Content guide · 12 min read
Regulatory Due Diligence
The compliance and license workstream that tells deal teams whether a target can keep operating after close — and which supervisors, consent orders, or change-of-control rules can delay or kill the deal.
What regulatory due diligence covers
Regulatory due diligence (also called compliance due diligence or regulatory DD) maps the legal operating stack of a business: who regulates it, which licenses and permits it needs, how examinations and enforcement look historically, and what approvals the transaction itself will trigger.
It sits next to legal DD (contracts, litigation, corporate authority) and operational DD (how the business runs day to day). For banks, fintech, healthcare, energy, defense, transportation, food, telecom, and many industrial niches, regulatory findings can dominate valuation, timing, and structure.
Six pillars of a practical regulatory DD workstream
1. License & permit inventory
Map every material license, registration, certification, and permit by entity, jurisdiction, and renewal date. Flag non-transferable or change-of-control-sensitive instruments.
2. Supervisors & frameworks
Identify primary and secondary regulators, statutes, and self-regulatory organizations. Note multi-jurisdiction stacks that multiply exam risk.
3. Enforcement & examinations
Review public and private exam findings, consent orders, fines, suspensions, criminal referrals, and open investigations. Trend severity and remediation status.
4. Compliance program design
Assess policies, training, monitoring, testing, escalation, and board/audit-committee oversight. Look for paper programs versus lived controls.
5. Transaction approvals
Change-of-control filings, waiting periods, foreign investment screens, ownership caps, and post-close conditions that gate timing and certainty.
6. Go-forward obligations
Remediation budgets, monitor appointments, capital/liquidity covenants from orders, product restrictions, and 100-day compliance plan needs.
Where regulatory DD sits in the deal timeline
| Stage | Regulatory focus | Typical output |
|---|---|---|
| Pre-LOI screen | Public licenses, news, enforcement databases, obvious CoC hurdles | Kill / watch / proceed flags |
| LOI / exclusivity | Data-room license register, exam history, counsel scoping | Issue list + specialist budget |
| Confirmatory | Deep program review, interviews, regulator calls (where appropriate) | Risk matrix + SPA conditions |
| Signing / close | Approval filings, interim covenants, order compliance | Closing checklist |
| 100 days | Remediation plan, control ownership, reporting cadence | Integration compliance plan |
Cost and timeline reality check
| Approach | Typical cost | Time | Best for |
|---|---|---|---|
| Big Four / boutique specialist | $25K–$150K+ | 2–6 weeks | Highly regulated mid-market / large deals |
| Outside regulatory counsel | $15K–$100K+ | 1–5 weeks | Sector-specific statutes and filings |
| dodilligence first-pass PDF | $49 ($39.20 with welcome code) | Minutes | Public-info screen before heavy spend |
Specialists remain essential for filing strategy and sensitive regulator dialogue. First-pass screening reduces wasted scopes on targets that already fail public checks.
Red flags that slow or kill deals
| Severity | Signal | Why it matters |
|---|---|---|
| Deal-Killer | Revoked / suspended core license | May block lawful operations at close |
| Deal-Killer | Undisclosed consent order with monitor | Hidden cost, control limits, reputation risk |
| Deal-Killer | Criminal referral or fraud finding | Sponsor risk appetite and financing fail |
| High | Change-of-control approval unlikely in timeline | Drop-dead date pressure; reverse break fees |
| High | Repeat exam findings, weak remediation | Pattern of control failure |
| High | Material unlicensed activity in a core product | Forced product exit post-close |
| Watch | Fragmented multi-state license map | Integration cost and renewal cliffs |
| Watch | Policy binder present, testing sparse | Paper program risk |
50-point regulatory due diligence checklist
Use as a working list for IC memos and data-room requests. Severity tags: DK deal-killer, H high, W watch.
Licenses & permits (1–10)
- DK Core operating license valid and current
- DK License transferable or CoC path clear
- H Full register by entity and jurisdiction
- H Renewal calendar next 24 months
- H Pending applications / expansions
- H Conditions, limitations, geographic caps
- W Sub-licenses and third-party dependencies
- W Professional licenses for key persons
- W Facility / environmental permits linked to ops
- W Export / import / dual-use controls if relevant
Enforcement & exams (11–20)
- DK Open investigations disclosed
- DK Consent orders / C&D fully inventoried
- H Exam findings last 5 years with status
- H Civil money penalties and remediation spend
- H Whistleblower / complaint trends
- H Restitution or customer remediation plans
- W Informal supervisory correspondence
- W Media / political attention risk
- W Peer enforcement themes in sector
- W Insurance coverage for regulatory defense
Compliance program (21–30)
- H Written policies mapped to risks
- H Training completion and testing evidence
- H Independent compliance testing cadence
- H Issue log and escalation path
- H Board / audit committee reporting
- W Compliance staffing ratios vs peers
- W Third-party / vendor oversight
- W AML/sanctions or privacy program where required
- W Product approval / change control
- W Incident response and regulator notification playbooks
Transaction & go-forward (31–40)
- DK Required CoC / ownership filings identified
- DK Hard legal bars (foreign ownership, prohibited acquirers)
- H Waiting periods and drop-dead compatibility
- H Interim operating covenants with regulators
- H Financing conditions tied to approvals
- H Post-close monitors or reporting duties
- W Integration plan for dual licenses
- W Brand / marketing claim restrictions
- W Data residency and cross-border transfer rules
- W Contingency if a license is delayed
Sector add-ons (41–50)
- H Financial services: capital, liquidity, conduct risk
- H Healthcare: billing, privacy, clinical licenses
- H Energy / industrial: EHS, emissions, site permits
- H Defense / dual-use: clearances and FOCI
- H Consumer: product safety, advertising, warranties
- W Tech/platform: content, payments, age controls
- W Multi-state money transmission / lending maps
- W FDA / medical device quality systems if applicable
- W Telecom / spectrum / interconnection rights
- W ESG disclosures that create regulatory exposure
How deal teams use a first-pass regulatory screen
- Universe triage — Drop names with obvious public enforcement or missing core licenses before LOI.
- Scope specialists — Send counsel a focused issue list instead of a blank-check diligence budget.
- Price risk — Fold remediation and monitor costs into model and SPA indemnities / escrows.
- Timeline honesty — Align exclusivity and drop-dead with real approval clocks.
- IC narrative — Document residual risk and who owns post-close compliance.
FAQ
What is regulatory due diligence?
It is the workstream that maps licenses, supervisors, enforcement history, compliance programs, and transaction approvals so buyers know the target can operate lawfully and on what timeline the deal can close.
Is regulatory DD the same as legal DD?
No. Legal DD covers contracts, corporate documents, litigation, and IP. Regulatory DD focuses on the operating license stack, examinations, consent orders, and change-of-control rules under sector supervisors.
When should it start?
Before LOI for regulated businesses. Public screens of enforcement and license status prevent expensive LOI processes on non-viable targets.
What usually delays close?
Change-of-control filings, multi-regulator reviews, open consent orders that require pre-approval of ownership changes, and incomplete license transfer packages.
Can small PE shops skip specialists?
Not on highly regulated names. Use a low-cost first-pass to decide whether and where to spend specialist dollars, then engage counsel for filings and sensitive issues.
What belongs in the SPA?
Conditions precedent for material approvals, interim covenants, specific indemnities for known orders, escrow for remediation, and cooperation clauses for regulator outreach.
How do you handle multi-jurisdiction targets?
Build a license heat map by revenue contribution. Prioritize jurisdictions that fund the investment thesis; treat long-tail permits as watch items with owners and budgets.
What does a dodilligence report include for this workstream?
Structured public-info synthesis: company context, risk themes, source-backed notes, and IC-style questions you can hand to counsel — not a substitute for privileged legal advice or filings.
Surface regulatory risk before you sign
Order a first-pass diligence PDF on your target — $49 list, $39.20 with DI20-WELCOME. Or grab a free brief to test the workflow.