UK due diligence, from request list to red flags, in 2026

UK M&A diligence opens the moment heads of terms are agreed. NSI Act mandatory notification and CMA merger control can each pause completion if you miss them before the request list goes out.

UK corporate records sit at Companies House, but that only gives you the surface. Directors, charges, and filed accounts are public. What you really need - board minutes, shareholder agreements, and side letters - is buried in the data room.

A mid-market UK deal generates 3,000-20,000 documents before review closes. Load them into Ellty before the request list arrives and advisors start reviewing on day one.

The NSI Act 2021 brought mandatory pre-closing notification for 17 sensitive sectors. As of March 2026, that list is expanding to 19, adding water infrastructure and standalone semiconductors.

CMA merger control thresholds changed on 1 January 2025. The target UK turnover trigger rose from £70 million to £100 million, with a new hybrid test for companies holding a 33%+ share of supply.

The UK due diligence checklist

Not every workstream carries the same weight. NSI Act notification and CMA clearance are binary - miss them and completion stops.

TUPE and IR35 exposure sit just below that. Both transfer to the buyer in a share deal and rarely show up clearly in the seller's accounts.

Load all workstreams into Ellty before you issue the request list. Legal, tax, and employment teams each get a scoped link and can start the moment access opens.

The full UK due diligence checklist

Ten workstreams, ordered by risk weight. Upload each document category into your Ellty data room before the buyer's request list arrives.

Corporate & legal

• Pull all Companies House filings: confirmation statements, charges register, filed accounts, and PSC register.
• Obtain the shareholders' agreement and all amendments - it rarely matches the filed articles exactly.
• Review board and shareholder minutes for approval of all material transactions in the last 3 years.
• Confirm no undisclosed drag-along triggers, pre-emption rights, or consent requirements at closing.
• Check for any outstanding charges registered at Companies House and confirm discharge status.
• Review the share capital structure for any convertible loan notes, options, or EMI scheme grants.

Financial

• Pull 3 years of statutory accounts filed at Companies House and compare to management accounts.
• Commission a quality of earnings report for any deal above £10M - it repays its cost.
• Check revenue recognition policies and confirm no early or deferred income distortions.
• Review 12 months of bank statements and reconcile against reported turnover figures.
• Confirm no off-balance-sheet obligations: operating leases, guarantees, or director loan accounts.
• Check for any going concern disclosures or auditor qualifications in prior years' accounts.

Tax

• Pull 3 years of corporation tax returns and HMRC correspondence for any open enquiries.
• Confirm R&D tax credit claims are properly documented - HMRC scrutiny has increased significantly.
• Review VAT returns and confirm registration and filing across all applicable jurisdictions.
• Check stamp duty on share deal (0.5% of consideration) vs SDLT on any asset transfer.
• Confirm transfer pricing documentation for any intragroup transactions above de minimis.
• Map group relief positions and confirm no clawback risk on prior tax losses in a share deal.

Employment & labor

• Pull all employment contracts, offer letters, and settlement agreements for key personnel.
• Map all contractor relationships and review IR35 status determination statements (SDSs).
• Confirm auto-enrolment pension compliance and check for any missed contribution periods.
• Review TUPE obligations - on an asset deal, employees transfer automatically with their terms.
• Check for any outstanding Employment Tribunal claims or ACAS early conciliation certificates.
• Confirm no gender pay gap reporting violations or ongoing equal pay exposure for listed targets.

Regulatory & licences

• Map all FCA authorisations and permissions and check each for change-of-control triggers.
• Confirm sector regulator licences (Ofgem, Ofwat, CQC, Ofcom) and their transfer or re-approval process.
• Check for any open FCA supervisory correspondence, skilled person reviews, or enforcement actions.
• Review professional body memberships that require re-registration after a change of control.
• Confirm export control compliance under UK Strategic Export Controls if target sells dual-use goods.
• Check planning permissions and permitted development rights for all operational sites.

NSI Act screening

• Map the target's activities against all 19 mandatory notification sectors under the NSI Act 2021.
• Key sectors: advanced materials, AI, civil nuclear, communications, defence, energy, semiconductors, water.
• Confirm acquisition of more than 25%, 50%, or 75% of shares triggers mandatory pre-closing notification.
• File with the Investment Security Unit before closing - completing without clearance voids the transaction.
• Build 30 working days of NSI review time into the deal schedule from the date of notification.
• Prepare full beneficial ownership disclosure for the acquirer - ISU requires the complete ownership chain.

IP

• Search the UK IPO register for all patents, trade marks, and designs in the target's name.
• Confirm all IP is owned by the company, not by founders or employees personally.
• Review IP assignment agreements in all founder and employee contracts - gaps are common in UK tech.
• Check software licences for open source components and GPL licence compliance.
• Pull all IP licence agreements and review each for change-of-control or assignment restrictions.
• Confirm domain names and social media handles are registered to the company entity.

Material contracts

• Pull all customer and supplier contracts above £50K annual value for change-of-control review.
• Flag Crown Commercial Service or government framework agreements - assignment requires Cabinet Office consent.
• Review all material contracts for termination-on-change-of-control clauses before signing.
• Confirm no exclusivity obligations that would restrict the buyer's commercial freedom post-close.
• Check software and SaaS licences for transferability - enterprise vendors routinely restrict assignment.
• Load all contracts into your Ellty data room before advisors start review.

Real estate & environmental

• Pull all leases and confirm change-of-control provisions - landlord consent may be required.
• Commission a Phase 1 Environmental Site Assessment for owned or formerly industrial properties.
• Check the Environment Agency contaminated land register and any open remediation notices.
• Confirm all planning permissions and building regulations approvals are in place and transferable.
• Review asbestos management registers for commercial properties built before 2000.
• Check CIL (Community Infrastructure Levy) obligations on any development sites.

Data protection & IT

• Pull UK GDPR compliance documentation: ROPA, privacy notices, DPIAs, and breach register.
• Review any ICO correspondence, enforcement notices, or undisclosed personal data incidents.
• Confirm data processing agreements with all third-party processors are in place and current.
• Check whether the target transfers personal data outside the UK - adequacy decisions matter.
• Review IT infrastructure for legacy systems out of support that pose breach risk.
• See our due diligence process guide for how to sequence these workstreams.

How due diligence in the UK works

The legal due diligence guide covers the full document scope. Here is how the buy-side process runs from scope to close.

Step 1: Scope

Define workstream scope before the request list is issued. Confirm immediately whether NSI mandatory notification applies and whether CMA thresholds are met.

Build regulatory timelines into the deal schedule before heads of terms are signed. NSI notification alone adds 30 working days from filing.

Step 2: Request

Issue the request list once the NDA is signed and scope is agreed with the seller. Sellers who load documents into Ellty before the request list arrives cut advisor turnaround time significantly.

Use folder structure by workstream: legal, financial, tax, employment, regulatory, IP, contracts, real estate, data.

Step 3: Review

Legal, financial, and tax workstreams run in parallel to compress the overall timeline. NSI and CMA review run as separate regulatory tracks that don't wait for commercial review to close.

Use Ellty analytics to track which advisors have reviewed which files and where review is lagging.

Step 4: Flag

All findings go into a risk register: dealbreaker, price-adjuster, or standard check. In UK deals, IR35 misclassification, R&D credit overclaiming, and TUPE exposure surface most often.

See our tax due diligence guide for how to structure the tax risk register in a UK deal.

Step 5: Resolve

Clear all dealbreakers before moving to SPA drafting. NSI clearance must be in hand before closing. CMA Phase 1 review runs 40 working days from a complete filing.

Price-adjusters go into the SPA as warranty and indemnity claims or retention mechanics.

What makes UK due diligence different

The NSI Act 2021 is the biggest structural difference for any buyer who hasn't closed a UK deal since 2021. Mandatory notification in 19 sectors applies regardless of whether the acquirer is foreign. Missing it voids the transaction. The ISU's 30-working-day window must be built into the schedule from the start.

TUPE is the second UK-specific trap. On an asset deal, employees transfer automatically with all their existing terms. Buyers who try to harmonise terms immediately post-close face unfair dismissal claims. The liability lands on day one and isn't always visible in the seller's management accounts.

IR35 creates a third category of hidden liability. Medium and large companies are responsible for assessing contractor status. A target with 30 or more contractors needs a full IR35 audit before price is agreed.

The CMA's new hybrid threshold adds a fourth layer. A target with 33%+ share of supply in any UK market plus £350M turnover triggers review even if the £100M turnover test isn't met. Technology and B2B deals are increasingly caught by this route. Use our IP due diligence guide to understand how IP market position is assessed in CMA reviews.

Timeline & cost in the UK

A UK mid-market deal typically runs in three phases. Weeks 1-2 cover initial scope: Companies House searches, NSI sector mapping, CMA threshold analysis, and data room setup. Legal cost: £5,000-£15,000 for initial corporate and regulatory screening.

Weeks 2-6 cover parallel workstream review. QoE, legal review, tax audit, employment IR35 assessment, and IP searches all run concurrently. NSI notification is filed at week 2 and runs its 30-working-day clock in the background. QoE and tax advisory fees: £20,000-£80,000 for mid-market deals.

Weeks 6-10 handle resolution. NSI clearance arrives (assuming no extended review). CMA Phase 1 runs if triggered (40 working days from a complete filing). W&I insurance premiums typically run 0.9-1.5% of insured limit.

Legal fees for buy-side UK counsel on a mid-market deal: £50,000-£250,000. Stamp duty on a share deal: 0.5% of consideration, paid to HMRC within 30 days of signing. Total soft costs for a UK mid-market deal: £100,000-£400,000 before success fees. Load documents into Ellty from day one to reduce advisor time and total cost. See our guide on what documents go in a data room for the full upload checklist. Also see our guide for investors for how buy-side teams structure UK deal risk.