Shopify DTC brand due diligence

Once a buyer is under LOI on a Shopify DTC brand, diligence shifts from evaluating the opportunity to verifying that what the seller described actually exists and actually transfers cleanly. A conventional financial-statement review still matters, but it is not where the real risk in this sub-sector tends to hide. Four areas do most of the work: whether the technical build is documented well enough for a new owner to maintain, whether the subscriber list’s consent records will withstand scrutiny, whether the merchant account is in good standing with its processor, and which advertising accounts and their historical data will actually move with the sale rather than resetting to zero under a new business manager. A buyer who treats this the same way as diligence on a business with physical inventory and a lease — focused mainly on financial statements and a site visit — will miss most of where the real risk actually sits.

The app and theme stack

Get a full inventory of every app the store runs, its licence terms and its ongoing cost, and confirm in writing what happens to any custom theme or checkout code once the current developer is no longer involved. Where the build is heavily customized, ask directly whether the code is documented anywhere outside the developer’s own head, and treat a “no” as a real cost to build into the transaction rather than a minor inconvenience to sort out later. Confirm domain and DNS ownership sits with the business itself and not with a personal account of the founder’s, since that detail is easy to overlook and genuinely disruptive to discover after closing. Also confirm that store administrator access — not just a single login shared informally — can be reissued cleanly to the buyer, and that no app is licensed under the developer’s own account rather than the store’s.

The subscriber list and CASL consent trail

Review whatever consent records exist for the email and SMS subscriber list against CASL’s documentation requirements, rather than accepting the subscriber count at face value — a large list built without consistent consent capture is a liability the buyer inherits, not an asset the buyer is receiving free and clear. For any Quebec-resident portion of the list, check the seller’s practices against Quebec’s stricter privacy standard specifically, since a general PIPEDA-level review can miss requirements that apply only to that customer segment. Engagement metrics — open and click rates, not just raw subscriber count — are also worth pulling directly from the platform rather than trusting a summary figure in the seller’s pitch deck.

The merchant account and chargeback history

Request the actual chargeback ratio and dispute history directly from the payment processor’s reporting, not a seller’s characterization of it, and compare that figure against the processor’s own published thresholds for account review or closure. A ratio trending upward, even if still technically within limits, is worth understanding the cause of before closing rather than after — a fulfilment or product-quality issue driving disputes upward is a fixable operational problem, while a ratio close to the threshold with no clear cause is an account-closure risk sitting on a short fuse. Confirm separately, in writing from the processor if possible, that it is prepared to underwrite the buyer as the new merchant of record.

Ad accounts — what actually transfers and what resets

Ad accounts across Meta, Google and TikTok can generally be added with a buyer as an admin ahead of closing, but pixel data, conversion history and audience-optimization data do not always carry over cleanly to a new business manager, and that gap is worth quantifying before closing rather than assuming it away. Where a meaningful share of current revenue depends on optimized paid-social performance, ask specifically what happens to that optimization the moment account structure changes, since a reset can materially raise acquisition cost in the weeks immediately following the sale — exactly when a new owner has the least cushion to absorb it. Get a written account, channel by channel, of the seller’s trailing acquisition cost, so the buyer has a documented baseline to compare against once the buyer’s own account starts running.

What a finding actually means

A payment processor that declines to re-underwrite the buyer is not a paperwork delay — it means the buyer cannot take payment on day one until a replacement processor is found and approved. A key app that is deprecated, or a developer who refuses to hand over customization rights, means real rebuild cost that should reduce the price, not just a footnote in the diligence report. Ad account history resetting on transfer means some portion of the store’s optimized performance genuinely does not survive the sale, and supplier or fulfilment terms that turn out to be personal to the founder mean the buyer needs its own arrangement in place before day one, not an assumption that the old terms simply continue. As with any diligence process, the individual findings matter less than the pattern they form together — a store with one isolated issue is a negotiation, while one with several of these findings at once is telling the buyer how much of its performance actually depends on the seller personally.