Due Diligence
Online Business Due Diligence Template: Complete Framework (2026)
Updated July 2026 · 11 min read · Deal Alert AI
Most first-time buyers approach due diligence reactively — they ask questions as they think of them, and hope they haven't missed anything critical. This template eliminates that problem. Use it as a structured framework: work through each category before submitting an LOI, and you'll rarely be surprised post-close.
When to use this: After you've identified a deal you're interested in and the seller has agreed to share information under NDA. This covers the full verification process — from financials to technical to legal. Estimated time to complete: 3–7 days for a thorough review.
Category 1: Financial verification
The most important category. Revenue claims on listing pages are self-reported — you need to verify against source systems before any number means anything.
Documents to request
36 months of P&L (not 12) Monthly breakdown. Identify seasonality, trends, and any anomalies. Trailing 12-month average tells you nothing about direction.
Bank statements (24 months) Actual deposits, not accounting reports. Cross-reference against P&L line items.
Revenue platform access Direct access to Stripe, PayPal, Amazon Seller Central, Shopify, or whatever the primary revenue system is. Not screenshots — actual account access.
Expense documentation Every line item with backup. Identify all owner add-backs — compensation, personal expenses, one-time costs — and verify each one is legitimate and truly non-recurring.
Tax returns (2 years) Compare to P&L. Significant discrepancies between tax returns and P&L need explanation.
Red flag: Sellers who provide summaries or screenshots but resist direct account access. If the numbers are real, there's no reason not to give you access. Resistance means something doesn't add up.
Category 2: Traffic and SEO verification
For content sites, this is equally important as financial verification. Traffic is the engine — and it can disappear overnight without showing up in your financials for 60–90 days.
Documents and access to request
Google Analytics access (View Only, 36 months) Look at sessions, organic vs paid vs direct, month-over-month trends, and geography. Screenshots are useless — get actual access.
Google Search Console access Check for manual penalties, coverage issues, and keyword ranking trends. Compare with GA organic data.
Ahrefs or Semrush organic profile Run independently — don't rely on seller-provided exports. Check domain rating, referring domains, keyword count, and ranking trends over 24 months.
Traffic source breakdown What % comes from Google? Email? Pinterest? Social? High Google concentration (>70%) is existential risk. Verify diversification claims with GA data.
Backlink audit Any PBN links, link schemes, or mass guest posting? Use Ahrefs' link intersect tool to compare against site history. Spammy backlinks can trigger penalties post-acquisition.
Category 3: Operations and transfer risk
The business needs to run after you take over. This section verifies whether it actually can.
Questions to get answered (call + documentation)
Owner hours per week breakdown What specific tasks does the owner do, and how many hours does each take? Not the headline number — the actual breakdown by task.
Team documentation List every contractor, VA, or employee. Their hourly rate, hours per week, tasks they handle, and whether they're committed to staying post-sale.
SOP access Request the operations manual or SOPs. If they don't exist, ask the seller to document the key processes as part of the transition agreement.
Tool and software list Every subscription with cost, purpose, and whether it's transferable. Some tools are seat-based or require new accounts post-transfer.
Vendor and supplier relationships For FBA and ecommerce: contact suppliers directly to confirm they'll work with a new owner and pricing won't change.
Category 4: Legal and IP verification
This is where first-time buyers most commonly skip steps — and where surprises happen post-close.
Key items to verify
Domain ownership Verify with WHOIS that the seller actually owns the domain(s). Transfer process and timeline should be agreed before LOI signature.
Trademark status Search USPTO (US), EUIPO (EU), and national registries for the brand name and any product names. Is there an existing trademark? Is it included in the sale?
Content ownership Who wrote the content? If it's contractor-created, are there work-for-hire agreements ensuring the business (not the contractor) owns the content?
Affiliate program terms Review each affiliate agreement. Most have change-of-control clauses — some require notification, others allow termination. Confirm all affiliate relationships survive ownership transfer.
Pending disputes or chargebacks Ask the seller to disclose any active disputes, customer complaints, or chargeback history over the past 24 months.
Category 5: The seller call
Documents tell you the numbers. A call with the seller tells you everything else. Schedule at least one 45-minute call before signing any LOI. Key questions:
- Why are you selling, and why now? (The real answer, not the rehearsed one)
- What would you do differently if you were buying this business today?
- What's the thing you're most worried about after the sale?
- Who are the 2–3 customers or clients I should talk to as a reference?
- What's the single biggest operational risk I need to understand before closing?
A seller who's evasive, overly polished, or unwilling to answer direct questions is a red flag regardless of what the documents show.
Timeline: how long should DD take?
For deals under $100K: 3–5 business days is achievable if the seller is responsive. For $100K–$500K: 7–14 days. For $500K+: 14–30 days with a lawyer's involvement. Don't rush — but don't let it drag either. Quality listings go under LOI fast, and excessive DD timelines signal to sellers that the buyer isn't serious.
The one metric that shortcuts DD: Deal Alert's AI scoring pre-screens the 12 most common red flags before you ever contact a seller. If a listing scores below 60, skip it and don't spend a week on DD. If it scores above 80, the upside is real and time spent verifying is time well spent.