Due Diligence

7.1Why buyers investigate — and the five things a finding can become

Recall from Chapter 1 the principle that shapes everything a share buyer does: caveat emptor — let the buyer beware. With narrow exceptions, a seller of shares has no duty to volunteer the bad news. The courts will hold a seller to the promises written into the SPA; they will not conduct the buyer’s investigation for it. Due diligence — universally, DD — is that investigation: the buyer’s structured review of the target before it commits. It is self-help, in a legal system that offers no other kind.

Be clear-eyed about what DD is for: it is not an academic study, and a DD report is not a biography of the target. Every finding is worth exactly the deal consequence it produces — and for any problem DD turns up, there are only five things the buyer can do with it:

1. Fix it before completion. Some problems can simply be cured while the deal is negotiated: a missing filing made, a landlord’s consent obtained, an unsigned IP assignment signed. Cheapest and cleanest, where the problem co-operates.
2. Make it a condition. If the fix takes time or depends on a third party, completion can be made conditional on it happening — the deal signs, but does not complete until the problem is resolved. Regulatory approval, as in Sunrise (clause 5.1), is the classic conditional fix.
3. Cover it with a warranty or an indemnity. Leave the risk with the seller by contract: a warranty where the buyer wants the seller to stand behind a fact, or a specific indemnity. A specific indemnity is a euro-for-euro promise to reimburse a particular identified risk if it materialises.
4. Chip the price. Where the problem is real and reasonably quantifiable — an unpaid tax bill, a needed systems upgrade — reduce the consideration by roughly that amount.
5. Walk away. Rare, but findings do kill deals: fraud, a business operating outside its licence, a liability that swallows the deal rationale. Better to lose the deal costs than buy the problem.

The routes combine freely — one finding might be partly fixed, partly priced and partly indemnified. What a finding must never do is end up nowhere.

7.2The workstreams — and who runs them

“Due diligence” is not one investigation but several, run in parallel by different professionals. On a mid-sized private deal like Sunrise you can expect most of the following:

The workstreams are only as good as the traffic between them. If Calder Fox spots monthly management fees flowing from the Target to Meridian, the lawyers need to know — those payments matter for the locked box and Permitted Leakage. Someone on the buyer side, on Sunrise Priya Nair in corporate development, coordinates the whole exercise and owns the consolidated issues list.

7.3How the process actually works

Scoping. You cannot read everything. A trading business of any size holds thousands of documents, and DD runs for weeks, not years. So the first task is to agree with the client what matters: which workstreams, which risks, and above what size. That last item is the materiality threshold — for example, “review all contracts with an annual value above €250,000, plus the contracts with the ten largest clients”. Notice that the Sunrise SPA uses the same €250,000 line in the seller’s pre-completion covenants (clause 6.2(d)) and in the contracts warranty (paragraph 6.1 of Schedule 3). That symmetry is deliberate: the diligence scope and the contractual protections should describe the same universe of “what matters”, with no gap between them.

The data room. The seller does not post documents to each bidder; it opens a virtual data room (VDR) — a permissioned online document library run by a specialist provider. On Sunrise it is hosted by Vaultline Limited under the project name “Sunrise” (see the definition of Data Room in the SPA). Three features matter to you. Structure: the room is organised into numbered folders that mirror the DD request list — corporate, financial, contracts, employment, IP, regulatory and so on — and every document has a number, like 7.4.1. Permissions: the seller controls who sees what; the most sensitive documents may be visible to external advisers only, or opened up late in the process. Watermarking: each page is stamped with the viewer’s name and firm — deterring leaks and evidencing exactly what was available to whom. That evidence matters, because at signing the data room is frozen and archived (on Sunrise, onto USB drives delivered to the Buyer’s Solicitors). Its contents are about to acquire a second legal life, described in section 7.6.

Q&A. Documents raise questions, and the questions go through a formal Q&A process on the data room platform: one consolidated, numbered list of written questions from the buyer’s side, answered in writing by the seller’s side. The discipline is strict — one list, no side-channels — and for good reasons. A written log is an audit trail: everyone sees the same answers, the answers can be checked against the warranties later, and (in an auction) the seller can show all bidders were treated alike. A friendly phone call to the target’s CFO produces none of that — just an unrecorded answer the buyer cannot rely on. And deduplicate before you submit: nothing erodes a seller’s confidence faster than three versions of the same question from three different advisers.

Reporting. Each workstream distils its review into a report, and the first scoping decision is what kind:

Reliance. A DD report is advice, and advice comes with liability — so the report states exactly who may rely on it: the addressee client, and nobody else. Third parties with a genuine need are added by a reliance letter, usually with a cap on the firm’s liability to them. Typically the third party is a bank financing the purchase, or a warranty-and-indemnity insurer where the deal uses W&I insurance (Sunrise does not, but many deals do). If you are ever asked to “just send the report over” to someone new, that is a supervisor question, not a favour.

7.4Legal due diligence — what you will actually review

The legal workstream is where you come in: junior lawyers do the first-pass reading. Here is the standard territory, and what you are looking for in each part of it.

• Corporate records and title to the shares. The constitution, statutory registers and share history of each group company. You are verifying an unbroken chain of title: that the seller really owns all the shares it is selling, free of options, pre-emption rights and charges. Those are the facts warranted in paragraph 1 of Schedule 3. You are also verifying that the group chart matches Schedule 1.
• Material contracts. Contracts above the threshold, plus key customer and supplier agreements. You check term, termination rights, exclusivity, liability caps — and the classic find, the change-of-control clause. In a share deal the target’s contracts do not transfer: the company stays the counterparty, so nothing needs to be novated. But a change-of-control clause gives the counterparty rights — usually to terminate or renegotiate — triggered by exactly what the deal does: change who owns the company. A buyer that misses one can complete on Friday and receive its biggest customer’s termination notice on Monday. Findings here route to outcome one (get consents before completion), outcome two (make consent a condition) or outcome four (price the loss).
• Litigation. Current, pending and threatened claims and regulatory proceedings; past settlements with continuing obligations. Quantify the exposure where you can — the litigation warranty (Schedule 3, paragraph 10.1) will be checked against it.
• Employment and incentives. Senior team service agreements, notice periods and restrictive covenants; bonus and option schemes — especially anything that pays out or vests on a sale; contractor arrangements that might really be employment.
• IP and IT. Does the group actually own what it uses? Founders and contractors who wrote code before proper assignments are a recurring problem. And which company owns it: in Sunrise, the Helia trading platform is owned by Solaris Tech Services sp. z o.o., the Polish subsidiary (Schedule 3, paragraph 7.1). Because the subsidiary is inside the group being bought, that is fine. But had Helia sat in a Meridian service company outside the perimeter, Atlas would be buying a crypto business that does not own its own platform. DD verifies the perimeter, not just the assets.
• Data protection. GDPR compliance, breach history, regulator correspondence, international transfer arrangements — checked against Schedule 3, paragraph 8.1.

A regulated target adds a further layer, and on a fintech deal it is often the layer that decides the deal. Four checks matter most. Licence scope against actual activities: read the authorisation, then look at what the business really does — an activity outside the licence is unauthorised business, a serious breach the buyer inherits. Solaris’s CASP authorisation covers custody, exchange and execution (Schedule 1, Part A); if DD found, say, a live staking product, alarm bells. Regulatory capital: is the firm meeting its requirements, with headroom? AML/CTF systems: policies, the compliance officer’s reports, screening tools, and sample customer files. Regulator correspondence: read every letter between the firm and its supervisor for the last few years. Supervisors write to firms when something is wrong — and the Central Bank of Ireland had written to Solaris.

7.5The document that reshaped the deal

In late May 2026, one of Blackwood & Steel’s associates was re-triaging the late uploads to folder 7.4 of the data room — regulatory correspondence. The associate opened document 7.4.1, a file that had only appeared in the room on 28 May. It was an inspection letter from the Central Bank of Ireland to Solaris dated 6 March 2026. Section 5 of the letter flagged failures in the Target’s automated transaction monitoring between January and September 2024, a backlog of thousands of unreviewed alerts, and required a remediation programme. For an AML-supervised crypto firm, that is not paperwork: it carries the possibility of a fine, a costly alert-by-alert clearance, and awkward reading for the very regulator whose approval the deal needs.

Run the letter through the five outcomes and watch each door close. Fix it before completion? No — remediation would take many months, and the historic monitoring failures cannot be un-happened; the fine risk stays whatever is fixed. Make it a condition? No — a condition that the CBI closes the matter without a fine could leave the deal hanging for years, and Meridian would never sign up to it. Chip the price? The exposure was too uncertain to price: the outcome could plausibly be anywhere from remediation costs alone to a multi-million-euro penalty, and any fixed discount would overpay one side for risk. Walk away? Disproportionate — the deal rationale (the MiCA licence, the platform, the client base) was intact, and the problem was bounded and remediable. That leaves contractual risk transfer — and even there, a warranty alone would not do. The matter was now known and would certainly be disclosed. Section 7.6 explains why disclosure defeats a warranty claim. And warranty damages require proof of loss. What Atlas needed was euro-for-euro cover for a specific, identified risk: a specific indemnity.

So the finding fed straight into the drafting. The letter became a defined term — the “Legacy AML Matter”, defined by reference to the very document the associate found, Data Room document 7.4.1 — and the risk became clause 10.2:

7.6DD and disclosure — two sides of one coin

Now the twist that makes diligence discipline a legal necessity rather than good housekeeping. At signing, the seller delivers a disclosure letter making disclosures against the warranties — and, as is market practice, the Sunrise letter discloses the entire data room generally. The SPA gives that disclosure teeth:

And “Disclosed” means “fairly disclosed in the Disclosure Letter or the Data Room, in each case with sufficient detail to enable a reasonable buyer to identify the nature and scope of the matter disclosed”. Read those two provisions together and the consequence lands: everything the buyer read in the data room — and everything it could have read — is everything it cannot complain about later. If a matter was fairly disclosed there, the warranty is qualified and the claim is gone, whether or not anyone on the buyer’s side actually opened the document. The SPA adds a second lock for matters the deal team actually knew about outside the data room. Under clause 9.6, the seller is not liable for a warranty claim where a member of the Buyer’s Deal Team had actual knowledge of the matter and its likely consequences at signing.

So due diligence and disclosure are the same machine viewed from opposite ends. DD converts unknown risks into known ones; disclosure then converts known risks into the buyer’s risks — unless the buyer does something with the knowledge before signing. That “something” is the five outcomes from section 7.1. It is also why the Legacy AML Matter became an indemnity rather than resting on the regulatory warranties: Schedule 3, paragraph 5.3 even carves the matter out of the warranty expressly. Disclosure gets its full treatment in Chapter 11.

7.7The craft: reviewing well

Finally, technique. First-pass document review is where juniors either build a reputation for reliability or quietly lose one. The habits that separate the two:

Read the index first. Before opening a single document, read the whole data room index. It tells you the shape of what exists — and, just as importantly, what is conspicuously missing. No folder of board minutes for 2024? No regulatory correspondence at all for a supervised firm? Absences are findings too, and they become Q&A questions.

Triage by materiality. Your scope and thresholds tell you where the risk lives. Skim everything in your allocation to classify it; read deeply only what the triage earns. Ten minutes on each of the five contracts that matter beats two minutes on each of twenty-five that do not.

Note as you go, in the agreed template. Every review uses a standard note form — fill it in while the document is open. “I’ll write it up on Friday” is how findings evaporate. And record document references precisely: “Data Room 7.4.1”, never “the CBI letter” — the whole system of definitions, disclosure and indemnities runs on exact references.

Flag, don’t conclude. Your job at first pass is to spot and escalate, not to adjudicate. Never record a speculative legal conclusion in writing — “this is clearly a GDPR breach” — without a supervisor’s sign-off. DD notes get circulated, quoted and sometimes fought over later; a junior’s off-the-cuff conclusion has a way of resurfacing at the worst moment. Describe the facts, flag the concern, ask the question.

Draft report entries in a fixed shape. Issue → facts → why it matters → recommended action. The recommendation should always point at one of the five outcomes.

Keep the Q&A log tidy. One live list, numbered, each question owned by a named reviewer, answers pasted in verbatim with their date. The log is evidence — of what was asked, what was answered and what was never explained — and on a contested deal it will be re-read line by line.

• Confirm scope, thresholds and the report style (red-flag or full-scope) with your supervisor before reading anything
• Read the full data room index first; list what is missing as well as what is there
• Triage your allocation by materiality before deep-reading
• Complete the review template as you read — with precise document references
• Escalate red flags the day you find them, not in the weekly round-up
• Route every finding to one of the five outcomes — and check it reached the SPA drafting team
• Put questions through the formal Q&A only; no side-channel answers
• No written legal conclusions without sign-off

Due diligence tells the buyer what the business is; the next question is what it is worth. On to Chapter 8 and valuation.