The Small-Business Due Diligence Playbook (2026)

Reviewed by the Regalis Capital acquisitions team. Last updated June 2026.

Most deals do not die on price. They die in diligence, when the numbers a seller swore by do not survive a line-by-line look at the bank statements. Due diligence is the part of an acquisition where you stop trusting the listing and start verifying it. This guide gives you the exact checklist: what to pull, what to verify, and the red flags that should make you walk. Run it in order and you will know whether the business is worth what the seller is asking before your money is at risk.

What Is Due Diligence When Buying a Business?

Due diligence is the verification phase, and it typically runs 30 to 45 days inside the 60 to 90 day window between a signed letter of intent and a close (industry aggregators). It is the structured process of confirming that the business you agreed to buy is the business that actually exists: the cash flow is real, the assets are owned free and clear, the contracts transfer, and there are no liabilities hiding off the books.

The letter of intent buys you an exclusivity window to do this work. Use it. The seller's incentive is to keep the picture rosy and the timeline short. Your incentive is to verify everything that matters and to walk if the verified numbers do not match the story. Diligence is the cheapest insurance you will ever buy on a six- or seven-figure decision. See the full due diligence glossary entry for the formal definition.

How Do You Verify the Financials (and Trust the Add-Backs)?

Verifying the financials is the single most important task in diligence, and the most common failure point is the add-backs: sellers inflate SDE, so you should discount a stated cash flow figure by 15% to 50% until every add-back is verified line by line. An add-back is an expense the seller removes from the books to show the business's true earning power. Some are legitimate (a genuine one-time legal fee, the owner's personal car). Many are not (normal operating costs disguised as one-time, or owner pay a new owner-operator will have to replace).

Tie every dollar back to a bank statement

Never value a business on a seller's spreadsheet. Tie the reported revenue and expenses back to source documents: three years of tax returns, three years of bank statements, the profit-and-loss statements, and the general ledger. When the tax return shows less income than the P&L, the tax return is usually the honest number, because that is the figure the seller reported to the government. A large gap between the two is a red flag, not a rounding error.

Strip the add-backs line by line

For each add-back the seller claims, ask one question: will the new owner actually avoid this cost? An owner's above-market salary that a new owner-operator replaces with their own labor is a legitimate add-back. A family member on payroll who does real work is not, because you will have to pay someone to do that job. The add-backs glossary entry breaks down which ones hold up and which get stripped. Discount the seller's stated SDE by 15% to 50% until you have proven each line, and rebuild the cash flow figure from verified numbers only.

What Legal and Lease Items Must You Check?

The lease is the item that quietly kills the most location-based deals, so confirm the remaining term, the renewal options, and whether the landlord will assign or re-sign the lease to you before you spend a dollar on financial diligence. A laundromat or a restaurant with a great P&L and 18 months left on a non-renewable lease is not a business, it is a countdown.

Work through the legal checklist:

• Lease and real estate: remaining term, renewal options, assignment or new-lease terms, rent escalations, and any deferred maintenance you would inherit.
• Liens and UCC filings: a UCC search and a title search confirm the assets are owned free and clear. Liens that survive the sale become your problem in an asset deal.
• Litigation and judgments: open lawsuits, past judgments, and any pending claims against the business or the owner.
• Licenses and permits: which licenses the business holds, whether they transfer to a new owner, and whether the buyer must hold a personal license to operate.
• Contracts and change-of-control clauses: customer contracts, supplier agreements, and franchise agreements that may terminate or require consent on a sale.
• Corporate and tax standing: entity status, payroll-tax and sales-tax filings, and any back taxes owed.

Whether you buy the assets or the entity changes which of these liabilities follow you. An asset purchase generally leaves old liabilities with the seller; a stock purchase carries them forward. The asset vs stock purchase guide walks through which structure protects you and why most SBA acquisitions are asset deals. Use a transaction attorney for this phase. It is not optional.

How Do You Confirm the Revenue Is Real, Not the Seller's Word?

Confirming the revenue is the difference between buying a business and buying a story, and you confirm it by matching reported sales to independent records: merchant-processor statements, sales-tax returns, and bank deposits, not the seller's internal report. A seller can build a P&L that says anything. A credit-card processor statement and a sales-tax filing are much harder to fake, because a third party generated them.

Match three independent records

For a cash-and-card business, pull the merchant-processor statements (the record of every card swipe), the sales-tax returns (filed with the state), and the bank deposit history. These three should agree with the reported revenue and with each other. When card sales plus reported cash do not match the deposits, or when sales-tax filings show a smaller business than the P&L claims, you have found the gap before it cost you.

Test for revenue that walks out the door

Real revenue is recurring and transferable. Ask: what share of revenue is under contract versus one-time? How many customers came back this year who bought last year? Does the revenue depend on the owner's personal relationships, their name on the door, or a handshake with a key referral source? Revenue that leaves when the owner leaves is worth far less than the multiple implies. Test it before you pay for it, and model the financed number in the acquisition calculator.

What Operational and Customer-Concentration Risks Matter?

Customer concentration is the operational risk that sinks the most otherwise-clean deals: if one customer is more than 20% of revenue, the business carries the risk that losing that single account guts the cash flow you are financing against. A business with 500 customers and no single account above 5% is durable. A business where the top client is 40% of revenue is one phone call away from a problem.

Work the operational checklist:

• Customer concentration: the revenue share of the top one, five, and ten customers. Anything above 20% from a single account is a flag.
• Owner dependence: does the business run when the owner is on vacation, or is the owner the salesperson, the key technician, and the relationship? The more the owner is the business, the less transfers.
• Key employees: who actually runs operations, will they stay through a sale, and are they under any retention or non-compete agreement?
• Supplier concentration: is the business dependent on a single supplier or a single piece of irreplaceable equipment?
• Systems and books: are the financials on real accounting software with documented processes, or in the owner's head and a shoebox?

This is where the Regalis three-part vetting comes in. Every deal we evaluate runs through location, operational, and financial vetting before it ever reaches a buyer. The operational vetting is exactly this: how dependent is the cash flow on the current owner, and what walks out the door when they leave?

Do You Need a Quality of Earnings Report?

A Quality of Earnings (QoE) report is a third-party forensic verification of the cash flow, and it typically costs $10,000 to $30,000 for a small business acquisition. It is the professional version of the financial verification above: an accounting firm independently rebuilds the earnings, tests every add-back, and tells you what the business actually earns. For a larger or more complex deal, it is money well spent. For a small, simple, clean-books business, a focused CPA review may be enough.

The table below shows where a QoE earns its cost and where it may be overkill.

Quality of Earnings cost range and use-case guidance for small business acquisitions (Regalis deal-aggregate analysis, 2026).

Whether you commission a full QoE or not, someone has to do this work. The full breakdown of when a QoE pays for itself is in Quality of Earnings: Do You Need One?.

Why Won't the SBA Lend Above What Diligence Supports?

If you finance with an SBA 7(a) loan, the loan proceeds are capped at an independent business valuation from a Qualified Source, and any price above that appraisal must be financed subordinate to the SBA loan (SBA SOP 50 10 8, effective June 1, 2025). Diligence and the appraisal work together: the appraisal puts a financeable ceiling on the price, and your diligence tells you whether even that ceiling is justified by real cash flow.

In plain terms, the lender will not hand you money to overpay. If the agreed price is $700,000 and the independent appraisal comes in at $600,000, the lender finances against $600,000. The gap has to come from a price cut, more buyer cash, or a seller note behind the SBA loan. This is a second set of eyes on the number, and it is one more reason to do your own diligence well: if your verified cash flow is lower than the seller's claim, you want to renegotiate the price before the appraisal, not after.

What Is the Diligence Timeline Inside a 60 to 90 Day Close?

Diligence is not one event, it is a sequence that fits inside the 60 to 90 day close, and the financial and legal work should start the day the letter of intent is signed because they take the longest. The timeline below is the order Regalis runs it.

Representative due-diligence sequence inside a 60 to 90 day small business close (Regalis deal-aggregate analysis, 2026).

Notice that the work overlaps. You do not finish financial diligence and then start legal. The clock is short, so the streams run in parallel, with the attorney on legal while you and your accountant work the numbers. The whole acquisition path from sourcing to close is laid out in The Complete Guide to Buying a Business with an SBA 7(a) Loan.

Frequently Asked Questions

What should I check before buying a business?

Check four areas: the financials (tie revenue to bank and tax records, strip the add-backs), the legal items (lease term, liens, litigation, license transfer), the operations (owner dependence and customer concentration), and the commercial story (is the revenue recurring and transferable). Discount the seller's stated SDE by 15% to 50% until each add-back is verified line by line.

How do I verify a seller's financials?

Never value on the seller's spreadsheet. Pull three years of tax returns, three years of bank statements, the P&L, and merchant-processor and sales-tax records, then make them agree. When the tax return shows less income than the P&L, the tax return is usually the honest number. A large gap between the two is a red flag, not a rounding error.

What is a Quality of Earnings report?

A Quality of Earnings report is a third-party forensic verification of a business's cash flow, typically costing $10,000 to $30,000 for a small business acquisition. An accounting firm independently rebuilds the earnings, tests every add-back, and tells you what the business actually earns. It is worth it on larger, complex, or cash-heavy deals; a clean, simple business may only need a focused CPA review.

How long does due diligence take?

Due diligence on a small business typically runs 30 to 45 days inside the 60 to 90 day window between a signed letter of intent and a close (industry aggregators). Financial and legal review take the longest, so they start the day the LOI is signed. The streams run in parallel: the attorney works the legal items while you and your accountant verify the numbers.

What are red flags when buying a business?

The top red flags are a large gap between the tax return and the P&L, heavy or aggressive add-backs the seller cannot document, customer concentration above 20% from a single account, a short or non-renewable lease, and revenue that depends on the owner's personal relationships. Any one of these can cut the verified cash flow well below the seller's stated SDE.

Do I need a lawyer for due diligence?

Yes. A transaction attorney handles the legal review: the lease assignment, lien and UCC searches, litigation history, license transfers, contract change-of-control clauses, and whether you buy the assets or the entity. That structure decision determines which old liabilities follow you, and it is not a place to save money. Pair the attorney with an accountant for the financial verification.

Ready to Run Diligence the Right Way?

Diligence is where a good price becomes a good deal or a costly mistake. The seller's job is to keep the story clean and the clock short. Your job is to verify everything that matters before your money is at risk.

Regalis Capital reviews upwards of 20,000 deals a month. We source acquisition targets through BizBuySell, brokers, and off-market channels, then run every one through three-part vetting (location, operational, financial) before it reaches you. We pressure-test the cash flow, strip the soft add-backs, verify the revenue against independent records, structure the financing, and run the deal to close.

Start a deal assessment with Regalis Capital to put a target through real diligence before you commit.

About Regalis Capital

Regalis Capital is a buy-side acquisition advisory firm that helps buyers find, value, and close small business acquisitions. Its team reviews upwards of 20,000 deals a month.