Buy

Ecommerce business due diligence checklist

A document request is not diligence. Diligence is proving that the same business exists in the store, the payment records, the marketing accounts, the supply chain, and the day-to-day operation.

The Ecomma deal team · The Ecomma Desk · Published and updated August 2026

Use this checklist after a business has passed your first screen and before you make an acquisition decision. Its job is not to produce a bigger folder. Its job is to connect every important claim to a source record, test whether the business can transfer, and leave you with a short list of exceptions you can price, resolve, or decline.

Start with read-only access wherever possible. Exported spreadsheets and screenshots are useful orientation, but they are not substitutes for the source systems that created the numbers. Work from the general acquisition checks in the U.S. Small Business Administration's guide to buying an existing business, then add the ecommerce-specific checks below.

This is an operating checklist, not legal, tax, accounting, or investment advice. The correct documents, consents, and transaction structure depend on the asset, entity, and jurisdictions involved. Use qualified advisers for those conclusions.

1. Define what you are actually buying

Before testing performance, fix the perimeter. An ecommerce business can include a legal entity, selected assets, inventory, intellectual property, contracts, customer data, platform accounts, or some combination of them. A seller saying “the whole business” does not settle which of those items transfers.

List every asset expected at closing: entity or assets, store, domains, trademarks, creative, product files, customer records, inventory, contracts, and operating documentation.
Separate assets that transfer from accounts that must be re-permissioned or rebuilt under the buyer's own entity.
State how inventory, cash, debt, refunds, chargebacks, taxes, gift cards, subscriptions, and open purchase orders are treated.
Identify every required third-party consent instead of assuming that a supplier, 3PL, app, or payment relationship follows the sale.

2. Financial evidence

Build the financial view month by month, then reconcile it outward. The point is not whether a P&L looks polished. The point is whether revenue, refunds, fees, cost of goods, ad spend, payroll, contractor costs, shipping, software, and inventory movement agree with the systems that generated them.

Obtain monthly P&Ls for the review period with the accounting basis, currencies, and timezone stated.
Tie gross sales to store orders, payment-processor payouts, refunds, chargebacks, taxes collected, and bank deposits. Record timing differences rather than forcing a match.
Rebuild gross profit by SKU or product family using documented landed cost, discounts, fulfillment, and shipping treatment.
Separate recurring operating costs from proposed add-backs. For each add-back, retain the invoice or ledger entry and explain why a buyer would not incur it.
Review balance-sheet items that can survive closing: inventory, payables, receivables, loans, tax balances, customer credits, gift cards, and reserves.
Compare management reports with filed returns and the general ledger where applicable; send unresolved tax or allocation questions to the transaction advisers.

3. Revenue and customer quality

Revenue quality is a composition question. Two stores with the same total sales can have very different exposure when one depends on a single product, campaign, customer cohort, marketplace, geography, or discount pattern. Ask for the cuts that explain how sales are produced and how much survives after refunds and fulfillment.

Break sales, gross profit, refunds, and contribution margin down by month, product, channel, geography, and new versus returning customer.
Inspect order-level data for discounting, bundles, test orders, wholesale orders, cancelled orders, subscription churn, and unusual spikes near the measurement date.
Review cohort retention and repeat purchase from the store or analytics source, not only a blended lifetime-value claim.
Reconcile paid-channel spend and attributed revenue with the store's total orders. Treat platform attribution as one view, not the general ledger.
Read a sample of support tickets, returns, reviews, disputes, and chargebacks to understand the customer promise behind the numbers.
List concentrations explicitly: top SKUs, suppliers, traffic sources, markets, affiliates, creators, and wholesale customers.

4. Inventory, suppliers, and fulfillment

Inventory can be an asset, a working-capital requirement, or a future write-off. The diligence file should let you trace units and cash from purchase order to warehouse to customer, including goods in transit and returned stock.

Reconcile inventory by SKU across the store, warehouse or 3PL, open purchase orders, goods in transit, returns, damaged stock, and accounting records.
Age the inventory and identify discontinued, seasonal, slow-moving, expiring, or restricted products.
Confirm landed cost components, minimum order quantities, lead times, payment terms, quality controls, and recent cost changes from source documents.
Read supplier, manufacturer, warehouse, freight, and 3PL agreements for term, termination, exclusivity, assignment, service levels, and outstanding claims.
Speak with material suppliers before closing when permitted. A relationship described as transferable is not the same as written consent or a new agreement.
Walk an order, cancellation, return, replacement, and stockout through the actual operating process.

5. Operations and owner dependence

A buyer needs to know what happens when the seller stops answering messages. Map the work, not just the organization chart: recurring decisions, exceptions, approvals, relationships, and knowledge that still lives with one person.

List every daily, weekly, monthly, seasonal, and exception-driven task with the system or document used to complete it.
Identify actions only the owner can perform: campaign approvals, supplier negotiation, creative direction, cash decisions, customer escalations, and platform administration.
Review employee and contractor roles, agreements, compensation, access, location, notice obligations, and willingness to continue, subject to local advice.
Observe a live operating cycle. Have someone other than the founder complete key tasks using the written procedure and record where the procedure fails.
Build a day-one dependency list: what would stop orders, advertising, fulfillment, customer support, reporting, or payouts if access changed tonight.

For the post-close sequence, read the first 30 days operator playbook. It is a useful counter-check: if the proposed handover cannot support that first month, the diligence is not finished.

6. Accounts, access, and transfer

Create an account register before closing. For each store, domain, payment provider, ad account, analytics property, marketplace, email platform, social profile, helpdesk, app, source-code repository, and 3PL portal, record who owns it, who administers it, what the buyer can inspect, and the approved transfer or access method.

Verify the current Shopify owner and rehearse the supported transfer steps. Shopify's ownership-transfer guidance also calls out billing, payout, domain, contract, inventory, and transition preparation.
Confirm Google Ads access inside Access and security, including an appropriate administrator. Use Google's account-access instructions rather than a shared login.
Confirm Analytics access at the account or property level and preserve the required history. Google documents the roles in its Analytics user-management guide.
For every other platform, verify current terms and transfer mechanics directly. Some assets can change owner; others require a new account, new billing, or support-assisted changes.
Do not remove the seller's access or change production ownership before the closing conditions and cutover plan say to do so.

7. Privacy, compliance, and contracts

Customer data is not merely a file in the asset list. Establish why it was collected, where the people are located, what notices and consents were used, which processors receive it, and what changes when a new controller or entity takes over. The UK Information Commissioner's Office specifically treats data sharing after mergers and acquisitions as a due-diligence issue and calls for purpose, lawful basis, transparency, governance, accountability, and security to be considered. See the ICO due-diligence guidance.

Collect the current privacy notice, cookie practices, consent records, unsubscribe handling, retention schedule, processor list, data map, and history of material complaints or incidents.
Review product claims, licenses, certifications, warranties, subscriptions, returns, shipping promises, and required disclosures for every market served.
Confirm ownership or licensed use of trademarks, domains, product photography, creative, copy, software, designs, and contractor-created work.
Read material customer, supplier, employee, contractor, affiliate, lease, financing, and software agreements for assignment and change-of-control terms.
Have the relevant adviser settle legal, regulatory, tax, and employment conclusions for each jurisdiction; the checklist only identifies the evidence and open questions.

8. Red flags that deserve an explicit answer

The seller will provide screenshots or summary exports but not reasonable read-only access to source systems.
Revenue, payouts, bank deposits, tax records, and the ledger only reconcile after unexplained manual adjustments.
A material account, domain, supplier, contractor, or piece of intellectual property is controlled personally and has no tested transfer path.
Profit depends on add-backs that are undocumented or on work the buyer will still need to pay someone to perform.
Inventory quantities, age, landed cost, or ownership cannot be reconciled across systems and physical records.
The business depends on a policy exception, prohibited claim, unapproved ad asset, borrowed audience, or customer-data use that has not been reviewed.
The seller's answers are individually plausible but change when the same fact is tested in another system.

9. Turn the work into a decision record

Finish with one exception log, not a stack of disconnected notes. For each open item, record the claim, source evidence, period covered, what does not reconcile, the deal implication, and the required resolution. Mark the item verified, accepted in price or structure, reserved for a specialist, or unresolved. The result should make the decision easier to explain even if the answer is “do not buy.”

Ecomma's buyer path begins with your budget, category, region, and preferred level of involvement. If there is a fit, the process moves into the business's financials, ad accounts, store and supplier data before closing. Read how buying from Ecomma works before you start the intake.

Sources and scope

Primary and authoritative references reviewed for this checklist in August 2026:

Platform procedures and laws change. Check the live source and obtain advice for the actual transaction rather than treating this page as a substitute.