Regulatory due diligence is the workstream that checks whether a target holds the licences, permits, registrations and approvals its business legally requires, whether those authorisations survive a change of control, and what open enforcement exposure the buyer inherits at closing. It decides whether the deal can actually be operated the day after it completes.
Regulatory diligence is the workstream buyers skip on deals they think of as unregulated, and it is exactly those deals where a lapsed permit stops a plant. Every business sits under someone's rules. A logistics company needs operator licences, a fintech needs a payment institution authorisation, a food manufacturer needs establishment registrations, and a staffing agency needs the right to sponsor the visas half its workforce holds. This guide covers the seven areas, the permits that never transfer, how merger control gates the closing date, and how to run the review without leaking enforcement correspondence.
Running that review means putting a permit register, regulator correspondence and open investigation files in front of counsel, a lender and an insurance underwriter who should not all see the same things. A data room for regulatory due diligence handles that with one link per party. Section 8 covers the setup step by step.
Regulatory due diligence is a structured review of every permission a target needs from a public authority in order to trade, and of every obligation those permissions carry. That means licences and permits, sector authorisations, registrations, notifications, filings, approvals, and the enforcement record attached to all of them. It is commissioned by a buyer or investor after the letter of intent and delivered as a register plus a risk memo.
The distinction from legal due diligence is worth being precise about, because the two are often bundled and the bundling is where things get missed. Legal diligence reads the target's private arrangements: its constitutional documents, its contracts, its litigation, its property titles, its employment terms. Regulatory diligence reads its public ones. One asks what the company promised its counterparties. The other asks what the state permitted it to do and on what conditions.
That difference matters commercially because the remedies are different. A defective contract can usually be repapered between two willing parties in a week. A defective permit cannot, because the counterparty is a regulator with its own statutory timetable, its own discretion, and no interest in the buyer's closing date. When a licence problem is found late, the only available levers are delay, indemnity, or price, and the buyer has already spent its leverage elsewhere.
The workstream also converts compliance vagueness into deal numbers. A model that assumes a target continues generating €40M of revenue from a regulated activity is only credible once someone has confirmed the authorisation supporting that activity is current, unconditioned, transferable, and not sitting under an open regulator investigation. Regulatory diligence is where those assumptions get tested against documents rather than management assurances.
Finally, it surfaces liabilities that appear nowhere in the accounts. Undisclosed regulator correspondence, a remediation programme agreed with an authority and quietly abandoned, a permit operating outside its stated capacity limit, an environmental consent that expired eighteen months ago and has been running on an informal accommodation with the local inspector. None of that is on the balance sheet, and all of it becomes the buyer's problem at completion.
The seven areas below make up the standard scope of a regulatory review. Each one produces findings that are either a timing constraint, a cost, or a contingent liability, and a good report expresses all three in the language the deal team already uses.
Licences and permits come first because they define whether the business can operate at all. The reviewer builds a register of every authorisation the target holds, site by site and entity by entity, with the issuing authority, the holder, the expiry date, the conditions attached, and the transfer treatment. Sector regulators come second: the FCA and PRA in the UK, the SEC and FINRA in the US, the FDA for medical devices and pharmaceuticals, the EPA and its national equivalents for environmental consents, and the network of national authorities that supervise energy, telecoms, gambling, transport and healthcare.
Change-of-control approvals and merger control are the third and fourth areas, and they are the two that gate the closing date rather than the price. The fifth is financial crime: sanctions screening, anti-money-laundering controls, and anti-bribery exposure under the FCPA and the UK Bribery Act. The sixth is data protection, principally GDPR in Europe and the state privacy statutes in the US. The seventh is enforcement history, which is where the reviewer asks what has already gone wrong and whether it is closed.
| # | Area | What the reviewer checks | Typical red flag |
|---|---|---|---|
| 1 | Licences and permits | Register of authorisations, holders, conditions, expiry, transfer treatment | Permit operating outside its stated capacity limit |
| 2 | Sector regulators | FCA, SEC, FDA, EPA and national equivalents, plus supervisory correspondence | Undisclosed supervisory letter or remediation plan |
| 3 | Change of control | Regulator approvals, third-party consents, notification deadlines | Approval needed that nobody has started |
| 4 | Merger control | HSR, EU Merger Regulation, national filings, foreign investment screening | Mandatory filing missed, leaving the deal void |
| 5 | Sanctions, AML, bribery | Screening records, AML programme, FCPA and UK Bribery Act exposure | Third-party agents paid on success in high-risk markets |
| 6 | Data protection | GDPR posture, records of processing, transfers, breach log | Breach never notified within the 72-hour window |
| 7 | Enforcement history | Inspections, findings, fines, open investigations, undertakings | Open investigation with unquantified exposure |
Two of these areas deserve a note on scope. Environmental permits sit in area one but are usually reviewed alongside a dedicated environmental due diligence workstream, because assessing whether a permit is being complied with needs a site assessment rather than a document review. And the financial crime area overlaps heavily with third-party due diligence, since most bribery exposure in an acquisition arrives through agents, distributors and consultants rather than through employees.
Knowing the seven areas is one thing. Knowing what actually lands in the room, and how sensitive each pile is, is what determines how the room gets built. The table below maps each area to the documents a reviewer will request, which is also the folder structure a well-prepared seller builds before the room opens.
| Area | Documents requested | Typical count | Sensitivity |
|---|---|---|---|
| Licences and permits | Permit register, licence certificates, conditions, renewal correspondence | 40 to 150 | Medium |
| Sector regulators | Authorisation letters, supervisory correspondence, inspection reports | 20 to 80 | High |
| Change of control | Consent clauses, prior approval precedents, notification templates | 15 to 50 | Medium |
| Merger control | Turnover by jurisdiction, market shares, board analyses of the deal | 20 to 60 | Very high |
| Sanctions, AML, bribery | Policies, screening logs, agent register, training records, audits | 25 to 90 | High |
| Data protection | Records of processing, DPAs, transfer mechanisms, breach log | 15 to 45 | High |
| Enforcement history | Fines, undertakings, investigation files, legal privilege log | 10 to 40 | Very high |
The sensitivity column is the one that changes how the room is configured. Merger control material and enforcement files are the two piles that must never carry the same permissions as the permit register. Board analyses of the transaction are exactly what an antitrust agency asks for later, and enforcement files are frequently privileged, which means a careless disclosure can waive the privilege for everyone.
This is the section that pays for the workstream. Buyers routinely assume that because they are buying the shares of a company, everything the company holds comes along automatically. That is true of most contracts and most assets. It is not reliably true of authorisations, and the exceptions are not marginal.
Authorisations fall into three practical categories once you look at them properly. The first transfers with the entity, because it is issued to a legal person that is not changing and the regulator has no interest in who owns the shares. Most routine site and environmental permits behave this way in a share purchase. The second transfers but triggers a notification duty, usually with a short and unforgiving deadline measured in days rather than months. The third does not transfer at all, either because the authorisation is personal to the holder, because it is conditioned on the identity of the controlling shareholder, or because the statute simply terminates it on a change of control.
The third category is where deals get hurt, and the examples are more common than buyers expect. A US federal alcohol basic permit terminates automatically thirty days after a change of control unless a new application has been filed in that window. A UK sponsor licence, which is what allows a company to employ visa-holding staff, must be reported to the Home Office within twenty working days of a takeover and can lapse if that is missed. A care provider registration in the UK is not transferable at all, so a new legal entity must register in its own name before it can lawfully operate. State money transmitter licences in the US each require their own change-of-control approval, and a business licensed in forty states is running forty parallel processes at once.
Deal structure changes the answer, and not always in the direction people assume. In an asset purchase, permits generally do not follow the assets, because the acquirer is a new operator and the authority has to approve it. That means an asset deal chosen for tax or liability reasons can quietly require a fresh application for every material permit in the portfolio, and fresh applications run on the regulator's timetable rather than the buyer's.
The permit register goes to every reviewer; the enforcement correspondence folder goes to two of them.
Once a finding is on the register, the negotiation is about which of four remedies applies, and the choice depends on whether the exposure is quantified, whether the regulator has discretion, and whether operations stop without it.
| Finding | How it surfaces | Commercial remedy |
|---|---|---|
| Permit lapses on change of control | Statutory transfer rule checked against the permit register | Condition precedent, with the application filed pre-signing |
| Notification deadline after completion | Licence conditions read line by line, not summarised | Covenant with a named owner and a diarised date |
| Fresh application required in an asset deal | Deal structure tested against each authorisation type | Price adjustment sized to the revenue at risk during the gap |
| Open regulator investigation | Enforcement correspondence and the privilege log | Specific indemnity, since the exposure is unquantified |
| Operating outside a permit condition | Actual throughput compared with the permitted capacity | Remediation plan with a dated milestone before closing |
| Licence conditioned on a named individual | Responsible person named on the certificate, checked against leavers | Retention arrangement, or walk away if no replacement qualifies |
Walking away is a real outcome and belongs on the list. Where a target's revenue depends on an authorisation that a regulator has discretion to refuse to the buyer specifically, no indemnity fixes it, because the indemnity pays out into a business that cannot trade. That scenario is rare, but it is the reason regulatory diligence should start before the exclusivity clock does.
Merger control is the area that most reliably moves the closing date. More than 130 jurisdictions now operate a merger control regime, and the analysis for a cross-border deal is less about whether the transaction raises a competition problem and more about how many filings are mandatory and how long the slowest one takes.
In the US, the Hart-Scott-Rodino regime requires premerger notification for transactions valued above $133.9 million in 2026, followed by a statutory waiting period of 30 days, or 15 days for cash tender offers. Filing fees run from $35,000 to $2,460,000 depending on the transaction value. A Second Request stops the clock entirely and typically adds three to six months. Our HSR filing guide covers the thresholds, the fee tiers, and the Item 4(c) document collection that causes most of the delay.
In the EU, the Merger Regulation catches concentrations that meet turnover thresholds rather than deal value, and the first of the two tests requires combined worldwide turnover above €5 billion with EU-wide turnover above €250 million for each of at least two parties. A Phase I review takes 25 working days, extended to 35 if commitments are offered or a member state seeks a referral. Phase II adds 90 working days and can be extended further. Where the EU thresholds are not met, national filings step in, and a deal can require notification in six or eight European jurisdictions with different forms, languages and standstill obligations.
Foreign investment screening is now a separate gate on top of competition review, and it has expanded faster than any other area of regulatory practice. CFIUS reviews transactions in the US on a 45-day review followed by a possible 45-day investigation, with filing fees reaching $300,000 for transactions of $750 million or more. The UK National Security and Investment Act imposes mandatory notification in 17 sensitive sectors, and a transaction completed without the required clearance is legally void, with penalties up to 5 percent of worldwide turnover or £10 million, whichever is greater. Most EU member states now run their own screening regimes under the framework of the EU screening regulation.
The practical consequence for a deal timetable is that the closing date is set by the slowest mandatory approval, not by the parties. That is why the merger control workstream produces a filing map early: which jurisdictions are mandatory, which are voluntary, which are suspensory, and what the realistic clearance date is in each. Building the signing-to-closing gap around that map is straightforward. Discovering a mandatory filing after signing is not, because gun-jumping rules restrict what the parties can even do together while they wait.
Financial crime diligence is where a buyer inherits liability for conduct it had nothing to do with. In a share purchase the legal entity continues, and so does its exposure. Successor liability under the FCPA is well established: an acquirer that buys a company with a history of improper payments takes on that history, and the fact that the conduct predates the acquisition is not a defence.
The review has three threads. Sanctions work starts with screening the target, its owners, its customers and its suppliers against the relevant lists, and applying the OFAC rule that treats any entity owned 50 percent or more by blocked persons as blocked itself, whether or not it appears on a list. Anti-money-laundering work tests whether the target's programme actually functions: customer due diligence records, transaction monitoring, suspicious activity reporting, and whether the responsible officer is a real role or a title on an org chart. Anti-bribery work looks at the third-party population, because agents, distributors, customs brokers and consultants are where the exposure concentrates.
The single most useful question in the bribery thread is who gets paid on success in a market with a poor corruption record. Success-fee arrangements with intermediaries in high-risk jurisdictions are the classic pattern, and the diligence test is whether the target can produce a documented rationale for each one, evidence that services were actually rendered, and a due diligence file on the intermediary. Under the UK Bribery Act, the corporate offence is failing to prevent bribery, and the only defence is having had adequate procedures, which means the procedures have to be evidenced rather than asserted.
What a buyer does with a finding is now shaped by disclosure policy. The Department of Justice safe harbour policy for mergers and acquisitions sets a baseline of 6 months from the closing date to voluntarily disclose criminal conduct discovered in diligence, and 12 months from closing to complete remediation. Those two numbers change the calculus in diligence, because a buyer that finds something and says nothing loses the benefit, while a buyer that finds it, discloses it, and remediates on schedule gets a materially better outcome.
Enforcement and investigation files are the documents most worth restricting: view-only, watermarked, and scoped to counsel.
Data protection belongs in the same conversation because the exposure is quantified the same way. GDPR fines reach €20 million or 4 percent of global annual turnover, whichever is higher, and the breach notification obligation runs on a 72-hour clock from awareness. A target with an undocumented breach history is carrying a contingent liability that a buyer will hold from completion, which is why the breach log and the records of processing are standard requests rather than optional ones. Broader sustainability and governance exposure is picked up alongside this in ESG due diligence.
A mid-market infrastructure fund agrees to acquire Nordhavn Process Group, a hypothetical €140M revenue industrial water treatment and waste handling business operating from eleven sites across Denmark, the Netherlands and Poland. Commercially the business is simple. Regulatorily it is not, which is why the fund commissions regulatory diligence before it commissions anything else.
The review builds a register of 84 separate authorisations. Forty-six of them, mostly site environmental permits held by the operating subsidiaries, transfer automatically, because the deal is a share purchase and the permit holder does not change. Twenty-six transfer but require notification to the issuing authority within a fixed window after completion, ranging from 14 to 30 days depending on the country and the permit type. Twelve do not transfer at all.
Worked scenario. The 12 non-transferring authorisations set the closing timetable, because each one needs a fresh application on the regulator's clock rather than the buyer's.
Those twelve are the deal. Three are Polish waste transport licences conditioned on the identity of the controlling shareholder. Two are Dutch environmental permits that lapse on a change of operator. Four are municipal water authority accreditations that must be re-applied for by the new owner. Two are transport authorisations naming a responsible person who is leaving at closing. One is a small payment institution licence held by a legacy financing subsidiary, which alone carries a 60 working day assessment period.
The fund does not walk. It rebuilds the timetable instead. The payment institution application goes in nine weeks before the target closing date, the twelve non-transferring authorisations become a condition precedent schedule with a named owner against each line, and a €2.1M specific indemnity covers the two Dutch permits where the regulator retains discretion to refuse. Diligence itself runs through a data room for regulatory due diligence holding 640 documents across seven folders, with the enforcement correspondence folder restricted to outside counsel and the fund's compliance reviewer, view-only and watermarked.
The most common mistake is starting the regulatory review after the structure has been chosen. Whether the deal is a share purchase or an asset purchase determines how most authorisations behave, and that decision is usually made on tax grounds weeks before anyone opens the permit register. A structure that saves €3M in tax and requires forty fresh permit applications is not obviously the better structure.
The second is treating the permit register as a list of names rather than a list of conditions. A licence certificate says the company is permitted to do something. The conditions attached say at what volume, at which site, with which named individual responsible, subject to what reporting, and until when. Findings almost never come from the certificate. They come from page four of the conditions.
The third is accepting management's own inventory without testing it. Ask finance for every payment made to a regulator or licensing authority in the past three years, then compare that list against the register the company provided. The gaps in that comparison are usually the permits nobody thought to mention, and the exercise takes an afternoon. A structured M&A due diligence checklist helps here, because it forces the same question from more than one angle.
The fourth is assuming enforcement history is closed because nobody has heard from the regulator lately. Silence is not resolution. The right requests are the inspection reports, the correspondence file, the undertakings register and the privilege log, and the right question is whether every finding raised in the past five years has a documented closure.
The fifth is circulating regulatory material carelessly. Enforcement correspondence, investigation files and board analyses of the transaction are the three most sensitive document types in the entire deal, and sending them over email to counsel, a lender, an underwriter and an antitrust economist creates both a privilege problem and a disclosure problem. A data room for regulatory due diligence with per-link permissions solves it in about ten minutes of setup.
A data room for regulatory due diligence carries a different risk profile to the financial one. The financial folder holds numbers that are commercially sensitive. The regulatory folder holds documents that can waive privilege, prejudice an open investigation, or hand an antitrust agency exactly the internal analysis it will later ask for. That difference should change how the room is built, who gets which link, and what happens to the archive after closing.
Papermark is a secure, fully customizable, and developer-friendly data room built for modern dealmakers, with page-by-page analytics, dynamic watermarking, and transparent pricing (open-source and self-hosting available).
A regulatory due diligence data room with one folder per area, so permissions can differ by folder rather than by document.
Most regulatory diligence still runs on email attachments and a shared drive, and this is the workstream where that habit is hardest to defend afterwards. There are four reasons a dedicated data room for regulatory due diligence earns its place. If you are still choosing a platform, our comparison of the best virtual data rooms covers pricing model, permissions depth and compliance posture across the main providers.
Privilege is fragile and disclosure is permanent. Investigation files and legal advice on open regulatory matters are usually privileged, and privilege can be waived by disclosure to the wrong recipient. A room where the enforcement folder is visible only to outside counsel and the buyer's compliance reviewer, with download disabled, is a defensible position. A group email thread with eleven recipients is not, and no amount of confidentiality footer text changes that.
Five parties need five different views. Regulatory diligence is unusually asymmetric in who should see what. Antitrust counsel needs the merger control material and market data. The compliance reviewer needs the sanctions, AML and bribery files. The lender needs the licence register and a summary of enforcement exposure. The warranty and indemnity underwriter needs the open investigation file specifically, because that is what it is pricing. A shared drive gives you one permission set. A data room for regulatory due diligence gives you one per link over the same underlying documents.
Regulatory requests arrive in waves and reference each other. The reviewer reads the permit register, then asks for the conditions attached to nine specific permits, then asks for the renewal correspondence on three of those. Across 640 documents and dozens of open questions, an email thread loses the chain within a week, and the same question gets asked twice by two workstreams that never compare notes.
The disclosure record is the defence years later. When a regulator or a claimant asks in 2029 what the buyer knew at completion, the answer needs to be evidenced. A per-visitor audit log that shows which reviewer opened which document, on which date, for how long, is that evidence. An inbox is not, and reconstructing it from mailboxes three years later is exactly as unpleasant as it sounds.
The rest of this section is the practical setup: five steps to build a data room for regulatory due diligence that handles all four.
Create one folder per area from the table earlier in this guide: licences and permits, sector regulators, change of control, merger control, financial crime, data protection, and enforcement history. Multi-site groups are tempted to organise by legal entity instead, which feels natural to the seller and is unusable for the reviewer, because a reviewer works one area at a time across every entity.
Upload the whole tree at once by dragging folders straight in, and keep the permit register itself at the top level as the index the reviewer starts from. Automatic file indexing on the Data Rooms Plus plan builds and maintains the numbered index as documents arrive, which matters here because a regulatory request list grows in waves for the whole of the diligence period rather than arriving complete on day one.
This is the step that separates a regulatory room from a financial one. Five parties typically need five different views of the same document set, and two of those views must exclude the enforcement folder entirely.
| Reviewer | Folders granted | Rights |
|---|---|---|
| Buyer's regulatory counsel | All seven areas | View and download |
| Antitrust counsel and economists | Merger control, market and customer data | View only, watermarked |
| Compliance reviewer | Financial crime, data protection, enforcement history | View only, watermarked |
| Lender | Licence register, enforcement summary | View only |
| W and I underwriter | Enforcement history and open investigations | View only, watermarked |
Granular file-level permissions are set per link rather than per user, so each party gets its own link carrying its own folder scope, email allowlist or domain restriction, and download rule. Access is link-based, so no reviewer has to create an account, which removes the friction that makes busy counsel abandon a room and ask for a zip file instead.
Permissions are set per link, so the lender and the antitrust economists see different folders of the same room.
Switch the enforcement history and merger control folders to view-only and turn on dynamic watermarking, which stamps every page with the viewer's email, IP address and timestamp as it renders. Add NDA agreements on the links that reach the underwriter and the lender, so acceptance is captured and logged before the first document opens rather than chased afterwards.
The honest limit is worth stating plainly. A file that has been downloaded is legally treated as read, and no platform can recall it. That is exactly why download is disabled rather than merely discouraged on these two folders, and why watermarking exists at all: it makes a leak traceable to a named viewer instead of merely regrettable.
Regulatory questions reference documents, which is why they belong attached to documents. The reviewer reads the permit register, asks about the conditions on nine permits, then asks about renewal correspondence on three of those. Run over email, that chain fragments across the general counsel, the head of compliance and two advisers, and nobody can say which of forty open questions is still unanswered.
The Q&A module on Data Rooms Plus attaches each question to the document that prompted it, with permissions controlling who sees which threads, so the lender never reads the compliance reviewer's questions about an open investigation. Answers can be published to one group or to everyone, and the whole log exports for the closing file, which is useful when a warranty claim later turns on what was asked and what was answered.
Page-level analytics show which reviewer opened which document, when, and for how long. In regulatory diligence this is an early warning system: an antitrust economist who has spent forty minutes on the customer concentration file has found something, and you will usually hear about it a week before it appears in a report or a request for a longer signing-to-closing gap.
Per-visitor analytics show which regulatory documents each reviewer opened and for how long.
After closing, data room freeze makes the room immutable and exports it as an archived ZIP with a certificate. When a regulator, a claimant or a W and I insurer asks in three years what was disclosed and when, that archive answers the question in an afternoon instead of a fortnight.
Papermark is our #1 VDR provider for M&A transactions right now. In two deals we used custom branding, dynamic watermarking, and granular permissions.
Tyler
The Data Rooms plan is €99/month with a 7-day free trial and includes 3 team members, unlimited data room visitors, unlimited data rooms, unlimited documents, custom domain, advanced data room branding, data room analytics, NDA agreements, dynamic watermarking, and granular file-level permissions. Data Rooms Plus at €249/month adds 5 team members, the Q&A module with permissions, the visitor audit log, automatic file indexing, email invite viewers, a dedicated account manager, and SOC 2 Type II. Data Rooms Premium at €549/month adds 10 team members plus multi-team, AI redaction, unlimited encrypted storage, full API access, SSO on request, whitelabeling and custom layouts. Data Rooms Unlimited at €999/month removes per-seat charges entirely, so teams that add reviewers mid-deal pay one number regardless of headcount, and it carries every Premium capability including AI redaction. Set against legal and regulatory diligence fees that run $25,000 to $150,000 on a mid-market deal, the room is immaterial, and unlimited data rooms under one subscription means a group with eleven regulated sites can run one room per workstream at no extra project fee.
No credit card required.
AI due diligence in 2026: the 9 domains, training-data provenance, wrapper margins, EU AI Act tiers, and how to run it in a data room for AI due diligence.
Cybersecurity due diligence in 2026: the 9 control domains, the SOC 2 scope trap, inherited breach duties, and the data room for cybersecurity due diligence.
Healthcare due diligence in 2026: the 8 review areas, the billing and overpayment trap buyers inherit, and how to run a data room for healthcare due diligence.
