The SMB Buyer's Due Diligence Checklist: What to Verify Before You Close (2025)

Due diligence when buying a small business is a structured investigation you conduct after signing a Letter of Intent (LOI) and before closing. Buyers typically spend 30 to 60 days reviewing three to five years of financials, legal contracts, customer data, and operations. The goal is to verify the seller's claims, uncover hidden risks, and either negotiate protections or walk away.

This guide covers the full buyer's playbook: what to request, what to actually verify (not just collect), what the 2025 SBA rule changes require, and what signals should make you renegotiate — or exit.

Key takeaways

• Due diligence begins the day you sign an LOI and runs through closing, typically 45 to 60 days for SMB deals under $5M.
• The most predictive red flag is seller evasion behavior — not any single document problem.
• The "proof of cash" method (matching bank deposits to reported revenue) is the most reliable way to catch manipulated financials in owner-operated businesses.
• SBA SOP 50 10 8, effective June 1, 2025, added mandatory IRS transcript requirements, a 10% equity injection floor, and seller guarantee rules that can disrupt late-stage deals.
• A Quality of Earnings report costs $6,000 to $25,000 for sub-$5M transactions and should be commissioned immediately after signing the LOI.

What Is Due Diligence — and When Does It Start?

Due diligence is the structured verification process that begins the moment your LOI is countersigned. It is your legal right to confirm everything the seller has told you before money changes hands — and it is the primary moment when the gap between what a business appears to be and what it actually is comes to light.

Your LOI should include an exclusivity period, typically 30 to 90 days, during which the seller agrees not to market to other buyers. That window is finite. The two objectives of due diligence can pull in different directions: confirming the story is accurate, and building enough understanding to operate the business after you close. Both matter. Buyers who focus only on verification sometimes miss integration risk. Buyers who focus only on understanding sometimes miss fraud.

How Long Does Due Diligence Take?

The standard for SMB acquisitions under $5M is 45 to 60 days. Fast, well-prepared transactions can complete diligence in 21 to 35 days. Complex businesses or unresponsive sellers can push timelines to 75 to 180 days.

The most common cause of delay is a seller who is not deal-ready. Research suggests roughly 95% of SMB sellers have not organized their financials and documentation before going to market. Budget two weeks for document gathering alone, and structure your exclusivity window accordingly.

The Documents You Must Request from the Seller

Send a formal document request within 48 hours of signing your LOI. Include a deadline for initial delivery. The minimum request list:

Financial documents

• Three to five years of business tax returns
• Three to five years of P&L statements, balance sheets, and cash flow statements
• 12 to 24 months of bank statements (all accounts, all months, no gaps)
• Accounts receivable and accounts payable aging reports
• Seller discretionary earnings (SDE) add-back schedule with supporting documentation for each item

Legal and compliance documents

• Business formation documents and ownership certificates
• All material contracts (customer, supplier, lease, equipment)
• Current and threatened litigation, including any government inquiries
• All licenses, permits, and certifications required to operate
• Intellectual property registrations (trademarks, patents, domain ownership)

Operational documents

• Customer list with annual revenue per customer, at minimum the top 20
• Employee list with titles, tenure, compensation, and any non-compete or non-solicitation agreements
• Supplier list with terms and contract expiration dates

Tax compliance

• IRS Form 4506-C authorization so your CPA or QoE firm can pull tax transcripts directly from the IRS

That last item is non-negotiable. Seller-provided tax return copies can be altered. Transcripts pulled directly from the IRS cannot.

Financial Due Diligence: Go Beyond the P&L

Financial due diligence is not reading the P&L the seller provided. It is building your own version of the financials from primary sources and comparing.

Start with the tax returns and corresponding bank statements. Most owner-operated SMBs run legitimate personal expenses through the business, and the add-backs that inflate SDE are often real — but only if properly documented. For each add-back the seller claims, request the supporting receipt, payroll record, or explanation. "Owner health insurance" needs a premium statement. "Non-recurring legal expense" needs the invoice and a description of why it will not recur.

The Proof of Cash Method

The proof of cash is the single most effective tool for detecting manipulated financials in owner-operated businesses. The logic is straightforward: revenue the business earned should show up as deposits in the business bank account.

Match total reported revenue on the P&L to total deposits in the bank statements, month by month. In a legitimate business, the figures will align closely, with explainable timing differences. If reported revenue consistently exceeds actual deposits, you have either undisclosed cash withdrawal behavior or fabricated revenue. Either is disqualifying.

A diligent buyer with a spreadsheet and two hours can run the proof of cash themselves. It is also the first thing every Quality of Earnings firm does when they open a file.

Do You Need a Quality of Earnings Report?

For any acquisition above $500K, yes. For any acquisition using SBA financing, yes without exception.

A Quality of Earnings (QoE) report, commissioned from an independent accounting firm, reconstructs the seller's financials from primary sources, verifies every add-back, assesses revenue quality, and surfaces working capital trends. It finds what standard CPA-reviewed statements miss, because standard reviews assume management is acting in good faith.

For businesses under $5M in enterprise value, a QoE costs $6,000 to $25,000 and typically takes one to three weeks (2025 estimates). Commission it at the start of your exclusivity window, not at the end. Ask the QoE firm to flag early warning findings as they emerge rather than waiting for the final deliverable.

Legal Due Diligence: Contracts, Licenses, and Hidden Liabilities

Your attorney will run legal diligence alongside your financial review. The issues that most frequently surprise buyers are not the ones that look alarming on the surface. They are the ones buried in boilerplate contract language.

Change-of-control clauses are the most common post-closing shock. Many customer contracts, supplier agreements, and commercial leases contain provisions allowing the other party to terminate or renegotiate when the business changes ownership. If 40% of revenue depends on a contract that terminates at closing, you are not buying a business — you are inheriting a liability.

Pull every material contract early and ask your attorney to specifically flag change-of-control language. Where it exists, the seller must obtain written consent from the counterparty before closing. Do not assume this can be resolved after the deal.

Other critical legal items to review:

• Pending and threatened litigation: ask directly, check state and federal court records, and have your attorney run a UCC lien search against the business assets
• Employee classification: independent contractors who meet the IRS test for employees create back-tax, penalty, and Department of Labor exposure that passes to the buyer
• License transferability: industry licenses in healthcare, childcare, food service, and licensed contracting are often issued to individuals and do not transfer with the entity
• IP ownership: software, brand assets, and domain names are sometimes owned personally by the founder rather than the company, which can surface as a complication at closing

Operational Due Diligence: Can the Business Run Without the Owner?

The financial story tells you what the business earned. Operational diligence tells you whether it can keep earning that after the seller leaves.

Visit the physical location if there is one. Spend time with the team. Ask the seller to walk you through a typical week and the most difficult operational situation they handled in the last year.

Key questions:

• Which customers, suppliers, or employees have relationships that are personal to the seller rather than institutional to the business?
• What is the seller's plan to introduce you to those relationships before closing?
• What processes, institutional knowledge, or system access live only in the seller's head?
• What is typical employee tenure, and has anyone key signaled they plan to leave?

A business that depends entirely on the owner's presence and relationships is a job offer, not an acquisition. The target is a business with documented processes, a team that can execute without daily owner involvement, and customer relationships that survive the transition.

Customer and Supplier Concentration: The Silent Deal-Killer

If a single customer represents more than 20 to 25% of revenue, the business carries material concentration risk. Above 40%, you are essentially buying a single-client services arrangement.

For every significant customer, understand whether the relationship belongs to the business or to the seller personally, when the contract expires, and whether there is a change-of-control clause. Request the contract if one exists.

The same analysis applies to suppliers. If the business relies on a single-source supplier for a critical input with no alternative and no long-term contract, a pricing change or supply disruption immediately compresses margins in a way you cannot easily hedge.

Tax Compliance: The IRS Form 8594 Trap Buyers Miss

When you buy a business, both you and the seller must file IRS Form 8594, the Asset Acquisition Statement Under Section 1060. This form allocates the total purchase price across seven asset classes in a specific order, using the residual method.

The trap is mismatched filings. If you and the seller file different allocations, IRS systems flag the discrepancy automatically. The result is an audit inquiry, additional filings, and potential penalties. This happens more often than it should because allocations are sometimes negotiated informally and the two parties' tax advisors file independently without coordinating.

Agree on the Form 8594 allocation before closing, document the agreement in the purchase agreement, and confirm that your tax advisor and the seller's tax advisor are filing identically on the same schedule.

Using SBA Financing? What SOP 50 10 8 Now Requires (2025)

SBA Standard Operating Procedure 50 10 8 became effective June 1, 2025, and represents the most significant update to SBA acquisition lending in years. If your deal involves SBA financing, these changes affect what your lender will require during underwriting.

The key changes:

• IRS Form 4506-C required on all SBA loans, regardless of size. Lenders must pull tax transcripts directly from the IRS, not rely on seller-provided documents.
• 10% minimum equity injection is now mandatory for any complete change of ownership.
• Seller guarantee rule: if the seller retains any equity in the business after the sale, even a 1% stake, they must personally guarantee the full SBA loan for a minimum of two years following closing.
• Environmental reports must be dated within 12 months of SBA loan number issuance.

The seller guarantee change is the provision that most frequently disrupts late-stage deals. Seller equity rollover, which used to be a deal-structuring tool to bridge valuation gaps, now carries a personal guarantee obligation that many sellers are unwilling to accept. If you are considering seller equity rollover as part of your deal structure, discuss this with your SBA lender before including it in the LOI — not the week before closing.

The 10 Biggest Red Flags That Should Make You Walk Away

1. Seller evasion: delays producing specific documents, inconsistent answers to basic questions, or hostility toward particular areas of inquiry — this is the single highest-predictive signal of a problem deal.
2. Revenue that does not deposit: proof of cash shows reported revenue consistently exceeding bank deposits with no plausible explanation.
3. Customer concentration above 40%: one customer representing nearly half of revenue is a business that can disappear overnight.
4. Key contracts with unresolved change-of-control clauses: not solvable at closing if the counterparty is unresponsive.
5. Declining revenue explained only by a story: "bad year" claims require documentation, not narrative.
6. Owner-dependent operations with no handoff plan: if the seller cannot describe how the business runs without them, it does not.
7. Undisclosed litigation discovered during diligence: what else was not disclosed?
8. Key employees who have already resigned or telegraphed departure: due diligence leaks are common in small businesses.
9. Lease expiring within 12 months of closing with no renewal confirmed: one of the most common main-street deal-killers.
10. Seller refusing buyer conversations with key customers or suppliers: legitimate sellers understand that buyers need to verify relationships.

How to Use Diligence Findings to Renegotiate — or Walk

Due diligence findings do not always end a deal. They frequently change one.

When a risk is quantifiable — a lease that needs renegotiating, a customer contract that may not transfer, deferred maintenance with a known price tag — use it to adjust the purchase price, add a holdback, or require seller indemnification tied specifically to that risk. Most sellers will negotiate rather than restart the process with a new buyer.

When a risk is not quantifiable — a seller who cannot answer basic questions about their own business, revenue that cannot be reconciled, legal exposure with unclear liability — the right answer is usually to exit.

The hardest decision is the middle case: a deal with real problems and real upside. Buyers who later regret acquisitions most often describe having seen the red flags clearly during diligence and rationalized past them anyway. Trust what you found in the data more than what you are hoping.

Due Diligence Checklist at a Glance