The Confidential Information Memorandum (CIM): How to Read a Seller's Pitch Deck Like a Skeptic

Deal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.

This post is based on a video from our Deal Alert AI YouTube channel. Watch the original or read the full breakdown below.

By Sophal Lanh, Founder of Deal Alert AI

Every acquisition starts the same way. You find a listing that looks interesting, you request access, you sign an NDA, and then the broker or seller sends you a document called the confidential information memorandum — the CIM. Some brokers call it a prospectus. Some call it a deal packet. Solo sellers on Flippa sometimes just call it "the doc."

Whatever the name, the function is identical: it is the seller's case for why this business is worth the asking price. It is a sales document. It was written by, or paid for by, the person on the other side of the negotiating table. That does not make it dishonest — most CIMs I read are broadly accurate — but it does mean every number in it was selected, framed, and formatted by someone with a financial incentive to make the business look good.

The skill that separates buyers who close good deals from buyers who waste six months on bad ones is the ability to read a CIM quickly and decide: is this worth a real diligence process, or is this a pass? I've read several hundred of these. The good ones share a structure. The bad ones share a set of tells. This post covers both.

What a CIM Actually Is and Why It Exists

The CIM sits between the public listing and full due diligence. The public listing is deliberately vague — it might say "content site in the pet niche, $8,400/mo SDE, 4 years old" without naming the URL, because the seller doesn't want employees, competitors, or Google to know the business is for sale. Once you sign an NDA, the broker unlocks the CIM, which reveals the identity of the business and the supporting detail behind those headline numbers.

The document exists because acquisition is an information asymmetry problem. The seller knows everything. You know almost nothing. The CIM is the seller's structured attempt to close that gap enough for you to make an offer — but not so completely that you find every wart before you're emotionally invested. A well-run brokerage produces CIMs that are genuinely informative because their business model depends on closings, and deals that blow up in diligence cost them money. A motivated private seller writing their own CIM has no such discipline.

This is why the source of the CIM matters as much as its contents. A CIM from Empire Flippers arrives after their internal vetting team has already pulled platform-level financials and verified traffic — the numbers have been through a filter before they reach you. A CIM assembled by a first-time seller on an open marketplace has been through no filter at all. Both can describe good businesses. They require different levels of paranoia.

The Nine Things a Complete CIM Should Contain

Completeness is the fastest quality signal you have. Not because a thick document means a good business — I've seen 40-page CIMs for garbage assets — but because a seller who has assembled all nine of these sections has done the work of actually understanding their own business. That correlates strongly with clean books and a smooth close.

Here is the checklist I run against every CIM that hits my inbox. If a document is missing three or more of these, I email the broker with a request for the gaps before I spend another minute. How they respond tells me as much as the answer itself.

1. Business overview and history. When it was founded, what problem it solves, who the customer is, and specifically how money moves from that customer to the owner. If you can't explain the revenue mechanism in one sentence after reading this section, the section failed.
2. Trailing twelve-month P&L with monthly breakdown. Not a summary. Twelve individual months of revenue, cost of goods, operating expenses, and net. Monthly granularity is where seasonality and decline hide.
3. A clear SDE calculation with itemized add-backs. Every add-back listed on its own line with a one-sentence justification. "Owner health insurance — $640/mo, discretionary" is fine. A lump line labeled "adjustments — $31,000" is not.
4. Traffic analysis covering at least 24 months. Google Analytics or equivalent, broken out by organic, paid, direct, referral, and social. Twenty-four months so you can see year-over-year, not just a favorable recent stretch.
5. Customer analysis. Total customer count, revenue concentration in the top five or ten customers, and — for subscription businesses — monthly churn, cohort retention, and average customer lifetime.
6. Operations overview with owner hours. A specific number of hours per week the current owner spends, and what those hours consist of. "10–15 hours: content briefs, contractor management, monthly financial review" is a real answer.
7. Team and contractor roster with costs. Every person touching the business, their role, their monthly cost, their employment status, and whether they've agreed to stay post-sale.
8. Technology stack and recurring costs. Hosting, plugins, SaaS subscriptions, payment processors, email platform — with monthly costs and, critically, whose account they're registered under.
9. Growth opportunities the seller identified but didn't pursue. With enough supporting data that you could evaluate the opportunity yourself, not just a bulleted wish list.
10. A specific, credible reason for selling. "Moving into a new venture that requires full-time attention and capital" is credible. "Personal reasons" is a placeholder for something you'll find in diligence.

Notice that six of those ten items are about things that could go wrong, not things that are going right. That asymmetry is intentional. A seller who volunteers their customer concentration risk and their exact weekly time commitment is a seller who expects you to find it anyway — which usually means the rest of the document is honest too.

Red Flags That Should Slow You Down Immediately

Some CIM problems are cosmetic. A typo-riddled document from a technical founder who built a great SaaS product isn't a dealbreaker. Other problems are structural — they tell you the seller is either disorganized in ways that will surface as broken systems, or deliberately obscuring something.

The first hard red flag is financials presented only as screenshots. A Stripe dashboard screenshot showing "$14,203 this month" is a picture of a number. A CSV export from Stripe covering 24 months, with transaction-level detail, is data. Screenshots can be cropped, can be from a cherry-picked window, and can — in genuinely fraudulent cases — be edited in a browser inspector in about eleven seconds. Any seller who cannot produce platform exports either doesn't know how, which is worrying, or won't, which is worse.

The second is large, thinly justified add-backs. Add-backs are legitimate. If the seller pays their spouse $2,000/month for work you'll do yourself, that's real discretionary earnings. But when a business claims $180,000 in revenue, $95,000 in expenses, and then adds back $40,000 of "one-time and owner-specific costs" to reach a $125,000 SDE, you're being asked to pay a multiple on $40,000 of expenses that may well recur. I've seen a $9,000 "one-time website redesign" add-back on a site that had been redesigned twice in three years. That's not one-time. That's maintenance capex.

The third is a chart that starts at a convenient moment. If a traffic graph begins in month 14 of the business's life, ask what months 1 through 13 looked like. Nine times out of ten there was a Google update, a platform ban, or a supplier problem that caused a cliff, and the chart begins immediately after the bottom so the trend line points up. Always demand the full history. Always.

How to Read a CIM Skeptically Without Being Paranoid

The correct posture is not distrust. It's structured verification. Assume every claim in the document is the most optimistic true statement the seller could make, then figure out what the less optimistic version looks like and whether you'd still buy at that price.

Practically, this means annotating as you read. I keep three columns: claims I can verify with third-party data, claims I can verify only with seller-provided data, and claims I cannot verify at all. Revenue is column one — Stripe, PayPal, Amazon Seller Central, and Shopify all produce exports the seller can't fabricate without serious effort, and screen-share verification closes the gap. Traffic is column one via Google Analytics read-only access. Expenses are column two, because a seller can omit costs more easily than they can invent revenue. "The niche is growing" and "there's an obvious opportunity in email" are column three — interesting, unpriceable.

Then apply the discount. Whatever the CIM says about growth potential, value the business on current performance only. Whatever it says about owner hours, add 50%. Whatever it says about the reason for selling, look for the version of that story where the seller knows something about the next twelve months that you don't. If the deal still clears your return threshold under those assumptions, you have a real candidate. This is the exact logic we've built into the scoring layer at Deal Alert AI — because most buyers never apply the haircut consistently, and it's the single highest-leverage habit in the whole process.

What a Strong Reason for Selling Actually Looks Like

This section of the CIM gets skimmed and it shouldn't. The reason for selling is the seller's story about why a profitable asset is available to you, and stories have plot holes.

Credible reasons share a common feature: they're specific and externally verifiable. "I'm relocating to Berlin in March and my new employer's contract prohibits outside businesses." "I've raised a seed round for a different product and my investors require full-time focus." "This is one of four sites I own, it's the smallest, and I'm consolidating to focus on the two largest." Each of these you can probe — you can ask follow-up questions and watch whether the details stay consistent across three conversations.

The less credible version is generic and unfalsifiable. "Personal reasons." "Focusing on family." "Ready for something new." These may be entirely true — burnout is real and common — but they give you nothing to test. When I get a vague answer, I don't treat it as a dealbreaker. I treat it as an open question that gets asked again in every subsequent call, phrased differently. Inconsistency across three tellings is the actual red flag, not vagueness in the document.

And pay close attention to timing. A business being sold six weeks after a Google core update, or two months before a major platform policy change the seller almost certainly knows about, deserves scrutiny that has nothing to do with the stated reason. The best question I've found: "What would you fix first if you were keeping this for another three years?" The answer to that reveals more than the reason-for-selling section ever will.

Comparing CIMs Across Brokers and Marketplaces

The quality baseline varies enormously by source, and knowing the baseline lets you calibrate. On curated brokerages, the CIM has already survived an internal vetting process — the brokerage pulled bank and platform data before listing, and their reputation is on the line at close. When I read a CIM from Empire Flippers, I'm mostly verifying that the business fits my thesis, not checking whether revenue exists. That's a materially different exercise.

Open marketplaces are the opposite end. On Flippa you'll find excellent deals — genuinely undervalued assets sold by owners who didn't want to pay a 15% brokerage commission — sitting next to listings with fabricated traffic and inflated SDE. The platform has added integrations and verification badges that help considerably, but the responsibility for verification sits with you. That's the trade: better prices, more work, higher variance. If you're comfortable doing the work, the risk-adjusted returns can be excellent. If you're not, pay the brokerage premium.

Mid-tier brokers occupy the middle. They produce professional CIMs but their vetting depth varies. My rule of thumb: the more a broker's CIM leads with narrative and design and the less it leads with exportable data, the more skeptical I get. A beautiful 30-page document with three pages of financials is a marketing asset. A plain 12-page document with eight pages of monthly P&L, traffic tables, and cohort data is a diligence asset. I want the second one.

Using Pre-Screening to Avoid Reading Bad CIMs at All

Here's the efficiency problem nobody talks about. Requesting a CIM costs you an NDA signature and roughly 30 to 90 minutes between the request, the read, and the follow-up email. Do that on 40 listings and you've burned 40 hours before you've made a single offer. Most active buyers I know do exactly this, then wonder why they're exhausted and haven't closed anything.

The fix is scoring listings before you request the CIM. Public listing pages carry more signal than people realize: how the broker presents financials, whether they disclose traffic sources at the listing level, whether the multiple is consistent with comparable deals in that category, how long the listing has been live, whether the price has been reduced, and how complete the pre-NDA summary is. A listing that's been live for 140 days with two price cuts and a vague monetization description is not going to produce a CIM that changes your mind.

That's the problem Deal Alert AI was built to solve. We scan listings across the major brokerages and marketplaces continuously, score them on completeness signals, broker quality, multiple-versus-category benchmarks, and listing age patterns, and surface only the ones that clear a threshold. The goal isn't to make the buying decision for you — it's to make sure that when you spend an hour reading a CIM, it's an hour on a deal that had a real chance of working. Buyers using the pre-screen typically cut their CIM request volume by more than half while looking at better deals.

The CIM will always be a sales document. That's fine. Your job isn't to find a CIM with no spin — it doesn't exist. Your job is to read it fast enough that spin doesn't cost you weeks, verify the load-bearing claims independently, and walk away without regret when the numbers don't survive contact with reality. Get that loop tight and you'll look at four times as many deals as the buyer next to you, which is ultimately the only edge that compounds. You can start screening pre-filtered listings at Deal Alert AI today.