A Surrey engineering firm considering a £12m acquisition, or a finance director preparing for a refinancing under closer lender scrutiny, needs more than a checklist of accounts and contracts. Due diligence for companies is a structured investigation of financial, legal, operational and commercial facts, designed to support a transaction, lending decision, contractual commitment or disclosure. In the UK, it now also needs to test fraud controls, beneficial ownership, identity evidence and the integrity of company records.
Table of Contents
- What Due Diligence Means for UK Companies Today
- Types of Due Diligence and What Each Stakeholder Needs
- The Core Due Diligence Process and Information Required
- Red Flags and Risk Indicators to Watch For
- When to Bring in Forensic and Accounting Specialists
- Legal and Regulatory Considerations Across the UK
- Worked Example and Practical Checklist for Next Steps
What Due Diligence Means for UK Companies Today
The practical question is no longer whether a target's numbers look plausible. The question is whether the buyer, lender, insurer or board can verify who controls the company, how it makes money, what obligations it carries and whether its controls can withstand challenge.
The Economic Crime and Corporate Transparency Act 2023 has moved fraud prevention closer to the centre of corporate governance. Government guidance says organisations should apply proportionate, risk-based due diligence to people providing services on their behalf. It also specifically identifies mergers and acquisitions as situations where relevant organisations should conduct checks covering criminal or regulatory charges, tax documentation, fraud detection measures and post-acquisition fraud controls. See the government guidance on the failure to prevent fraud offence.
That change matters because the exposure is substantial. The 2024 Economic Crime Survey found that 27% of businesses with employees experienced fraud in the previous 12 months, equivalent to about 389,000 businesses. It estimated approximately 6.04 million fraud offences against UK businesses, with fake invoice fraud affecting 11% of businesses, mandate fraud 7%, and investment fraud 6%, as recorded in the same government guidance.
The control has three purposes
- Reduce decision risk: identify weaknesses before a buyer pays, a lender advances funds or an insurer accepts exposure.
- Support compliance: evidence that the organisation assessed fraud, ownership, tax and governance risks on a proportionate basis.
- Create an audit trail: preserve the reasoning, documents and decisions that may later be needed in negotiations, investigations, regulatory enquiries or disputes.
Companies House information remains useful, but it isn't conclusive. Companies House has confirmed that it can register information but does not currently have the legal power to verify or validate filings in every respect, and its investigatory powers are limited. Suspected fraud may be referred to enforcement bodies, while banks are expected to conduct their own checks. The Parliamentary evidence on Companies House powers and verification therefore supports a straightforward recommendation: treat registry data as an important starting point, not as independent proof.
For UK SMEs and mid-market businesses, due diligence should continue after completion or onboarding. Registered offices, directors, PSC information, bank mandates, supplier controls and fraud prevention procedures can change. The sensible model is a transaction review followed by proportionate periodic monitoring.
Types of Due Diligence and What Each Stakeholder Needs
A request for “one due-diligence report” is usually under-specified. A strategic buyer needs a different answer from a lender, insurer, board committee or litigator. The scope determines the evidence reviewed, the level of testing and whether the report supports a commercial decision, a compliance file or contested proceedings.
| Due Diligence Type | Focus | Typical Stakeholder | Primary Use |
|---|---|---|---|
| Financial | Revenue quality, margins, cash flow, debt, working capital and forecasts | Buyer, lender, investor | Price, funding and completion adjustments |
| Legal | Corporate authority, contracts, disputes, licences and title | Buyer, solicitor, insurer | Identify enforceability and liability issues |
| Commercial | Customers, suppliers, competition, pricing and market assumptions | Strategic buyer, board | Test revenue durability and synergy assumptions |
| Tax | Corporation tax, VAT, PAYE, transfer pricing and open enquiries | Buyer, lender, tax adviser | Quantify historic exposure and tax indemnities |
| Operational | Processes, capacity, suppliers, controls and business continuity | Buyer, insurer, lender | Assess whether the business can operate as represented |
| IT and cyber | Systems, access rights, incidents, resilience, data lineage and technology dependencies | Buyer, insurer, board | Price remediation and understand operational exposure |
| Environmental | Sites, permits, contamination, waste and sustainability obligations | Buyer, lender, insurer | Identify remediation and disclosure requirements |
| HR and employment | Workforce structure, pensions, disputes, incentives and key-person dependency | Buyer, board | Assess integration, retention and employment liabilities |
| Forensic | Fraud indicators, related parties, diverted funds, ownership and loss | Board, litigators, insolvency practitioners | Establish facts, quantify exposure and preserve evidence |
The strategic buyer's corporate finance team will normally compare financial and commercial findings with the acquisition model. A revenue concentration issue may not defeat the deal, but it can undermine synergy assumptions, affect the price mechanism or require a retention plan.
A bank or private credit fund will place greater weight on sustainable cash generation, tax compliance, security, debt-like items and the reliability of management information before sanctioning lending. A broker, insurer or underwriter may focus on operational resilience, claims history, cyber controls and the evidence supporting declared risk.
The reporting standard changes with the audience
A board approving a related-party transaction needs a clear forensic view of independence, pricing and control. A litigator may need a defensible quantification methodology, source schedules and an explanation of assumptions. An insolvency practitioner may instead need asset tracing, transaction chronology and analysis of recoverability.
Operational questions deserve their own scope, particularly where a deal depends on production, service delivery or supplier continuity. Lighthouse's operational due diligence service is one example of a specialist workstream that can sit alongside financial, legal and tax reviews.
Practical rule: define the stakeholder decision before defining the document request. Otherwise, the engagement may produce a polished report that doesn't answer the question being asked.
The Core Due Diligence Process and Information Required
A properly run engagement starts with a written scope, not a shared folder. The engagement letter should identify the entity, transaction or relationship under review, reporting lines, timetable, intended users, limitations and deliverables. It should also state whether the work is decision support, investigative analysis or expert evidence. Those are different products.
Build the evidence request around questions
The vendor information request list, or DDQ, should explain why each document is needed.
- Management accounts and general ledgers: explain the revenue trend, margin movement, cash conversion and unusual journals. Trailing twelve-month figures should be reconciled to audited or filed figures where available.
- Customer contracts and sales data: test concentration, renewal terms, termination rights, rebates, side agreements and whether reported revenue reflects enforceable obligations.
- Supplier contracts and purchase records: identify dependency, minimum commitments, price escalation and unusual payments.
- Statutory registers, articles and minutes: establish share ownership, authority, appointments, resolutions and the decisions that management says were made.
- PSC records and identity evidence: test declared control against the ownership story, filings and evidence of the people involved. Government guidance requires relevant entities to identify PSCs, provide information to Companies House within 14 days, update it within 14 days of a confirmed change and confirm accuracy at least annually where the register hasn't been updated during the previous 12 months. The PSC summary guidance sets out those requirements.
- VAT, PAYE and corporation tax records: explain working-capital drivers, arrears, enquiries, disputed assessments and the relationship between tax filings and accounts.
- Lease schedules and property documents: size rent, break clauses, dilapidations and site obligations.
The difference between statutory registers and Companies House records matters. Internal books may contain resolutions or transfer documents not yet reflected in public filings, while public records may not reflect an unreported change. Reviewers should reconcile both rather than accepting either in isolation.
Use the data room and meetings properly
The data room should preserve document versions, access records and a clear response log. Management meetings then test explanations against evidence. Specialist testing may include bank confirmations, sample-based invoice review, customer confirmation, beneficial-owner tracing, tax reconciliation or cyber and data-lineage review.
A seller-facing explanation of the due diligence phase for sellers can help management understand why buyers request detailed records and how delays or inconsistent answers affect confidence. Buyers should also distinguish completion conditions from post-signing undertakings. Some risks must be resolved before signing, while others can be allocated through warranties, indemnities, price adjustments or a defined remediation plan.
A practical guide to how to do financial due diligence can support the financial workstream, but the process still needs transaction-specific judgement. Transactional diligence answers a defined decision. Ongoing reviews test whether controls, ownership and risk indicators remain reliable after the decision has been made.
Red Flags and Risk Indicators to Watch For
Red flags don't prove fraud. They indicate where the evidence is incomplete, inconsistent or unusually difficult to explain. The correct response is targeted testing, not an automatic accusation or an unstructured demand for every available document.
Public filings provide an early screening layer. Frequent changes of registered office, directors or company secretaries can indicate instability, administrative weakness or attempts to distance individuals from a company. The issue becomes more serious when changes coincide with altered shareholdings, new bank mandates, dormant periods, late filings or unexplained transactions.
Companies House data also needs integrity testing. A reported vulnerability exposed private dashboards of roughly five million registered companies for five months, with unauthorised access to directors' home addresses, email addresses and filing functions, as described in this analysis of the Companies House security vulnerability. The practical implication is to compare addresses, filing timestamps and administrative changes against independent evidence rather than relying on surface consistency.
Match the warning sign to the next test
| Red Flag | Typical Source | Risk Signalled |
|---|---|---|
| Repeated registered-office or director changes | Companies House history, statutory books | Governance instability, concealment or weak administration |
| PSC mismatch or late ownership update | PSC register, share register, transfer documents | Unclear control, undisclosed ownership or reporting failure |
| Irregular share allotments | Articles, resolutions, allotment filings | Dilution dispute, invalid authority or hidden control change |
| Related-party transactions outside normal terms | Ledgers, minutes, contracts, bank records | Value diversion, conflict of interest or misstatement |
| Aggressive revenue recognition | Contracts, invoices, credit notes and cut-off testing | Inflated revenue or premature recognition |
| Unexplained cash movements | Bank statements, payment files and journals | Diverted funds, false suppliers or concealed liabilities |
| Late or qualified accounts | Filed accounts and auditor's report | Financial reporting weakness, uncertainty or going-concern concern |
| Unusually concentrated customer revenue | Sales ledger, contracts and renewal data | Dependency, forecast fragility or undisclosed cancellation risk |
An ownership anomaly calls for a reconciliation of the PSC register, share register, articles, transfer instruments and identity evidence. A cash anomaly calls for bank confirmation, payment-voucher testing and tracing through connected parties. A revenue concern requires cut-off testing, contract review and examination of post-period credits.
Separate signing risk from monitoring risk
Some issues are transaction-critical. An unresolved beneficial-owner dispute, inability to verify authority to sell shares, material tax exposure or unexplained cash diversion may justify delaying signing or changing the legal and economic terms.
Other issues belong in a continuing control framework. Repeated late filings, supplier changes, unusual payment approvals and unexplained administrative updates may not prevent completion, but they should trigger post-completion monitoring, management actions and documented review.
A general business risk assessment guide for 2026 may help teams structure broader risk registers. It shouldn't replace transaction-specific evidence testing or the UK legal analysis required for the particular company.
When to Bring in Forensic and Accounting Specialists
Specialist support is justified when the question has moved beyond “does this look reasonable?” into who benefited, whether the records can be trusted, how much exposure exists or what evidence will withstand challenge.
The clearest triggers are suspected fraud or misstatement, complex related-party arrangements, cross-border ownership or payments, insolvency exposure, disputed beneficial ownership and a transaction where warranty and indemnity insurance is being considered. A specialist can also assist where management accounts don't reconcile to filed accounts, tax balances appear inconsistent with cash payments, or a seller's explanation changes between meetings.
Scope the assignment before collecting everything
A sound instruction identifies:
- The hypothesis: for example, whether a related party received value on non-commercial terms.
- The evidence required: bank statements, ledgers, contracts, emails, registers, tax records or device data.
- The reporting purpose: board decision, negotiation, insurer notification, disciplinary process, litigation support or expert evidence.
- The timetable and cap: milestones, decision dates, assumptions and an agreed limit on initial work.
- The reporting line: who receives findings and who can authorise expanded testing.
The skill sets differ. A forensic accountant analyses financial evidence, reconstructs transactions and quantifies loss or exposure. An independent business valuer addresses value, pricing and valuation methodology. A corporate investigator may focus on identity, background, asset tracing or external intelligence. One professional isn't automatically a substitute for the others.
Confidentiality needs active controls. The engagement should include appropriate non-disclosure terms, restricted access, secure document exchange, a clear retention policy and, where necessary, separation between teams handling conflicting interests. Legal advice remains the solicitor's role. Financial investigation can support legal strategy, but it isn't legal representation.
The engagement letter should also address assumptions, reliance on management information, limitation of liability, intended users and whether the report may be disclosed to insurers, lenders, regulators or a court. Findings can then feed into negotiation, completion accounts, warranty drafting, indemnities, escrow arrangements or post-completion claims. No report should promise recovery or a particular court outcome.
Legal and Regulatory Considerations Across the UK
UK due diligence sits across several overlapping regimes. The appropriate review depends on the company, sector, transaction, jurisdiction, control structure and intended use of the findings.
The Economic Crime and Corporate Transparency Act 2023 has made proportionate, risk-based due diligence and fraud prevention central to corporate controls. The Companies House identity-verification route now applies to directors and PSCs, with online verification through GOV.UK One Login using specified photo identification such as a biometric passport or UK photo driving licence. The government standard describes the purpose as checking that an identity is real and belongs to the person claiming it. The Companies House identity-verification guidance provides the operational detail.
Supervision is increasingly active. As of 5 April 2025, the Solicitors Regulation Authority reported 5,569 firms within the scope of the money laundering regulations, representing around two-thirds of the firms it authorises. In that reporting year, the SRA carried out 935 proactive AML engagements, including 833 inspections or desk-based reviews, up from 545 proactive engagements in the prior year. The FCA reported 934 desk-based reviews and 31 onsite visits as part of AML and counter-terrorist-financing supervision in 2024-25. These figures are discussed in this UK regulatory enforcement and supervision analysis. Firms should assume that undocumented checks are difficult to defend.
Relevant reviews may also cover the Companies Act 2006, the UK Corporate Governance Code where applicable, the Money Laundering Regulations 2017, the Bribery Act 2010, sanctions obligations and the Senior Managers Regime for regulated firms. A transaction may also require competition screening. The CMA can have jurisdiction where the target's UK turnover exceeds £100 million, or where the merger creates or enhances a 25% share of supply in the UK or a substantial part of it. A separate share-of-supply limb can apply where one party has more than 33% of supply and UK turnover above £350 million, with a UK nexus for the other party. These thresholds are summarised in this UK merger control overview.
| Area | England and Wales | Scotland | Northern Ireland |
|---|---|---|---|
| Company registration | Companies House records UK companies, with English and Welsh legal concepts relevant to many transactions | Companies House records companies, but Scots law affects security, property, insolvency and contract analysis | Companies House records companies, while Northern Irish law affects property, insolvency and local proceedings |
| Ownership and control | PSC, share registers, identity evidence and corporate authority require reconciliation | The same corporate records need analysis alongside Scots law concepts | The same corporate records need analysis alongside Northern Irish legal requirements |
| Security and insolvency | Review charges, enforcement and insolvency exposure under the applicable law | Security creation, ranking and enforcement can differ materially | Local insolvency and enforcement procedure may differ |
| Disputes and documents | Confirm governing law, forum and enforceability | Check Scots law clauses and Scottish court implications | Check Northern Irish law clauses and court implications |
A focused explanation of the Economic Crime and Corporate Transparency Act can help boards and advisers translate the legislation into controls. The governing law, registry evidence and enforcement route should still be checked for every transaction.
Worked Example and Practical Checklist for Next Steps
Hypothetical example: a mid-market trade buyer is assessing a UK engineering firm with £6m turnover. The initial review identifies three problems: PSC information doesn't match the share register, revenue from the largest customers has become unusually concentrated, and HMRC has raised a disputed VAT assessment.
The PSC discrepancy is not treated as an administrative nuisance. The buyer requests the statutory books, historic allotment and transfer documents, board minutes, identity evidence and Companies House filing history. Completion is made conditional on the control position being regularised, or the risk is allocated through specific contractual protection.
The concentration issue leads to customer-level testing. The buyer reviews contracts, renewal dates, termination rights, credit notes, order backlogs and post-completion pipeline evidence. A price adjustment or earn-out may be considered if value depends on revenue that isn't sufficiently secure. An independent stocktake may be commissioned where inventory and work in progress affect the completion accounts.
The VAT assessment is separated into liability, timing and quantum. The buyer requests HMRC correspondence, returns, payment evidence and the accounting treatment. The agreement may include a specific indemnity, warranty cover and a completion mechanism that prevents the disputed exposure from being absorbed into an unsupported working-capital assumption.
A proportionate checklist
Before engagement
- Define the decision, transaction perimeter, intended users and timetable.
- Identify whether the review is financial, forensic, tax, operational, cyber or combined.
- Record known concerns, related parties, jurisdictions and potential conflicts.
In the data room
- Request management accounts, ledgers, bank records, tax returns and filed accounts.
- Reconcile statutory registers, PSC information, identity evidence and Companies House filings.
- Review customer and supplier contracts, leases, insurance, disputes, minutes and warranties.
Escalate where needed
- Commission forensic testing for unexplained payments, ownership disputes or suspected misstatement.
- Obtain independent tax analysis for disputed assessments or historic filing concerns.
- Test stock, work in progress, data lineage or cyber controls where the price depends on them.
After completion
- Track warranty notices, tax correspondence, customer retention and control remediation.
- Refresh ownership and authority records when changes occur.
- Preserve the evidence file supporting price adjustments, indemnities and management actions.
The correct next step isn't to order the largest possible review. It is to identify the decision that must be made, the evidence capable of answering it and the consequence if the answer is adverse.
Lighthouse Consultants provides due diligence and financial analysis for acquisitions, investment reviews, lenders, solicitors, insurers and businesses facing unexplained financial issues. Prospective clients can outline the transaction, records available and immediate concerns through Lighthouse Consultants, then invite a proportionate discussion about scope, independence, confidentiality and reporting.
