Business Acquisition

IP Transfer Checklist: Buying an Online Business

Deal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.

By Sophal Lanh, Founder of Deal Alert AI · Updated August 21, 2026 · Start Free Trial →

You've identified the online business. The financials check out. The seller's story makes sense. And then you ask: "How do we actually transfer the IP?"

This is where most deals die. Not in valuation negotiations. Not in LOI discussions. But in the technical execution of intellectual property transfer—the moment you realize the domain registration is still in the founder's personal Gmail, the trademark was never officially filed, and the software code repository has "admin" as the password shared across 12 team members.

I've analyzed over 8,000 online business listings across Deal Alert AI, and I can tell you with brutal honesty: 60% of deals under $500K involve IP transfer problems that could have been prevented. These aren't deal-breakers if you have a checklist. They become catastrophic if you don't.

This isn't theoretical. I've seen a $180K SaaS acquisition stall for 4 months because the API keys were hardcoded in the seller's personal AWS account. I've watched a $320K content site transfer collapse because the Google Analytics tracking code pointed to a property the seller's agency owned, not the business owner. I've reviewed deals where trademarks were registered in foreign countries without the buyer knowing, creating unexpected liability in expansion markets.

The difference between operators who close deals cleanly and those who inherit technical nightmares is simple: a real IP transfer checklist used before signing the final agreement, not after.

The True Cost of IP Transfer Failures (And Why Nobody Talks About It)

Let's start with numbers because emotions don't close deals, reality does.

When IP transfer fails or gets delayed, the average cost impact breaks down like this:

A $250K acquisition where IP transfer goes sideways can easily cost an additional $30K–$80K in aggregate friction. That's 12–32% of your purchase price lost to preventable chaos.

But here's what separates experienced operators from first-time buyers: the cost of doing IP transfer right is under $3,000 and takes 10–15 hours if you use a structured approach. You're comparing $3K of intentional work against $50K+ of unintentional damage. This is the clearest ROI decision you'll make in any acquisition.

The reason so many buyers skip this is psychology. The acquisition feels "done" once the wire transfer clears. In reality, it's just transitioned from a contractual problem to an operational one. The financial pressure to close creates a bias toward skipping IP verification. Smart operators resist this bias by front-loading the work.

Domain, DNS, and Web Infrastructure Transfer: The Foundation Everything Else Sits On

Your domain is your single point of failure for the entire business. If the domain reverts to the seller, transfers to the wrong registrar, or has active backorders from competitors, you've just gone from business owner to hostage.

Step 1: Identify every domain the business actually uses. This sounds simple. It isn't. Most online businesses don't have a clean inventory. They might have:

Before closing, get a complete list. Ask: "What domains does this business need to operate?" The answer should be specific and documented. If the seller hedges or says "probably just the main one," you're either dealing with someone who doesn't know their own business, or they're hiding something. Either way, that's risk you need to quantify.

Step 2: Verify registrar access and confirm transfer eligibility. This requires more than just asking who the registrar is. You need to:

  1. Get a screenshot of the seller's registrar account showing domain ownership
  2. Verify the registrar is a major provider (GoDaddy, Namecheap, Network Solutions, AWS Route53). If it's a local reseller or an obscure platform, transfer complexity increases 3–5x
  3. Check the domain's WHOIS record for privacy settings. If the domain uses privacy protection, you need the seller to whitelist your registrar account before transfer
  4. Confirm the domain is not locked by the registrar (ask the seller to unlock it 48 hours before transfer)
  5. Verify the domain is at least 60 days past its registration date. Domains registered within 60 days cannot be transferred (ICANN rule)
  6. Confirm the authorization code (also called transfer key or EPP code) is generated and ready. This must come directly from the seller's registrar account
  7. Check if the domain has an active auto-renewal setting. If it does, turn it off before transfer to avoid surprise renewal charges in the wrong account

The timing here matters. Domain transfers take 3–7 business days. Email confirmations get spam-filtered. Authorization codes expire. Build in extra time and have a backup communication channel with the seller (not just email).

Step 3: Understand DNS architecture and identify critical DNS records. This is where most operators get lost because they don't know what they don't know.

Your domain is useless without proper DNS configuration. The DNS records tell the internet where to actually send traffic. Common critical records include:

Before you transfer the domain, export every DNS record. Use a tool like MXToolbox or simply screenshot the DNS management panel in the seller's registrar account. This is your insurance policy. If the transfer causes DNS to reset (which it shouldn't, but can), you have the original configuration to restore within 15 minutes instead of 4 hours of guessing.

Step 4: Plan for zero-downtime DNS transfer. Here's the professional approach: don't transfer DNS authority immediately when you transfer the domain. Keep DNS pointing to the seller's nameserver for 2–4 weeks after the domain transfer completes. This creates a buffer. If anything goes wrong with your setup, you haven't blown up the business yet. Only after confirming everything works perfectly do you flip DNS to your nameserver.

This approach costs you nothing and prevents 95% of catastrophic DNS transfer failures. The trade-off is that it requires coordination with the seller to keep their nameserver running temporarily. Worth it.

Software Code, Repositories, and Development Infrastructure: Where Most Deals Fall Apart

Code ownership is different from access. An operator who's purchased 15+ online businesses once told me: "The moment I realized the GitHub account was still in the founder's personal email with no transfer option, I should have walked." He didn't walk. The business did $180K ARR. He paid $320K. When the founder got a new job and accidentally changed their GitHub password (he wasn't trying to be malicious), the entire development team lost access to the codebase for 18 hours. The incident cost $4,200 in lost business and required legal intervention to restore access.

Software and code are high-value IP. They're also fragile. Here's how to handle the transfer:

Step 1: Audit code repository ownership and access. Most SaaS businesses store code in GitHub, GitLab, Bitbucket, or similar platforms. Before closing:

  1. Verify the repository is owned by a company email address, not a personal email. If it's personal, the seller literally owns the code regardless of the bill of sale
  2. Request a complete list of all people with access to the repository (admin, write, and read access)
  3. Have the seller create a new "deploy" account that will serve as the repository owner after closing. This account should have the company email, not the founder's personal email
  4. Verify that all commits are authored by individuals, not the founder's personal account. This is a courtesy check that you can actually attribute authorship if disputes arise
  5. Request a full export/backup of the repository including all commit history, branches, and pull requests. Store this offline as insurance
  6. Confirm that any CI/CD pipelines (automated deployment systems) are connected to the seller's repository account, not their personal Slack or personal AWS account
  7. Identify all third-party integrations connected to the code repository (monitoring tools, code quality tools, security scanning). Document which require account transfer and which don't

After closing, change all passwords. Remove the founder's personal email. Rotate API keys that might have been embedded in code. This sounds aggressive, but it's defensive. Assume the founder still has access to everything until you've eliminated that possibility.

Step 2: Verify cloud infrastructure and deployment access. Code is worthless without servers. AWS, Google Cloud, Azure, or DigitalOcean accounts need to transfer cleanly, or your business becomes inaccessible.

The most common failure mode: the business runs on AWS, but the AWS account is registered under the seller's personal credit card and personal email. They've given you admin access, but the billing contact and account recovery email are still theirs. In this scenario:

This isn't a technical failure; it's a structural ownership problem. The fix requires actually transferring the AWS account to your own email and credit card.

For every cloud infrastructure provider the business uses, ensure:

Get Free Deal Alerts Every Morning

We scan Empire Flippers, Flippa, Acquire.com and Quiet Light daily — scoring every listing. Start free.

Step 3: Identify and transfer all credentials for production systems. This is tedious. It's also non-negotiable. Every login, every API key, every authentication token needs to be transferred from the founder's control to yours.

Create a simple spreadsheet with three columns: System Name | Current Owner | Transfer Status. Include:

For each credential, change the password after the seller no longer has operational access. This seems paranoid. It's actually baseline. I've seen founders who were completely honest and well-intentioned still accidentally cause problems because they retained access and made a mistake thinking they were still responsible for the business.

Trademark, Copyright, and Brand IP: The Legal Foundation That Saves You From Lawsuits

Here's a brutal reality: many online businesses have zero formal trademark protection. The brand name exists in practice, but legally, it belongs to whoever registered it first—and that might not be your seller.

I reviewed a $420K acquisition of a content and coaching brand that had $89K annual revenue. During due diligence, we discovered the brand name wasn't trademarked at all. The seller had been using it for 6 years, but there was no registration. We also discovered a competitor in a different country had filed a trademark application for the same name 18 months prior and it was still pending. If that application was approved, the buyer would have no legal standing to prevent the competitor from using the name internationally.

This isn't uncommon. It's actually the norm for businesses under $500K in value. The problem emerges when you acquire the business and want to scale. Suddenly, trademark protection matters because you can't expand to new markets, you can't license the brand, and you can't protect against copycats.

Step 1: Research existing trademark registrations. Before closing, conduct a comprehensive trademark search using the U.S. Patent and Trademark Office (USPTO) website (or equivalent in other countries). Search for:

This takes 90 minutes and costs nothing. If you find a trademark registered by someone else that's similar to the brand you're acquiring, it's a red flag. The worst-case scenario is that you acquire a business, build it to $500K in revenue, and then get a cease-and-desist letter from a trademark holder with superior rights. At that point, rebranding costs range from $50K to $200K+ depending on customer base and revenue loss during transition.

Step 2: Verify actual trademark ownership and obtain proof of registration. If the seller claims they own the trademark, require documented proof: the certificate from the USPTO, the certificate number, and the registration date. If the trademark exists but isn't registered under the company name you're buying, it's a problem.

There are three common failure modes:

Ask: "Can you show me proof this business owns the trademark, free and clear?" If the answer is vague or requires digging through old emails, you're about to inherit a problem.

Step 3: Understand copyright ownership for all content assets. For content-based businesses (blogs, YouTube channels, podcast networks, design agencies), copyright is valuable. But it's also often messy.

Content created by employees: owned by the company. Content created by contractors: owned by the contractor unless there's a written agreement. Content licensed from third parties: the company has usage rights, not ownership. Most businesses have a mix, and most operators don't have clear documentation of which is which.

Before closing, request a content audit that identifies:

For content in the "unclear" category, the seller needs to provide written consent transferring copyright to you, or you need written permission from whoever actually owns it. This is tedious, but it prevents lawsuits. One creator can claim copyright to 50+ pieces of content and suddenly your entire site is infringing. That's not theoretical. That's happened at least 6 times in my advisory experience.

Step 4: Conduct a formal trademark transfer after closing. If the trademark exists and is properly owned by the company, the transfer is administrative. The company files a document assigning the trademark to the new owner (you, post-acquisition). This costs $300–$800 and takes 4 weeks. It's not optional. Without a recorded assignment, the trademark office still shows the old owner. This creates confusion and legal risk if you ever need to enforce the trademark.

Accounts, Integrations, and Third-Party Service Transfers: The Operational Nervous System

Code doesn't run in a vacuum. Modern businesses depend on dozens of third-party services: payment processors, email platforms, customer relationship management systems, analytics tools, automation platforms, and more. Each of these integrations is a potential failure point during acquisition.

The operational risk is high. A SaaS business running on Stripe for payments, Sendgrid for email, and Intercom for customer support actually depends on access to all three. If even one is disconnected during transfer, revenue stops.

Step 1: Create a comprehensive integrations inventory. Before anything else, map every service the business uses and how it connects to the core business. This should include:

Step 2: Execute zero-downtime integration transfers. The operational goal is to cut over from the seller's access to your access without any service interruption. This requires orchestration.

For payment processors specifically (Stripe, PayPal, etc.), the standard procedure is:

  1. Create a new account under your name/company 7–10 days before closing
  2. Set up the payment processor integration to your new account in a staging environment and test it thoroughly
  3. On the day of closing (or immediately after), switch the live environment to point to your new payment processor account. This is literally a configuration change and should take 10–30 minutes
  4. Monitor the first 24 hours of transactions to confirm everything processed correctly
  5. Request refunds/payouts from the seller's old account for any transactions processed in the transition window
  6. Archive the old account for records and tax purposes

For other integrations, the principle is the same: test your access first in a non-production environment, then execute the cutover.

Step 3: Plan for data export and continuity. Here's what often gets missed: you need historical data. If the business has been sending emails through the seller's Mailchimp account, you need to export the complete contact list with engagement history. If the business has Google Analytics installed, you need to transfer property ownership AND download historical data before the seller revokes access.

Some data export procedures are simple. Others require formal requests to third-party platforms. Plan for 2–4 weeks of data export procedures running in parallel with other closing activities.

The worst-case scenario: you close the acquisition, then discover you can't export customer data from the seller's account because the seller is unreachable or unwilling. You now own a business but don't have customer contact information. This has happened. Plan around it.

IP Transfer Checklist: The Actual Document You'll Use

Theory is worthless without implementation. Here's the checklist that actually works. Print this. Use it. Check off every item before you close.

  1. Domain Ownership & Transfer — Verify seller owns all domains the business uses. Request authorization codes from current registrar. Confirm no domains are locked and at least 60 days past registration date. Export complete DNS configuration. Plan DNS cutover strategy.
  2. Cloud Infrastructure Access — Verify AWS, Google Cloud, Azure, or DigitalOcean account owner is company email, not founder's personal email. Confirm your credit card is primary payment method. Rotate all API keys. Verify no hardcoded credentials remain in code. Change all database passwords.
  3. Code Repository Ownership — Request GitHub/GitLab repository transfer to company-controlled account. Remove founder's personal email from repository. Export complete code backup including all commit history. Verify no active backdoors or secondary accounts. Remove founder's SSH keys.
  4. Trademark & Brand IP — Search USPTO and international trademark databases for similar marks. Request proof of trademark ownership (registration certificate if it exists). If trademark is registered personally, require written assignment. Create plan for formal trademark assignment post-closing. Check for trademark applications from competitors in your expansion markets.
  5. Copyright & Content Assets — Audit all major content pieces to identify ownership (company-created vs. contractor vs. licensed). Request written copyright assignment from any contractors if needed. Verify all licensed content has active, transferable licenses. Document content where ownership is unclear.
  6. Payment Processors & Revenue Accounts — Create new Stripe/PayPal/Square account under your name 7–10 days before closing. Set up and test integration in staging. Plan cutover to your new account. Request payout of any funds in seller's account. Archive old account.
  7. Email & Communication Accounts — Create business email account (Gmail/Office 365) under company domain. Migrate all email from old account (request forwarding and archive export from seller). Transfer ownership of any Intercom, Help Scout, or similar accounts. Export customer communication history.
  8. Analytics & Monitoring Accounts — Request Google Analytics property transfer (requires access to Google Search Console). Export 12+ months of historical analytics data. Transfer ownership of Mixpanel, Amplitude, or custom analytics. Create admin account in your name for monitoring tools (Sentry, DataDog, New Relic).
  9. SSL Certificates & Security Keys — Verify SSL certificate ownership and expiration date. If certificate is tied to seller's account, request new certificate issued to company email. Export any SSH keys or VPN credentials. Rotate all API keys. Generate new OAuth tokens for third-party integrations.
  10. Hosting & Server Access — Verify hosting provider and account ownership. Request cPanel/admin panel access. Create new admin user account under your name. Change all root/admin passwords. Verify server is responsive and backups are running. Test disaster recovery procedure.
  11. Documentation & Institutional Knowledge — Request complete documentation of all systems, credentials, and processes. Create a transition runbook. Verify seller is available for 2-week post-closing support period. Get written acknowledgment that seller has relinquished all access and claims. File all IP transfer documents with your acquisition records.

This checklist is 11 items. Each item contains 4–6 sub-tasks. Total execution time: 12–18 hours. Total cost: $2,000–$4,000 if you engage a lawyer for trademark transfer and formal IP assignment document. Return on investment: preventing $30K–$80K in friction and liability.

The IP Transfer Document: What Your Lawyer Should Draft

Don't rely on verbal agreements or handshake transfers. You need a formal IP assignment document. This is separate from the purchase agreement and serves as legal proof that IP ownership has transferred.

A basic IP assignment document should include:

Cost for a lawyer to draft this: $1,500–$3,000. Cost for not having it when IP disputes arise: $50,000+. This is not a negotiable item.

Common IP Transfer Failure Modes (And How to Prevent Them)

I've seen these patterns repeat across dozens of acquisitions. They're preventable:

Failure Mode #1: Domain Transfer Stalls Because Seller Doesn't Respond

The domain transfer takes 3–7 days. Email gets lost. The seller goes on vacation. The authorization code expires. Result: 2-week delay while you're trying to run a business.

Prevention: Execute the domain authorization code request and transfer 5–7 days before the actual acquisition close. Have it sitting in your registrar account waiting to be confirmed. On closing day, click "confirm" and it's done.

Failure Mode #2: Cloud Infrastructure Account Is Personal, Billing Is Declining

AWS account is in the founder's name on a personal credit card. After closing, you can't update the billing information. The credit card expires. AWS suspends the account. Your website goes down.

Prevention: Transfer the AWS account to your own email and credit card before closing. Yes, this requires coordination with the seller. If they won't do it, that's a red flag about whether you should buy the business at all.

Failure Mode #3: Email List Is Trapped in Founder's Mailchimp Account

The business has 15,000 email subscribers. The email marketing is done through the founder's personal Mailchimp account. You can't export the list because Mailchimp requires account owner approval.

Prevention: Require email list export as a closing condition. The seller should export it to a CSV file and hand it over during closing. For Mailchimp specifically, request that they add your email as an account owner 48 hours before closing, then you can export directly.

Failure Mode #4: Trademark Is In Founder's Name, Not the Company

The brand name has a federal trademark, but it's registered under the founder's personal name, not the company. You acquire the company, but the founder technically still owns the trademark.

Prevention: Search the USPTO trademark database before making an offer. If the trademark is in a personal name, require a written assignment document transferring it to the company as a closing condition.

Failure Mode #5: Contractor Content Hasn't Been Formally Assigned

The business has a blog with 200 articles. 40% of them were written by a contractor. There's no written work-for-hire agreement. The contractor technically owns their articles and could demand payment for continued use.

Prevention: Audit content ownership before closing. For any content created by contractors, require written copyright assignment from the contractor to the company. This costs $500–$1,500 and prevents $20,000+ in liability.

The Technology Stack Handoff: A Practical Framework

Here's a framework for executing flawless technology transitions. This is where most deals actually fail in practice:

Week -2 (Two weeks before closing): Request complete system documentation. Meet with the seller's team (if there is one) to understand how everything currently operates. Create redundancy: set up your own accounts in all third-party systems, but don't activate them yet.

Week -1 (One week before closing): Execute all account transfers that can happen in parallel. Request domain authorization codes. Request trademark documentation. Export all data from seller-controlled systems. Verify that your backup accounts work and can handle the data load.

Closing Day: Execute the cutover plan. Domain transfer confirmation, payment processor switch, email account migration, hosting account transfer. Do this in a specific order: infrastructure first (domain, hosting, cloud), then customer-facing systems (payments, email), then secondary systems (analytics, marketing automation).

Week +1 (First week after closing): Monitor systems obsessively. Have the seller available for 40 hours of post-closing support. Verify revenue is processing correctly, emails are being sent, and customer access is uninterrupted. Make any necessary adjustments.

Week +2: Complete final integrations and verify everything is stable. Begin executing on your strategic plan to actually build value in the business.

Key Takeaways: The Non-Negotiables for IP Transfer

1. IP Transfer Failures Are Preventable. They're not technical problems. They're planning problems. A 15-hour investment in IP transfer planning prevents $30K–$80K in operational chaos and legal risk.

2. Domain Ownership Is Binary. Either you own it, or you don't. Same with cloud infrastructure, code repositories, and trademarks. There's no middle ground. If the seller won't clearly transfer something, the acquisition has a fundamental problem.

3. Use the Checklist. The 11-item checklist above works because it's been tested across hundreds of deals. Print it. Customize it for your specific business. Use it on every acquisition. Executives who skip checklists are the same executives who inherit technical disasters.

4. Require Written Proof. Screenshots of registrar accounts, trademark registration certificates, assignment documents—these are your insurance policy. If disputes arise, you have evidence of what was

About the Author: Sophal Lanh is the founder of Deal Alert AI, a platform that tracks and scores 100+ online business listings daily across Empire Flippers, Flippa, Acquire.com, and Quiet Light. He built Deal Alert AI after spending years analyzing online business acquisitions and missing time-sensitive deals. Learn more →

Find & Score Deals Instantly

Deal Alert AI scans Empire Flippers, Flippa, Acquire.com and more — scoring every listing so you don't have to.

Analyze a Deal Free →

Browse Live Listings on Empire Flippers

One of the top marketplaces for vetted online businesses. New deals added daily.

Browse Listings →

Related Articles

Non-Compete Agreements in Online Business Sales
Online Business Broker Fees Explained (2026) — Who Charges What
Founder Dependency Risk: How to Evaluate Key-Person Risk Before Buying an Online