M&A Process Step by Step, With a Due Diligence Checklist

Last updated: 14 November 2026. US thresholds and fees are from the Federal Trade Commission’s 2026 announcement, effective 17 February 2026. UK rules are from the CMA’s jurisdiction guidance and the government’s National Security and Investment Act guidance; EU rules are from the European Commission’s merger and foreign subsidies pages. Timelines marked as indicative are typical ranges from market practice, not legal deadlines.

Short answer: The M&A process runs through seven stages: strategy and target screening, an NDA and letter of intent, due diligence, negotiation of the purchase agreement, signing, regulatory clearance, and closing followed by integration. A private deal with no in-depth antitrust review usually takes three to six months from LOI to closing; deals that need a second-phase merger review can take a year or more.

Key takeaways

• In 2026 a US deal needs an HSR filing if it is valued above $133.9 million (subject to other tests), with filing fees from $35,000 to $2.46 million.
• A federal court vacated the expanded HSR form in February 2026, so filers are back on the older, shorter form while the FTC considers new rules.
• The UK regime has two tracks: voluntary CMA merger control and mandatory National Security and Investment Act filings in 17 sensitive sectors, where completing without approval makes the deal void.
• Legal due diligence should be scoped to the deal: the checklist below covers the areas that most often change price, structure or the protections in the purchase agreement.

What are the stages of the M&A process?

If you need a refresher on deal structures first, our explainer on what M&A means covers mergers, share purchases and asset purchases. The table below follows a typical negotiated private acquisition from the buyer’s side. Public takeovers add securities law and, in the UK, Takeover Code timetables.

Stage	What the lawyers do	Key documents	Indicative timing
1. Strategy and screening	Early antitrust and foreign investment read, structuring options	Board papers, preliminary filing analysis	Weeks to months
2. NDA and LOI	Draft confidentiality terms, negotiate exclusivity and key commercial terms	NDA, letter of intent or term sheet	2 to 6 weeks
3. Due diligence	Review data room, issue requests, write red flag report	Request list, due diligence report	4 to 8 weeks
4. SPA negotiation	Draft and negotiate warranties, indemnities, conditions, price mechanism	Share or asset purchase agreement, disclosure letter	3 to 8 weeks, often alongside diligence
5. Signing	Board approvals, signing mechanics, announcements	Signed SPA, ancillary agreements	1 day to 1 week
6. Regulatory clearance	Merger control and foreign investment filings, responses to agencies	HSR filing, CMA briefing paper, NSIA notification, EU Form CO	30 days to 12 months or more
7. Closing and integration	Satisfy conditions, funds flow, post-closing filings and adjustments	Closing checklist, completion accounts, integration plan	Closing day, then 3 to 24 months

How does an M&A deal start?

Lawyers should be involved earlier than many clients expect, because two questions shape everything that follows: will the deal need merger control or foreign investment clearance, and which structure (shares, assets or merger) works for tax, liabilities and consents.

The NDA. Before the seller opens its books, the buyer signs a confidentiality agreement. The points that matter in practice are the definition of confidential information, permitted disclosees (advisers, financing sources), a non-solicitation of employees, how long obligations last, and, for public targets, a standstill restricting share purchases. Our mutual NDA template is a starting point, though sell-side NDAs are usually one-way.

The letter of intent. The LOI or term sheet records price, structure, key conditions and timetable. Most terms are expressly non-binding, but exclusivity, confidentiality, costs and governing law are usually binding. Exclusivity periods of 30 to 90 days are common, and a buyer should not spend serious money on diligence without one. Our guide on how to read a term sheet like a lawyer explains which clauses deserve the most attention.

What does legal due diligence cover?

Legal due diligence answers three questions: does the seller own what it says it is selling, what liabilities come with it, and will the deal itself trigger anything (consents, change of control payments, filings). Findings feed directly into price, specific indemnities, conditions to closing and the disclosure letter. The checklist below is a practical starting list; scope it to the target’s sector and size.

Area	What to request and check	Typical red flags
Corporate and capitalisation	Constitutional documents, share register, option and warrant records, minutes, group structure	Unissued or disputed shares, missing approvals, undisclosed shareholder agreements
Material contracts	Top customer and supplier contracts, change of control and assignment clauses, exclusivity, most favoured nation terms	Termination rights on change of control, non-competes that bind the buyer’s group
Financing and security	Loan agreements, guarantees, security interests, intercompany debt	Change of control defaults, prepayment penalties, liens over key assets
Intellectual property	Registered rights, ownership of software and inventions, licences in and out, open source use	IP held by founders or contractors without assignment, restrictive open source licences
Data protection and cybersecurity	Privacy notices, data maps, breach history, GDPR or state law compliance, security audits	Unreported breaches, unlawful transfers, regulator inquiries
Employment and benefits	Key employee contracts, bonus and retention plans, pension and benefit plans, worker classification	Change of control bonuses, misclassified contractors, underfunded pensions
Litigation and investigations	Pending and threatened claims, settlements, regulatory correspondence	Large uninsured claims, government investigations, class actions
Regulatory and permits	Licences and permits, sanctions and export control, anti-bribery compliance	Permits that do not transfer, sanctions exposure, past bribery issues
Real estate and environment	Title, leases, landlord consents, environmental reports	Contamination, leases terminable on change of control
Tax	Returns, audits, transfer pricing, tax groupings (usually with accountants)	Open audits, aggressive structures, secondary liabilities
Antitrust and foreign investment	Market shares, overlaps, government contracts, sensitive sector activities	Filings that add months to the timetable or require remedies

Agree a materiality threshold with the client at the start. Most clients want a short red flag report with recommended contractual fixes, not a description of every document.

How is the purchase agreement negotiated?

The share purchase agreement (SPA), or asset purchase agreement, is where diligence findings turn into risk allocation. The main levers are:

• Price mechanism: a locked box (price fixed by reference to historic accounts, with protection against value leakage) or completion accounts (price adjusted after closing for actual cash, debt and working capital). Locked boxes are common in UK and European private equity deals; completion accounts remain standard in many US deals.
• Warranties and representations: statements about the business, qualified by the disclosure letter or schedules. The fight is over knowledge qualifiers, materiality and the scope of disclosure.
• Indemnities: pound-for-pound or dollar-for-dollar cover for specific risks found in diligence, such as a known tax exposure or a pending claim.
• Limitations: caps, baskets, de minimis thresholds and time limits for claims.
• Warranty and indemnity (or representations and warranties) insurance: increasingly used so that a seller can exit cleanly while the buyer claims against an insurer.
• Conditions and covenants: regulatory clearances, third-party consents, conduct of business rules between signing and closing, and long-stop dates.

In-house teams often lead on commercial points while external counsel drafts, as our profile of the in-house counsel role explains.

Which regulatory clearances might the deal need?

Merger control and foreign investment screening usually set the critical path. Run the analysis before signing so the conditions and long-stop date are realistic.

United States: HSR. Under the FTC’s 2026 adjustments, effective 17 February 2026, a transaction is reportable if the acquiring person will hold voting securities or assets valued above $133.9 million and the size-of-person test is met (generally one party with $26.8 million and the other with $267.8 million in sales or assets). Deals valued at $535.5 million or more are reportable regardless of party size. The parties must then wait 30 days (15 days for cash tender offers and bankruptcy sales) before closing. If the agency issues a second request, the waiting period runs until both parties have substantially complied and a further 30 days have passed, as the FTC’s guide to merger review explains.

Value of transaction (2026)	HSR filing fee
$133.9m to less than $189.6m	$35,000
$189.6m to less than $586.9m	$110,000
$586.9m to less than $1.174bn	$275,000
$1.174bn to less than $2.347bn	$440,000
$2.347bn to less than $5.869bn	$875,000
$5.869bn or more	$2,460,000

The form itself is in flux. The expanded HSR form that took effect on 10 February 2025 was vacated by a federal district court in Texas on 12 February 2026, and the Fifth Circuit refused to stay that ruling on 19 March 2026. The FTC now accepts filings on the older form, according to its HSR forms page. The FTC’s appeal was paused until the end of 2026 while the agencies consider a new rulemaking, so check the position before you file.

United Kingdom: CMA and NSIA. UK merger control is voluntary, but the CMA can investigate if the target’s UK turnover exceeds £100 million, if the parties together supply at least 25% of a product in the UK and one has UK turnover above £10 million, or under the hybrid test where one party has a 33% share and UK turnover above £350 million. Mergers where each party’s UK turnover is £10 million or less fall in a safe harbour. Phase 1 lasts 40 working days, and a phase 2 report is normally due within 24 weeks, under the CMA’s jurisdiction and procedure guidance.

Separately, the National Security and Investment Act requires a mandatory filing for certain acquisitions of entities active in 17 sensitive sectors. Completing without approval makes the acquisition void and risks penalties of up to 5% of worldwide turnover or £10 million, whichever is greater. The government has a 30 working day review period after accepting a notification, and a called-in deal faces a further 30 working days, extendable by 45. In March 2026 the government confirmed it would add a water sector and split out critical minerals and semiconductors, through regulations to be laid later in the year.

European Union: EUMR and FSR. A concentration has an EU dimension if the parties’ combined worldwide turnover exceeds €5 billion and at least two each have EU turnover above €250 million, or under the alternative €2.5 billion test. Phase I takes 25 working days and phase II 90 working days, extendable, according to the Commission’s merger procedures page. Deals cannot close before clearance. Under the Foreign Subsidies Regulation, a separate filing is needed where the target, a merging party or a joint venture has EU turnover of at least €500 million and the parties received more than €50 million in foreign financial contributions over the previous three years.

What happens at signing and closing?

Without clearances or consents, signing and closing can happen on the same day. Otherwise, in the gap period the seller runs the business in the ordinary course and both sides prepare closing deliverables: resignations, board minutes, consents, payoff letters and the funds flow.

Public deals add their own clock. In the UK, once a potential bidder is named, Rule 2.6 of the Takeover Code gives it until 5 pm on the 28th day to announce a firm offer or walk away, unless the target board asks for an extension. Listed company deals in the US involve proxy or tender offer filings with the SEC, which our guide to filing for an IPO touches on from the issuer side.

What happens after closing?

Post-closing work includes completion accounts and price adjustments, earn-out calculations, warranty claims within the agreed time limits, transfers of permits and contracts, and integration of employees and benefit plans. Flag integration risks during diligence, not after closing.

For lawyers building a deal practice, it helps to watch who advises on comparable transactions. DealDatabase tracks which law firms act on announced deals, and our analysis of 3,034 law firm deal announcements shows how the M&A share of that work has moved since 2024.

How long does the M&A process take?

Indicative ranges, assuming a motivated seller and no major diligence surprises:

• Small private deal, no filings: 6 to 12 weeks from LOI to closing.
• Mid-market deal with an HSR filing that clears in the initial 30 days: about 3 to 5 months.
• Deal with a UK NSIA filing: add at least the 30 working day review, plus time for the notification to be accepted.
• Deal with a second request, CMA phase 2 or EU phase II review: 9 to 18 months is realistic, and remedies may be needed.

Build the regulatory timetable first, then set the long-stop date.

This article is general information about the M&A process and the 2026 thresholds published by the FTC, the CMA, the UK government and the European Commission as of 14 November 2026. Thresholds change annually and filing obligations depend on the facts; it is not legal advice.

Frequently asked questions

What are the main steps in the M&A process?

Strategy and target screening, an NDA and letter of intent, due diligence, negotiation of the purchase agreement, signing, regulatory clearances, and closing followed by integration. In practice due diligence and contract negotiation usually run in parallel.

What is the HSR threshold for 2026?

From 17 February 2026, the size-of-transaction threshold is $133.9 million. Deals valued at $535.5 million or more are reportable whatever the size of the parties, unless an exemption applies.

How much is the HSR filing fee in 2026?

Fees range from $35,000 for deals under $189.6 million to $2.46 million for deals valued at $5.869 billion or more, in six tiers set by the FTC’s January 2026 announcement.

Is UK merger control mandatory?

No. Filing with the CMA is voluntary, though the CMA can investigate deals that meet its thresholds and impose hold-separate orders. Filing under the National Security and Investment Act is mandatory for acquisitions of entities in 17 sensitive sectors.

What is included in a legal due diligence checklist?

Corporate records and capitalisation, material contracts and change of control clauses, financing, intellectual property, data protection, employment, litigation, permits and compliance, real estate and environment, tax, and antitrust or foreign investment exposure.

How long does due diligence take in M&A?

For a mid-sized private target, four to eight weeks is typical, often overlapping with negotiation of the purchase agreement. Complex, regulated or multinational targets can take longer.