Due Diligence

Due diligence (sometimes abbreviated DD) is the investigation or review that a person or organization carries out before entering into an agreement, transaction or business relationship, in order to verify the information it has been given and to identify legal, financial and operational risks. The term describes both the process and the standard of care expected of a reasonable party in the circumstances.

In financial services, due diligence appears in several distinct settings: buyers and investors examine target companies, regulated firms examine their customers under anti-money-laundering rules, and banks and payment companies examine the partners, vendors and correspondent institutions they rely on.

The phrase has long been used in law to mean reasonable care. Its modern financial meaning is closely associated with the US Securities Act of 1933, which made underwriters and others liable for misstatements in a registration statement but gave them a defence if they could show they had conducted a reasonable investigation. Underwriters responded by developing systematic reviews of issuers, and the practice spread to mergers, private investment and lending.

In mergers, acquisitions and investments, due diligence is conducted after a preliminary agreement and before signing or closing. A buyer and its advisers typically examine:

• financial records, including audited financial statements, quality of earnings and debt;
• legal matters, such as contracts, litigation, intellectual property and corporate records;
• tax exposures;
• commercial position, including customers, competitors and market size;
• regulatory status, licences and any history of enforcement.

Sellers usually provide documents through a virtual data room, sometimes organized as a due diligence pack. Findings shape the price, the warranties and indemnities in the purchase agreement, and sometimes the decision to proceed. In regulated sectors the regulator conducts its own review: a person acquiring control of a US money transmitter, for example, must usually obtain approval from each state that issued the company a money transmitter license, submitting background and financial information on the new owners.

Under anti-money-laundering law, customer due diligence (CDD) is the obligation to identify and verify customers, understand the nature and purpose of the relationship, identify beneficial owners of legal entities, and monitor the relationship over time. The FATF Recommendations require it of financial institutions and certain non-financial businesses, and the measures are scaled to risk:

• Enhanced due diligence applies to higher-risk customers, such as politically exposed persons or customers linked to high-risk countries, and may involve establishing source of wealth and source of funds and obtaining senior management approval.
• Simplified due diligence may be permitted where risk is demonstrably low, for example for some public bodies or listed companies.

For business customers the same process is often called know your business.

Financial institutions also review the organizations they depend on. Section 312 of the USA PATRIOT Act requires US banks to apply due diligence, and in some cases enhanced due diligence, to correspondent accounts for foreign financial institutions, a central element of any correspondent banking relationship. In 2023 the US federal banking agencies issued joint guidance on third-party risk management, which expects banks to assess vendors and fintech partners before contracting and throughout the relationship. This has particular weight in banking-as-a-service arrangements, where a bank's customers are acquired and served by a non-bank partner. Related practices are described as know your vendor and know your partner.

Due diligence reduces but does not eliminate risk. It depends on the accuracy of the documents provided, on the time and access available, and on the skill of the reviewers. Frauds such as Wirecard, whose reported cash balances did not exist, passed years of audits and investor reviews. Practitioners therefore distinguish between confirming documents and testing them independently, for example by contacting banks, customers or regulators directly.