M&A Data Room Checklist (Sell-Side)

A sell-side data room checklist is the master document the seller uses to populate a VDR for a European M&A process. The list below is the consolidated version of the major European mid-market checklists used by Big Four advisors, EU law firms, and corporate finance houses.

Last updated: May 2026.

01. Corporate

  • Articles of association / statutes (current and historical).
  • Shareholder register and cap table.
  • Shareholder agreements and voting trusts.
  • Board minutes (last 5 years).
  • Resolutions of significant transactions.
  • Subsidiary register, organigramme.

02. Financial

  • Audited financial statements (last 3–5 years).
  • Management accounts (monthly, last 24–36 months).
  • Working capital analysis.
  • Debt schedule and loan agreements.
  • Cash flow forecast / business plan.
  • KPI dashboard and segment reporting.
  • Bank statements and reconciliations.
  • Capex history and forecast.

03. Tax

  • Tax returns (corporate, VAT, payroll) — last 3–5 years.
  • Tax assessments and ongoing audits.
  • Transfer-pricing documentation.
  • VAT registrations and historical position.
  • Deferred tax position.

04. Commercial / Customer / Supplier

  • Customer list (top 20 by revenue, with contract copies).
  • Customer churn analysis.
  • Pricing schedule.
  • Supplier list (top 20 by spend, with contract copies).
  • Distribution / agency agreements.
  • Sales pipeline.

05. Legal

  • Material contracts (above defined threshold).
  • Joint ventures, partnerships.
  • Real-estate leases (own-use and investment).
  • Insurance policies and claims history.
  • Permits and licences.
  • Litigation register (current and last 5 years).

06. Intellectual Property

  • Patent register.
  • Trademark register.
  • Domain names.
  • Software licences (in and out).
  • IP assignments from employees and contractors.
  • Open-source compliance register.

07. IT and Cybersecurity

  • IT system landscape.
  • Cybersecurity policies and last penetration test.
  • GDPR record of processing activities (Article 30).
  • Sub-processor list and DPA register.
  • Incident register.

08. HR

  • Org chart and headcount by function.
  • Senior-management contracts.
  • Standard-form employment contract.
  • Pension and benefits arrangements.
  • Works-council and union agreements.
  • Litigation and grievance register.

09. Environmental and ESG

  • Environmental permits and audits.
  • Phase I / Phase II reports for owned property.
  • Carbon and energy reporting.
  • CSRD-aligned ESG data.

Frequently Asked Questions

Should the seller redact personal data before bidder access?

Yes. Pre-redaction of employee, customer, and supplier personal data is the GDPR-clean baseline for European M&A.

How early should the seller start populating the VDR?

Typically four to eight weeks before the planned launch of phase-1 marketing.

Further Reading