Consider this scenario: a target’s largest customer contract is in the data room, and the revenue forecast assumes that relationship will continue. Yet the contract contains a termination right exercisable shortly after the acquisition. Elsewhere, software described as proprietary was developed by contractors whose intellectual property assignments cannot be found.
Such details turn due diligence from document review into a test of deal value. The question is not simply what the target owns today, but what the buyer can legally acquire, retain and operate after completion—and what liabilities come with it.
In light of the above, there are several key areas where legal due diligence can uncover risks that may not be immediately apparent from the documents provided. The following are eight areas that warrant particular attention, as their findings can materially affect the transaction structure, valuation, contractual protections and ultimately, the buyer’s decision to proceed.
1. The ownership chart does not match the legal record
An organisation chart does not prove clean title. Lawyers reconcile share registers, capitalisation tables, allotments and investment agreements, looking for options, convertibles, undisclosed beneficial interests, security interests and pre-emption rights. They also test the sellers’ authority to transfer their interests and identify required approvals. In an asset purchase, title and transferability must instead be checked asset by asset.
An incomplete register may be curable. Contested ownership or unreleased security can prevent the buyer from acquiring what it bargained for. Rectification, waivers and releases may need to be secured before completion, rather than left to a warranty claim.
2. A signed contract does not guarantee continuing revenue
A business may depend on a handful of customers, suppliers or landlords. Lawyers ask not only whether contracts are signed, but what they allow counterparties to do. Warning signs include imminent expiry, termination for convenience, price-reset rights, exclusivity, onerous service credits and minimum-purchase commitments. Change-of-control and assignment provisions require separate analysis: their triggers depend on the transaction structure and actual wording.
Contractual rights must be tested against the assumptions underpinning the price. If material revenue can disappear shortly after completion, that is a valuation issue. Required consents may justify conditions precedent or a carefully managed counterparty approach, without compromising confidentiality or deal certainty.
3. Liabilities do not always appear on the balance sheet
Legal due diligence cannot replace financial or tax diligence, but may uncover obligations that accounting summaries overlook. Side letters, rebates, indemnities, guarantees, tax assessments, related-party arrangements and payment disputes can change the risk profile. Often the warning is a mismatch: management calls an obligation immaterial, but the contract imposes uncapped exposure; a loan has been repaid, but its guarantee remains; a settlement creates continuing commitments.
Counsel should work with financial and tax advisers to establish quantum and seek repayment, release, a price adjustment or specific indemnity, as appropriate. An indemnity’s practical value depends on the obligor’s ability to pay and the agreed recovery limitations.
4. A compliance manual is not a compliance programme
Licences and regulatory approvals can be fundamental to a target’s ability to operate. Counsel checks their scope, conditions, duration, renewal status and potential implications of a change in ownership or an asset transfer. A licence listed in the data room is of limited comfort if the business is operating outside its terms.
Malaysia illustrates the importance of sector-specific scrutiny. Manufacturing licences may carry conditions requiring attention to MIDA’s post-licensing processes, while certain mining activities may require environmental impact assessments under the Environmental Quality (Prescribed Activities) (Environmental Impact Assessment) Order 2015. Seller-completed checklists are useful starting points, but cannot replace verification of licence conditions and applicable regulatory requirements.
A second category concerns conduct: unusually high commissions to intermediaries, poorly documented payments, dealings with higher-risk counterparties, recurring regulatory complaints or an absence of credible investigation and remediation records. These may warrant targeted enquiries into bribery, sanctions, competition, environmental or other sector-specific exposure.
The distinction matters: weak controls are a warning sign, not proof that an offence occurred. But a buyer needs to understand whether questionable conduct is isolated, systemic or ongoing.
5. Valuable assets may not be owned—or usable—as expected
For technology, pharmaceutical, media and data-driven businesses, ownership and permitted use of intellectual property can be central to the investment thesis. Lawyers trace the chain of title to trademarks, patents, material software, inventions, designs, brands and other IP, paying particular attention to founders, former employees and external developers. Applicable law matters: ownership and assignment rules are not uniform across jurisdictions.
Restrictions in third-party licences, open-source software obligations and intellectual property disputes may also affect how the buyer can use and commercialise an asset. For businesses deploying A.I., the enquiries may extend to rights over training inputs, outputs and third-party models, where material to the business.
Data requires a separate analysis. A target may possess a large customer database without having an adequate legal basis to use, share or repurpose all of it. Lawyers examine privacy notices, processing arrangements, international transfers, security incidents and breach-response records. Where the E.U. General Data Protection Regulation applies, its requirements on lawful processing and security (Articles 5, 6 and 32) provide a concrete starting point. In Malaysia, amendments to the Personal Data Protection Act 2010, which took effect in stages in 2025, introduced mandatory data breach notification, with failure to notify the Commissioner as required under section 12B(1) constituting an offence under section 12B(3). A historic breach or unlawful data practice can translate into remediation costs, regulatory exposure and limits on the buyer’s intended integration strategy.
6. Workforce arrangements and disputes tell another story
An apparently stable workforce may conceal disputed contractor classifications, unpaid entitlements, unusually generous termination benefits, change-of-control payments or undocumented promises to key executives. Incentive plans and retention arrangements should be tested against the buyer’s integration plans.
Litigation searches and claims schedules tell only part of the story. Threatened proceedings, employee grievances, regulatory correspondence and settlement obligations can reveal risks not yet reflected in a formal claim. The significance turns on the underlying facts, potential exposure and business disruption—not simply the amount currently claimed. Review of sensitive materials must also respect privilege, confidentiality and applicable data-protection requirements.
7. Regulatory approval are not mere housekeeping
Cross-border transactions require early assessment of merger control, foreign-investment screening and sectoral approvals. Some regimes prohibit completion until clearance is obtained.
Malaysia provides an example. Under the Ministry of Economy’s Guideline on the Acquisition of Properties, effective 13 July 2022, an indirect acquisition of property through the purchase of shares may require prior approval, even where the property itself is not transferred. This may arise where a non-Bumiputera interest acquires control of a company owned by Bumiputera interests and/or a government agency, where property constitutes more than 50% of the company’s total assets and is valued at more than RM20 million. Due diligence must therefore examine not only the target’s ownership structure, but also its underlying property holdings and whether the proposed acquisition triggers regulatory approval.
The practical consequence is straightforward: no amount of warranty protection substitutes for a mandatory approval. The transaction timetable, conditions precedent, long-stop date and allocation of clearance risk must reflect the applicable regime.
8. What is missing can matter as much as what is disclosed
Missing schedules, unsigned agreements, contradictory answers, late disclosures and unexplained gaps between records may indicate weak governance or an unresolved substantive problem. None, taken alone, proves concealment. A sensible review distinguishes a clerical omission from a pattern that undermines confidence in management’s account of the business.
The key is to pursue discrepancies systematically, identify what remains unverified and avoid presenting an absence of evidence as evidence that no liability exists. Where the missing information concerns a value-critical asset or contract, the gap itself may need to be treated as a material diligence limitation.
From red flag to deal decision
A useful due diligence report does more than catalogue exceptions. It identifies the underlying fact, the remaining evidential gap, the likelihood and potential impact of the risk, and the proposed response.
Beyond identifying risks, lawyers also play an important role in advising on the appropriate transaction structure. This may include whether the acquisition should be undertaken through a share purchase or asset purchase, the use of an acquisition vehicle, and the allocation or assumption of existing liabilities, including the repayment, refinancing or takeover of indebtedness. The findings of legal due diligence may also inform the need for specific contractual protections, conditions precedent or adjustments to the proposed transaction structure.
Some issues can be resolved before completion through consents, releases or corrective documentation. Others call for repricing, an escrow or retention, tailored warranties, a specific indemnity or a post-completion remediation plan. Warranty and indemnity insurance may assist with some unknown exposures, but coverage and exclusions must be checked; it is not a universal answer to identified problems. Risks that threaten title, regulatory clearance or the continued viability of the business may justify restructuring or abandoning the transaction. The following framework maps these specific deal risks to their practical commercial remedies:
| No. | Solution | Explanation |
| Fix before completion | Seller must resolve the problem before the buyer completes the purchase. | |
| Price adjustment | Buyer pays less because the business is worth less than expected. | |
| Warranty | Seller makes a contractual promise about the business; breach may give the buyer a claim. | |
| Indemnity | Seller agrees to compensate the buyer for a specified risk or liability. | |
| Escrow / retention | Some purchase money is held back to protect against specified risks. | |
| Condition precedent | The deal cannot complete until a specified requirement, such as regulatory approval, is satisfied or, where legally permissible, waived. | |
| Walk away | If the problem is serious enough, the buyer may decide not to proceed. |
Legal due diligence should, however, inform, rather than dictate the buyer’s commercial decisions. The lawyer’s role is to identify and assess legal risks, explain their potential implications and advise on appropriate safeguards. Whether those risks are commercially acceptable, and whether the transaction should proceed, remains a decision for the buyer.
Ultimately, the most revealing diligence findings are not always in the bold print of a contract. They emerge when lawyers compare what the documents say, what the business is said to do and what the buyer expects to acquire. Reading between those lines is how due diligence moves from issue spotting to protecting the deal itself.
For further information, please contact:
Farah Deena Azmi, Azmi & Associates
