Due Diligence Guide

How Long Does Due Diligence Take for an Online Business?

Updated July 2026 · 9 min read · Deal Alert AI

Standard exclusivity periods on online business acquisitions run 30 days. Some sellers push for 21. A few allow 45. What matters isn't how long you have — it's knowing exactly what to do in each week so nothing gets missed and nothing drags past the deadline.

This guide breaks the 30-day due diligence window into four phases, tells you what to accomplish each week, and identifies the two most common causes of deals falling apart.

The most important rule: Start SBA paperwork on day one of exclusivity — don't wait for due diligence to finish. Run them in parallel. SBA takes 30–45 days from complete application. If you wait until day 20 to apply, you'll blow through closing on a business that may have already been re-listed.

The 30-day due diligence timeline

Days 1–3

Document Request & Revenue Verification

Send a formal document request list on day one. What you need: 3 years of P&Ls, 3 years of tax returns, last 12 months of bank statements, payment processor statements (Stripe/PayPal/Shopify), Google Analytics or equivalent access. Cross-reference stated revenue against payment processor originals. A mismatch of more than 5% ends the deal.

Days 4–7

Traffic & SEO Audit

For content sites: verify organic traffic trend in Ahrefs or SEMrush. Confirm Google Search Console access. Look for: sudden traffic spikes that precede the listing date (sellers list after a peak), manual penalties, thin content, or AI-generated content that may trigger future updates. For SaaS: verify lead sources and organic vs. paid split.

Days 8–14

Customer & Revenue Quality Review

Request customer distribution by revenue. Flag any customer over 15% of total. For SaaS: calculate monthly churn from cohort data. For ecommerce: check repeat purchase rate and refund rate. For content: check affiliate commission history and confirm rates haven't changed. Request any correspondence with top customers or affiliate partners.

Days 15–21

Legal, IP & Tech Review

Confirm IP ownership: who owns the domain, the code, the trademarks, the content? All should be in the seller's name, transferable. Check for any pending legal disputes, DMCA claims, or trademark conflicts. For SaaS: review code ownership, any open-source licenses that restrict commercial use, and third-party API dependencies with transfer restrictions.

Days 22–30

Final Verification & Closing Prep

Reconcile any outstanding questions. Confirm SBA application status. Finalize purchase price adjustment based on working capital peg. Have M&A attorney review APA (Asset Purchase Agreement). Prepare asset transfer checklist: domain, hosting, social accounts, payment processor, email list, ad accounts, trademarks.

What causes due diligence to blow past 30 days

The two most common delay sources aren't complexity — they're process failures:

Slow document delivery: Sellers who respond to document requests over weeks instead of days. Set a firm expectation on day one: all documents due within 72 hours of request. If they can't deliver, that's information about how organized the business is.
SBA started too late: Buyers who wait for completed due diligence before applying. SBA underwriting takes time regardless of when you apply. Start the application in parallel — if due diligence fails, you can cancel the SBA application at no cost.

Deal killers to watch for in each week: Week 1: revenue verification gap over 5%. Week 2: organic traffic declining for 3+ months before listing. Week 3: any single customer over 20% of revenue with no contract. Week 4: IP not clearly in seller's name.

The 10 questions every buyer must answer before closing

Does stated revenue match payment processor statements within 5%?
Is organic traffic trending up, flat, or declining over the last 12 months?
What is the monthly churn rate (SaaS) or repeat purchase rate (ecom)?
Does any single customer account for more than 15% of revenue?
Are there any pending legal disputes, DMCA notices, or regulatory issues?
Who currently owns the domain, code, and all content IP?
What contracts require consent to assign on change of control?
What does the seller do weekly that you'll need to take over?
Are there any one-time revenue sources included in the trailing 12 months?
Has the SBA application been submitted and confirmed received?

Free 78-point due diligence checklist Every question organized by priority: revenue, traffic, legal, tech, operations. Use it alongside this timeline to ensure nothing gets missed.

When 30 days isn't enough

For deals above $500K, or where the revenue model is complex (multiple revenue streams, enterprise contracts, international operations), ask for a 45-day exclusivity period in your LOI. Most sellers will accept 45 days if you're clearly moving fast and have your SBA pre-qualification in hand. Frame it not as "I need more time" but as "I want to run a thorough process that protects us both."

Browse verified deals with full financial packages on Empire Flippers — every listing comes with pre-packaged financials, making due diligence significantly faster.