continue in place since the legal entity itself isn't changing hands, but any contract with an explicit change-of-control clause can still trigger termination or renegotiation rights even though the paper counterparty stays the same.
How much should an escrow holdback be when buying a business?
Per SRS Acquiom's 2025 M&A Deal Terms Study, the median indemnity escrow across non-insured deals sits around 9 to 10% of purchase price, with nearly half of non-insured deals exceeding 10%. Smaller sub-$10M deals commonly land at 10 to 15% given thinner financial diligence and higher relative uncertainty, held for a typical survival period of 12 to 18 months.
Should I buy a business as an asset purchase or a stock purchase?
Asset purchases generally let you choose which liabilities to assume and offer a tax basis step-up, but require re-titling contracts, licenses, and leases individually, some of which need third-party consent to transfer. Stock or equity purchases are administratively simpler since the entity itself doesn't change hands, but you inherit all of that entity's liabilities, known and unknown, unless specifically carved out and covered by indemnification. Our dedicated guide on asset purchase vs. stock purchase covers the full tradeoff in depth.
Do I need a separate LLC for each business I acquire?
Most experienced acquirers keep each acquisition in its own legal entity (commonly an LLC) rather than merging it into an existing holding structure, specifically to isolate that business's historical and future liabilities from your other holdings. If a lawsuit or liability surfaces tied to the acquired business, it's generally contained to that entity rather than exposing your broader portfolio, provided normal corporate formalities are maintained.