Marketplace platform due diligence in Canada

Where what a buyer has been told about a marketplace platform comes through a dashboard the seller built, the work under a letter of intent is to rebuild that picture from raw records and contracts, in five strands: the network data, who owns the code and the brand, privacy and breach history, the platform’s trust claims, and what is attached to the assets or promised to the payment provider. This guide is organized around findings and the question each one raises when it turns up.

Rebuild liquidity from transaction records

Ask for a transaction-level export rather than the dashboard, and build the cohorts yourself: for each month’s new participants on each side, how many transacted again, and how many pairs of buyers and sellers kept transacting after their first deal. If repeat pairs disappear after one transaction, participants may be using the platform as an introduction service, and the revenue may then be closer to a lead fee, which may not recur. Look for activity that is not real demand, such as listings or purchases by founders, staff or related accounts, and for refunds and chargebacks that were reversed or pushed past a period end. Reconcile the processor’s payout records to the bank statements; a gap between the two is a finding in its own right.

Confirm who owns the code, the algorithm and the brand

Under the Copyright Act the author of a work is, subject to the Act, its first owner, but where an employee made the work in the course of employment under a contract of service or apprenticeship, the employer is first owner in the absence of any agreement to the contrary. That employment rule does not mention contractors, so the author-as-first-owner rule is the starting point for a contractor’s work, and no assignment of copyright is valid unless it is in writing signed by the owner of the right or the owner’s duly authorized agent. The Act’s definition of a literary work includes computer programs, and CIPO’s guidance says an assignment can be registered, so ask for signed assignments from every contractor, agency and departed founder who wrote the matching, ranking, fraud-detection or app code, and check the register for what is recorded. Then look at the brand: whether the platform’s name is a registered trademark, which CIPO describes as giving the owner the sole right to use the mark across Canada, and in whose name the registration and the domain sit. See also who owns the intellectual property after a sale.

Test privacy, consent and breach history

Request the privacy policy and consent screens as they stood at each point the user base grew, the record of breaches that the federal statute requires the company to keep, and any reports made to the Privacy Commissioner or notices sent to users. A breach that posed a real risk of significant harm and was neither reported nor notified is a finding about past non-compliance; who bears it after closing depends on whether you buy shares or assets and on what the agreement says.

For Quebec users, ask whether the business has published the title and contact details of its person responsible for privacy, whether it completed privacy impact assessments for projects to acquire, develop or redesign information systems involving personal information and for communications outside Quebec, and how it handled any confidentiality incident presenting a risk of serious injury. Ask also how the matching system uses behaviour. The Commission d’accès à l’information says Quebec’s law defines profiling as collecting and using personal information to evaluate certain characteristics of an individual, including personal preferences, interests or behaviour, and that technologies with identification, location or profiling functions cannot be activated by default. The broader checklist is in cybersecurity and data privacy checks before buying a business.

Compare what the platform says with what it does

A marketplace’s trust claims are representations to the public, so list every claim the platform makes about it: that sellers are verified, that payments are protected, that reviews are genuine, that disputes follow a stated process. Then test each claim against the incident log, the dispute outcomes and the systems themselves. The Competition Act restricts representations to the public that are false or misleading in a material respect, and the general impression of a representation counts alongside its literal meaning, so a “verified” badge that means only that an email address was confirmed can be a legal question as well as a reputational one. Read the fraud and dispute files for patterns, and ask whether any matter involves a regulator, a police report or a claim.

Search for liens and read the payment contract

Search the personal property security registry against the company. In Ontario, Access Now is the system for registering a notice of security interest or searching for a lien on personal property; for another province, use that province’s registry. The Personal Property Security Act defines personal property to include intangibles, so a security interest can attach to accounts and contractual rights as well as goods; what a PPSA search is explains the mechanics. Then read the contract with the payment provider for what it says about assignment, change of control, reserves, held funds and termination, and read the hosting, identity-verification and app-store agreements, noting any account that sits in a founder’s personal name.

Findings to raise before closing

• Repeat pairs that vanish after a first transaction, which may show that participants deal directly once introduced.
• Matching, ranking or app code written by people who never signed a written assignment.
• An unreported breach that posed a real risk of significant harm.
• An open trust and safety incident with legal exposure, or a trust claim the systems do not deliver.
• A payment provider relationship that will not transfer, or a registered security interest the seller cannot discharge at closing.