US M&A diligence kicks off the moment the LOI is signed. CFIUS and HSR filings can add months if you don't flag them before the request list goes out.
The US is the deepest M&A market in the world, but that depth adds complexity. Federal and state-level rules stack on top of each other across every workstream.
A mid-market US deal generates 5,000-30,000 documents before review closes. Without a structured data room, advisors waste time hunting files instead of reviewing them.
HSR notification rules changed in February 2025. The new filing requirements are broader - more documents and more deal information than before.
CFIUS review can apply even when the buyer is not foreign. Deals touching critical infrastructure, AI, or semiconductors get flagged regardless of acquirer nationality.
The US due diligence checklist
Not every check carries the same weight in a US deal. CFIUS and HSR exposure can kill or delay closing; tax structure and employment classification gaps usually move price.
Work through dealbreakers first. If HSR applies or CFIUS could flag the deal, those timelines need to be built into your closing schedule before you sign the LOI.
Load your documents into Ellty by workstream before the request list arrives. Legal, financial, and tax advisors each get a scoped link and can start reviewing on day one.
| Area | Documents to pull | US red flag | Tier | |
|---|---|---|---|---|
| Corporate & legal | Corporate & legal | Certificate of incorporation, bylaws, cap table, board minutes | State of incorporation matters - Delaware vs other states affects governance rights | Dealbreaker |
| Financial | Financial | 3y GAAP financials, management accounts, QoE, bank statements | Revenue recognition under ASC 606 frequently inflates top line in SaaS targets | Dealbreaker |
| Tax | Tax | Federal and state returns, IRS correspondence, transfer pricing docs | Multi-state nexus creates hidden income tax and sales tax exposure | Dealbreaker |
| Employment & labor | Employment & labor | Employment contracts, contractor agreements, ERISA plan docs, WARN notices | Worker misclassification (contractor vs employee) carries federal and state tax liability | Dealbreaker |
| Regulatory & licences | Regulatory & licences | Federal and state licences, FCC, FDA, state money transmitter licences | State-level licences often don't transfer on change of control - re-application required | Dealbreaker |
| HSR & merger control | HSR & merger control | Revenue and asset figures to test HSR thresholds, size-of-person test | 2025 HSR rule changes require more documents at filing - build in extra prep time | Dealbreaker |
| CFIUS screening | CFIUS screening | Foreign ownership chain, target business sector, proximity to US gov facilities | AI, semiconductors, critical infrastructure trigger CFIUS review regardless of acquirer | Dealbreaker |
| IP | IP | USPTO patent and trademark filings, copyright assignments, software licences | Open source licence violations (GPL contamination) common in software targets | Price-adjuster |
| Material contracts | Material contracts | Customer contracts, supplier agreements, change-of-control clauses | Government (GSA/federal) contracts contain strict assignment and novation rules | Price-adjuster |
| Real estate & environmental | Real estate & environmental | Phase I ESA, CERCLA liability search, lease assignments | CERCLA Superfund liability can follow the buyer - prior site use matters | Standard check |
| Data protection & IT | Data protection & IT | CCPA/CPRA compliance, state breach notification policies, IT architecture | Multi-state data privacy obligations vary widely - CCPA, VCDPA, CPA all differ | Standard check |
Running due diligence on a US target?
Set up your Ellty data room before the request list lands.
Start free 14-day trialThe full US due diligence checklist
Ten workstreams, ordered by risk weight. Load each folder into Ellty before the request list arrives so advisors start on day one.
Corporate & legal
- Pull the certificate of incorporation, all amendments, and bylaws from the state of formation.
- Confirm Delaware vs other state of incorporation - it affects shareholder rights and M&A governance.
- Review the cap table for convertible notes, SAFEs, warrants, and option pool dilution.
- Check board and shareholder minutes for approval of all material transactions over 3 years.
- Confirm no outstanding stockholder disputes or drag-along/tag-along triggers at closing.
- See our M&A deal types guide for how structure affects what you pull.
Financial
- Pull 3 years of US GAAP financials, audited or reviewed depending on deal size.
- Check revenue recognition under ASC 606 - common issue in SaaS and subscription businesses.
- Review 12 months of bank statements and reconcile against reported revenue.
- Commission a quality of earnings report for any deal above $20M - it earns back its fee.
- Confirm no off-balance-sheet obligations: operating leases, guarantees, or earn-out liabilities.
- See our financial due diligence guide for the full document checklist.
Tax
- Pull 3 years of federal and state tax returns - check which states the target has filed in.
- Map multi-state nexus exposure: economic nexus rules vary widely by state post-Wayfair.
- Review IRS correspondence for open audits, notices of deficiency, or transfer pricing queries.
- Confirm sales tax compliance across all states where the target has economic nexus.
- Model share deal vs asset deal tax treatment before the LOI - asset deals provide step-up but double-tax C-corps.
- 338(h)(10) elections allow asset deal tax treatment on stock deals for S-corps and subsidiaries.
Employment & labor
- Pull all employment contracts, offer letters, and severance agreements for key personnel.
- Identify all contractor relationships and assess misclassification risk under IRS and DOL tests.
- Review ERISA-qualified plans: 401(k), defined benefit, and any unfunded pension obligations.
- Check WARN Act exposure for any recent or planned workforce reductions above 50 employees.
- Confirm no pending NLRB charges, EEOC complaints, or class action employment litigation.
- See our HR due diligence guide for the full employment checklist.
Regulatory & licences
- Map all federal and state licences the target holds and check each for change-of-control triggers.
- Confirm FCC, FDA, FINRA, or other federal agency approvals if the target operates in regulated sectors.
- Check state money transmitter licences - these require re-application in most states on change of control.
- Review state professional licences for any business that requires licensed practitioners.
- Confirm no pending enforcement actions, consent orders, or regulatory investigations are open.
- Confirm export control (EAR/ITAR) compliance if the target sells technology internationally.
HSR & merger control
- Calculate combined US revenues and assets to test whether the 2026 HSR threshold of $133.9M is met.
- Apply the size-of-person test: one party needs $267.8M+ in sales/assets, the other $26.8M+.
- Build 30 calendar days of HSR waiting period into your deal schedule from the filing date.
- Note that 2025 HSR rule changes require broader document production at filing - budget extra prep time.
- Confirm whether state-level merger notification requirements apply alongside federal HSR.
- Prepare 4(c) and 4(d) documents carefully - these are the most scrutinized part of the HSR filing.
CFIUS screening
- Assess whether the acquirer has any foreign government ownership or foreign beneficial interests.
- Identify if the target touches critical technology, infrastructure, or sensitive personal data.
- AI, semiconductors, advanced manufacturing, and critical minerals face heightened CFIUS scrutiny in 2026.
- Mandatory CFIUS filing applies for certain TID US business acquisitions by foreign persons.
- Build 45 days of CFIUS review time into the deal schedule if a filing is required or likely.
- See our acquisition due diligence guide for cross-border deal structure considerations.
IP
- Search USPTO for all patents, trademarks, and pending applications in the target's name.
- Confirm IP ownership sits with the company, not with founders or employees personally.
- Review all inventor assignment agreements and work-for-hire clauses in employment contracts.
- Check software licences for open source components - GPL contamination affects commercial use.
- Confirm domain names, social media handles, and key accounts are registered to the entity.
- Pull all IP licences granted to or by the target and check for change-of-control clauses.
Material contracts
- Pull all customer and supplier contracts above $100K annual value for review.
- Flag every change-of-control, assignment, and termination clause across material agreements.
- Government contracts (GSA schedules, federal prime contracts) require novation - plan early.
- Review SaaS and software licences for transferability - enterprise vendors often restrict assignment.
- Confirm no exclusivity obligations that would restrict the buyer post-close.
- Load all contracts into your Ellty data room before advisors start review.
Real estate & environmental
- Commission a Phase I ESA per ASTM E1527-21 for any owned or formerly industrial property.
- Run a CERCLA Superfund search - prior site owners can still hold liability after sale.
- Confirm all lease assignments are permitted under change-of-control provisions in the lease.
- Check state environmental agency records for open investigations or corrective action orders.
- Review owned real estate for title issues, easements, and encumbrances before closing.
Data protection & IT
- Map which US state privacy laws apply: CCPA/CPRA, VCDPA, CPA, and others by state.
- Pull data processing agreements with all third-party processors and cloud service vendors.
- Review breach notification history and confirm no undisclosed incidents affecting US consumers.
- Check HIPAA compliance if the target handles any protected health information.
- Confirm FTC Act compliance and review any prior FTC consent orders or investigations.
- See our due diligence red flags guide for IT and data issues that derail deals.
How due diligence in the US works
The sell-side due diligence guide covers what sellers prepare. Here is what the buy side runs through, step by step.
Step 1 - Scope the deal
Define scope before the request list goes out - this sets your advisor team and regulatory timeline. For US deals, confirm early whether HSR applies and whether CFIUS review is a realistic risk.
Build regulatory timelines into your scope before you sign the LOI. Missing them costs weeks later.
Step 2 - Issue the request list
Send the request list once NDA is signed and scope is agreed with the seller. Sellers who load documents into Ellty before the request list arrives cut advisor response time significantly.
The 2025 HSR changes mean sellers need to prepare more documents upfront - factor this into your timeline.
Step 3 - Parallel workstream review
Legal, financial, and tax workstreams run in parallel to compress the total timeline. CFIUS and HSR review run as separate tracks - they don't wait for commercial review to close.
Use Ellty analytics to see which advisors have reviewed which files and where review is lagging.
Step 4 - Flag into a risk register
All findings go into a risk register: dealbreaker, price-adjuster, or hygiene item. In US deals, multi-state tax nexus and worker misclassification surface most often in this phase.
Dealbreakers that surface late cost more to resolve than those flagged in the first week of review.
Step 5 - Resolve before signing
Clear all dealbreakers before moving to SPA and conditions precedent negotiation. HSR waiting periods run concurrently with final negotiation - plan closing around the regulatory calendar.
CFIUS approval, if required, must be in hand before closing - there is no workaround.
How to set up your US data room in Ellty.
Upload deal documents before the request list arrives. Each advisor team gets a scoped link to start reviewing on day one.
- 1.Create a data room and upload your deal documentsAdd folders for each workstream: legal, financial, tax, employment, IP. Advisors find what they need without chasing you for files.
- 2.Give each workstream a scoped, secure linkLegal sees contracts. Tax sees returns. No advisor accesses files outside their workstream. Ellty enforces permissions at the link level.
- 3.Track who reviews which documentsSee which advisors opened which files and how long they spent. Spot where questions are forming before they delay your deal.
What makes US due diligence different
HSR is the first US-specific risk most buyers underestimate. The 2025 rule changes added significant document production requirements - deals above $133.9M now take more time and cost more to file.
CFIUS has expanded its remit well beyond foreign government-owned acquirers. Any deal where the target touches AI, semiconductors, critical infrastructure, or sensitive personal data can trigger mandatory review - even for US-to-US deals.
Multi-state tax nexus is the hidden cost that catches out-of-state and foreign buyers. The target may have economic nexus in 20+ states without having filed returns - that liability transfers to the buyer in a stock deal.
Worker misclassification is another trap that shows up in most mid-market deals. A target with 50 contractors reclassified as employees can face years of unpaid payroll taxes, benefits exposure, and state penalties.
In US M&A, the diligence surprises that move price the most are multi-state tax nexus, worker classification, and open source IP contamination. These are not exotic risks - they show up in most mid-market deals.
Timeline & cost in the US
A quick review runs 2-3 weeks for a narrow single-workstream scope. Full-scope mid-market diligence runs 6-12 weeks from data room access to final reports.
Add 30 calendar days minimum for the HSR waiting period if the deal is reportable. CFIUS review adds 30-45 days on top - and can extend further if the committee requests additional information.
Legal fees for buy-side counsel on a US mid-market deal run $150,000-$600,000 depending on complexity. Financial advisory and QoE adds $75,000-$250,000 on top.
Tax advisory and structuring (federal and state) runs $50,000-$150,000 for a mid-market transaction. HSR filing preparation adds $25,000-$75,000 in legal fees alone.
CFIUS counsel costs $50,000-$200,000 for a full voluntary notice filing. Total soft costs for a mid-market US deal land at $350,000-$1M+ before deal-size-linked success fees.
See our guide to M&A due diligence software to understand how a well-organized data room reduces advisor time and total cost.
Run your US deal from one room
Hold financials, contracts and the SPA in one secure, tracked Ellty data room.
Start free 14-day trialCommon questions about due diligence in the US
- An HSR filing is required if the deal value exceeds $133.9M in 2026 and both size-of-person thresholds are met. The waiting period is 30 calendar days from a complete filing.
- CFIUS applies when a foreign person acquires control of a US business. Deals involving critical technology, infrastructure, or sensitive personal data may require mandatory filing.
- Asset deals give buyers a tax basis step-up, which increases depreciation deductions. Stock deals avoid double taxation for sellers but don't provide the same tax benefits to buyers.
- Economic nexus rules mean a target can owe income tax and sales tax in states where it has no physical presence. Buyers inherit unfiled returns and unpaid tax in a stock deal.
- Targets that use contractors who meet the IRS or DOL employee test carry unpaid payroll tax liability. This exposure transfers to the buyer and can run to several years of back taxes.
- Set up your Ellty data room before you send the NDA - ideally when preparing initial materials. Loading documents early means advisors start reviewing on day one of access.
