---
title: "Due diligence request list in 2026: the 120 documents buyers ask for"
lang: en
canonical_url: https://www.papermark.com/blog/due-diligence-request-list
last_updated: 2026-10-15
published: 2026-10-15
category: [mergers-and-acquisitions]
author: "Marc Seitz"
summary: "Due diligence request list for 2026: the 120 documents buyers ask for in M&A, by workstream, lookback and priority, plus a free CSV template you can import."
---

# Due diligence request list in 2026: the 120 documents buyers ask for

A due diligence request list is the buyer's itemized list of every document it wants from the seller, grouped into 8 to 10 workstreams. Buyers ask first for 3 to 5 years of financial statements and tax returns, monthly results, the cap table, material contracts, an employee census, IP assignments, insurance and litigation. [Papermark](https://www.papermark.com/index.md) is a secure, modern data room for running that list.

## Quick recap

- A due diligence request list is the buyer's document checklist, usually sent within days of the signed letter of intent (LOI).
- A lower middle market deal typically carries 80 to 150 requests; larger or regulated deals often run past 300.
- The list below has 120 items across 8 workstreams: financial (24), tax (12), legal and corporate (16), contracts and commercial (18), HR (14), IP and technology (14), operations and regulatory (8), and insurance, litigation, real estate and environmental (14).
- Lookback periods are usually 3 to 5 years for annual financials and tax returns, and 24 to 36 months for monthly accounts.
- 32 of the 120 items are Week 1 requests. Buyers expect the first delivery within 1 to 2 weeks of the LOI.
- The most common causes of delay are a missing document with no explanation, an unreconciled cap table, and customer contracts with change-of-control clauses nobody flagged.
- A [Papermark](/data-room.md) data room keeps the request list next to the documents, with Open, In progress, Submitted and Completed statuses, on the Data Rooms plan from $99/month.
- The full list is free to [download as a CSV](https://www.papermark.com/_static/templates/due-diligence-request-list.csv).

Most sellers meet the request list for the first time the week after they sign the LOI, and it lands as a spreadsheet with 100 or more rows. This guide gives you the same list in advance, so you can work through it before the buyer's accountants arrive.

## 1. What documents do buyers ask for in due diligence?

Buyers ask for the documents that let them confirm three things: the earnings are real, the company owns what it says it owns, and nothing in the contracts, the workforce or the courts will cost money after closing. In practice that means a due diligence request list covering financial, tax, legal and corporate, commercial, HR, IP and technology, operational and insurance or litigation records.

The request list is the working document of that review. Each row names a document, the period it should cover, and usually the date the buyer wants it by. A buyer's counsel or M&A adviser issues it right after the LOI is signed. Some buyers send a short pre-LOI list of 10 to 20 items first, mainly summary financials and a customer concentration figure, so they can price the offer.

The size of the list follows the deal. A small owner-run business acquired with an SBA loan might see 60 to 80 requests. A lower middle market deal backed by private equity typically sees 80 to 150. Strategic buyers in regulated industries often send 300 or more, because their legal, tax and compliance teams each add their own rows.

What buyers do not ask for is just as useful to know. They rarely want the pitch deck, marketing collateral or long narrative documents early on. They want source records: signed contracts, filed returns, bank statements, board minutes. A summary helps, but only if the source sits next to it.

## 2. The 15 documents buyers request first

If you only have time to prepare 15 items before the request list arrives, prepare these. They are the documents that decide whether the buyer's model holds, and they show up on almost every M&A due diligence request list in the first week.

The ranking follows how a buyer's team actually works. Financial reviewers start with annual statements and tax returns, because those tie the books to something filed with the government. Then they go to monthly results for trend and seasonality, then customer revenue for concentration. Counsel starts at the same time with the cap table and formation documents, because they need to know who has to sign.

| # | Document | Why the buyer asks | Typical lookback |
| --- | --- | --- | --- |
| 1 | Annual financial statements (P&L, balance sheet, cash flow) | Verify earnings and the trend | 3-5 years |
| 2 | Business tax returns | Tie the books to filed numbers | 3-5 years |
| 3 | Monthly financials, year to date and trailing | Seasonality and current run rate | 24-36 months |
| 4 | Revenue by customer and top-10 customer list | Customer concentration | 3 years |
| 5 | Top customer contracts | Change-of-control and termination rights | Current |
| 6 | Debt schedule and loan agreements | Debt and debt-like items in the price | Current |
| 7 | AR and AP aging | Working capital peg | Current + 12 months |
| 8 | Fully diluted cap table and equity ledger | Who must approve and get paid | Current |
| 9 | Formation documents, bylaws or operating agreement | Authority to sell | All |
| 10 | Real property leases | Landlord consent to assignment | Current |
| 11 | Employee census and key employee agreements | Retention and classification risk | Current |
| 12 | IP registrations and invention assignments | Ownership of the core asset | All |
| 13 | Insurance policies and claims history | Uninsured exposure | 3-5 years |
| 14 | Litigation and regulatory notices | Contingent liabilities | 5 years |
| 15 | Licenses and permits | Transferability to the new owner | Current |

Notice that 8 of the 15 are not financial at all. Sellers usually over-prepare the numbers and under-prepare the paperwork, and the paperwork is where deals slip: a lease that needs landlord consent, a founder who never signed an invention assignment, an option grant without a board approval.

Tab, a Swedish fintech, ran its acquisition by Kivra out of a Papermark data room and closed in 3 to 4 weeks, because the IP, financial and product documents the buyer asked for were ready and permissioned from the start.

## 3. Financial due diligence requests (24 documents)

Financial requests are the largest block on any due diligence request list, and the one the price depends on. The buyer's accountants, often running a quality of earnings review, want to rebuild your earnings from source data and test every adjustment you made to get to adjusted EBITDA.

The lookback is the detail sellers miss. Buyers want 3 to 5 years of annual statements, but they also want 24 to 36 months of monthly accounts, because a monthly view shows seasonality and the working capital swings that set the peg. If your monthly closes are rough, fix that first. Our guide to [financial due diligence](/blog/financial-due-diligence.md) covers what the reviewers test.

Each item below shows the lookback and the priority (Week 1, Week 2-3 or Later), which is how a buyer's team usually stages its requests.

- **1.01** Annual financial statements (P&L, balance sheet, cash flow), audited or reviewed (3-5 years; Week 1)
- **1.02** Monthly management accounts (P&L and balance sheet) (24-36 months; Week 1)
- **1.03** Year-to-date financials compared with the prior-year period (Current year; Week 1)
- **1.04** General ledger and trial balance (3 years; Week 2-3)
- **1.05** Bank statements for every account (12-36 months; Week 1)
- **1.06** Revenue by customer, product and geography (3 years; Week 1)
- **1.07** Gross margin by product or service line (3 years; Week 2-3)
- **1.08** Adjusted EBITDA or SDE bridge with support for every add-back (3 years + TTM; Week 1)
- **1.09** Sell-side quality of earnings report, if one exists (Latest; Week 1)
- **1.10** Accounts receivable aging (Current + 12 month-ends; Week 1)
- **1.11** Accounts payable aging (Current + 12 month-ends; Week 2-3)
- **1.12** Net working capital by month (12-24 months; Week 2-3)
- **1.13** Inventory listing, valuation method and reserves (Current + 2 year-ends; Week 2-3)
- **1.14** Deferred revenue and customer deposits (Current + 2 year-ends; Week 2-3)
- **1.15** Debt schedule and loan agreements (Current; Week 1)
- **1.16** Debt-like items: earn-outs, accrued bonuses, unpaid taxes, deferred rent (Current; Week 2-3)
- **1.17** Capex history and fixed asset register (3 years; Week 2-3)
- **1.18** Budget and forecast with assumptions (Current + 1-3 years; Week 2-3)
- **1.19** Budget vs actual comparisons (2-3 years; Later)
- **1.20** Accounting policies, including revenue recognition (Current; Week 2-3)
- **1.21** Auditor management letters and proposed adjustments (3 years; Later)
- **1.22** Related-party transactions (3 years; Week 2-3)
- **1.23** Off-balance-sheet commitments and guarantees (Current; Later)
- **1.24** Payroll summary reconciled to the general ledger (2-3 years; Later)

The add-back bridge (1.08) deserves its own folder. Every add-back you claim needs an invoice, a contract or a payroll record behind it. An add-back without support is usually removed, and at an 8x multiple a $150,000 add-back is a $1.2M price conversation. If you commissioned a [quality of earnings](/blog/quality-of-earnings.md) report before launch, put it first.

## 4. Tax requests (12 documents)

Tax requests check two things: that the company paid what it owed, and that the deal structure does not inherit a problem. Unpaid sales tax, payroll tax and state income tax all follow the business, and in a stock sale they follow it completely.

Sales tax nexus is the item that most often surprises sellers of US businesses that sell across state lines. Since the 2018 Wayfair decision, a company can owe sales tax in a state where it has no office. Buyers check. The [tax due diligence checklist](/blog/tax-due-diligence-checklist.md) has the longer version.

- **2.01** Federal income tax returns (3-5 years; Week 1)
- **2.02** State and local income or franchise tax returns (3-5 years; Week 2-3)
- **2.03** Sales and use tax filings and nexus analysis (3-5 years; Week 2-3)
- **2.04** Payroll tax filings (Forms 941, W-2 and 1099 summaries) (3 years; Week 2-3)
- **2.05** Property tax returns and assessments (3 years; Later)
- **2.06** Tax audits, notices and correspondence (5 years; Week 2-3)
- **2.07** Book-to-tax reconciliation and tax provision (3 years; Week 2-3)
- **2.08** Entity classification (S corp election, LLC, C corp) and tax structure chart (Current; Week 1)
- **2.09** Net operating losses and credit carryforwards (All open years; Later)
- **2.10** Transfer pricing documentation (multi-entity or cross-border) (3 years; Later)
- **2.11** Tax sharing and tax indemnity agreements (All; Later)
- **2.12** Foreign filings and permanent establishment exposure (3-5 years; Later)

## 5. Legal and corporate requests (16 documents)

Legal and corporate requests answer one question: can the people selling actually sell, and who else has to agree? Counsel works from the formation documents to the cap table to the agreements that give someone a veto, a right of first refusal or a drag-along obligation.

The fully diluted cap table is the most common problem item. It has to reconcile to the stock ledger, every option grant has to trace to a board approval, and every SAFE or convertible note has to show how it converts at the deal price. If the cap table and the ledger disagree, counsel stops and asks, and that question can take weeks. See the [legal due diligence checklist](/blog/legal-due-diligence-checklist.md) for what counsel tests.

- **3.01** Certificate of incorporation or articles of organization, with amendments (All; Week 1)
- **3.02** Bylaws or operating agreement (Current; Week 1)
- **3.03** Board and shareholder minutes and written consents (3-5 years; Week 2-3)
- **3.04** Fully diluted cap table (Current; Week 1)
- **3.05** Stock ledger, option and warrant ledger, with grant documents (All; Week 1)
- **3.06** Shareholder, voting and buy-sell agreements (Current; Week 1)
- **3.07** Equity incentive plan and board approval of each grant (All; Week 2-3)
- **3.08** Subsidiaries list and corporate structure chart (Current; Week 1)
- **3.09** Certificates of good standing for each jurisdiction (Current; Later)
- **3.10** Foreign qualifications to do business (Current; Later)
- **3.11** Prior acquisition, merger or divestiture agreements (All; Week 2-3)
- **3.12** Convertible notes, SAFEs and investor rights agreements (All; Week 1)
- **3.13** Shareholder consents the sale needs (drag-along, ROFR, approvals) (Current; Week 1)
- **3.14** Liens, UCC search results and security interests (Current; Week 2-3)
- **3.15** Agreements with owners, family members or affiliates (All; Week 2-3)
- **3.16** Powers of attorney (Current; Later)

## 6. Contracts and commercial requests (18 documents)

Contracts and commercial requests test whether the revenue survives the change of owner. The buyer reads your top customer and supplier contracts for termination rights, exclusivity and, above all, change-of-control or anti-assignment clauses that let a customer walk when the company is sold.

Customer concentration is the commercial number buyers care about most. A single customer above 10 to 15 percent of revenue usually gets a dedicated question, and above 25 to 30 percent it often changes the structure of the offer, with an earn-out or an escrow tied to that customer. Have the concentration analysis ready, and if a large contract expires soon after closing, try to renew it before you launch. The [commercial due diligence](/blog/commercial-due-diligence.md) guide covers how buyers read the pipeline.

- **4.01** Top 10-20 customer contracts with amendments (Current; Week 1)
- **4.02** Top 10-20 supplier and vendor contracts (Current; Week 1)
- **4.03** Schedule of contracts with change-of-control or anti-assignment clauses (Current; Week 1)
- **4.04** Customer list with revenue and contract term (anonymized before the LOI) (3 years; Week 1)
- **4.05** Customer concentration analysis (top 10 share of revenue) (3 years; Week 1)
- **4.06** Churn, retention and renewal data (2-3 years; Week 2-3)
- **4.07** Sales pipeline and backlog (Current; Week 2-3)
- **4.08** Pricing policies, discounts and rebate agreements (Current; Week 2-3)
- **4.09** Distribution, reseller, agency and franchise agreements (Current; Week 2-3)
- **4.10** Partnership and joint venture agreements (Current; Later)
- **4.11** Non-compete, exclusivity and most-favored-nation clauses (Current; Week 2-3)
- **4.12** Government contracts and related compliance (Current; Later)
- **4.13** Standard terms and conditions and MSA template (Current; Later)
- **4.14** Warranty claims and returns history (3 years; Later)
- **4.15** Customer complaints and disputes log (3 years; Later)
- **4.16** Market analysis and competitive landscape (Current; Later)
- **4.17** Open purchase orders and purchase commitments (Current; Later)
- **4.18** Third-party consents needed to close (Current; Week 2-3)

## 7. HR and employment requests (14 documents)

HR requests look for three kinds of cost: people the business cannot keep, people who were classified wrongly, and payments the sale itself will trigger. The employee census is the core document. Buyers want role, hire date, location, pay and exempt status for everyone, usually anonymized until the shortlist stage.

Contractor classification is where buyers most often find money. A business that treats long-term, full-time workers as 1099 contractors can owe back payroll taxes and benefits, and buyers price that in. Change-of-control bonuses and retention payments are the other item to surface early, because they come out of the seller's proceeds at closing. The [HR due diligence](/blog/hr-due-diligence.md) guide goes deeper.

- **5.01** Employee census: role, hire date, location, pay, exempt status (anonymized) (Current; Week 1)
- **5.02** Organizational chart (Current; Week 1)
- **5.03** Employment agreements and offer letters for key employees (Current; Week 2-3)
- **5.04** Contractor list with classification rationale (Current + 3 years; Week 2-3)
- **5.05** Non-compete, non-solicit and confidentiality agreements (Current; Week 2-3)
- **5.06** Benefit plan documents, 401(k) plan and Form 5500 filings (3 years; Week 2-3)
- **5.07** Bonus, commission and incentive plans (Current + 2 years; Week 2-3)
- **5.08** Severance, retention and change-of-control payments (Current; Week 1)
- **5.09** Employee handbook and HR policies (Current; Later)
- **5.10** Accrued PTO and unpaid compensation (Current; Later)
- **5.11** Employment claims, EEOC charges and settlements (5 years; Week 2-3)
- **5.12** I-9 and work authorization compliance (Current; Later)
- **5.13** Union or collective bargaining agreements (Current; Week 2-3)
- **5.14** Layoff history and WARN Act notices (3 years; Later)

## 8. IP and technology requests (14 documents)

IP and technology requests confirm that the company owns its core asset and that its systems will not leak, break or get sued. For a software or product company this is often the workstream that decides the deal, and the single most important document is the invention assignment agreement signed by every founder, employee and contractor who wrote code or designed product.

Cybersecurity has moved from a side question to a standard request. Buyers now ask for the security policy, the latest penetration test and the incident log, and they ask whether customer data is processed in line with GDPR or CCPA. An open-source inventory matters too, because a copyleft license in the wrong place can force disclosure of source code. See [IP due diligence](/blog/ip-due-diligence.md) and [cybersecurity due diligence](/blog/cybersecurity-due-diligence.md) for the detail.

- **6.01** Patents and patent applications schedule (All; Week 2-3)
- **6.02** Trademark and copyright registrations (All; Week 2-3)
- **6.03** Domain names and social media accounts (Current; Later)
- **6.04** Invention assignment agreements for founders, employees and contractors (All; Week 1)
- **6.05** Inbound IP and software licenses (Current; Week 2-3)
- **6.06** Outbound licenses granted to others (Current; Week 2-3)
- **6.07** Open-source software inventory and license review (Current; Week 2-3)
- **6.08** IP disputes, infringement claims and cease-and-desist letters (5 years; Week 2-3)
- **6.09** Systems and software architecture overview (Current; Later)
- **6.10** SaaS and software subscriptions list (Current; Later)
- **6.11** Cybersecurity policies and latest penetration test (Current; Week 2-3)
- **6.12** Data breach and security incident log (3-5 years; Week 2-3)
- **6.13** Privacy policies and data processing records (GDPR, CCPA) (Current; Week 2-3)
- **6.14** Disaster recovery and business continuity plans (Current; Later)

## 9. Operations and regulatory requests (8 documents)

Operations and regulatory requests check whether the business can keep running the day after closing. The key question is transferability: some licenses and permits move with a stock sale but have to be reissued in an asset sale, and a few need regulator approval either way.

The supply chain map is the operational document buyers value most. A single-source supplier with no contract, or a key component from one factory, is a risk the buyer will want to understand before it commits.

- **7.01** Business licenses and operating permits, with transferability (Current; Week 1)
- **7.02** Regulatory filings and agency correspondence (3-5 years; Week 2-3)
- **7.03** Key standard operating procedures (Current; Later)
- **7.04** Supply chain map and single-source suppliers (Current; Week 2-3)
- **7.05** Product certifications and quality audits (3 years; Later)
- **7.06** Anti-bribery, sanctions and export control compliance (3-5 years; Later)
- **7.07** Equipment list with age and condition (Current; Later)
- **7.08** Health and safety records (OSHA logs) (3-5 years; Later)

## 10. Insurance, litigation, real estate and environmental requests (14 documents)

This last workstream collects the contingent liabilities: claims that have happened, claims that might, and the property the business sits on. Buyers want a litigation summary for 5 years, the insurance schedule with loss runs, and every lease with its assignment clause.

### If the deal includes commercial real estate

When the business owns property, or the deal includes buildings it leases out, the request list grows a real estate branch. Expect requests for title policies, surveys, zoning reports, a rent roll and tenant estoppel certificates, plus a Phase I environmental site assessment for any site with industrial history. The [real estate due diligence checklist](/blog/real-estate-due-diligence-checklist.md) and [environmental due diligence](/blog/environmental-due-diligence.md) guides cover that branch in full.

- **8.01** Insurance policies (general liability, property, D&O, cyber, E&O) (Current; Week 1)
- **8.02** Insurance claims history and loss runs (3-5 years; Week 2-3)
- **8.03** Pending and threatened litigation summary (5 years; Week 1)
- **8.04** Settlement agreements, judgments and consent decrees (5 years; Week 2-3)
- **8.05** Attorney response letters to auditors (3 years; Later)
- **8.06** Real property leases with landlord consent requirements (Current; Week 1)
- **8.07** Deeds and title policies for owned real estate (All; Week 2-3)
- **8.08** Property list with address, use and square footage (Current; Week 2-3)
- **8.09** Phase I environmental site assessments (Latest; Week 2-3)
- **8.10** Environmental permits and compliance reports (3-5 years; Later)
- **8.11** Hazardous materials and remediation history (All; Later)
- **8.12** Rent roll and tenant estoppels (if leased-out property is included) (Current; Later)
- **8.13** Surveys and zoning reports (if real estate is included) (Latest; Later)
- **8.14** Product liability and recall history (5 years; Later)

## 11. Request list template (free CSV)

A request list only works if both sides read it the same way. That means a stable ID for each row, a priority, an owner on the seller side and a status that changes as documents arrive. The template uses the same 120 rows as this article, with the ID scheme `workstream.item` so that "request 4.03" means one thing to everyone.

[Download the due diligence request list as a CSV](https://www.papermark.com/_static/templates/due-diligence-request-list.csv). It opens in Excel, Google Sheets or Numbers. Delete the rows that do not apply, add the buyer's extra requests at the end of each workstream, and keep the IDs fixed once the list is shared.

| Column | What it holds | Example |
| --- | --- | --- |
| id | Workstream and item number, never reused | 4.03 |
| workstream | One of the 8 workstreams | Contracts and commercial |
| document | What the buyer asked for | Contracts with change-of-control clauses |
| lookback | Period the document must cover | 3-5 years |
| priority | Week 1, Week 2-3 or Later | Week 1 |
| owner | Seller-side person who supplies it | Sales lead / counsel |
| status | Open, In progress, Submitted, Completed | Open |
| folder | Data room folder it will live in | 5 Contracts |

The folder column maps each request to a numbered data room index, so the request list and the folder tree tell the same story. Our [data room index template](/blog/data-room-index-template.md) has the matching 13-folder structure, and the [data room folder structure](/blog/data-room-folder-structure.md) guide explains how to number it.

One rule matters more than any column: never leave a request silent. If a document does not exist, mark the row N/A with one sentence explaining why. A blank row reads as something being hidden, and it generates a follow-up question that costs more time than the explanation would have.

## 12. Worked example: a 112-item request list

Bayline Coatings is a hypothetical industrial coatings distributor with $18M of revenue and $2.6M of adjusted EBITDA, selling to a private equity-backed platform. The LOI is signed on a Friday. On Monday the buyer's counsel sends a request list with 112 items across eight workstreams and asks for the Week 1 items within ten business days.

The owner had spent the previous two months preparing, so 61 items are ready on day one: three years of reviewed statements, tax returns, the cap table, customer contracts and the lease. Those go straight into the data room, each matched to its request row and marked Submitted. Another 29 items are in progress by the end of week one. Most are HR and IP records that live with outside providers, such as the payroll company and the patent attorney.

Three items slip. The largest customer's contract has an anti-assignment clause, which means a consent letter is needed before closing. Two former contractors never signed invention assignments for the mixing process the company patented. And the sales tax nexus analysis does not exist, because the company never did one.

None of the three kills the deal, but each is handled differently because it was flagged early. The customer consent goes on the closing checklist. Counsel drafts confirmatory assignments for the two contractors, and one signs within a week. The nexus study is commissioned in week two, finds a modest exposure in two states, and is covered by a specific indemnity rather than a price cut. By day 30, 104 of the 112 requests are Completed, and the 8 still open are all closing deliverables.

## 13. Common mistakes when answering a request list

The most common mistake is answering by email. Fifty attachments across thirty threads cannot be audited, and three weeks in nobody knows which version of the AR aging the buyer has. Every document should go to one place, against one request ID.

The second is uploading drafts. Once a buyer has seen a draft with different numbers, every later version invites the question of what changed. Upload final versions only. If a document changes, replace it as a new version and say why.

The third is dumping everything at once. Sending 400 files on day one looks cooperative, but it buries the 30 that matter and gives a buyer's team reasons to ask about documents nobody requested. Answer the list, in priority order.

The fourth is sharing sensitive records too early. Customer names, payroll by employee and supplier pricing belong to the final bidder, and often only to a clean team of advisers inside it. Our guide to [sell-side due diligence](/blog/sell-side-due-diligence.md) covers staging those releases.

## 14. Data room for your due diligence request list

A due diligence request list and a data room solve the same problem from two sides. The list says what the buyer needs, and the data room is where it arrives. When the two live in different tools, the seller spends diligence reconciling a spreadsheet against a folder tree. When the list lives inside the data room, each request points at the document that answers it.

[Papermark](/data-room.md) is a secure, fully customizable, and developer-friendly data room for modern dealmakers. It keeps the request list, the documents, the permissions and the analytics in one place, with unlimited data room visitors on every plan.

![Papermark data room request list with statuses, assignees and due dates for M&A due diligence](https://www.papermark.com/_static/blog/data-room-request-list.png)

_The request list sits inside the data room, so each row carries a status, an assignee and a due date._

### Why you need a data room for a due diligence request list

A buyer's request list changes every week. New rows arrive after the first review, some items get split, others get answered with "N/A". A spreadsheet emailed back and forth always has at least two versions in circulation. A data room for your due diligence request list gives both sides a single current list.

The documents on the list are also the most sensitive files the company has. Payroll, customer pricing and the cap table should be watermarked and scoped to the right people, and you need to know who opened them. If you are still choosing a platform, our comparison of the [best virtual data rooms](/blog/best-virtual-data-rooms.md) covers pricing and permissions across providers.

### Step 1: map the request list to your folder index

Before you upload anything, give each request a folder. Use the numbered index from the [data room index template](/blog/data-room-index-template.md), so request 4.03 lands in folder 5 Contracts and the buyer can find it without asking. Upload with drag and drop, and the folder hierarchy is kept.

### Step 2: load the list into the data room and assign each item

Open the data room and click **Request List** in the sidebar. Use **Import** to bring in a prepared checklist instead of typing 120 rows, or add requests one by one. Group them into categories such as Financial and Legal, set a due date on each, and assign each item to a visitor group or a specific link. The [data room request list](https://www.papermark.com/data-room-request-list) is included on the Data Rooms plan, and you can keep several lists in one room, for example one per buyer.

![Request list status options Open, In progress, Submitted and Completed in a Papermark data room](https://www.papermark.com/_static/blog/data-room-request-list-status.png)

_Every request moves through Open, In progress, Submitted and Completed, so both sides see what is outstanding._

### Step 3: upload against each request and mark it Submitted

As documents come in, upload them to the mapped folder and move the request to **Submitted**. The buyer's team reviews and marks it **Completed**. That status trail replaces the weekly "where are we" call, and **export** gives you the list with statuses for your own records.

### Step 4: restrict sensitive items to the right group

Put payroll detail, customer names and supplier pricing in folders only the final bidder or its clean team can open. [Granular permissions](https://www.papermark.com/granular-permissions) are set per link or per group, an [NDA](/one-click-nda.md) can gate the link before any file opens, and [dynamic watermarking](/dynamic-watermarking.md) stamps the viewer's email, IP address and time on every page.

![Granular folder permissions per buyer group in a Papermark data room](https://assets.papermark.io/upload/file_LkU4BNY6MKUKMgDucSzzFg-papermark-granular-permissions.png)

_Folder permissions per group keep payroll and customer pricing locked to the final bidder._

### Step 5: read the analytics, then archive the record

[Page-by-page analytics](/document-analytics.md) show which documents each buyer team opened and for how long, which tells you where the next question is coming from. At closing, export the completed request list for the disclosure schedules. On Data Rooms Plus and above, you can also freeze the room into a point-in-time archive.

![Per-visitor document analytics for due diligence documents in a Papermark data room](https://assets.papermark.io/upload/file_YVZLbYwELYa8SxfjBg3mGe-virtual-data-room-analytics-.png)

_Page-level analytics show which buyer team is reading which request._

### What it costs

The [Data Rooms plan](https://www.papermark.com/pricing.md?view=datarooms) is $99/month with a 7-day free trial. It includes the request list, 3 team members, unlimited data room visitors, unlimited data rooms, dynamic watermarking, NDA agreements, granular permissions, a custom domain, and the [API, CLI and MCP server](https://www.papermark.com/agents.md) for teams that want to build the list programmatically. Data Rooms Plus adds the [Q&A module](https://www.papermark.com/data-room-questions-and-answers), the audit log, automatic file indexing and data room freeze. [AI redaction](https://www.papermark.com/ai-redaction) for removing personal data before upload is on Data Rooms Premium and above. Papermark is ISO 27001 certified and SOC 2 Type II, and it is also open source.

_No credit card required._

## FAQ

### What documents do buyers ask for in due diligence?

Buyers ask for 3 to 5 years of financial statements and tax returns, 24 to 36 months of monthly accounts, the cap table and formation documents, material customer and supplier contracts, an employee census, IP registrations and assignments, insurance policies and a litigation summary. A typical lower middle market request list has 80 to 150 items across 8 to 10 workstreams.

### What is a due diligence request list?

It is the buyer's itemized list of documents and information it needs from the seller, grouped by workstream, with a lookback period and often a due date for each row. In a Papermark data room the request list sits next to the documents, with Open, In progress, Submitted and Completed statuses.

### When does the buyer send the due diligence request list?

Usually within a few days of signing the letter of intent. Some buyers send a short pre-LOI list of 10 to 20 items, mostly summary financials and customer concentration, so they can price the offer. First delivery of Week 1 items is typically expected within 1 to 2 weeks.

### How many years of financials do buyers want?

Most buyers want 3 to 5 years of annual statements and tax returns, plus 24 to 36 months of monthly profit and loss and balance sheets. The monthly view is what shows seasonality and sets the working capital peg.

### How many items are on a typical due diligence request list?

Around 60 to 80 for a small business sale, 80 to 150 for a lower middle market deal, and 300 or more for larger or regulated deals where legal, tax and compliance teams each add rows. The template in this article has 120.

### What if I don't have a document the buyer requested?

Mark the request N/A with one sentence explaining why, for example that the company has no owned real estate. Never leave a row blank. In Papermark you can set the item's status and add the explanation in the request's description, so the buyer sees it in the same list.

### Should I share customer names and payroll during due diligence?

Only with the final bidder, and often only with its clean team of advisers. Anonymize customer lists and the employee census before the LOI. Put the named versions in a restricted folder with view-only access and dynamic watermarking, which Papermark includes on the $99/month Data Rooms plan.

### How do I track which due diligence requests are still outstanding?

Keep the list in one place with a status per row instead of emailing spreadsheets. A data room request list with Open, In progress, Submitted and Completed statuses, due dates and assignees per buyer group shows what is outstanding at a glance. Papermark includes this in every data room.

### What is the difference between a request list and a due diligence checklist?

A checklist is generic and written in advance. A request list is the specific set of 80 to 150 or more items a particular buyer sends for a particular deal, with due dates. Sellers use a checklist to prepare and then answer the buyer's request list item by item.

### Can I reuse the same request list across deals?

Yes. Advisers and serial acquirers keep one standard list and adapt it. In Papermark you can export a request list from one data room and import it into the next, then delete the rows that do not apply.

### Can buyers download documents from the data room?

That is your choice per link or group. Many sellers allow downloads of standard documents but set payroll, customer pricing and the cap table to view-only. Papermark stamps the viewer's email, IP address and timestamp on every page with dynamic watermarking.

### How long does it take to answer a due diligence request list?

A prepared seller can submit 50 to 60 percent of a lower middle market list in the first week. The rest usually follows over 3 to 6 weeks as follow-up requests arrive. Total diligence typically runs 30 to 90 days; see our guide on how long due diligence takes.

## Related resources

- [Papermark data room](/data-room.md)
- [Best virtual data rooms in 2026](/blog/best-virtual-data-rooms.md)
- [Data room request list feature](https://www.papermark.com/data-room-request-list)
- [How long does due diligence take?](/blog/how-long-does-due-diligence-take.md)
- [Data room index template](/blog/data-room-index-template.md)
- [M&A due diligence checklist](/blog/m-and-a-due-diligence-checklist.md)
- [Due diligence Q&A](/blog/due-diligence-q-and-a.md)
- [Sell-side due diligence](/blog/sell-side-due-diligence.md)
- [Due diligence template](/blog/due-diligence-template.md)

---

_Markdown version of [this article](https://www.papermark.com/blog/due-diligence-request-list) for AI agents and LLMs._
_More Papermark content: [llms.txt](https://www.papermark.com/llms.txt) · [full index](https://www.papermark.com/llms-full.txt)._