A practitioner’s guide to structuring the due diligence process itself, and to the sector-specific and structural risks that determine whether the business you are buying is the business you think you are buying.
This is Part 3 of our Investment Series, following Part 1 (the three legal systems that govern a UAE acquisition) and Part 2 (the architecture of the MOU). This instalment turns to the due diligence process itself, and to the sector-specific and structural risks it should be designed to uncover.
The Due Diligence Roadmap: Timeline, Scope, and the Art of Knowing What to Look For
If the MOU is the opening statement, due diligence is the cross-examination. It is the structured, systematic process by which the buyer verifies the representations made by the seller, uncovers what the seller has not disclosed, and ultimately satisfies itself, or otherwise, that it is paying a fair price for what it is acquiring.
The MOU should set out, at a minimum, a framework for the due diligence process: the categories of information to be provided, the timeline for delivery and review, the format and structure of the data room, and the process for raising and answering queries. The following is a typical timeline for a mid-market transaction:
| Phase | What Happens |
|---|---|
| Data Room Preparation & Kick-Off | Seller populates the virtual data room. Buyer’s advisers prepare due diligence questionnaires. The information protocols letter is agreed, governing how queries will be raised and answered. |
| Active Due Diligence Review | Legal, financial, tax, and operational workstreams run in parallel. Q&A sessions conducted. Management presentations held. Specialist advisers (technical, regulatory, HR, ESG) conduct their workstreams. Site visits take place where relevant. |
| Reports & Red Flag Analysis | Advisers consolidate findings. Red flags, i.e. issues material enough to affect price, structure, or the decision to proceed, are identified and quantified. The buyer and its board consider implications for valuation and deal structure. |
| SPA Negotiation & Completion | Due diligence findings feed into the representations, warranties, and indemnity regime in the SPA. Price adjustments or escrowed amounts may be introduced. Regulatory approvals are pursued. Conditions are satisfied, and the transaction is signed and completed. |
For the seller, time is always the most precious commodity. Every week of open due diligence carries operational risk: key personnel become anxious, clients may sense uncertainty, and management attention is diverted from running the business. A disciplined, well-organised seller who has prepared thoroughly before going to market will not only attract better bids, but will close deals faster and at higher prices. The quality of a seller’s data room is one of the most reliable signals of management quality that a buyer will encounter during the process.
One Size Does Not Fit All: Industry-Specific Due Diligence
The appropriate scope of due diligence is a function of the specific business, its sector, the stage of its corporate lifecycle, and the nature of what is being acquired. The instinct, particularly among less experienced buyers, is to run a standard financial and legal review and treat the exercise as complete. This instinct is frequently, and expensively, wrong. In practice, effective diligence turns on asking the right questions about the target: where value is generated, where risk is concentrated, and what assumptions would fail in a change-of-control scenario. For that reason, the MOU should anticipate and frame these business- and sector-specific questions upfront, rather than defaulting to a generic diligence exercise and hoping the critical issues emerge organically. Some indicative, business-specific examples are set out in the table below.
| Sector / Business Type | Critical Additional DD Workstreams | Key Questions to Answer |
|---|---|---|
| Technology / SaaS | Technical architecture review; IP ownership audit; key developer dependency; cybersecurity posture; data privacy compliance (particularly if processing EU/UK data) | Does the company actually own its codebase? Are key engineers on standard employment contracts, or do they own IP they have developed? What happens if the CTO leaves? |
| Professional Services | Key man & relationship dependency analysis; client contract portability; non-compete review of departing founders; talent pipeline assessment | If the three most senior billers leave, what percentage of revenue walks out with them? Do client contracts survive a change of control, or do they require client consent to transfer? |
| Manufacturing / Industrial | Physical asset and machinery inspection; environmental and H&S compliance; supply chain concentration risk; maintenance records; regulatory certifications | Are the machines in the condition represented? Are there latent environmental liabilities from the site? Is the company reliant on a single supplier who could withdraw access post-acquisition? |
| Financial Services (DIFC/ADGM Licensed) | Regulatory standing and license review; AML/KYC compliance history; DFSA/FSRA correspondence; client complaints register; regulatory capital adequacy | Are there any open regulatory matters? Has the firm received a supervisory letter? What is the status of its license conditions and any pending variations? |
| Retail / Consumer | Lease portfolio review (are leases transferable?); franchise agreement review; inventory valuation; trademark registration status in all markets | Do the store leases survive a change of control? Are the trademarks properly registered? Who are the key franchise counterparties? |
| Healthcare / Pharma | Regulatory license review (DHA/HAAD/MOH); practitioner credential verification; insurance claims history; clinical governance records; controlled substance compliance | Are all practitioners currently licensed and in good standing? Have there been clinical complaints or malpractice claims? Are licenses held in the company’s name, or in individuals’ names? |
The MOU should deal expressly with the mechanics of due diligence, including the allocation of costs and the manner in which any specialist reviews are to be conducted. In particular, it should specify which party bears the cost of technical, environmental, regulatory or other specialist diligence, define the permitted scope of any physical inspection or operational review, and set clear parameters to ensure that such enquiries are proportionate and do not unduly disrupt the day-to-day operations of the business.
Structural Concentration Risks: When Value Does Not Sit Where the Financials Suggest
Beyond sector-specific considerations, buyers should also identify structural features of the target business that may disproportionately influence performance after completion. These risks are often visible in hindsight but under-analysed at the diligence stage, particularly where headline financials are strong. They are not, in themselves, reasons to walk away from a transaction; they are reasons to structure it properly.
Founder and Key-Person Dependency
A recurring feature of founder-led businesses, particularly those built over 10 to 15 years, is acute dependency on a small number of individuals, or solely on the founder. While the business may present as institutionally robust, a material proportion of revenue, client relationships or operational decision-making may in fact sit with the founder personally. This creates obvious execution risk if that individual disengages, retires, or fails to transition effectively post-closing.
Team Concentration Risk
A related, but distinct, issue arises where business performance is disproportionately driven by a single team or function, be it a revenue-generating group, a specialist operational unit, or a technical cohort, rather than the wider organisation. Financial statements may mask this concentration, particularly where overheads are spread evenly but output is not.
Here, diligence should focus on identifying dependency at team level, assessing retention risk, competitive exposure, and the portability of output.
Revenue Concentration and Legacy Client Exposure
Strong historical performance can also conceal risk where revenue is heavily weighted towards a small number of long-standing clients, particularly those secured through legacy relationships rather than repeatable institutional processes. These arrangements may not survive a change of control, whether for contractual, regulatory, or relational reasons.
Other Common Structural Skews
Additional non-sectoral factors frequently encountered include reliance on a critical license or regulatory approval that cannot readily be replicated or substituted, and supplier concentration in critical inputs.
Each requires tailored treatment, but the unifying point remains the same: these risks must be identified early and be worked through at the MOU stage, while the parties still have flexibility to shape the transaction architecture and align expectations on risk allocation. Addressing them early allows the MOU to frame the areas of focus for due diligence and, where appropriate, to anticipate the mechanics by which they may be dealt with post-closing. Following completion of diligence, the manner in which these issues are ultimately addressed will depend on their nature and severity: some lend themselves to pricing adjustments, others to conditionality, deferred consideration, retention arrangements, or bespoke protections in the sale documentation. These tools, and how they are deployed in practice through the SPA, are examined in more detail in Part 4 of this series, which focuses on drafting the definitive transaction documents.
Conclusion
Due diligence is sometimes treated, particularly by buyers eager to close, as a box-ticking exercise that validates a decision already made. Approached properly, it is the opposite: the process by which a buyer discovers whether the business it is negotiating to acquire is the business it believes it is negotiating to acquire.
The risks that matter most in a UAE acquisition are rarely the ones that announce themselves in the headline financials. They sit in the sector-specific detail a generic review will miss, and in the structural dependencies, on a founder, a team, a handful of clients, a single licence, that a strong set of accounts can conceal. Buyers who scope their diligence to the business in front of them, rather than to a standard checklist, are the buyers who price risk correctly and negotiate from a position of genuine knowledge.
The findings of this process do not end with a report. They flow directly into the representations, warranties, indemnities, and pricing mechanics of the Sale and Purchase Agreement, the subject of Part 4 of this series.
This publication does not provide any legal advice and is for information purposes only.