AS | Ankit Sarawagi|Founder, CFOmatrix·June 2026·15 min read | Updated Jun 2026 |
- Due diligence verifies your claims. The investor checks that the numbers are real, taxes are paid, and the company truly owns its assets and IP (intellectual property) before money moves.
- There are three core streams: financial, tax and legal. Each examines a different part of the business and produces its own findings.
- A typical venture round runs four to eight weeks from signed term sheet to closing, usually inside the exclusivity period. A clean data room can halve that.
- Findings do not disappear. They become reps and warranties, disclosures, indemnities, price adjustments and conditions precedent in the SSA.
- The best defence is self-diligence before you sign. Use a standard checklist to find your own red flags first (we offer free India, US and UAE checklists).
| 3 Core diligence streams: financial, tax and legal | 4-8 wks Typical time from signed term sheet to closing for a venture round | 30-60 d Usual exclusivity / no-shop window diligence runs inside |
To keep this concrete we will follow one company: Brewly, a D2C coffee brand at ₹15 crore revenue raising a ₹40 crore Series A from a lead institutional investor. We will use Brewly to show how each diligence stream works and how its findings reshape the deal.
What Due Diligence Is and Why Investors Do It
Due diligence is the investigation an investor or acquirer runs on a startup before putting money in or buying it. Its job is simple: verify that the business is what the founders say it is. That the revenue is real and collectible, the taxes are paid, the company legally owns its assets and intellectual property, the cap table is clean, and there are no hidden liabilities waiting to surface after the cheque clears.
Diligence almost always starts after a term sheet is signed, not before. The term sheet sets the price and headline terms on the assumption that everything the founder has said is true. Due diligence tests that assumption. If reality matches the story, the deal closes on the agreed terms. If it does not, the terms change.
Investors and acquirers run diligence for three reasons:
- To confirm value. A valuation is built on numbers. If the numbers cannot be verified, the valuation is not safe.
- To find risk. Unpaid taxes, missing IP assignments, pending litigation, or a contract that terminates on a change of control can all destroy value after closing.
- To allocate that risk. Whatever diligence finds becomes a negotiation point: who carries the risk, at what price, and under what protection.
Diligence is not an accusation. Even the cleanest company gets diligenced, because the investor has a duty to their own fund and limited partners. Treat it as a professional, expected step, and the calmer and more prepared you are, the more confidence it builds.
The Three Streams: Financial, Tax and Legal
Due diligence runs across three core streams that examine different parts of the business: financial, tax and legal. They usually happen in parallel, run by different specialists, and each produces its own findings. Larger or specialised deals add technology, commercial, HR or environmental diligence on top, but for a startup raise these three are the backbone.
Financial due diligence: are the numbers real?
Financial due diligence verifies the quality and reliability of your financials. It is not a re-audit; it is a test of whether the numbers tell the truth. Reviewers look at revenue recognition and quality of earnings, gross and contribution margins, cash and bank reconciliations, working capital, debt, and the credibility of your forecast. For Brewly, this means confirming that ₹15 crore of revenue is genuine sales (not channel stuffing or returns sitting unbooked), that the unit economics hold, and that the cash in the bank matches the books.
Tax due diligence: is everything paid and provided for?
Tax due diligence checks that the company has met its tax obligations and has no nasty contingent liabilities. It covers direct tax (corporate income tax) and indirect tax (GST in India, VAT in the UAE, sales tax in the US), withholding (TDS in India), transfer pricing on cross-border transactions, and any open assessments or notices. For Brewly, a reviewer would test GST filings, TDS deduction and deposit, and whether any past period is under-provided. Unpaid or under-provided tax is one of the most common deal-changing findings.
Legal due diligence: who owns what, and what could go wrong?
Legal due diligence confirms the company is properly formed, fully owns what it claims, and is not carrying legal landmines. It examines incorporation and corporate records, the cap table and share issuances, material contracts (and their change-of-control clauses), intellectual property ownership and assignments, employment and contractor agreements, litigation, and regulatory and licensing compliance. A classic startup gap: the founders or early contractors never formally assigned their IP to the company.
| Stream | Key question | What it examines |
|---|---|---|
| Financial | Are the numbers real? | Revenue quality, margins, cash, working capital, debt, forecast |
| Tax | Is everything paid and provided for? | Corporate tax, GST/VAT/sales tax, TDS, transfer pricing, notices |
| Legal | Who owns what, what could go wrong? | Incorporation, cap table, contracts, IP, employment, litigation, licences |
Financial = is it real. Tax = is it paid. Legal = is it ours. Three questions, three streams. Each of these has its own deep-dive in this series, with a downloadable checklist.
The Due Diligence Process and Typical Timeline
The due diligence process is a predictable sequence: a term sheet triggers it, a request list defines it, a data room feeds it, and the findings reshape the deal. Here is how it runs from start to close, step by step.
The seven steps of a typical diligence process
- Sign the term sheet and trigger exclusivity. Diligence begins once the term sheet is signed. The no-shop or exclusivity clause gives the investor a window (often 30 to 60 days) to complete the work.
- Receive the request list. The buy side sends a checklist of documents across finance, tax and legal. This defines what your data room must contain.
- Populate the data room. You upload and index everything into a virtual data room (VDR) with controlled access.
- Run the three streams in parallel. Financial, tax and legal advisers review, raise follow-up questions, and hold management calls.
- Receive the findings. Each stream produces a report. Material issues (red flags) are escalated.
- Negotiate findings into the agreement. Findings become reps, warranties, disclosures, indemnities, price adjustments and conditions precedent in the SSA.
- Satisfy conditions precedent and close. You clear any pre-closing conditions, sign the definitive agreement, and the deal closes and funds.
| Deal type | Typical diligence timeline | Depth |
|---|---|---|
| Seed round | 2 to 3 weeks | Light: cap table, key contracts, basic financials |
| Series A / B | 4 to 8 weeks | Full three-stream review by advisers |
| Growth / M&A | 2 to 4 months | Deep, often adds tech, commercial and HR streams |
The single biggest driver of timeline is not the deal size, it is your preparation. When Brewly handed over a complete, indexed data room on day one, diligence closed in five weeks instead of the ten the lawyers had budgeted. Every day you save in diligence is a day less your money sits outside the bank, and a day less the deal can wobble.
The Data Room: Where Diligence Actually Happens
A data room is a secure, organised repository where you store every document an investor or acquirer needs to review during diligence. Today it is almost always a virtual data room (VDR): a cloud platform with controlled access, granular permissions, a clear index, and an audit log of who viewed what and when. The data room is the heart of diligence: it is where the reviewers live for several weeks.
A well-built data room is the single biggest thing a founder can control to make diligence faster and calmer. Organise it by workstream so each adviser finds their section instantly:
| Data room folder | What goes in it |
|---|---|
| Corporate | Incorporation docs, MOA/AOA or charter, board and shareholder resolutions, statutory registers |
| Cap table & financing | Cap table, prior SSAs/SHAs, ESOP plan and grants, convertible notes/SAFEs |
| Financial | Audited and management accounts, MIS, bank statements, the financial model |
| Tax | Tax returns, GST/VAT filings, TDS challans, assessment orders, notices |
| Contracts | Customer, supplier, lease and partnership agreements (flag change-of-control clauses) |
| IP | Trademarks, patents, IP assignment deeds from founders and contractors |
| People | Employment agreements, offer letters, contractor contracts, HR policies |
| Compliance & litigation | Licences, registrations, regulatory filings, any litigation or disputes |
A messy, half-empty data room reads as a warning sign even when nothing is actually wrong. Reviewers extrapolate: if the documents are disorganised, they assume the business is too, and they dig harder. Never dump files in a single folder, never share a personal Google Drive with no access control, and always keep a master index that maps each request-list item to its document.
How to Prepare for Due Diligence (Pre-DD)
The best time to prepare for due diligence is before you sign a term sheet, not after. Once the clock starts, you are reacting; the founders who sail through are the ones who ran their own diligence months earlier and fixed the problems quietly. This is the highest-leverage thing in this entire guide.
| Keep the books clean and current |
Reconciled monthly accounts, an audit where required, and a credible model. If your numbers are six months behind, fix that first; nothing else matters until they are current.
| Close tax and compliance gaps early |
File and pay on time, sort out any open GST, TDS, VAT or corporate tax issues, and provide for known exposures. A small unpaid tax found in diligence often becomes a large indemnity or escrow.
| Get the legal house in order |
A clean cap table, signed copies of every material contract, and IP assignments from all founders and contractors. The IP assignment gap is the most common avoidable legal red flag.
| Run a self-diligence with a checklist |
Diligence yourself with the same checklist the investor will use, so you find the red flags first and can fix or disclose them on your terms. We provide free finance, tax and legal due diligence checklists for India, the US and the UAE for exactly this.
A problem you disclose proactively is a negotiation; a problem the investor finds is a credibility hit. The same unpaid ₹8 lakh of TDS costs you far more in trust and leverage if it surfaces in their report than if you flag and fix it before they ask.
From Findings to the Term Sheet and SSA
Due diligence findings do not just sit in a report; they flow directly into the deal terms. This is the part founders underestimate. Whatever diligence finds gets converted into legal protection for the investor inside the definitive agreement, usually the Share Subscription Agreement (SSA). Here is how each kind of finding lands.
| Mechanism | What it does |
|---|---|
| Representations & warranties | Formal statements that the diligenced facts are true (taxes paid, IP owned, no undisclosed litigation). If false, the founder is on the hook. |
| Disclosure schedule | Where you list the exceptions to those warranties. A known issue, once disclosed, cannot later be claimed as a breach. |
| Indemnity (cap, basket, de minimis) | A promise to reimburse the investor for specific losses, limited by a cap (maximum), a basket (threshold before claims start) and a de minimis (minimum claim size). |
| Price adjustment / escrow | A finding can cut the price or park part of it in escrow until a risk clears. |
| Conditions precedent (CP) | Things that must be fixed before closing: regularise a filing, obtain a consent, complete an IP assignment. |
Brewly worked example. Diligence on Brewly surfaced three findings, and each one mapped to a different mechanism:
- Unpaid TDS of ₹8 lakh became a condition precedent: deposit it before closing.
- A contractor who built part of the app had never assigned IP. Getting the signed assignment became a condition precedent, and a warranty that the company owns all its IP.
- A possible GST exposure of up to ₹20 lakh on past periods was covered by a specific indemnity with a cap, so the investor was protected if it crystallised.
None of these killed the deal. But each one moved risk from the investor back to the founders, which is exactly why finding them yourself first matters. For the full mechanics of warranties, disclosure schedules and indemnities, see our SSA and SHA deep dive.
“Due diligence does not change what your business is. It only changes who finds out first. The founder who diligences themselves controls the story; the one who waits hands that control to the investor.”
Ankit Sarawagi, CFOmatrixJurisdiction Notes: India, the US and the UAE
The three-stream framework is the same everywhere, but the specific items reviewers focus on differ by country. If you operate across borders, diligence will touch each entity. Here is what changes by jurisdiction.
In India
Indian diligence leans heavily on indirect tax and withholding: GST returns and reconciliations, and TDS deduction and deposit are checked closely. On the legal side, reviewers test FEMA (Foreign Exchange Management Act) compliance on any foreign investment, the validity of past CCPS (Compulsorily Convertible Preference Share) issuances and their pricing, ROC (Registrar of Companies) filings, and historical angel tax positions on prior fundraises. Cap-table cleanliness and statutory registers matter a lot.
In the US
US diligence focuses on corporate housekeeping, especially for Delaware C-corporations: stock issuances, board consents, and 83(b) elections for founder stock. Reviewers scrutinise the cap table and option grants (409A valuations), federal and state tax including sales tax nexus across states, and IP assignment agreements. Employment classification (employee vs contractor) is a recurring area.
In the UAE
UAE diligence centres on licensing and structure: whether the entity is mainland or in a free zone (such as DIFC or ADGM), the validity of the trade licence, and ownership structure. On tax, reviewers check VAT registration and filings and the newer corporate tax regime, plus economic substance requirements where relevant. Documentation is often lighter than India or the US, so contract completeness gets extra attention.
If you run a cross-border structure (say an India operating company under a US or UAE holding company), expect diligence on both entities and on the flows between them: transfer pricing, intercompany agreements and the legitimacy of the holding structure itself. Our downloadable checklists are split by jurisdiction so you can run each entity separately.
Frequently Asked Questions
What is due diligence in a startup?
Due diligence is the investigation an investor or acquirer runs on a startup before putting money in or buying it. It verifies that the business is what the founders claim: that the numbers are real, the taxes are paid, the company owns its assets and IP, and there are no hidden liabilities. It usually runs across three streams, financial, tax and legal, and starts once a term sheet is signed.
What are the three types of due diligence?
The three core streams are financial due diligence (revenue quality, margins, cash, working capital and the forecast), tax due diligence (direct and indirect tax compliance, exposures and contingent liabilities), and legal due diligence (incorporation, the cap table, contracts, IP, employment, litigation and regulatory compliance). Larger or specialised deals may add technology, commercial, HR or environmental diligence.
How long does startup due diligence take?
For a venture round, due diligence typically takes four to eight weeks from a signed term sheet to closing, often aligned to the exclusivity period. Seed rounds can be lighter and faster, sometimes two to three weeks. M&A and larger growth rounds can run two to four months. The biggest variable is how prepared the company is: a clean, complete data room can cut the timeline in half.
What is a data room in due diligence?
A data room is a secure, organised repository where a startup stores all the documents an investor or acquirer needs to review during due diligence. Today it is almost always a virtual data room (VDR): a cloud platform with controlled access, permissions, an index and an audit log of who viewed what. A clean, well-indexed data room is the single biggest thing a founder can control to make diligence faster.
How do I prepare for due diligence as a founder?
Prepare before you sign a term sheet, not after. Keep your books current and reconciled, file taxes on time, maintain a clean cap table, store signed copies of all material contracts, secure IP assignments from founders and contractors, and close known compliance gaps early. Run a self-diligence using a standard checklist so you find issues before the investor does. CFOmatrix provides free finance, tax and legal due diligence checklists for India, the US and the UAE.
What happens to due diligence findings?
Findings do not just sit in a report. They flow into the definitive agreement, usually the Share Subscription Agreement (SSA). Confirmed facts become representations and warranties, known problems are listed in a disclosure schedule, risks are covered by indemnities (often with caps, baskets and a de minimis), specific items can trigger a price adjustment or an escrow holdback, and unresolved issues become conditions precedent that must be fixed before the deal closes.
What is a red flag in due diligence?
A red flag is a material issue serious enough to change the deal terms, the price, or whether the deal happens at all. Common red flags include revenue that cannot be verified, large unreconciled cash movements, unpaid or under-provided taxes (GST, TDS, VAT or corporate tax), a messy or disputed cap table, missing IP assignments, undisclosed litigation, and key contracts that lack change-of-control consent. Founders should hunt for these themselves before diligence starts.
Timelines, cost ranges and jurisdiction notes are general market guidance for 2026 and vary by deal, stage and country. This is general information, not financial, tax or legal advice. Indian deals involve CCPS, FEMA and pricing rules; US and UAE deals have their own regimes. Have your specific situation reviewed by a qualified adviser.
- The Master Due Diligence Checklist (Free Downloads: India, US & UAE)Due Diligence · CFOmatrix Series
- Due Diligence: The Complete Finance, Tax & Legal GuideDue Diligence · CFOmatrix Series
- SHA, SSA & Term Sheet Explained: The Complete Guide for Indian FoundersSHA · SSA · Term Sheet Series
AS | Founder, CFOmatrix | Finance Strategy & Equity Compliance CFOmatrix is a knowledge platform focused on how finance actually works inside growing companies. Every insight is shaped by real operating experience across startups and growth-stage companies, including cross-border setups. |