Introduction
Deals fall apart when the commercial story doesn't hold up under scrutiny. Investors and acquirers are buying a future — and commercial due diligence (CDD) is what tests whether that future is real.
CDD is now standard practice across M&A, private equity, and capital raises. For most businesses, that means validating market size, competitive position, and revenue quality.
For fintech, crypto, and banking companies, there's an added layer many founders underestimate. Compliance infrastructure — BSA/AML programs, licensing status, data privacy controls — has become a commercial risk variable that deal teams scrutinize as closely as revenue growth.
This guide breaks down what CDD actually involves, how compliance posture has become a dealbreaker for regulated businesses, and what founders and operators need to have ready before a deal team comes knocking.
TL;DR
- CDD evaluates commercial viability — market position, customer base, competitive landscape, and growth potential — before a deal closes.
Wait — on re-examination, the double em-dash issue requires a structural fix, not just reordering. Applying the correct revision:
- CDD evaluates commercial viability: market position, competitive landscape, customer base, and growth potential — assessed before a deal closes.
- CDD ≠ financial due diligence: financial DD verifies the numbers; CDD validates the commercial logic behind them.
- The process typically starts after a Letter of Intent is signed and runs before final deal terms are set.
- For fintech, crypto, and banking companies, compliance infrastructure is a deal-stopper if it's weak — not just a legal formality.
- Both buyers and sellers benefit: buyers avoid overpaying; sellers surface full value and enter negotiations prepared.
What Is Commercial Due Diligence?
Commercial due diligence is a systematic evaluation of a target company's commercial viability — covering market position, competitive dynamics, customer relationships, and growth potential — conducted before an investment or acquisition is finalized.
ICAEW defines CDD as "an objective enquiry to critique and challenge commercial matters relating to a business," particularly its business plan and projections. KPMG frames it as helping an interested party understand a target from a commercial perspective, including its business environment and future prospects.
Where CDD Sits in the Deal Lifecycle
CDD typically begins after a Letter of Intent (LOI) is signed and runs in parallel with financial, legal, and operational due diligence — but always before final deal terms are set. The process determines whether those final terms get signed at all, not after.
The Three Types of CDD
| Type | Who Initiates It | Purpose |
|---|---|---|
| Buy-side CDD | Buyer/investor | Validate investment thesis, surface risks before committing |
| Vendor CDD (VDD) | Seller | Prepare for buyer scrutiny, strengthen negotiating position |
| Red flag CDD | Either party | Expedited scan to identify critical deal-breakers early |
According to KPMG, red flag CDD typically costs 20–50% of full-scope CDD — a useful option when deal timelines are tight or early-stage screening is needed before committing to a full review.
Why Commercial Due Diligence Is Critical
CDD gives investors and acquirers a fact-based answer to the most important question in any deal: does the commercial story match the pitch?
Without it, buyers risk overpaying for businesses with shrinking markets, churning customers, or growth projections built on wishful thinking. With it, deal teams can move forward with genuine confidence, or walk away before a costly mistake is locked in.
The Seller's Case for CDD
Vendors that proactively run their own due diligence enter negotiations from a stronger position. PwC notes that vendor due diligence gives sellers greater control over the sale process and timing — which often translates to a stronger final price. Pre-empting buyer concerns, rather than reacting to them mid-process, shifts the negotiating dynamic in the seller's favor.
The Compliance Dimension for Regulated Businesses
For fintech, crypto, and banking companies, CDD has expanded well beyond market analysis. Compliance infrastructure is now treated as a commercial risk factor — and the stakes are real.
Two high-profile examples make this concrete:
- In 2023, Reuters reported that regulators' concerns over TD Bank's anti-money-laundering practices helped scuttle its $13.4 billion acquisition of First Horizon.
- Also in 2023, the SEC and New York's top financial regulator opposed Binance.US's $1 billion deal to acquire Voyager assets, citing unregistered securities concerns and New York licensing issues.
These aren't edge cases. Compliance gaps discovered late in diligence either kill deals or trigger significant price reductions. For any regulated business entering a deal process, the compliance program isn't background context — it's part of the commercial story.
CDD Informs What Happens After the Deal
CDD insights don't expire at closing. The findings directly shape what happens next:
- Go-to-market plans grounded in validated market assumptions
- Integration priorities ranked by commercial risk and revenue impact
- Pricing strategy informed by customer retention and competitive data
- Growth initiatives scoped to what the business can actually support
Deal teams that use CDD as a strategic input — not a procedural hurdle — leave the process with a clearer post-close roadmap, whichever side of the table they're on.
How Commercial Due Diligence Works — Step by Step
Every CDD is tailored to the specific deal, but the underlying process follows consistent logic. The most common failure isn't in the analysis — it's in rushing the early stages, skipping stakeholder validation, or treating the process as an administrative requirement rather than a genuine strategic interrogation.
Step 1 — Define Scope and Investment Thesis
Before any data is collected, establish exactly what the CDD must answer:
- Is the market growing or contracting?
- Can this company defend its competitive position?
- Is the revenue model scalable at the claimed growth rate?
- What would have to be true for the investment thesis to hold?
A clearly defined scope keeps the analysis focused on what actually drives the deal decision — and prevents the team from producing a comprehensive document that answers every question except the important ones.
Step 2 — Gather Market and Commercial Data
Inputs typically include market sizing reports, industry data, regulatory filings, management information, customer data, and competitive intelligence.
For fintech, banking, and crypto targets, this step must also pull in regulatory status documentation, license conditions, and compliance program materials.
These aren't optional add-ons. They're core inputs that determine whether the business can actually operate as modeled.
Step 3 — Analyze Market Position and Competitive Landscape
Map the target's position within its addressable market:
- Estimated market share and trajectory
- Competitive differentiation (product, pricing, distribution, brand)
- Barriers to entry and sustainability of competitive advantage
- Emerging threats — new entrants, substitutes, or regulatory shifts
The goal is an honest picture of where this company stands relative to its market, not a confirmation of what the pitch deck claims.
Step 4 — Assess Customer Base and Revenue Quality
This is often where the most revealing analysis happens. Key dimensions to evaluate:
- How concentrated is revenue — does one or two accounts represent outsized dependency?
- What does churn look like, and what's driving it?
- Do unit economics hold at scale, or does LTV erode as the customer base grows?
- How much revenue is recurring and contracted versus one-time or at-risk?
A business with strong topline growth but deteriorating retention or thin contracted revenue is far harder to underwrite than the headline number suggests.
Step 5 — Evaluate Compliance and Operational Posture
For regulated businesses, this step has become its own workstream. The key frameworks that deal teams assess include:
- BSA/AML — program maturity, SAR workflows, transaction monitoring effectiveness
- UDAAP — consumer protection controls for financial product companies
- Reg E — error resolution procedures for electronic fund transfer businesses
- Data privacy — UK GDPR, CCPA, and cross-border data handling
- FCA Consumer Duty (UK) — whether the business can demonstrate it delivers good outcomes for retail customers
- Crypto registration/licensing — FCA registration status for UK firms; FinCEN and state licensing for US operations
Compliance gaps found at this stage don't just create regulatory risk — they give buyers direct grounds to reprice or exit the deal entirely.
Step 6 — Synthesize Findings and Issue the CDD Report
The final report translates all inputs into a structured, actionable document that either validates or challenges the investment thesis. A strong report includes scenario modelling, risk ratings, and strategic recommendations — it drives decisions rather than just describing what was found.
Key Components of a Commercial Due Diligence Report
The CDD report is the deliverable that underpins the deal decision. Report depth varies by deal size and complexity, but the core components remain consistent across most transactions.
Strategic Business Plan Review
Assess whether the target's growth strategy is credible and executable. Does it define a realistic path to revenue expansion? Do the assumptions hold under scrutiny, or are they speculative extrapolations? Flag the specific assumptions that are evidence-based versus those that require the market to behave in optimistic ways.
Market Analysis
Document market size, growth trajectory, demand drivers, and structural trends. For fintech and crypto specifically, the regulatory environment is itself a market-shaping force — evolving rules around payments, crypto asset regulation, and open banking directly affect total addressable market and competitive dynamics.
Competitive Positioning
Map direct and indirect competitors, assess market share distribution, and evaluate the target's differentiation across product, pricing, distribution, and brand. Identify risks from new entrants or substitutes. A SWOT framing helps structure findings deal teams and boards can act on directly.
Customer Analysis
Evaluate the customer base by segment: concentration risk, churn rate, lifetime value, and acquisition channels. Customer relationship strength is often the most predictive indicator of post-acquisition revenue stability — and the hardest thing to rebuild if it deteriorates post-close.
Financial and Sales Performance
Review revenue growth, margin trends, pipeline quality, and pricing strategy. The central question is whether management's financial projections are grounded in commercial reality or reflect management optimism from a strong but non-representative period.
The most useful inputs for stress-testing projections include:
- CAC-to-LTV ratios — do unit economics hold at scale?
- Pipeline conversion rates — is forecast revenue actually closeable?
- Cohort retention data — does revenue compound or churn away?
How Fraxtional Can Help
For fintech, crypto, banking, and embedded finance companies, passing commercial due diligence isn't only about having a strong market narrative. It's about demonstrating that the compliance and risk infrastructure is investor-grade — something that buyers, sponsors, and regulators can actually verify.
Fraxtional is a fractional compliance leadership firm that helps regulated businesses build this kind of compliance posture before and during deal processes. Through fractional CCO, CRO, BSA Officer, CAMLO, and MLRO placements, Fraxtional provides named, director-level compliance leadership without the cost or timeline of a full-time hire.
What this looks like in practice:
- Pre-deal compliance readiness reviews that identify gaps before the deal process begins
- Third-party compliance audits producing board-ready reports with prioritized remediation findings for investor and sponsor bank review
- Pre-investment due diligence and post-acquisition program buildouts for PE firms assessing financial services or payments businesses
- End-to-end BSA/AML frameworks aligned with FFIEC, FinCEN, and FATF standards, pre-approved by sponsor banks across lending, cards, and wallets
The team covers BSA/AML, UDAAP, Reg E, privacy, and cyber risk across the US, UK, Canada, and EU. Fraxtional is ranked a Top 10 Best Fractional Compliance Firm in the US for 2024 and 2025, and its founder was named to the Top 100 Leaders in Finance 2024.
One Series A fintech CEO described the engagement this way: "Fraxtional's Director was on every call, reviewed every policy, and handled investor questions as if she were part of our internal team."
For companies approaching fundraising, acquisition, or sponsor bank relationships, the compliance program is a deal variable — and how it reads to investors matters. Fraxtional's role is to make sure it's positioned as a strength before the process begins.
Conclusion
Commercial due diligence isn't a bureaucratic hurdle that slows deals down. It's the process that separates informed investment decisions from costly ones. For buyers, it validates the thesis with real evidence. For sellers, it reveals the full value of the business and reduces the risk of late-stage renegotiation.
For fintech, crypto, and banking companies, CDD has expanded well beyond market and financial analysis. Compliance infrastructure — its maturity, documentation quality, and defensibility under regulatory scrutiny — is now a commercial variable that investors and acquirers evaluate directly.
Companies that treat it as an afterthought don't just face regulatory risk. They face deal risk, valuation risk, and transactions that don't close.
Frequently Asked Questions
What is commercial due diligence?
Commercial due diligence (CDD) is the evaluation of a target company's commercial viability — covering market position, competitive landscape, customer base, and growth potential — conducted before an investment or acquisition is finalized. It tests whether the commercial story behind a business holds up under independent scrutiny.
What are FDD and CDD in the context of commercial due diligence?
CDD (commercial due diligence) assesses the commercial logic and market credibility of a business: specifically, whether the growth thesis is real and defensible. FDD (financial due diligence) verifies whether the financial statements, projections, and reported numbers are accurate. The two are complementary and run in parallel during a deal process.
What are the 4 P's of commercial due diligence?
The 4 P's framework covers Product (what the company sells and how it's differentiated), People (management capability and team depth), Positioning (competitive standing in the market), and Prospects (growth potential and market opportunity). CDD works through all four systematically, stress-testing the growth narrative against independent market evidence.
What is commercial due diligence in the UK?
CDD in the UK follows the same core process as internationally, evaluating commercial viability, market position, and growth potential. For fintech and financial services deals, UK-specific factors matter: FCA oversight, Consumer Duty obligations, and cryptoasset registration requirements under the Money Laundering Regulations each shape how a target's commercial and compliance posture is assessed.
Who conducts commercial due diligence?
CDD is carried out by specialist strategy consulting firms or transaction advisory teams; Bain, PwC, EY, KPMG, and Alvarez & Marsal are common providers. For regulated industries like fintech and banking, compliance specialists join the engagement to assess regulatory and risk posture alongside the commercial analysis.
How long does commercial due diligence take?
According to Alvarez & Marsal's published benchmarks, timelines range from 5–7 days for a red flag report to 3–5 weeks for a full CDD engagement. Sell-side market studies can run 4–6 weeks. Deal complexity, data access, and auction timetables all affect the duration — and having documentation organized from the outset can significantly compress the timeline.
