Commercial, Operational & Legal Due Diligence: After Approval: What Continues
Commercial, Operational & Legal Due Diligence does not end at approval — a set of obligations continues afterwards. The questions below are the ones raised most often in practice; the full scope of the service is on the Commercial, Operational & Legal Due Diligence page.
What is the difference between Commercial, Operational & Legal Due Diligence and Financial & Tax Due Diligence?
Financial & Tax Due Diligence examines whether the target's accounting records, revenue recognition, working capital, and tax positions are accurate and sustainable — it is fundamentally a review of the numbers. Commercial, Operational & Legal Due Diligence examines everything that determines whether those numbers will hold up after the deal closes: customer concentration and churn, competitive position, operational capacity, vendor dependency, material contracts, litigation, IP ownership, and labour compliance. A target can have immaculate financials and still be a poor acquisition if its top three customers can walk away, its key contracts terminate on change of control, or its core IP is registered in a departing founder's personal name.
In practice: We strongly recommend running both workstreams together and cross-referencing findings. A commercial red flag — say, 60% revenue concentration in two customers — has a direct financial consequence that should feed into the quality-of-earnings adjustment in the financial diligence report, not sit disconnected in a separate document.
Why does customer concentration matter so much in this diligence?
Revenue that depends heavily on a small number of customers is inherently more fragile than diversified revenue — a single customer's decision to switch suppliers, renegotiate terms, or simply not renew can materially change the target's trajectory, and that decision is often more likely, not less, immediately after an ownership change becomes known. We compute top-5 and top-10 customer revenue concentration, review contract tenure and renewal history, and specifically check whether major customer contracts contain change-of-control or assignment clauses that this specific transaction structure could trigger.
In practice: A target's largest customer relationship may be governed by an informal purchase-order arrangement with no long-term contract at all — technically terminable at any time, by either party, for any reason. That is a materially different risk profile than a five-year contract with a change-of-control consent clause, even if both targets show the identical revenue number from that customer today.
Does PNPC diligence India-UAE cross-border transactions?
Yes. PNPC has operating offices in Chennai, Bangalore, Hyderabad, and Dubai, and we coordinate cross-border diligence — an Indian buyer acquiring a UAE target, or a UAE-based buyer acquiring an Indian company — as a single engagement rather than splitting the work between unconnected correspondent firms in each jurisdiction. UAE-side considerations include UAE Corporate Tax registration and compliance status, Ultimate Beneficial Owner (UBO) and AML/CFT compliance, any legacy Economic Substance Regulations filings and penalty history for pre-2023 financial years (ESR reporting itself was discontinued for financial years commencing on or after 1 January 2023), trade licence validity and transferability, and WPS (Wage Protection System) payroll compliance, alongside the equivalent India-side review.
In practice: Cross-border diligence loses coherence fastest at the handoff between two firms in two countries who are not actually talking to each other. Our single-team structure across both jurisdictions is specifically designed to avoid that failure mode — one findings report, one set of recommendations, informed by both sides of the transaction.
How do you assess a target's IT and cybersecurity posture without an in-house technical audit team?
For most mid-market targets, we conduct a structured assessment covering system inventory and criticality, software licensing compliance, backup and business continuity practices, any history of data breach or security incident, and data privacy compliance relevant to the target's sector. Where a deal's scale or the target's technology dependency (a SaaS or data-heavy business, for instance) warrants a deeper technical security audit, we bring in a specialist cybersecurity firm as part of a coordinated engagement rather than presenting a surface-level review as a full technical audit.
In practice: We are candid with clients about where our own review reaches its natural limit and a specialist technical audit adds genuine value — particularly for technology-heavy or data-intensive targets where cybersecurity risk is a first-order commercial concern, not a checklist item.
How do you handle diligence on a target with operations across multiple Indian states?
Multi-state targets add a layer of complexity — state-specific labour law variations (Shops and Establishments Act registrations, state-specific professional tax), state stamp duty considerations on any asset or property transfer, and potentially multiple GST registrations that each need independent compliance verification. We map the target's full operational footprint at scoping stage and structure the diligence workplan to cover each material location, rather than reviewing only the headquarters location and assuming other locations mirror it.
In practice: Assuming compliance uniformity across a target's branch locations based on headquarters-level documentation is a common shortcut that generic diligence providers take under timeline pressure. We have found materially different compliance postures between a target's registered office state and its branch operations more than once — this is worth the additional scoping effort.
Should minority shareholders or a joint venture partner also commission their own due diligence?
In a joint venture, a minority stake acquisition, or a structured investment where governance and information rights will be shared between parties post-transaction, an incoming minority investor or JV partner has just as much reason to commission independent commercial and legal diligence as a full acquirer would — the fact that they are not buying full control does not reduce their exposure to the same underlying business risks, particularly where they will not have day-to-day operational visibility after closing.
In practice: Minority investors may skip independent diligence, sometimes relying entirely on the lead investor's diligence in a syndicated round. That can work when the lead investor's report is genuinely shared and its scope matches the minority investor's own risk concerns — but it is worth confirming explicitly rather than assuming, since diligence scoped for one investor's thesis may not cover every risk that matters to another.
Where this sits in the wider engagement
Commercial, Operational & Legal Due Diligence rarely arrives on its own. The statutory basis and the current requirements are set out on the Commercial, Operational & Legal Due Diligence service page, and the related services are grouped under Corporate Finance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Commercial, Operational & Legal Due Diligence we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.