M&A due diligence typically takes 30 to 90 days after the letter of intent is signed: 4 to 8 weeks for a well-prepared lower middle market deal, and 3 to 6 months for regulated or cross-border deals. The clock usually starts when the buyer gets access to the data room. Sellers who open a prepared room in Papermark, a secure, modern data room, tend to land at the short end.
The honest answer to "how long does due diligence take" is that it takes as long as the slowest missing document. Buyers rarely run out of questions. What changes the timeline is how quickly the seller can answer them, and that is mostly decided before the LOI is signed.
Due diligence in an M&A deal typically takes 30 to 90 days, measured from the signed letter of intent (LOI) to the point where the buyer is ready to sign the purchase agreement. That range covers most private company sales. It stretches for deals with regulatory approvals, multiple countries or financing contingencies, and it compresses when the seller has already done the work.
The table below shows typical ranges by deal type. They are common ranges reported by advisers and data room providers, not guarantees, and any single deal can sit outside them.
| Deal type | Typical diligence duration | What drives the timeline |
|---|---|---|
| Small, owner-run business | 2-6 weeks | Records quality and seller responsiveness |
| SBA-financed small business | 60-90 days to close | Lender underwriting, appraisal and valuation |
| Lower middle market | 30-60 days | Quality of earnings and legal review |
| Mid-market PE or strategic | 60-90 days | QoE, financing and management sessions |
| Large, regulated or cross-border | 90-180+ days | Antitrust, regulators, multiple jurisdictions |
| Clean business with a prepared data room | Often 4-6 weeks | Few follow-up rounds |
The last row is the one sellers control. A prepared business does not skip diligence, it skips the second and third rounds of follow-up requests that come from missing documents and numbers that do not reconcile. Tab, a Swedish fintech, closed its acquisition by Kivra in 3 to 4 weeks because the IP, financials and product documents were ready in a data room before the buyer asked.
The type of buyer shapes the due diligence timeline as much as the size of the deal. Each buyer brings different advisers, different financing and a different tolerance for open questions, and each of those adds or removes weeks.
For a business selling for under $5M, the buyer is often an individual or a search fund using an SBA 7(a) loan. Active document review can be quick, 2 to 6 weeks, because the business is simple. The total time from LOI to close is usually 60 to 90 days, though, because the SBA lender runs its own underwriting, orders a business valuation and sometimes a real estate appraisal, and waits for its own approvals. Sellers should plan for the lender's timeline, not the buyer's. Our small business due diligence guide covers what those buyers check.
Private equity buyers run the most structured process. They commission a quality of earnings report, which takes 4 to 6 weeks, legal and tax reviews in parallel, and often an IT or commercial review. Expect 60 to 90 days of diligence for a mid-market deal. If the buyer uses acquisition debt, the lender's own diligence can add 2 to 4 weeks at the end. The private equity due diligence guide has the detail.
A strategic acquirer (a company buying a competitor, supplier or adjacent business) often moves faster on the financial side and slower on integration. Expect 45 to 90 days, with time spent on product, technology, customer overlap and the employees it wants to keep. Strategic buyers also tend to involve more internal teams, which means more people in the data room and more questions.
Deals that need antitrust clearance, sector regulator approval (banking, healthcare, defense, telecoms) or foreign investment review can take 90 to 180 days or more. The diligence itself may finish in 60 to 90 days, but closing waits on the approvals. Multiple jurisdictions also mean multiple sets of tax, employment and data protection rules to review.
Due diligence is one stage of a longer sale. When people ask how long due diligence takes, they often mean the whole process, so it helps to see where diligence sits.
| Stage | Typical duration | What happens |
|---|---|---|
| Preparation | 1-6 months | Financial cleanup, sell-side QoE, data room build |
| Marketing and buyer outreach | 1-3 months | Teaser, NDA, CIM, management calls, IOIs |
| LOI and exclusivity | 1-3 weeks to negotiate | Price, structure, 45-90 day exclusivity |
| Confirmatory due diligence | 30-90 days | Request list, review, Q&A, site visits |
| Purchase agreement and closing | 2-6 weeks (overlaps) | SPA or APA, disclosure schedules, consents |
From first conversation to closing, a typical private company sale takes 6 to 12 months. Due diligence is the stretch where the seller has the least leverage, because exclusivity means no other bidders are being courted. That is why the time spent preparing before the LOI pays back so directly. Our guide to the M&A due diligence process has a week-by-week view of the diligence stage itself.
Most M&A due diligence runs through five phases. They overlap, and a well-run process moves several workstreams forward at once, but the order is consistent from deal to deal. Each phase below covers what happens, who is involved, how long it typically takes and what tends to go wrong.
The LOI is signed and exclusivity starts. The buyer's counsel sends the due diligence request list, often 80 to 150 items for a lower middle market deal. The seller's side loads the list into the data room, sends NDA-gated access links, and uploads the Week 1 items. Who: seller's CFO and counsel, the M&A adviser, the buyer's deal lead. What goes wrong: the room is built after the LOI instead of before, and the first week is spent finding files.
The buyer's accountants and lawyers read the core documents: annual and monthly financials, tax returns, the cap table, top customer contracts. They come back with the first wave of follow-up requests. Who: buyer's financial and legal advisers. What goes wrong: follow-ups arrive by email from several people, and the same question gets answered twice with slightly different numbers.
The specialist workstreams run in parallel: quality of earnings, tax, legal, HR, IT and commercial. This is where most of the time goes. Who: each adviser team, plus the seller's managers who own the data. What goes wrong: the QoE team disputes an add-back, or legal finds a contract with a change-of-control clause that needs a customer's consent.
The buyer meets management, visits sites, and digs into the issues found in phase 3. Specialist calls happen here: the CTO with the buyer's tech reviewer, the controller with the QoE team. Who: seller's leadership, buyer's deal team. What goes wrong: findings turn into a price discussion, often called a retrade.
Findings feed into the purchase agreement: price adjustments, specific indemnities, escrows and the disclosure schedules. Third-party consents, lender sign-off and any regulatory approvals are collected. Who: both sides' counsel, lenders, sometimes regulators. What goes wrong: a consent from a landlord or a major customer is requested late and becomes the last item holding up closing.
Buyers ask for the same core documents in almost every deal, in roughly the same order. Week 1 is financial statements, tax returns, monthly accounts, the cap table, top customer contracts and the debt schedule. Weeks 2 to 4 bring the general ledger, working capital detail, employee census, IP assignments and insurance. Later requests cover policies, permits and the long tail.
| Area | Common requests | What the buyer is testing |
|---|---|---|
| Financial | 3-5 years of statements, monthly accounts, EBITDA bridge | Are the earnings real and repeatable? |
| Tax | Returns, sales tax nexus, payroll tax filings | Is there unpaid tax that follows the company? |
| Legal and corporate | Formation docs, cap table, minutes, consents | Can the sellers actually sell? |
| Commercial | Top customer contracts, concentration, churn | Does revenue survive the change of owner? |
| HR | Census, key agreements, contractors, benefit plans | Who stays, and what does the sale trigger? |
| IP and technology | Assignments, licenses, security policies, incidents | Does the company own and protect its core asset? |
The full list, with 120 items by workstream, lookback and priority, is in our due diligence request list.
Most due diligence delays come from a short list of causes, and almost all of them are visible before the LOI. The table shows typical time each one adds and the fix that removes it. The added time is a typical range from deal practice, not a fixed rule.
| Delay cause | Typical added time | Fix |
|---|---|---|
| Missing or late documents | +1-3 weeks | Pre-built data room and a loaded request list |
| Repeated follow-up requests | +1-2 weeks | Answer once in Q&A and publish to all reviewers |
| Disputed QoE adjustments | +2-4 weeks | Sell-side QoE with support for every add-back |
| Third-party consents | +2-6 weeks | Flag change-of-control clauses before launch |
| Lender diligence | +2-4 weeks | Lender-only link with restricted folders from day one |
| Cap table that does not reconcile | +1-3 weeks | Reconcile ledger, grants and board approvals early |
| Regulatory or antitrust approval | +4-12 weeks or more | File early; agree a long-stop date in the LOI |
Two of these deserve a closer look. Third-party consents are slow because they depend on someone outside the deal: a landlord, a major customer or a licensor. They have no reason to hurry, and some will use the moment to renegotiate. And disputed quality of earnings adjustments are slow because each one is also a price discussion. Our sell-side due diligence guide explains how sellers take that argument off the table before launch.
The exclusivity period and the due diligence period are related but not the same. Exclusivity, sometimes called a no-shop, is the window in the LOI during which the seller agrees not to talk to other buyers. It is commonly 45 to 90 days, and 60 days is a frequent starting point for lower middle market deals.
Due diligence happens inside that window. If diligence runs long, the buyer will ask to extend exclusivity, and the seller has to decide whether to agree. Extensions are common and usually short, 2 to 4 weeks, but each one keeps the seller off the market while the buyer gathers more reasons to adjust the price. Our guide to the letter of intent covers how to negotiate the exclusivity term.
The practical rule for sellers: set exclusivity long enough to finish a realistic diligence, and short enough that the buyer feels the deadline. A prepared seller can accept a shorter window with confidence, because they know the room is ready.
Ridgeway Labs is a hypothetical B2B software company with $9M of annual recurring revenue, being acquired by a private equity-backed platform. The LOI gives 60 days of exclusivity. The founder and the CFO started preparing four months earlier, so the data room is ready the day the LOI is signed.
In week 1, counsel sends a 118-item request list. The CFO imports it into the data room's request list, assigns each row to a buyer group, and submits 64 items in the first five days. The buyer's QoE firm starts in week 2 instead of week 3, because bank statements, the general ledger and the revenue by customer file are already there.
Phase 3 brings the expected friction. The QoE team questions $210,000 of add-backs; the CFO has invoices for $180,000 of them, and the remaining $30,000 is conceded without a fight. Legal finds that the second-largest customer's contract requires consent to assignment. Because the change-of-control schedule flagged it in week 1, the consent request goes out on day 9 and comes back signed on day 31.
The purchase agreement is signed on day 52, inside the exclusivity window, with no price change. Closing follows two weeks later, once the lender completes its own review.
Worked scenario. Full diligence is still the longest phase, but a ready data room cut setup to a week and kept follow-up rounds short.
The biggest lever a seller has is to finish most of the buyer's work before the buyer starts. That means a data room built, indexed and populated before the LOI, and a request list that is already loaded when counsel sends theirs.
The second lever is a single channel for questions. When follow-up requests arrive by email from five advisers, they duplicate, contradict and get lost. A Q&A module tied to the documents lets the seller answer once and publish the answer to everyone who needs it.
The third is staged access. Give the buyer's lender its own link to the financial folders from day one, so its review runs in parallel instead of at the end. Give the clean team its own access to customer and payroll detail, so the rest of the room can move faster.
The fourth is knowing where the buyer is. Page-level analytics show which workstreams are reading and which have gone quiet. A QoE team that has not opened the general ledger by day 10 is a timeline risk, and you can raise it with the buyer before it becomes one.
A data room is the one piece of due diligence infrastructure the seller controls end to end. The buyer picks its advisers and sets its pace, but the seller decides whether the documents are ready, findable and permissioned on day one. That is where the weeks are won or lost.
Papermark is a secure, fully customizable, and developer-friendly data room for modern dealmakers, with unlimited data room visitors on every plan.
A due diligence data room organized by workstream, ready before the LOI is signed.
The causes of delay in the table above are mostly information problems: missing documents, duplicate questions, and late access for lenders or specialists. A data room for due diligence fixes them at the source, because the documents, the request list, the questions and the access rules sit in one place. If you are still choosing a platform, our comparison of the best virtual data rooms covers pricing and permissions across providers.
Create the room, build the numbered folder index from our data room index template, and upload by drag and drop. The folder hierarchy is preserved, so a room built on your laptop arrives in the same order.
Open Request List in the sidebar and Import the buyer's list, or your own standard list. Set due dates and assign rows to buyer groups. The request list moves each item through Open, In progress, Submitted and Completed, so nobody asks "where are we" on a call.
Request statuses and due dates show which items could hold up the timeline.
Create a link or group for the buyer's deal team, its lender and its clean team, each with its own folders. Granular permissions keep the lender in the financial folders, an NDA gates the link, and dynamic watermarking stamps every page with the viewer's email and the time.
Separate access for the lender lets its review run in parallel instead of at the end.
On Data Rooms Plus, the Q&A module ties each question to the document that prompted it. Answer once, and publish the answer to the groups that need it, instead of replying to the same question in five email threads.
Page-by-page analytics show who opened which document and for how long. If a workstream has gone quiet, raise it with the buyer's deal lead before it costs you a week of exclusivity.
Analytics show which buyer teams are reading and which have stalled.
Papermark is our #1 VDR provider for M&A transactions right now. In two deals we used custom branding, dynamic watermarking, and granular permissions.
Tyler
The Data Rooms plan is $99/month with a 7-day free trial. It includes the request list, 3 team members, unlimited data room visitors, unlimited data rooms, NDA agreements, dynamic watermarking, granular permissions, a custom domain, and the API, CLI and MCP server. Data Rooms Plus adds the Q&A module, the audit log, automatic file indexing and data room freeze for archiving at close. Papermark is ISO 27001 certified and SOC 2 Type II, and it is also open source.
No credit card required.
Environmental due diligence in 2026: Phase I and Phase II ESA scope, ASTM E1527-21, the 180-day rule, costs, and the data room for environmental due diligence.
Regulatory due diligence in 2026: the 7 areas, the permits that never transfer, merger control timelines, and how to run a data room for regulatory due diligence.
Buy-side due diligence in 2026: the 7 workstreams, the LOI to signing timeline, real fee ranges, and how to run a data room for buy-side due diligence.
