Due diligence request list for a payments company sale

How to use this list

Build the data room to this structure before the first buyer sees a teaser. Payments diligence is its own discipline, and the gaps that surface in it are where weaker processes lose a turn of value.

• Reconcile first. The processor statements, the residual reports and the financial statements must tie. A buyer who finds a gap between them stops trusting every other schedule.
• Lead with the four items buyers weight most: take-rate durability, merchant and partner concentration, portability of residuals and sponsor relationships, and the compliance record.
• Triage your own red flags. Anything on this list you would rather not produce is the thing to fix, disclose or price before launch, not during exclusivity.
• Keep identity out of it until NDAs are signed. The first-round room is anonymized; merchant names, contracts and regulatory correspondence are released in stages. See how we run a sale.

1. Corporate and ownership

• Articles, bylaws or shareholders’ agreement, minute books and board consents for the last three years.
• Capitalization table, option and warrant schedules, convertible instruments, and any prior financings or shareholder loans.
• Organization chart of entities, with the licensed or registered entity identified.
• Prior acquisitions or portfolio purchases, with the purchase agreements and any outstanding earnouts or buyout obligations.

2. Licences, registrations and exemptions

• State money transmitter licences with status, renewal dates and the most recent examination reports and correspondence; the NMLS record if applicable.
• Written exemption analyses or legal opinions where the company relies on payment processor, agent-of-the-payee or similar exemptions, state by state.
• FinCEN MSB registration (Form 107), renewal history and any re-registration filings; FINTRAC registration for a Canadian entity.
• Card-network registrations held by the sponsoring acquirer: Visa Third Party Agent or Payment Facilitator registration and Mastercard Service Provider registration, with the acquirer’s confirmation letters and the registration identifiers.
• Nacha third-party sender registration confirmation from the ODFI, if the company originates ACH.
• Any MATCH listing history for the company, its principals or its merchants, and how each was resolved.
• Which approvals a change of control will trigger, and the expected timeline for each. See change-of-control approvals when selling a payments company.

3. Sponsor bank, processor and network agreements

• Every sponsor bank, processor, gateway, network and ISV agreement with all amendments, schedules and pricing exhibits.
• For each: term and renewal, exclusivity, minimum volume or revenue commitments, pricing and interchange pass-through terms, reserve and collateral requirements, termination rights and fees, change-of-control and assignment provisions, residual buyout or right-of-first-refusal clauses.
• Current reserve balances and the history of reserve adjustments.
• Any notices of breach, pricing disputes or sponsor-initiated reviews in the last three years.

4. Merchant and portfolio data

• Thirty-six months of monthly residual or processing statements by processor, with merchant-level detail: volume, transaction count, gross revenue, interchange and network pass-through, processor cost, net residual or retained revenue.
• Attrition cohorts by vintage, by merchant count and by residual dollars, with the definition used.
• Concentration: top 20 merchants, top agents or referral partners, and top ISVs by net revenue, each as a share of the total.
• Portfolio mix: industry codes, card-present versus card-not-present, average ticket, regulated or high-risk verticals, geography.
• Pricing structure by segment: interchange-plus, tiered or flat; recent repricing actions and their effect.
• Chargeback and fraud ratios by month and by merchant, and the company’s standing in network monitoring programs, including the Visa Acquirer Monitoring Program and the Mastercard Excessive Chargeback Program.
• Agent and sub-ISO agreements with residual split schedules, non-solicitation terms and portability language.
• Merchant agreement templates in use, with the versions each cohort signed.

5. Financial

• Three fiscal years of financial statements plus the current year to date, with any audit or review reports, and management accounts by month.
• A revenue bridge from gross processing revenue to retained net revenue, reconciled to processor statements.
• Proposed EBITDA adjustments with support: owner compensation, agent commission normalization, one-time items, residuals already sold forward.
• Working capital analysis that separates settlement float, reserves and merchant funds from the company’s own cash; the working capital peg is set from this.
• Deferred revenue, prepaid residuals, equipment leasing or terminal financing arrangements.
• Tax returns, sales-tax treatment of fees and software, nexus analysis, and any open audits.

6. Compliance and risk

• AML and sanctions program: policies, risk assessment, independent testing, training records, OFAC screening procedures, and, for a registered MSB, suspicious activity reporting procedures and volumes.
• Merchant underwriting and onboarding procedures: KYC and KYB standards, prohibited and restricted categories, ongoing monitoring, and exception approvals.
• PCI DSS validation: the current Attestation of Compliance, the Self-Assessment Questionnaire type or Report on Compliance, the validation level set by the acquirer or card brands, and remediation history.
• SOC 1 or SOC 2 reports, penetration tests and vulnerability assessments for the last two years.
• Data-breach and security-incident history, notifications made, and insurance claims.
• Privacy program and consumer-data handling, including state privacy law obligations.
• Complaints log, regulatory inquiries, examination findings and remediation status.

7. Technology

• Architecture overview: gateway, tokenization vault, settlement and reconciliation systems, and which components are owned, licensed or outsourced.
• PCI scope definition and the network segmentation that supports it.
• Third-party and open-source dependencies, with licence terms.
• Uptime and incident history, disaster recovery and business continuity testing.
• Source-code ownership, contractor assignments and escrow arrangements.

8. Commercial

• Contracts with the top merchants, ISVs and referral partners, including pricing, term, exclusivity and termination rights.
• Sales pipeline, win and loss reasons, and the production record of each sales channel.
• Churn reasons by cohort, retention initiatives and their measured effect.
• Marketing commitments, revenue-share obligations and co-marketing agreements.

9. People

• Organization chart with roles, tenure and compensation; identification of key employees and single points of failure.
• Employment agreements, contractor and 1099 agent agreements, commission plans and non-solicitation or non-compete terms.
• Change-of-control, retention and severance arrangements.
• Benefits plans and any accrued liabilities.

10. Legal and insurance

• Litigation, arbitration, regulatory actions and demand letters, pending or threatened, for the last five years.
• Intellectual property schedule: trademarks, patents, domains, and any licences in or out.
• Insurance policies and loss runs: cyber, errors and omissions, crime, general liability, directors and officers.
• Material contracts not covered above, including leases and vendor agreements with change-of-control terms.

What buyers weight most

Workstream	What the buyer is really testing	What a soft answer costs
Portfolio data	Whether the retained take rate and the merchant base survive pricing cycles and ownership change	A lower multiple, or an earnout tied to attrition
Sponsor and processor agreements	Whether residuals and relationships transfer, and on whose consent	Closing conditions, holdbacks, or a buyer that must re-sponsor the book
Licences and exemptions	Whether the company has been operating within its legal perimeter in every state	Indemnities, escrow, or a walk-away
Compliance	Whether the buyer inherits an exam finding, a monitoring-program penalty or a breach	Price reduction and special indemnities
Financial reconciliation	Whether the EBITDA in the memorandum is the EBITDA in the statements	A retrade during exclusivity

The valuation mechanics behind these tests are set out in how buyers value a residual book, a payfac and a gateway; the buyer landscape in who buys payments companies.

Questions founders ask

What do buyers ask for first in payments due diligence?

The residual or processing statements reconciled to the financials, the merchant-level attrition and concentration data, every sponsor bank and processor agreement with its change-of-control and portability terms, the licence and exemption position, and the compliance record.

How far back should payments diligence data go?

Thirty-six months of monthly data by merchant is the usual request, because it lets a buyer build attrition cohorts by vintage and see pricing changes through a full cycle. Three fiscal years of financial statements plus the current year to date is the norm for the financial workstream.

Why assemble the data room before buyers are approached?

Because every item a seller cannot produce quickly becomes a price or terms discussion, and a competitive process only holds if several buyers can complete diligence on the same timetable.

References. PCI Security Standards Council, merchant resources (Self-Assessment Questionnaires and the role of payment brands and acquirers in setting validation requirements). Nacha, Third-Party Sender Registration. FinCEN, MSB Registration. Visa Acquirer Monitoring Program and Mastercard Excessive Chargeback Program thresholds change by region and date; confirm the current standards with the sponsoring acquirer. This list is general information and is not exhaustive; the buyer’s counsel and accountants will add requests specific to the transaction.

Windsor Drake is an independent sell-side M&A advisory firm headquartered in Toronto, advising founder-led fintech and payments companies. Windsor Drake is not a registered broker-dealer and does not offer, sell or place securities. Published October 1, 2026.