Small Business Due Diligence (2026): Checklist + SBA Rules

Last updated: October 2026

I've spent the last year fielding data-room questions from SBA 7(a) acquirers buying $1-5M HVAC and trades businesses, search-fund principals, family offices adding another Main Street company, and first-time buyers working out what "due diligence" means at the sub-$5M end of the market. Small business due diligence is not startup diligence with smaller numbers — it is a different workflow built around SBA underwriting, owner-adjusted earnings, owner dependency, and third-party consents the buyer does not control. The rules moved again on October 1, 2026, when SOP 50 10 8.1 added a mandatory lender QoE at $3M+ and took projections out of acquisition underwriting. I work on Peony, a data room platform used by 8,000+ teams across M&A, private equity, and search-fund workflows. This guide covers sub-$25M deals: the 5-axis scoping grid, the SBA document stack under 8.1, the lease, license and contract transfer map, the deal-killers, and a 170-day calendar.

What does due diligence on a small business involve? Proving five things before you close. (1) The earnings are real: three years of tax returns, monthly P&Ls and bank deposits reconcile, and every add-back has evidence. (2) The deal can be financed: for an SBA 7(a) initial acquisition that means at least 10% equity, an independent valuation once the price passes $350,000, a lender QoE at $3M+, 1.25x debt-service coverage on historical or lender-adjusted earnings (not projections), and owners who are all U.S. citizens or nationals. (3) Nothing is attached: entity good standing, UCC and tax liens, litigation and judgments. (4) The revenue transfers: customer concentration, contracts with assignment or change-of-control clauses, and customers who don't depend on the owner. (5) The business can legally keep operating under you: the lease, licenses held in the owner's name, equipment leases, merchant accounts and software all re-papered in the buyer's name. Plan for up to about 170 days: BizBuySell's 2025 median time to close, measured from listing to sale, was 170 days, with manufacturing slower (223 days) and retail faster (163).

---

Why is small business due diligence different from startup or PE diligence?

Because three things that barely matter in other deals decide this one: the price runs on owner-adjusted earnings, the financing usually runs on SBA 7(a) rules, and the business's right to operate often sits in the seller's own name.

Owner-adjusted earnings set the price. Seller's Discretionary Earnings (SDE) — EBITDA plus the owner's pay and discretionary or personal add-backs — is the standard yardstick for owner-operated businesses, because the working owner's salary is cash the next owner-operator takes home. BizBuySell's average cash-flow (SDE) multiple was 2.7x in both Q1 and Q2 2026. Businesses with a paid manager in place trade on EBITDA instead; Stanford's 2024-25 search-fund cohort paid a median 6.2x. The most common pricing error is mixing the two — applying an EBITDA multiple to SDE that still includes the owner's pay.

SBA rules shape the buyer pool. The Standard 7(a) loan tops out at $5 million (SBA's guaranteed share at $3.75 million), and 7(a) Small (up to $350,000) and SBA Express (up to $500,000) loans can also finance changes of ownership; under 8.1 they follow the Appendix 15 rules, with an in-house valuation allowed at a purchase price of $350,000 or less. In BizBuySell's Q2 2026 survey, 78% of buyers expected to use SBA financing. Above the 7(a) ceiling the buyers are search funds, family offices and independent sponsors, whose diligence looks more like PE-lite.

The records are tax-driven, not GAAP-driven. Many owner-operated businesses keep cash-basis, tax-driven books (Schedule C, Form 1120-S) and have never been audited. Diligence has to bridge from tax returns and bank statements to true cash flow without an auditor's opinion — which is what a quality of earnings review does, and why SBA now requires one at $3M+.

The 2026 market is more selective. BizBuySell's 2025 Year in Review counted 9,586 small business transactions at a median sale price of $350,000 and 94% of asking price — a market in balance. 2026 has turned selective: 2,345 deals in Q1 (-1% YoY) and 2,117 in Q2 (-10% YoY), with a Q2 median sale price of $349,250, and 45% of brokers said lending conditions were making deals harder to complete (Q1 2026). SBA guaranteed 77,600 7(a) loans for $37 billion in FY2025 — part of what it called the most capital it has ever delivered. FY2026, the first full year under the tighter SOP 50 10 8 rules, fell to 56,130 7(a) loans for $32.4 billion. Sellers are underprepared: in BizBuySell's Q2 2026 survey, 52% of owners said they have an exit plan, but only 14% had completed a professional valuation and 35% had no idea what the business is worth; retirement was the top reason to sell (45%).

---

How do you scope diligence on a small business? The 5-axis intensity grid

Score the deal 1-3 on five axes — deal size, business type, buyer profile, owner dependency and records quality — and let the total set the depth. This is my scoping tool, not an industry standard; it exists so the buyer and the broker agree early on which workstreams matter for this deal.

5-7 (light). Financial review with a bank-deposit-to-tax-return check, entity and lien searches, and the lease and license review. A limited-scope financial review is usually enough unless the lender requires more.

8-11 (standard). Full QoE, working capital schedule, customer concentration testing, the full consent map for leases, licenses and contracts, and key contract reviews.

12-15 (deep). Add commercial diligence (customer interviews, market study), operational and IT diligence, environmental work where the property triggers it, and an R&W-versus-escrow decision.

Two SBA rules override the score: an SBA initial acquisition at a $3M+ purchase price needs a lender-engaged QoE whatever it scores, and a Phase I is required wherever commercial real estate securing the loan has an environmentally sensitive use. For budgets by line item, see the due diligence cost breakdown.

---

What SBA documents does a buyer need under SOP 50 10 8.1?

SOP 50 10 8.1 took effect October 1, 2026 for applications SBA receives from that date; it folds every change-of-ownership rule into a new Appendix 15, which governs where it conflicts with the rest of the SOP. Applications submitted through September 30, 2026 stay under SOP 50 10 8. The rules below are read from the SOP text and SBA Information Notice 5000-882227 — confirm how your lender applies them.

What that means on a $3M project. The buyer needs at least $300,000 of equity, measured on total project cost rather than purchase price. A full-standby seller note (plus any other limited sources) can supply at most $150,000. At least the other $150,000 must come from unborrowed cash (gifts included), a personal loan repaid from outside the business, a non-repayable grant, or verified prepaid expenses. Money you spend on the valuation and QoE counts toward the injection, and any price above the lender's valuation must be covered by equity.

Guaranties. Every 20%+ owner gives a full personal guaranty (standard SBA rule, unchanged in 8.1). A selling owner who keeps less than 20% after a partial change of ownership must give a full guaranty for at least two years after final disbursement, and can be released only once the loan has been current for 12 consecutive months (introduced in SOP 50 10 8, carried into 8.1). If trusts own 20% or more in total, each trust guarantees and the trustor guarantees personally. For search funds, the citizenship rule reaches through the holding structure: one non-citizen investor anywhere in the chain makes the deal ineligible for SBA financing.

The SBA acquisition document set:

1. Equity injection evidence. Bank statements, gift letters or grant documents showing the source of every dollar.
2. Seller-note standby agreement. Full standby for the life of the 7(a) loan — drafted and signed during diligence, not at close.
3. Personal financial statements and guaranties. A personal financial statement from every individual guarantor, dated within 90 days of loan approval (SBA Form 413 or the lender's equivalent), and the guaranties described above.
4. IRS tax transcripts for the seller and the buyer. The lender pulls them through IVES (Form 4506-C) or by filing Form 8821 with the lender named as designee; SBA does not let the borrower or its own tax preparer file the 8821. The IRS must receive a 4506-C within 120 days of the signature date or it rejects it, and IVES fax requests return in about 2-3 business days. Under 8.1, change-of-ownership transcripts are part of the financial due diligence that verifies what the seller reported.
5. Purchase agreement and every schedule. The lender reviews all of them; a working-capital true-up in the agreement is not treated as a seller rebate, and the borrower can keep that cash.
6. License evidence. State, local and professional licenses and permits, with the lender taking a security interest in transferable licenses such as a liquor license.
7. Phase I environmental site assessment where commercial real estate (owned, or a leasehold mortgage) secures the loan and its current or past use matches SBA's list of environmentally sensitive NAICS codes — auto repair, gas stations, many manufacturing subsectors (assembly-only is exempt) and trucking with service bays, for example. That applies regardless of loan size. On-site dry cleaners need a Phase I and a Phase II.
8. Lender's business valuation and, at $3M+, the QoE. Both are engaged by the lender. PLP lenders must have them formally engaged (vendor retained, engagement letter in place) by the time the SBA loan number is issued; non-delegated submissions include both with the application.

Each of these has a different audience — the lender needs the personal financial statements, the QoE firm does not need the guaranty package — so stage them by party rather than in one shared folder.

---

When is a quality of earnings report required on a small business acquisition?

In owner-operated deals, the owner's pay is usually the add-back that moves the price most, and since October 1, 2026 a lender-engaged QoE is mandatory on SBA initial acquisitions priced at $3M or more. SDE adds back the whole owner salary, so before you apply an EBITDA multiple, subtract what a market-rate manager would cost. Which add-backs survive, and how the proof-of-cash test works, are covered in our quality of earnings guide (see proof of cash, and why no reliable share-of-add-backs-rejected figure exists). For SBA initial acquisitions of $3M or more, SOP 50 10 8.1 makes that test mandatory: the lender's QoE must include a Cash Proof reconciling bank statements to the income statement and tax returns for the trailing 12 months and the last two fiscal years. SBA also requires owner-compensation adjustments to pass a global cash-flow test at 1:1.

Limited-scope reviews exist at very different price points (ProjectionHub, for example, sells a QoE "Sniff Test" for under $1,000), but none satisfies SBA's QoE requirement at $3M+. Full QoEs are delivered by accounting and transaction-advisory firms; for SBA deals at $3M+, by an independent, experienced financial professional engaged for the lender, never by or for the seller.

Does a QoE raise the price at this size? Rarely. GF Data's Fall 2025 study found sellers with a sell-side QoE averaged 7.4x TEV/EBITDA versus 7.0x without, but the benefit was most notable above $50M of enterprise value, and smaller deals in its sample (360 deals completed since Q3 2024) tended not to see a valuation boost. Below that, the reason to run one is risk: it finds add-back inflation, working-capital window dressing and customer concentration before they become post-close losses.

---

How much customer concentration can a small business deal carry?

There is no SBA cap: SOP 50 10 8.1 sets no concentration threshold, but on $3M+ acquisitions the lender's QoE must assess customer concentration and contract continuity, and debt-service coverage is computed on QoE earnings — so a fragile customer base shrinks the loan.

The test: pull invoice-level revenue for the trailing 24 months, rank customers, calculate top-1 / top-3 / top-5 / top-10 shares, and re-run debt-service coverage without each top-3 customer in turn. At SBA's 1.25x minimum, that is the stress test the lender will run.

Earnouts are off the table for SBA deals. SOP 50 10 8.1 prohibits seller earnouts. For SBA-financed deals, reprice, put more of the price into a full-standby seller note (still capped with other limited sources at half the injection), or use a buyer rebate tied to performance, which SBA allows and which must pay down the 7(a) principal. Earnouts remain available on conventionally financed or search-fund deals — see how to structure an earnout.

---

Which problems kill small business deals most often?

Six categories break small business deals most often in my experience (no public dataset ranks them by frequency). The sourced anchor is Stanford's 2026 Search Fund Study: "discovery in due diligence" was the most-cited reason a searcher's LOI fell through (79% of respondents), ahead of valuation differences (45%) and lack of investor support (40%).

1. A lease, license or contract consent fails. The landlord uses the sale to reset rent or demand a new guarantee, or a license held in the owner's name cannot move. Start on day one of the LOI — the full map is below.

2. Working capital peg dispute. Deferred revenue treatment, payables classification and pre-close window dressing (stretched payables, accelerated receivables) drive most fights. Put the NWC formula and a defined tolerance band in the LOI; our financial due diligence guide walks through the peg and the true-up. Under SOP 50 10 8.1 a working-capital true-up in the purchase agreement is not a seller rebate, and the borrower can keep the cash.

3. Customer concentration discovered late. Get top-3 percentages (no names) from the broker before the LOI. For SBA deals, use the earnout alternatives above.

4. Inherited tax liability. Unpaid payroll taxes, uncollected sales tax, worker misclassification and unreported income. Successor liability is statutory in places: in California, a buyer who doesn't withhold from the price until CDTFA issues a tax clearance certificate becomes personally liable for the seller's unpaid sales tax up to the purchase price, and CDTFA must issue the certificate or a demand within 60 days of the latest of the request, the sale, or the records being made available (Rev. & Tax. Code §6811-6812). Get transcripts moving in week one and request clearance wherever your state offers it.

5. Owner dependency. When customers buy from the owner rather than the business, the price has to move or the transition has to be long. A broker quoted in BizBuySell's Q2 2026 report called minimized owner dependence an "absolute prerequisite" to closing. Audit it in week two (the four dimensions are in the FAQ below); for SBA deals the seller can stay on only as a consultant, for up to 24 months in total.

6. Equipment or inventory overvaluation. SBA itself values used equipment at no more than 50% of net book value (80% with an orderly-liquidation appraisal) when testing whether the loan is fully secured, so an orderly-liquidation appraisal can reduce how much personal real estate the lender has to take as collateral. Order appraisals before the working capital peg is set.

For red flags by workstream, see due diligence red flags.

---

What does a 170-day small business due diligence calendar look like?

Plan for up to about 170 days. That is BizBuySell's 2025 median time to close, measured from listing to sale rather than from a buyer's first look, with retail at 163 and manufacturing at 223 (manufacturing stretched to 247 days in Q2 2026). Most of the buyer's own diligence resolves by day 90; the back half waits on the lender and on third-party consents.

Days 1-14: search to LOI.

• Broker contact and first document review
• Financial pre-screen (3 years of tax returns, monthly P&Ls)
• Top-3 customer concentration disclosure (no names)
• Read the lease and list every license, permit and contract held in the owner's name
• LOI terms: working capital peg formula, no-shop period, escrow or holdback expectations — and, for SBA deals, no earnout

Days 15-45: post-LOI financial diligence and lender engagement.

• Lender orders the business valuation and, at a $3M+ purchase price, the QoE. Under SOP 50 10 8.1 the QoE must be prepared for your lender — coordinate before you engage a QoE firm
• Seller signs the tax-transcript authorization; the lender (or its IVES vendor) submits it
• Working capital schedule (trailing 12-month NWC)
• Earnings bridge (tax return → reported → normalized) with a bank-deposit reconciliation
• Customer concentration testing (top 1/3/5/10)
• Owner and family compensation normalized to market
• Landlord, licensing-agency and key-contract consent requests go out

Days 46-90: legal and operational diligence.

• Entity good standing (state of formation and operating states)
• UCC, federal and state tax lien searches
• Civil litigation (PACER and state courts)
• Top customer and supplier contracts reviewed for assignment and change-of-control clauses
• Owner-dependency audit
• Phase I environmental where real estate collateral triggers it
• Equipment appraisal if material

Days 91-135: SBA underwriting.

• Full loan package to the lender; debt-service coverage tested on historical or lender-adjusted earnings, not projections (1.25x for an initial acquisition)
• Equity injection evidence and the seller-note standby agreement
• Guaranty package and personal financial statements dated within 90 days of approval
• Credit decision and SBA approval

Days 136-170: close prep.

• Final purchase agreement and schedules
• Escrow or holdback setup (size and duration negotiated)
• Working capital peg confirmed
• Landlord consent and license transfers executed; the buyer's merchant account live
• Transition plan (for SBA deals, seller consulting of up to 24 months in total)
• Close

---

How is search-fund diligence different from an SBA buyer's?

It is bigger, more investor-facing and, where SBA money is involved, more exposed to the ownership rules. Search funds closed 14% of the deals done on Axial's platform in 2025, an all-time high, at an average enterprise value of about $11.9M, and Stanford's 2026 Search Fund Study is the benchmark searchers and their investors use.

The 2026 numbers (862 core search funds since 1984): a 58% acquisition rate across concluded searches, but 48% for funds launched 2021-24; a median of about 20 months from search to acquisition; 2024-25 acquisitions at a median $16.0M purchase price and 6.2x EBITDA, down from about 7x in the two prior cohorts; and an aggregate IRR of 33.9% and ROI of 4.75x as of December 31, 2025, versus 35.1% and 4.5x in the 2024 study. Acquirers in the 2024-25 cohort signed 2.5 LOIs on average before closing one.

The multiple and the size are higher. Companies searchers have acquired since 2020 typically had a 25% EBITDA margin and 30-40 employees. SDE matters less here — a market-rate manager's salary is usually already in the P&L.

The depth is closer to PE-lite. Expect full QoE, full legal, commercial diligence (customer interviews, market study) and operational diligence.

Investors read the diligence. Searchers in the 2024-25 cohort raised a median $550,000 per principal from a median of 13 investors (earlier cohorts had 15-16), and those investors expect investor-grade diligence reporting — which is why a searcher's room needs separate views for investors, lender and QoE team (see search fund data rooms).

SBA rules bite. If the deal uses SBA money and the price is $3M or more, the lender's QoE applies; the seller can consult for no more than 24 months; earnouts are out; and every direct and indirect owner — every investor in the holding structure — must be a U.S. citizen or national. R&W insurance is an option to price at the top of this range; model it against a larger escrow.

---

Which leases, licenses and contracts must be transferred before you close?

Anything the business runs on that sits in the seller's name or needs a third party's consent — the lease, licenses held through the owner, equipment leases, merchant processing, software, franchise rights and government contracts — and each one moves on the other party's clock, not yours. Deal structure matters: in an asset purchase every lease and contract has to be assigned; in a stock purchase the entity keeps them, but change-of-control clauses can still require consent. Our legal due diligence guide covers building the full consent map; this is the small-business version.

The landlord is the usual bottleneck. Even where consent "shall not be unreasonably withheld," landlords often use the request to renegotiate rent, term, deposit or a personal guarantee from the new owner. Some leases bar assignment outright, and franchised locations usually need the franchisor's approval too. The landlord's response time is set by the lease, not by statute — read the consent clause for a response window and start on day one of the LOI.

SBA adds its own lease test. When the lesser of $500,000 or 30% of loan proceeds goes into leasehold improvements — or the same share of the collateral is improvements, fixtures or equipment attached to leased premises — the lender must get the lease. The lease term, including renewal options only the tenant can exercise, should equal or exceed the loan term (change-of-ownership loans amortize over up to 10 years, longer only for real estate), and the lender should obtain an assignment of lease and a landlord's waiver.

Check who holds each license. Many states use the qualifier model for contractor and trade licenses, so confirm whether a license belongs to the company or to the owner personally, and line up a replacement qualifier before close. For multi-location businesses, run the consent workstream in parallel across every site — a single refusal can stall the whole deal.

---

Are seller non-competes still enforceable after the FTC rule was vacated?

Yes — non-competes signed with the sale of a business survive both the FTC's retreat and the state bans, provided they are reasonable. A Texas federal court set aside the FTC's noncompete rule in August 2024. On September 5, 2025 the FTC voted 3-1 to drop its appeals and accept the vacatur, and it now pursues noncompetes case by case; it held a public workshop on January 27, 2026.

Sale-of-business covenants are carved out of the state bans (e.g., California Bus. & Prof. Code §16601, Minnesota §181.988 subd. 2(b)(1), Wyoming §1-23-108(a)(i)) but must still be reasonable in geography and length. Size the term to the goodwill you are paying for, with counsel.

For employee non-competes already in place at the target, state law governs: California, Minnesota, North Dakota, Oklahoma and (since July 1, 2025) Wyoming bar most non-competes, while Washington, Colorado and several other states restrict them by earnings. Review the target's employee covenants during diligence, especially if your retention plan relies on them.

---

When does R&W insurance make sense for a small business deal?

Rarely below $10M, and as a priced option above it. Average quoted primary R&W rates rose from 2.5% of the policy limit in Q4 2024 to 3.23% in Q4 2025, per Gallagher's transactional-risk data. At 3.23%, a $3M limit implies roughly $97K of premium before taxes and fees, plus a retention and underwriter exclusions for known issues and anything diligence didn't cover.

• Under $10M: seller indemnification plus an escrow or holdback (size and duration negotiated) is the usual risk-allocation tool.
• $10-25M: price R&W against a larger escrow. A policy lets the buyer ask for cleaner reps because the insurer, not the seller, backs them.

The test: model total seller exposure and buyer protection both ways — premium plus a smaller escrow, versus a larger escrow with no policy — and pick the cheaper path that still covers the risks diligence can't see.

---

What should a solo buyer check in the first 7 days?

Seven checks, one a day, that surface the risks most likely to break the deal before you pay for a QoE.

Day 1 — Financial pre-screen. Pull 3 years of business tax returns, the last 12 months of monthly P&Ls and the latest balance sheet. Calculate trailing 12-month SDE, compare it to the asking price's implied multiple, and flag any year-over-year revenue or earnings swing above 20%.

Day 2 — Customer concentration. Request 24 months of revenue by customer, without names. Calculate top-1, top-3, top-5 and top-10 shares. If the top customer is over 30%, decide now whether the price can absorb it — for an SBA deal that means a reprice, a larger full-standby seller note or a performance-based buyer rebate, not an earnout.

Day 3 — Lease, license and contract review. Read the lease's assignment clause, consent standard, remaining term (against a loan of up to 10 years) and escalations. List every license, permit, merchant account and software admin seat in the owner's name.

Day 4 — Online reputation. Read several pages deep on Google, Yelp and BBB and look for a recurring complaint across recent reviews. For employee turnover, check the Glassdoor rating trend over time.

Day 5 — Owner-dependency interview. Ask the seller who handles the top-5 customer relationships, vendor negotiation, pricing, hiring and the books. If the answer to all five is "me," plan for a long transition — for an SBA deal, a consulting agreement of up to 24 months — and price for the risk.

Day 6 — Tax transcript authorization. Ask the seller to sign a transcript authorization. For an SBA deal your lender (or its IVES vendor) submits it; your own accountant cannot file the 8821. Check that the transcripts match what the seller has shown you.

Day 7 — Lien and litigation search. Run a state good-standing check, UCC searches at state and county level, federal and state tax lien searches, and a PACER civil litigation search. Send any judgment, bankruptcy or active case to counsel.

---

How does small business diligence compare with startup and PE diligence?

The workstreams overlap, but valuation, financing and the deal-killers differ.

Applying the wrong template is expensive either way: if a full QoE cost $40,000, on a $1.5M deal that would be 2.7% of the price, while a limited-scope review on a $50M deal misses the earnings-bridge issues a PE buyer needs to see.

---

Frequently asked questions

What is small business due diligence and how is it different from startup or PE due diligence?

Small business due diligence is the review a buyer (an SBA-financed individual, search fund, family office or independent sponsor) runs on a profitable, owner-operated Main Street or lower-middle-market business before closing. It differs from startup diligence, which judges unprofitable companies on growth potential, and from large PE diligence, which works from audited financials and institutional sellers. Three things set it apart: the price rides on owner-adjusted earnings (SDE) rather than audited EBITDA, financing usually runs through SBA 7(a) rules, and the right to operate (lease, licenses, merchant accounts, contracts) often sits in the owner's own name and has to be re-papered for the buyer. BizBuySell's 2025 median time to close, measured from listing to sale, was 170 days.

We're an SBA 7(a) buyer acquiring a $3M revenue HVAC business — what changed with SBA SOP 50 10 8.1 (effective October 1, 2026)?

SOP 50 10 8.1 applies to applications SBA receives on or after October 1, 2026 and moves every change-of-ownership rule into a new Appendix 15. New in 8.1 for an initial acquisition: the lender must obtain a quality of earnings report with a Cash Proof when the purchase price is $3 million or more (the trigger is price, not revenue, so many $3M-revenue HVAC deals fall below it); the lender may value the business in-house only at a purchase price of $350,000 or less (previously $250,000 financed), so an independent business valuation applies above that; debt-service coverage must reach 1.25x (up from 1.15x) on the last fiscal year or a two-year average, historical or lender-adjusted, and projections cannot be relied on; the seller can stay on as a consultant for up to 24 months (up from 12); and personal financial statements from every individual guarantor must be dated within 90 days of loan approval. Still in force from SOP 50 10 8 and its updates: the 10% equity injection cannot be reduced, and seller notes on full standby plus other limited sources can supply no more than half of it; seller earnouts are prohibited; and since March 1, 2026 every direct and indirect owner must be a U.S. citizen or U.S. national. Confirm specifics with your lender.

Our search fund is evaluating a $5M revenue business — what should we expect from the quality of earnings work?

Expect a full QoE: searchers' investors expect investor-grade diligence reporting, and the QoE produces the bridge from tax-return earnings to normalized EBITDA that supports the multiple. If the deal is SBA-financed and the purchase price is $3 million or more, SOP 50 10 8.1 requires the QoE to be prepared for the lender, with a Cash Proof reconciling bank statements to the income statement and tax returns for the trailing 12 months and the last two fiscal years, so ask your lender which firms it accepts before you engage one. Under the SOP, a QoE you commissioned yourself can be used only after one of the lender's vendors reviews it; SBA's Information Notice 5000-882227 also allows a reliance letter, so ask your lender which it accepts. For context, Stanford's 2026 Search Fund Study (862 funds since 1984) puts the 2024-25 median purchase price at $16.0M and the median multiple at 6.2x EBITDA. Cost depends on scope; our due diligence cost breakdown has the benchmarks.

What customer concentration level kills a small business deal?

There is no single number. SOP 50 10 8.1 sets no concentration cap, but on $3M+ SBA acquisitions the lender's QoE must assess customer concentration and contract continuity, and debt-service coverage is computed on QoE earnings, so a fragile customer base shrinks the loan. In our experience, buyers start asking hard questions once the top customer passes 20% of revenue, and from 30% the price, the structure or the buyer usually changes. For SBA-financed deals earnouts are off the table; the options are a lower price, more of the price in a full-standby seller note (still capped with other limited sources at half the equity injection), or a buyer rebate tied to performance, which SBA allows and which must pay down the 7(a) principal.

We're buying a $1.2M-SDE business — should we use an SDE multiple or an EBITDA multiple?

Run both, and never mix them. SDE (EBITDA plus the owner's pay and discretionary add-backs) is the standard yardstick for owner-operated businesses; BizBuySell's average cash-flow multiple was 2.7x in Q1 and Q2 2026. An EBITDA multiple assumes a paid manager, so first subtract what a market-rate manager would cost from the $1.2M; Stanford's 2024-25 search-fund cohort paid a median 6.2x EBITDA for much larger businesses. The classic error is applying an EBITDA multiple to SDE that still includes the owner's pay, which produces a price no lender will finance. If the deal is SBA-financed, owner-compensation adjustments must also pass a global cash-flow test at 1:1, so the new owner's pay has to cover their obligations and living expenses.

What documents should we request in a small business due diligence request list?

Cover six workstreams. Financial: 3 years of business tax returns, monthly P&Ls, balance sheets, bank statements, AR and AP agings, 24 months of revenue by customer, purchases by supplier, a working capital schedule and an equipment list. SBA: personal financial statements from every individual guarantor dated within 90 days of approval, a signed tax-transcript authorization, equity-injection evidence, the seller-note standby agreement, license evidence, and a Phase I where real estate collateral triggers one. Legal: good-standing certificates plus UCC, tax-lien, litigation, judgment and bankruptcy searches. Commercial: top customer and supplier contracts, the lease, franchise and licensing agreements, and anything with an assignment or change-of-control clause. HR: employee roster with pay, key-employee agreements, owner and family compensation history, and existing non-competes. Operations: SOPs, maintenance records, inventory reports, insurance policies, merchant-processing and software accounts, and customer review trends.

How long does small business due diligence take, and what is the typical 170-day calendar?

BizBuySell's 2025 Year in Review put the median time to close (listing to sale) at 170 days, with retail at 163 and manufacturing at 223, so plan for up to about 170 days. For an SBA-financed deal, plan five phases: pre-screen and LOI (days 1-14); financial diligence, with the lender ordering the business valuation and any $3M+ QoE while landlord, license and contract consent requests go out (days 15-45); legal and operational diligence (days 46-90); SBA underwriting on historical or lender-adjusted earnings, not projections (days 91-135); and close prep (days 136-170). The buyer's own work usually resolves by day 90; the back half waits on the lender and third parties.

What does small business due diligence typically cost on a $1-5M acquisition?

It depends on deal size, records quality and whether SBA requires a lender QoE, so treat any single range with caution. The line items are an attorney (purchase agreement, entity and lien work, lease review), a financial review or QoE, the lender's business valuation, an environmental report where real estate collateral triggers one, lien and court searches, and equipment or inventory appraisals when they matter to value. As arithmetic, $50,000 of diligence on a $2M deal is 2.5% of the price. Under SOP 50 10 8.1, what the buyer pays for the valuation and QoE counts toward the SBA equity injection. The data room is the smallest line: Peony's Data Room plan is $52 per admin per month billed yearly ($75 monthly), with unlimited data rooms and storage and free, unlimited viewers. Our due diligence cost breakdown has benchmarks by workstream.

How do we audit owner dependency in small business due diligence?

Test four dimensions. Customer relationships: for the top 20 customers, check who actually manages each account through the owner's calendar, email traffic and named account managers. Decision-making: list which decisions (pricing, hiring, vendors, large purchases) need the owner and which run on documented procedures. Technical knowledge: in trades businesses, check whether only the owner can do certain jobs or holds the license the business operates under. Financial controls: see whether the books are run by the owner or by a team with written procedures. A broker quoted in BizBuySell's Q2 2026 report called minimized owner dependence an "absolute prerequisite" to closing. The evidence buyers want: accounts already moving to employees, SOPs for critical workflows, key staff on retention agreements, and a transition plan; for SBA deals the seller can stay on only as a consultant, for up to 24 months in total.

Is R&W insurance worth it on a small business acquisition?

Rarely below $10M, where seller indemnification plus a negotiated escrow or holdback is the usual tool. On $10-25M deals, price R&W against a larger escrow. Average quoted primary R&W rates rose from 2.5% of the policy limit in Q4 2024 to 3.23% in Q4 2025, per Gallagher's transactional-risk data; at 3.23%, a $3M limit implies roughly $97K of premium before taxes and fees, plus a retention and exclusions for known issues.

What are the most common deal-killers in small business M&A?

Six categories break small business deals most often in our experience; no public dataset ranks them. They are: a lease, license or contract consent that fails or re-prices the deal; a working capital peg dispute; customer concentration discovered late; inherited tax liabilities such as unpaid payroll or sales tax; owner dependency that only surfaces in diligence; and equipment or inventory valued above what an appraisal supports. The sourced anchor: in Stanford's 2026 Search Fund Study, discovery in due diligence was the most-cited reason an LOI fell through (79% of respondents). Most fixes are about timing: consents and concentration checks start before or at the LOI, not after.

What is the best data room for small business due diligence, and how should the buyer, seller, lender, QoE firm and attorney share the files?

Our pick is Peony, the data room we build, because a small business deal has five parties who should each see different files: use one room with a separate group for each party instead of emailing PDFs. In Peony each group gets its own folder permissions — No access, View, Download or Upload — so the seller uploads into request folders, the lender sees the SBA package, the QoE firm sees financials and bank statements, and the attorney sees contracts and the lease. Turning on Hide new content by default keeps a newly added file private until you grant it. Each group can sit behind its own NDA: the e-signed Advanced NDA, dynamic watermarks and granular permissions are on the Data Room plan, $52 per admin per month billed yearly ($75 monthly), with unlimited data rooms and storage and free, unlimited viewers. Page-level analytics show which pages each person opened and for how long, so you can see whether the credit officer actually read the customer-concentration schedule. Keep files in the tracked viewer and turn off downloads where you can: a downloaded copy leaves the tracked environment. Data Room has a 7-day trial with no credit card.

---

Related Resources

• Quality of Earnings — which add-backs survive, the proof of cash, and what a QoE costs
• Financial Due Diligence — the working capital peg and true-up in detail
• Legal Due Diligence — the change-of-control consent map
• Due Diligence Red Flags — warning signs by workstream
• How to Structure an Earnout — for conventionally financed and search-fund deals (SBA prohibits seller earnouts)
• Best Home-Services M&A Advisors — the HVAC/plumbing/electrical sell-side bench, the consolidator map, and why the 2-week exploding offer is a pricing strategy
• How to Acquire a Company in 2026 — the full acquisition journey this DD guide plugs into: financing design under the current SBA SOP, the 75-day close plan, and the buyer-built deal room
• IT Due Diligence — 6-axis fragility audit for tech-enabled SMBs and lower-mid-market
• Tax Due Diligence Checklist — payroll tax, sales tax, and successor-liability risk
• Environmental Due Diligence — Phase I/II for SBA acquisitions
• Vendor Due Diligence Checklist — procurement-side vendor risk (distinct from sell-side VDD)
• Sell-Side Due Diligence — what the seller commissions before going to market
• Ecommerce Due Diligence Checklist — the online-business specialization of this framework: platform accounts, supplier terms, and traffic verification
• Cybersecurity Due Diligence — breach posture and ransomware exposure for tech-enabled SMBs
• M&A Due Diligence Process Guide — the full M&A DD framework
• Startup Due Diligence Guide — pre-product VC-backed startup DD (distinct audience)
• Due Diligence Cost Breakdown — comparative costs across deal sizes
• Investment Due Diligence Checklist — for LPs and family-office investment teams
• Best Data Room for Small M&A — sale-side VDR pick for sub-$30M deals
• Best Data Room for Small Business — the general small-business secure-sharing room
• Clinic Sale Data Rooms — the quiet-sale playbook for physio, chiro, and rehab clinic owners (and the brokers who run their mandates).
• Search Fund Data Rooms — the buyer-built room this checklist feeds: collect from the seller, share scoped views with lender and QoE.

For SBA-buyer diligence, Peony's AI room generation builds a diligence folder structure from a one-line prompt, and Index documents numbers every file ("open 2.3") so the buyer, lender and QoE team reference the same document (Data Room plan). Peony's AI document Q&A answers questions across every file in the room with page-level citations — e.g. "which contracts need consent to assign?" — so you jump to the clause instead of opening every file (Business plan and up; 5x usage on Data Room; not available during the trial). Screenshot protection blocks native screenshot shortcuts and screen recording on supported desktop browsers (Business+), Screenshield reduces what can be captured on mobile (Data Room+), and dynamic watermarks (Data Room+) keep the viewer's identity on any photo of the screen. Start a 7-day Data Room trial — no credit card; AI features switch on when you upgrade.

About the author: Deqian Jia leads content strategy at Peony, the data room used by 8,000+ M&A, PE, fundraising, and search-fund teams. Prior experience includes M&A advisory and search-fund due diligence support across $500K-$50M deal sizes.