Due diligence on an e-commerce business

Due diligence on an e-commerce business has to dig past the sales dashboard, because the numbers a platform reports don’t tell a buyer whether the revenue is durable, whether the accounts behind it can actually be transferred, or whether customer data has been handled the way Canadian privacy law requires. A thorough review treats the technical and account-level details as seriously as the financial statements.

Reconcile platform data against the bank and the books

Marketplace and payment processor dashboards report gross sales, fees and payouts in their own formats, and a buyer should reconcile that reported activity against actual bank deposits and the seller’s bookkeeping rather than accepting a platform’s summary screen as the full financial picture. Discrepancies between what a platform shows and what actually landed in the bank are worth understanding before they’re explained away.

Test whether revenue is concentrated or resilient

Look at how much of total revenue comes from the largest customers, the top-selling products and any single traffic or advertising source, because heavy concentration in any of those means the business is more fragile than the top-line numbers suggest. A store where the majority of sales trace back to one product, one platform or a small handful of repeat buyers carries a different risk profile than one with a broadly diversified base. Ask what happened the last time a top customer or product line underperformed, and how the business responded, since that history says more about resilience than the current snapshot does.

Verify what will and won’t transfer at closing

Marketplace seller accounts, payment processor accounts, advertising accounts and the domain itself each have their own transfer rules, and current policy needs to be confirmed directly with each platform rather than assumed from what worked for someone else’s deal. Build a specific list of every account the business depends on, and get a straight answer, in writing where possible, on what actually happens to each one at closing. Where a platform’s answer is vague or non-committal, treat that uncertainty as a real risk to be priced into the deal rather than assumed away.

Examine customer data handling and cybersecurity practices

An e-commerce business holds personal information about its customers and is subject to Canadian privacy obligations around how that data is collected, used and protected. Ask for the store’s privacy policy, any history of data incidents, and how customer information is stored and secured — a buyer effectively takes on the store’s existing data practices and any exposure that comes with them.

Check intellectual property ownership line by line

Confirm that the domain, any trademarks, product photography, website content, and app or software components the store relies on are actually owned — or properly licensed — by the entity being sold, rather than by the founder personally, a freelancer or an outside developer. Gaps in IP ownership are common in businesses that started small and grew informally, and they’re much easier to fix before closing than after.

Verify inventory and supplier terms independently

Where the business holds physical inventory, confirm quantities and condition directly rather than relying solely on the seller’s stated figures, and check how inventory turnover compares across the periods under review — inventory that’s aging or overstated quietly inflates the value a buyer thinks they’re getting. Review supplier agreements for exclusivity terms, minimum order requirements and whether they can be assigned to a new owner at all. Physically counting a sample of inventory against what the records show, rather than accepting a spreadsheet at face value, is a small step that catches a surprising number of discrepancies.

Check the technical health of the store itself

Website uptime history, page load speed and mobile performance all affect conversion rates and search visibility, and a buyer taking over a technically neglected store may need to invest in fixes before growth resumes. Ask about the platform or software the store runs on, whether it’s current or approaching an unsupported version, and whether any custom code or integrations depend on a developer who won’t be staying on after the sale. A store that looks polished on the surface can still be running on infrastructure that needs near-term attention, and that’s worth pricing into the deal rather than discovering after closing.

Give diligence the time these checks actually require

Reconciling platform data, confirming account transferability with multiple providers, and reviewing privacy and IP records all take time, and compressing that work to meet an aggressive closing date is how gaps get missed. A realistic timeline that allows for direct confirmation with each platform and provider, rather than accepting the seller’s summary at face value, produces diligence a buyer can actually rely on.