Due diligence request list in 2026: the 120 documents buyers ask for

A due diligence request list is the buyer's itemized list of every document it wants from the seller, grouped into 8 to 10 workstreams. Buyers ask first for 3 to 5 years of financial statements and tax returns, monthly results, the cap table, material contracts, an employee census, IP assignments, insurance and litigation. Papermark is a secure, modern data room for running that list.

Quick recap

• A due diligence request list is the buyer's document checklist, usually sent within days of the signed letter of intent (LOI).
• A lower middle market deal typically carries 80 to 150 requests; larger or regulated deals often run past 300.
• The list below has 120 items across 8 workstreams: financial (24), tax (12), legal and corporate (16), contracts and commercial (18), HR (14), IP and technology (14), operations and regulatory (8), and insurance, litigation, real estate and environmental (14).
• Lookback periods are usually 3 to 5 years for annual financials and tax returns, and 24 to 36 months for monthly accounts.
• 32 of the 120 items are Week 1 requests. Buyers expect the first delivery within 1 to 2 weeks of the LOI.
• The most common causes of delay are a missing document with no explanation, an unreconciled cap table, and customer contracts with change-of-control clauses nobody flagged.
• A Papermark data room keeps the request list next to the documents, with Open, In progress, Submitted and Completed statuses, on the Data Rooms plan from $99/month.
• The full list is free to download as a CSV.

Most sellers meet the request list for the first time the week after they sign the LOI, and it lands as a spreadsheet with 100 or more rows. This guide gives you the same list in advance, so you can work through it before the buyer's accountants arrive.

Start 7-day data room trial

1. What documents do buyers ask for in due diligence?

Buyers ask for the documents that let them confirm three things: the earnings are real, the company owns what it says it owns, and nothing in the contracts, the workforce or the courts will cost money after closing. In practice that means a due diligence request list covering financial, tax, legal and corporate, commercial, HR, IP and technology, operational and insurance or litigation records.

The request list is the working document of that review. Each row names a document, the period it should cover, and usually the date the buyer wants it by. A buyer's counsel or M&A adviser issues it right after the LOI is signed. Some buyers send a short pre-LOI list of 10 to 20 items first, mainly summary financials and a customer concentration figure, so they can price the offer.

The size of the list follows the deal. A small owner-run business acquired with an SBA loan might see 60 to 80 requests. A lower middle market deal backed by private equity typically sees 80 to 150. Strategic buyers in regulated industries often send 300 or more, because their legal, tax and compliance teams each add their own rows.

What buyers do not ask for is just as useful to know. They rarely want the pitch deck, marketing collateral or long narrative documents early on. They want source records: signed contracts, filed returns, bank statements, board minutes. A summary helps, but only if the source sits next to it.

2. The 15 documents buyers request first

If you only have time to prepare 15 items before the request list arrives, prepare these. They are the documents that decide whether the buyer's model holds, and they show up on almost every M&A due diligence request list in the first week.

The ranking follows how a buyer's team actually works. Financial reviewers start with annual statements and tax returns, because those tie the books to something filed with the government. Then they go to monthly results for trend and seasonality, then customer revenue for concentration. Counsel starts at the same time with the cap table and formation documents, because they need to know who has to sign.

Notice that 8 of the 15 are not financial at all. Sellers usually over-prepare the numbers and under-prepare the paperwork, and the paperwork is where deals slip: a lease that needs landlord consent, a founder who never signed an invention assignment, an option grant without a board approval.

Tab, a Swedish fintech, ran its acquisition by Kivra out of a Papermark data room and closed in 3 to 4 weeks, because the IP, financial and product documents the buyer asked for were ready and permissioned from the start.

3. Financial due diligence requests (24 documents)

Financial requests are the largest block on any due diligence request list, and the one the price depends on. The buyer's accountants, often running a quality of earnings review, want to rebuild your earnings from source data and test every adjustment you made to get to adjusted EBITDA.

The lookback is the detail sellers miss. Buyers want 3 to 5 years of annual statements, but they also want 24 to 36 months of monthly accounts, because a monthly view shows seasonality and the working capital swings that set the peg. If your monthly closes are rough, fix that first. Our guide to financial due diligence covers what the reviewers test.

Each item below shows the lookback and the priority (Week 1, Week 2-3 or Later), which is how a buyer's team usually stages its requests.

• 1.01 Annual financial statements (P&L, balance sheet, cash flow), audited or reviewed (3-5 years; Week 1)
• 1.02 Monthly management accounts (P&L and balance sheet) (24-36 months; Week 1)
• 1.03 Year-to-date financials compared with the prior-year period (Current year; Week 1)
• 1.04 General ledger and trial balance (3 years; Week 2-3)
• 1.05 Bank statements for every account (12-36 months; Week 1)
• 1.06 Revenue by customer, product and geography (3 years; Week 1)
• 1.07 Gross margin by product or service line (3 years; Week 2-3)
• 1.08 Adjusted EBITDA or SDE bridge with support for every add-back (3 years + TTM; Week 1)
• 1.09 Sell-side quality of earnings report, if one exists (Latest; Week 1)
• 1.10 Accounts receivable aging (Current + 12 month-ends; Week 1)
• 1.11 Accounts payable aging (Current + 12 month-ends; Week 2-3)
• 1.12 Net working capital by month (12-24 months; Week 2-3)
• 1.13 Inventory listing, valuation method and reserves (Current + 2 year-ends; Week 2-3)
• 1.14 Deferred revenue and customer deposits (Current + 2 year-ends; Week 2-3)
• 1.15 Debt schedule and loan agreements (Current; Week 1)
• 1.16 Debt-like items: earn-outs, accrued bonuses, unpaid taxes, deferred rent (Current; Week 2-3)
• 1.17 Capex history and fixed asset register (3 years; Week 2-3)
• 1.18 Budget and forecast with assumptions (Current + 1-3 years; Week 2-3)
• 1.19 Budget vs actual comparisons (2-3 years; Later)
• 1.20 Accounting policies, including revenue recognition (Current; Week 2-3)
• 1.21 Auditor management letters and proposed adjustments (3 years; Later)
• 1.22 Related-party transactions (3 years; Week 2-3)
• 1.23 Off-balance-sheet commitments and guarantees (Current; Later)
• 1.24 Payroll summary reconciled to the general ledger (2-3 years; Later)

The add-back bridge (1.08) deserves its own folder. Every add-back you claim needs an invoice, a contract or a payroll record behind it. An add-back without support is usually removed, and at an 8x multiple a $150,000 add-back is a $1.2M price conversation. If you commissioned a quality of earnings report before launch, put it first.

4. Tax requests (12 documents)

Tax requests check two things: that the company paid what it owed, and that the deal structure does not inherit a problem. Unpaid sales tax, payroll tax and state income tax all follow the business, and in a stock sale they follow it completely.

Sales tax nexus is the item that most often surprises sellers of US businesses that sell across state lines. Since the 2018 Wayfair decision, a company can owe sales tax in a state where it has no office. Buyers check. The tax due diligence checklist has the longer version.

• 2.01 Federal income tax returns (3-5 years; Week 1)
• 2.02 State and local income or franchise tax returns (3-5 years; Week 2-3)
• 2.03 Sales and use tax filings and nexus analysis (3-5 years; Week 2-3)
• 2.04 Payroll tax filings (Forms 941, W-2 and 1099 summaries) (3 years; Week 2-3)
• 2.05 Property tax returns and assessments (3 years; Later)
• 2.06 Tax audits, notices and correspondence (5 years; Week 2-3)
• 2.07 Book-to-tax reconciliation and tax provision (3 years; Week 2-3)
• 2.08 Entity classification (S corp election, LLC, C corp) and tax structure chart (Current; Week 1)
• 2.09 Net operating losses and credit carryforwards (All open years; Later)
• 2.10 Transfer pricing documentation (multi-entity or cross-border) (3 years; Later)
• 2.11 Tax sharing and tax indemnity agreements (All; Later)
• 2.12 Foreign filings and permanent establishment exposure (3-5 years; Later)

5. Legal and corporate requests (16 documents)

Legal and corporate requests answer one question: can the people selling actually sell, and who else has to agree? Counsel works from the formation documents to the cap table to the agreements that give someone a veto, a right of first refusal or a drag-along obligation.

The fully diluted cap table is the most common problem item. It has to reconcile to the stock ledger, every option grant has to trace to a board approval, and every SAFE or convertible note has to show how it converts at the deal price. If the cap table and the ledger disagree, counsel stops and asks, and that question can take weeks. See the legal due diligence checklist for what counsel tests.

• 3.01 Certificate of incorporation or articles of organization, with amendments (All; Week 1)
• 3.02 Bylaws or operating agreement (Current; Week 1)
• 3.03 Board and shareholder minutes and written consents (3-5 years; Week 2-3)
• 3.04 Fully diluted cap table (Current; Week 1)
• 3.05 Stock ledger, option and warrant ledger, with grant documents (All; Week 1)
• 3.06 Shareholder, voting and buy-sell agreements (Current; Week 1)
• 3.07 Equity incentive plan and board approval of each grant (All; Week 2-3)
• 3.08 Subsidiaries list and corporate structure chart (Current; Week 1)
• 3.09 Certificates of good standing for each jurisdiction (Current; Later)
• 3.10 Foreign qualifications to do business (Current; Later)
• 3.11 Prior acquisition, merger or divestiture agreements (All; Week 2-3)
• 3.12 Convertible notes, SAFEs and investor rights agreements (All; Week 1)
• 3.13 Shareholder consents the sale needs (drag-along, ROFR, approvals) (Current; Week 1)
• 3.14 Liens, UCC search results and security interests (Current; Week 2-3)
• 3.15 Agreements with owners, family members or affiliates (All; Week 2-3)
• 3.16 Powers of attorney (Current; Later)

6. Contracts and commercial requests (18 documents)

Contracts and commercial requests test whether the revenue survives the change of owner. The buyer reads your top customer and supplier contracts for termination rights, exclusivity and, above all, change-of-control or anti-assignment clauses that let a customer walk when the company is sold.

Customer concentration is the commercial number buyers care about most. A single customer above 10 to 15 percent of revenue usually gets a dedicated question, and above 25 to 30 percent it often changes the structure of the offer, with an earn-out or an escrow tied to that customer. Have the concentration analysis ready, and if a large contract expires soon after closing, try to renew it before you launch. The commercial due diligence guide covers how buyers read the pipeline.

• 4.01 Top 10-20 customer contracts with amendments (Current; Week 1)
• 4.02 Top 10-20 supplier and vendor contracts (Current; Week 1)
• 4.03 Schedule of contracts with change-of-control or anti-assignment clauses (Current; Week 1)
• 4.04 Customer list with revenue and contract term (anonymized before the LOI) (3 years; Week 1)
• 4.05 Customer concentration analysis (top 10 share of revenue) (3 years; Week 1)
• 4.06 Churn, retention and renewal data (2-3 years; Week 2-3)
• 4.07 Sales pipeline and backlog (Current; Week 2-3)
• 4.08 Pricing policies, discounts and rebate agreements (Current; Week 2-3)
• 4.09 Distribution, reseller, agency and franchise agreements (Current; Week 2-3)
• 4.10 Partnership and joint venture agreements (Current; Later)
• 4.11 Non-compete, exclusivity and most-favored-nation clauses (Current; Week 2-3)
• 4.12 Government contracts and related compliance (Current; Later)
• 4.13 Standard terms and conditions and MSA template (Current; Later)
• 4.14 Warranty claims and returns history (3 years; Later)
• 4.15 Customer complaints and disputes log (3 years; Later)
• 4.16 Market analysis and competitive landscape (Current; Later)
• 4.17 Open purchase orders and purchase commitments (Current; Later)
• 4.18 Third-party consents needed to close (Current; Week 2-3)

7. HR and employment requests (14 documents)

HR requests look for three kinds of cost: people the business cannot keep, people who were classified wrongly, and payments the sale itself will trigger. The employee census is the core document. Buyers want role, hire date, location, pay and exempt status for everyone, usually anonymized until the shortlist stage.

Contractor classification is where buyers most often find money. A business that treats long-term, full-time workers as 1099 contractors can owe back payroll taxes and benefits, and buyers price that in. Change-of-control bonuses and retention payments are the other item to surface early, because they come out of the seller's proceeds at closing. The HR due diligence guide goes deeper.

• 5.01 Employee census: role, hire date, location, pay, exempt status (anonymized) (Current; Week 1)
• 5.02 Organizational chart (Current; Week 1)
• 5.03 Employment agreements and offer letters for key employees (Current; Week 2-3)
• 5.04 Contractor list with classification rationale (Current + 3 years; Week 2-3)
• 5.05 Non-compete, non-solicit and confidentiality agreements (Current; Week 2-3)
• 5.06 Benefit plan documents, 401(k) plan and Form 5500 filings (3 years; Week 2-3)
• 5.07 Bonus, commission and incentive plans (Current + 2 years; Week 2-3)
• 5.08 Severance, retention and change-of-control payments (Current; Week 1)
• 5.09 Employee handbook and HR policies (Current; Later)
• 5.10 Accrued PTO and unpaid compensation (Current; Later)
• 5.11 Employment claims, EEOC charges and settlements (5 years; Week 2-3)
• 5.12 I-9 and work authorization compliance (Current; Later)
• 5.13 Union or collective bargaining agreements (Current; Week 2-3)
• 5.14 Layoff history and WARN Act notices (3 years; Later)

8. IP and technology requests (14 documents)

IP and technology requests confirm that the company owns its core asset and that its systems will not leak, break or get sued. For a software or product company this is often the workstream that decides the deal, and the single most important document is the invention assignment agreement signed by every founder, employee and contractor who wrote code or designed product.

Cybersecurity has moved from a side question to a standard request. Buyers now ask for the security policy, the latest penetration test and the incident log, and they ask whether customer data is processed in line with GDPR or CCPA. An open-source inventory matters too, because a copyleft license in the wrong place can force disclosure of source code. See IP due diligence and cybersecurity due diligence for the detail.

• 6.01 Patents and patent applications schedule (All; Week 2-3)
• 6.02 Trademark and copyright registrations (All; Week 2-3)
• 6.03 Domain names and social media accounts (Current; Later)
• 6.04 Invention assignment agreements for founders, employees and contractors (All; Week 1)
• 6.05 Inbound IP and software licenses (Current; Week 2-3)
• 6.06 Outbound licenses granted to others (Current; Week 2-3)
• 6.07 Open-source software inventory and license review (Current; Week 2-3)
• 6.08 IP disputes, infringement claims and cease-and-desist letters (5 years; Week 2-3)
• 6.09 Systems and software architecture overview (Current; Later)
• 6.10 SaaS and software subscriptions list (Current; Later)
• 6.11 Cybersecurity policies and latest penetration test (Current; Week 2-3)
• 6.12 Data breach and security incident log (3-5 years; Week 2-3)
• 6.13 Privacy policies and data processing records (GDPR, CCPA) (Current; Week 2-3)
• 6.14 Disaster recovery and business continuity plans (Current; Later)

9. Operations and regulatory requests (8 documents)

Operations and regulatory requests check whether the business can keep running the day after closing. The key question is transferability: some licenses and permits move with a stock sale but have to be reissued in an asset sale, and a few need regulator approval either way.

The supply chain map is the operational document buyers value most. A single-source supplier with no contract, or a key component from one factory, is a risk the buyer will want to understand before it commits.

• 7.01 Business licenses and operating permits, with transferability (Current; Week 1)
• 7.02 Regulatory filings and agency correspondence (3-5 years; Week 2-3)
• 7.03 Key standard operating procedures (Current; Later)
• 7.04 Supply chain map and single-source suppliers (Current; Week 2-3)
• 7.05 Product certifications and quality audits (3 years; Later)
• 7.06 Anti-bribery, sanctions and export control compliance (3-5 years; Later)
• 7.07 Equipment list with age and condition (Current; Later)
• 7.08 Health and safety records (OSHA logs) (3-5 years; Later)

10. Insurance, litigation, real estate and environmental requests (14 documents)

This last workstream collects the contingent liabilities: claims that have happened, claims that might, and the property the business sits on. Buyers want a litigation summary for 5 years, the insurance schedule with loss runs, and every lease with its assignment clause.

If the deal includes commercial real estate

When the business owns property, or the deal includes buildings it leases out, the request list grows a real estate branch. Expect requests for title policies, surveys, zoning reports, a rent roll and tenant estoppel certificates, plus a Phase I environmental site assessment for any site with industrial history. The real estate due diligence checklist and environmental due diligence guides cover that branch in full.

• 8.01 Insurance policies (general liability, property, D&O, cyber, E&O) (Current; Week 1)
• 8.02 Insurance claims history and loss runs (3-5 years; Week 2-3)
• 8.03 Pending and threatened litigation summary (5 years; Week 1)
• 8.04 Settlement agreements, judgments and consent decrees (5 years; Week 2-3)
• 8.05 Attorney response letters to auditors (3 years; Later)
• 8.06 Real property leases with landlord consent requirements (Current; Week 1)
• 8.07 Deeds and title policies for owned real estate (All; Week 2-3)
• 8.08 Property list with address, use and square footage (Current; Week 2-3)
• 8.09 Phase I environmental site assessments (Latest; Week 2-3)
• 8.10 Environmental permits and compliance reports (3-5 years; Later)
• 8.11 Hazardous materials and remediation history (All; Later)
• 8.12 Rent roll and tenant estoppels (if leased-out property is included) (Current; Later)
• 8.13 Surveys and zoning reports (if real estate is included) (Latest; Later)
• 8.14 Product liability and recall history (5 years; Later)

11. Request list template (free CSV)

A request list only works if both sides read it the same way. That means a stable ID for each row, a priority, an owner on the seller side and a status that changes as documents arrive. The template uses the same 120 rows as this article, with the ID scheme workstream.item so that "request 4.03" means one thing to everyone.

Download the due diligence request list as a CSV. It opens in Excel, Google Sheets or Numbers. Delete the rows that do not apply, add the buyer's extra requests at the end of each workstream, and keep the IDs fixed once the list is shared.

The folder column maps each request to a numbered data room index, so the request list and the folder tree tell the same story. Our data room index template has the matching 13-folder structure, and the data room folder structure guide explains how to number it.

One rule matters more than any column: never leave a request silent. If a document does not exist, mark the row N/A with one sentence explaining why. A blank row reads as something being hidden, and it generates a follow-up question that costs more time than the explanation would have.

12. Worked example: a 112-item request list

Bayline Coatings is a hypothetical industrial coatings distributor with $18M of revenue and $2.6M of adjusted EBITDA, selling to a private equity-backed platform. The LOI is signed on a Friday. On Monday the buyer's counsel sends a request list with 112 items across eight workstreams and asks for the Week 1 items within ten business days.

The owner had spent the previous two months preparing, so 61 items are ready on day one: three years of reviewed statements, tax returns, the cap table, customer contracts and the lease. Those go straight into the data room, each matched to its request row and marked Submitted. Another 29 items are in progress by the end of week one. Most are HR and IP records that live with outside providers, such as the payroll company and the patent attorney.

Three items slip. The largest customer's contract has an anti-assignment clause, which means a consent letter is needed before closing. Two former contractors never signed invention assignments for the mixing process the company patented. And the sales tax nexus analysis does not exist, because the company never did one.

None of the three kills the deal, but each is handled differently because it was flagged early. The customer consent goes on the closing checklist. Counsel drafts confirmatory assignments for the two contractors, and one signs within a week. The nexus study is commissioned in week two, finds a modest exposure in two states, and is covered by a specific indemnity rather than a price cut. By day 30, 104 of the 112 requests are Completed, and the 8 still open are all closing deliverables.

112requests

• Submitted on day one61 · 54%

  Financials, tax, cap table, contracts, lease
• In progress29 · 26%

  HR, payroll and IP records from outside providers
• Open19 · 17%

  Week 2-3 and Later items
• Flagged risk3 · 3%

  Customer consent, IP assignments, sales tax nexus

Worked scenario. Preparing before the LOI meant more than half the list was submitted on day one, and the open items were known risks, not surprises.

13. Common mistakes when answering a request list

The most common mistake is answering by email. Fifty attachments across thirty threads cannot be audited, and three weeks in nobody knows which version of the AR aging the buyer has. Every document should go to one place, against one request ID.

The second is uploading drafts. Once a buyer has seen a draft with different numbers, every later version invites the question of what changed. Upload final versions only. If a document changes, replace it as a new version and say why.

The third is dumping everything at once. Sending 400 files on day one looks cooperative, but it buries the 30 that matter and gives a buyer's team reasons to ask about documents nobody requested. Answer the list, in priority order.

The fourth is sharing sensitive records too early. Customer names, payroll by employee and supplier pricing belong to the final bidder, and often only to a clean team of advisers inside it. Our guide to sell-side due diligence covers staging those releases.

14. Data room for your due diligence request list

A due diligence request list and a data room solve the same problem from two sides. The list says what the buyer needs, and the data room is where it arrives. When the two live in different tools, the seller spends diligence reconciling a spreadsheet against a folder tree. When the list lives inside the data room, each request points at the document that answers it.

Papermark is a secure, fully customizable, and developer-friendly data room for modern dealmakers. It keeps the request list, the documents, the permissions and the analytics in one place, with unlimited data room visitors on every plan.

The request list sits inside the data room, so each row carries a status, an assignee and a due date.

Why you need a data room for a due diligence request list

A buyer's request list changes every week. New rows arrive after the first review, some items get split, others get answered with "N/A". A spreadsheet emailed back and forth always has at least two versions in circulation. A data room for your due diligence request list gives both sides a single current list.

The documents on the list are also the most sensitive files the company has. Payroll, customer pricing and the cap table should be watermarked and scoped to the right people, and you need to know who opened them. If you are still choosing a platform, our comparison of the best virtual data rooms covers pricing and permissions across providers.

Step 1: map the request list to your folder index

Before you upload anything, give each request a folder. Use the numbered index from the data room index template, so request 4.03 lands in folder 5 Contracts and the buyer can find it without asking. Upload with drag and drop, and the folder hierarchy is kept.

Step 2: load the list into the data room and assign each item

Open the data room and click Request List in the sidebar. Use Import to bring in a prepared checklist instead of typing 120 rows, or add requests one by one. Group them into categories such as Financial and Legal, set a due date on each, and assign each item to a visitor group or a specific link. The data room request list is included on the Data Rooms plan, and you can keep several lists in one room, for example one per buyer.

Every request moves through Open, In progress, Submitted and Completed, so both sides see what is outstanding.

Step 3: upload against each request and mark it Submitted

As documents come in, upload them to the mapped folder and move the request to Submitted. The buyer's team reviews and marks it Completed. That status trail replaces the weekly "where are we" call, and export gives you the list with statuses for your own records.

Step 4: restrict sensitive items to the right group

Put payroll detail, customer names and supplier pricing in folders only the final bidder or its clean team can open. Granular permissions are set per link or per group, an NDA can gate the link before any file opens, and dynamic watermarking stamps the viewer's email, IP address and time on every page.

Folder permissions per group keep payroll and customer pricing locked to the final bidder.

Step 5: read the analytics, then archive the record

Page-by-page analytics show which documents each buyer team opened and for how long, which tells you where the next question is coming from. At closing, export the completed request list for the disclosure schedules. On Data Rooms Plus and above, you can also freeze the room into a point-in-time archive.

Page-level analytics show which buyer team is reading which request.

What it costs

The Data Rooms plan is $99/month with a 7-day free trial. It includes the request list, 3 team members, unlimited data room visitors, unlimited data rooms, dynamic watermarking, NDA agreements, granular permissions, a custom domain, and the API, CLI and MCP server for teams that want to build the list programmatically. Data Rooms Plus adds the Q&A module, the audit log, automatic file indexing and data room freeze. AI redaction for removing personal data before upload is on Data Rooms Premium and above. Papermark is ISO 27001 certified and SOC 2 Type II, and it is also open source.

Load your request list into a data room

No credit card required.

FAQ

Related resources

• Papermark data room
• Best virtual data rooms in 2026
• Data room request list feature
• How long does due diligence take?
• Data room index template
• M&A due diligence checklist
• Due diligence Q&A
• Sell-side due diligence
• Due diligence template