Dropshipping business due diligence

Once a dropshipping deal is under LOI, diligence stops being about whether the business looks good on paper and starts being about verification: does the paperwork back up what the seller has represented, and does the data tell the same story as the narrative. Because this business model has almost no physical assets to inspect, nearly all of the real diligence work happens in documents, correspondence and platform data rather than a site visit — which makes it easy to under-invest in relative to a business with equipment or premises to walk through, and that is exactly the mistake that lets the real risks through.

The documents that actually matter

The central document, or lack of one, is whatever exists in writing between the store and its supplier — a signed agreement if there is one, or at minimum a correspondence history showing pricing, terms and any prior discussion of what happens if ownership changes. Ad account statements matter almost as much, because they let a buyer verify the true, current cost of acquiring a customer rather than relying on whatever number the seller has quoted; a business that looks profitable at the seller’s stated ad cost can look very different once the buyer pulls the actual account history. Delivery-time, order-accuracy and chargeback logs from the storefront platform and payment processor round out the core file, along with the standing of any marketplace account the business depends on.

Checks beyond the paper file

There is no dedicated registry search specific to dropshipping the way there is for a licensed trade, but a buyer should still confirm the marketplace or payment-processor account is in good standing and not flagged for a pending policy review, since either one can freeze the business’s ability to sell overnight. Where the product itself crosses an international border before reaching the customer, it is worth confirming who has actually been acting as importer of record on past shipments, because that is a mechanism that can differ from what the paperwork assumes and can carry tax exposure that only surfaces once someone checks.

The findings that actually kill this kind of deal

The single most common deal-killer is a supplier who, once asked directly, will not confirm continuing on the same terms for a new owner — sometimes because they simply prefer dealing with the person they already know, sometimes because they were already planning to change terms regardless of who owns the store. A close second is a delivery or complaint pattern that, once actually reconciled against order volume rather than taken at face value, shows the supplier relationship was already deteriorating before the sale was ever discussed. A third is discovering that marketing claims already live on the storefront — delivery promises, product-origin statements, images — that do not match what the supplier can actually deliver, which exposes the buyer to Competition Bureau risk on day one regardless of who wrote the original listing copy.

What a finding actually means once it appears

Not every finding is fatal, and treating them all the same way wastes negotiating leverage on the ones that do not matter. A handful of old chargebacks tied to a shipping method the seller has already switched away from is a very different signal than a chargeback rate that is climbing right up to closing — the first is resolved history, the second is an active problem the buyer is about to inherit. Similarly, a supplier who is slow to respond but ultimately confirms continuation on the same terms is a manageable communication issue, while a supplier who goes silent entirely, or who confirms only on materially worse terms, is telling the buyer the core asset in this deal is not actually transferring the way the purchase price assumes it will.

Verifying data and marketing compliance

The order and customer data the storefront collects is subject to federal privacy law, and to Quebec’s own privacy legislation for any Quebec-resident customer, separate from whatever the supplier itself sees to fulfil an order — a buyer taking on that data should confirm it has actually been collected and stored the way the store’s own privacy policy claims, rather than assuming compliance because nothing has gone wrong yet. Any marketing email sent after a purchase or to a subscriber list is separately subject to Canada’s anti-spam legislation, so a buyer inheriting that list should confirm consent records actually exist for it rather than treating a large subscriber count as an asset without checking how it was built. A store that cannot produce either of these on request is not necessarily non-compliant, but it is a business where the buyer is taking that compliance on faith rather than on evidence.