A legal due diligence checklist for a UK acquisition is useful only when it is tied to the deal thesis, the target's real structure and records you can check. A long generic request list can fill a data room and still miss the charge, consent right, notification or claim that changes price or completion.
This guide is written for buy-side lawyers and in-house teams working on deals governed by the law of England and Wales. The UK has three separate legal systems: England and Wales, Scotland, and Northern Ireland. Scotland and Northern Ireland also use different land registers, so property and dispute checks there need local advice. The National Security and Investment Act and CMA merger control look at UK national security and competition in the UK, so they are not limited to England and Wales.
What should be fixed before the first request list goes out?
Start with a short scope note. Name the target entities, the deal structure, the review period, the materiality rule, the jurisdictions, the workstreams, exclusions and decision owners. Decide the structure early. In a share purchase, the review looks at the target company as a whole. In a business or asset purchase, it follows the assets and liabilities the buyer agrees to take, and each transfer, consent and employee move needs separate work.
| Scope item | Decision it supports | Evidence owner | Completion test |
|---|---|---|---|
| Company and authority | Can the seller and target sign and complete? | Corporate lawyer | Filings, statutory books and approvals reconciled |
| Share capital and control | What is being bought, and who controls it? | Corporate lawyer | Register of members matched to filings and PSC register |
| Charges and debt | What secures lending over shares or assets? | Banking lawyer | Registered charges matched to facility documents |
| Property | Does the target own or lease what it uses? | Real estate lawyer | Title registers and leases checked |
| Government and competition review | Do the NSI Act or CMA merger control apply? | Regulatory and competition lawyers | Dated memo with sources and assumptions |
| Employees | Who transfers, on what terms, and with what claims? | Employment lawyer | Employee data and TUPE analysis complete |
Agree an issue scale before review begins: critical, high, medium, informational and out of scope. Base the label on deal consequence, not on how surprising a document looks. Track every question and answer in one place; a due diligence question log works well for this.
What does an end-to-end buy-side workflow look like?
| Phase | Operating question | Output |
|---|---|---|
| 1. Scope and request | What must be tested for this deal, entity set, period and materiality rule? | Approved scope note, request list and owners |
| 2. Data-room control | What was supplied, and which request does it answer? | Indexed data room with a status for each request |
| 3. Public register searches | What do Companies House, HM Land Registry and court records show? | Dated search results |
| 4. Workstream review | What do corporate, contracts, employment, IP, data, regulatory and disputes reviewers find? | Findings linked to source documents |
| 5. Red-flag escalation | Which facts or gaps could change price, structure, timing or drafting? | Prioritised red-flag report |
| 6. Exchange and completion | How will findings be handled in the sale agreement, disclosure letter and completion steps? | Response matrix tied to the current draft |
| 7. Post-completion handoff | Which obligations, consents and remediation items continue? | Action register with owners and due dates |
The phases loop. A late upload can reopen contract review, and a structure change can reopen the NSI or TUPE analysis. Record what triggered the change, which conclusion it affects and who approved it.
Which Companies House, PSC and title checks should you run?
Start at Companies House. Its company information service gives free access to the registered address, date of incorporation, current and resigned officers, document images, mortgage charge data, previous names and insolvency information. You can also set up email alerts for changes during the deal.
Check the register of people with significant control. GOV.UK guidance on PSCs says a PSC is usually anyone who holds more than 25% of the shares or voting rights, can appoint or remove a majority of directors, or can otherwise influence or control the company. Compare the PSC entries with the register of members, the articles and any shareholders' agreement. Differences belong in the issues log.
For property in England and Wales, use HM Land Registry. The title register shows the title number, the owner, any rights of way and whether a mortgage has been discharged. Online copies cannot be used as proof of ownership, so order official copies where you need evidence. Scotland and Northern Ireland use different registers.
- Trace each share allotment and transfer to the required approvals and filings.
- Check the articles and any shareholders' agreement for pre-emption, transfer restrictions, drag-along and tag-along rights.
- Match each registered charge to a facility document, a release or a payoff letter.
- Reconcile directors and PSCs on the register with board minutes and the statutory books.
- Check title registers and leases for every material site.
- Log missing minutes, unexplained share movements and late filings as issues.
Which government reviews can affect exchange and completion?
| Regime | What it does | What diligence should collect |
|---|---|---|
| National Security and Investment Act 2021 | Mandatory notification for certain acquisitions in 17 sensitive areas; call-in power for others | Target activities mapped to the 17 areas, buyer ownership chain, deal timetable |
| CMA merger control (Enterprise Act 2002, Part 3) | Voluntary notification; the CMA can review qualifying mergers before or after completion | UK turnover, overlapping products and services, customer and competitor information |
NSI Act. The government's guidance says that buying a qualifying entity active in one of 17 sensitive areas may need government approval before completion. Under section 13 of the Act, a notifiable acquisition completed without the Secretary of State's approval is void. The guidance adds that a civil penalty can reach 5% of global turnover or £10 million, whichever is greater, and that criminal penalties can also apply. A notification review can last up to 30 working days. Deals outside mandatory notification can be notified voluntarily. If a deal is not notified, the government can assess it up to 5 years after it happens and up to 6 months after becoming aware of it. Diligence should map what the target actually does against the 17 areas early, because this affects the timetable and the conditions in the sale agreement.
CMA. Merger control sits in Part 3 of the Enterprise Act 2002. The CMA's guide to telling it about a merger says merger notification in the UK is voluntary. It can still investigate a merger after completion. Parties can send a short briefing paper or notify formally. Avoid fixed thresholds in a standing checklist; check the CMA's current guidance and record the date.
How should material contracts be reviewed?
Build the contract population from finance, procurement, sales, property and IT records, not only from the data room. Group each main agreement with its variations, orders, side letters, waivers and notices. Then extract the terms the deal touches: duration, renewal, termination, assignment, change of control, exclusivity, pricing, limits of liability, indemnities, data and IP terms, and governing law.
| Review question | Required output | Escalate when |
|---|---|---|
| Will the relationship continue after completion? | Change-of-control or assignment trigger, consent or notice route | A variation or definition is missing |
| Can the counterparty exit? | Right, notice period, timing and cost | Termination terms conflict across documents |
| Are the economics reliable? | Pricing, adjustments and rebates | A side letter changes the schedule |
| Can the target use key assets? | Licence scope, ownership and restrictions | The chain of title is incomplete |
In a business or asset purchase, assignment and novation drive the work, because each contract must move to the buyer. In a share purchase, change-of-control clauses matter more. Keep clause text and references with each finding. Who may sign a waiver or consent is a separate question; a contract approval matrix helps record that.
What should the employment, IP and data workstreams check?
Employment and TUPE. Collect employee lists, contracts, policies, bonus and incentive plans, pension arrangements, collective agreements, and records of disputes and grievances. In a business or asset purchase, check whether the Transfer of Undertakings (Protection of Employment) Regulations 2006 apply. Under regulation 4, a relevant transfer does not end the employment contracts of assigned employees, and the transferor's rights, powers, duties and liabilities under those contracts pass to the transferee. GOV.UK guidance on TUPE says the identity of the employer must change for TUPE to protect employees in a business transfer, which is why a share purchase usually falls outside it. Under regulation 11, the transferor must give the transferee employee liability information not less than 28 days before the transfer. Check also that the seller has met its duty to inform and consult employee representatives.
Intellectual property. Map each registered and unregistered right to its creator, owner of record, assignments, licences and the products that use it. A registration list alone does not prove ownership. Check that employee and contractor terms assign rights to the company.
Data. If the deal moves personal data to a new or extra controller, the ICO's data sharing code says you must consider data sharing as part of due diligence. That includes the original purposes, your lawful basis and whether either changes after the deal. The ICO notes that this guidance is under review following the Data (Use and Access) Act, so check the current version.
How should litigation, compliance and bribery risk be tested?
Request claim forms, statements of case, orders, settlement agreements, letters before claim, regulator correspondence, the internal claims list, insurance notifications and board papers. Check them against court records and search under former names and group companies. For each matter, record the court or tribunal, parties, claim number, issues, stage, exposure, insurance position and source date. The litigation readiness plan guide shows how to hand pending matters to the people who will run them after completion.
For bribery, section 7 of the Bribery Act 2010 makes a relevant commercial organisation guilty of an offence if a person associated with it bribes another person to obtain or keep business, or a business advantage, for it. It is a defence to prove that it had adequate procedures to prevent this. The Ministry of Justice guidance names a merger or acquisition as a relationship with particularly important due diligence implications. Test what the target does in practice: sample agents and intermediaries, contacts with public officials, gifts and hospitality, and past investigations.
What makes a red-flag report decision-ready?
Separate fact, legal assessment, deal consequence and next step. Open with scope, dates, sources, assumptions and gaps. Link each issue to evidence and name an owner.
| Field | Practical entry |
|---|---|
| Verified fact | Short statement with a document or register citation |
| Uncertainty | Missing fact, conflicting evidence or open legal question |
| Deal relevance | Price, structure, condition, warranty, indemnity, timing or integration |
| Proposed response | Request, specialist review, drafting change or completion deliverable |
| Owner and status | Named role, due date, open or closed |
Do not bury missing documents at the end. A gap can be the main finding. In the sale agreement, a finding may become a specific indemnity, a condition, a warranty, a disclosure point or a price change.
How does diligence carry into exchange, completion and integration?
Link each condition, consent, notification, charge release, payoff letter and disclosure point to the issue and evidence behind it. After completion, hand ongoing obligations, contract notices, litigation dates, filings and remediation tasks to named owners.
Before exchange, confirm that:
- scope changes and draft versions are reflected in the findings;
- high-priority findings had senior review;
- open requests show their consequence and owner;
- every report statement cites a document or register;
- NSI, CMA and third-party consent status is documented;
- the sale agreement and disclosure letter address the agreed findings; and
- integration owners have accepted continuing tasks.
If the deal also involves a US target or US assets, see the US version of this checklist. Gotham lets UK legal teams research UK case law and legislation, review contracts at scale and draft in Word, in one workspace, with data for UK customers stored in the United Kingdom. Every answer cites the passage it relies on.
Questions about UK legal due diligence
What should a UK legal due diligence checklist for M&A cover?
It should cover Companies House filings and the register of people with significant control, statutory books, HM Land Registry title, material contracts, employees and TUPE, intellectual property, data protection, litigation and Bribery Act compliance. It should also cover whether the deal needs a National Security and Investment Act notification or raises CMA merger control questions. Each finding should feed a red-flag report.
Do I need to notify the government under the National Security and Investment Act?
You must notify and get approval before completing a notifiable acquisition: an acquisition of control of a qualifying entity active in one of 17 sensitive areas of the economy. Under section 13 of the Act, a notifiable acquisition completed without approval is void, and civil and criminal penalties can apply. Other acquisitions can be notified voluntarily, and the government can call in deals it has not been told about.
Is CMA merger notification mandatory?
No. The CMA says merger notification in the UK is voluntary. It can still investigate a qualifying merger after completion, so parties to a deal that meets the legal criteria and may raise competition concerns often brief or notify the CMA first.
Does TUPE apply to a share purchase?
Usually not. GOV.UK guidance says the identity of the employer must change for TUPE to protect employees in a business transfer. In a share purchase the employing company stays the same. TUPE is central to business and asset purchases, where the seller must give the buyer employee liability information at least 28 days before the transfer.
