Ecommerce Due Diligence Checklist (15 Things to Verify)

Most ecommerce deals do not die on price. They die in diligence when a buyer discovers Meta spend was under-reported, the hero SKU returns at 19%, or the Google Merchant Center account cannot transfer. Sellers who survive LOI opened with proof. Buyers who close run a repeatable checklist — not a PDF scavenger hunt.

This is the 15-point sequence I use on every store acquisition review at TrustExits. It assumes you already saw a profit-verified listing or connected data room. It is buyer-side, practitioner-grade, and ordered by kill rate: what fails most often comes first. Work through it before you wire escrow, not after.

Before the 15 points: set your diligence frame

Three rules that save weeks:

• Read-only beats exports. Shopify, Stripe, Meta, and Google connections that you control beat seller-generated CSVs. PDFs are declarative theater. Platforms are adversarial truth.
• TTM, not last month. One good month hides ad compression and return spikes. Trailing twelve months minimum.
• Channel dependency is a line item. Same SDE, different value if 82% Meta vs 35% email. Score it explicitly.

With that frame, run the checklist.

The 15-point ecommerce due diligence checklist

1. Reconcile revenue to payouts. Match Shopify (or WooCommerce) gross sales, discounts, and refunds to Stripe/PayPal/Shopify Payments deposits by month. Gaps >2% unexplained → stop. Common causes: alternate processors, manual invoices, marketplace side channels.
2. Rebuild SDE from primary sources. Start from verified revenue, subtract COGS (with supplier invoices on top SKUs), ad spend from ad accounts, shipping/3PL, payment fees, apps, and normalized owner pay. Compare to seller SDE. Variance >10% needs written explanation before LOI hardens.
3. Validate COGS on hero SKUs. Request invoices or supplier portal read-only for the top 3–5 SKUs by revenue. COGS drift of 5–15% after supplier price hikes is the silent killer on thin-margin stores.
4. Pull ad spend from platform billing, not dashboards. Meta Ads Manager and Google Ads billing profiles can differ from what sellers book in QuickBooks. Match billing TTM to claimed spend. Under-reporting ad spend inflates SDE artificially.
5. Audit ROAS vs contribution margin. Platform ROAS uses attributed revenue, not margin after COGS and shipping. Rebuild MER (total ad spend / total revenue) and contribution margin by channel. A 4x ROAS campaign can lose money on 55% COGS with free shipping.
6. Map channel mix and concentration. Document % revenue from Meta, Google, TikTok, email, organic, wholesale. Flag any single paid channel >65%. That is not a veto — it is a discount and a transfer checklist item.
7. Verify ad account and pixel transfer path. Confirm Business Manager ownership, pixel history, custom audience terms, and whether the seller used a personal ad account. Personal accounts do not transfer cleanly. Budget 2–4 weeks and possible performance dip.
8. Check Google Merchant Center and policy health. Read-only GMC access: disapprovals, account warnings, feed issues, checkout policy flags. A suspended feed kills paid Google revenue overnight. This is channel dependency diligence, not optional.
9. Analyze refund and return cohorts. Export orders with return reason codes TTM. Hero SKU return rate >12% on fashion/home goods triggers margin rework. Seasonal spikes are fine if disclosed and priced.
10. Review chargebacks and fraud reserves. Stripe/PayPal dispute rates above 0.75% or rolling reserves signal processor risk. Ask about high-risk SKU categories and 3DS usage.
11. Confirm inventory truth. Match Shopify inventory to 3PL or warehouse counts. Dead stock, unpaid supplier terms, and consignment arrangements must appear on the balance sheet or purchase agreement adjustments.
12. Inspect supplier and MOQ dependencies. Single-source suppliers, exclusive contracts, long lead times, and MOQ cliffs affect working capital post-close. Read contracts for change-of-control clauses.
13. Assess owner dependency. Who creates ads, negotiates suppliers, handles escalations, appears on camera? Replaceability cost belongs in your multiple haircut or transition plan — not a surprise at day 30.
14. Validate email/SMS list hygiene and compliance. Klaviyo/Omnisend: list source, sunset flows, GDPR/CAN-SPAM consent evidence, deliverability metrics. Purchased lists are a liability, not an asset.
15. Run legal and platform ToS review. Trademarks, IP on creative, licensed assets, Amazon/Shopify AUP history, pending litigation. Asset purchase agreements should enumerate excluded liabilities and include reps on policy violations TTM.

Fail any single point and you do not always walk. You retrade, hold back escrow, or require earnout. Fail three without disclosure and you walk — the seller knew.

How to sequence the 15 checks in time

Do not run all 15 in parallel on day one. Buyers who drown sellers in export requests get slow answers and bad data. Order matters:

Week 1: Financial truth (points 1–5)

These five decide if the SDE in the listing is real. Use read-only connections where the seller already granted them via a verified marketplace or data room. If the seller refuses read-only on ads or payments after LOI, treat that as information.

Output: reconstructed SDE spreadsheet you would defend to a lender or partner. If you cannot build it, the deal is not ready.

Week 2: Channel and operational risk (points 6–10)

This is where ecommerce differs from SaaS diligence. Traffic mix, ad account transfer, GMC health, returns, and chargebacks determine whether the earnings survive the ownership change. I have seen stores lose 30% revenue in 60 days post-close because the pixel rebuilt from scratch while GMC sat in warning state.

Output: channel risk memo with explicit haircuts applied to your offer multiple.

Week 3: Supply chain, people, compliance (points 11–15)

Inventory, suppliers, owner dependency, email compliance, and legal. These items rarely kill deals alone but define transition cost and escrow holdback size. Budget $5k–$25k and 40–80 hours of operator time for typical sub-$500k acquisitions when owner dependency is high.

Output: transition plan draft and final purchase price adjustments.

Red flags that should pause or kill the deal

Some findings are yellow flags (retrade). Others are red:

• Ad spend mismatch >15% vs claimed SDE stack with no reconciliation → red.
• Seller refuses read-only ad or payment access post-LOI → red.
• GMC or Meta account in active policy violation undisclosed → red.
• Revenue/payout gap >5% unexplained for 3+ months → red.
• Material IP on listing images without license → red until remediated or priced.
• Material misstatement on channel mix (claimed 40% organic, actual 11%) → red.

Yellow flags — negotiate, do not ghost: rising CPMs with stable MER, single supplier with backup quoted, owner willing to stay 30–60 days on transition.

Read-only connections vs PDF theater

Sellers send P&L PDFs because they are easy. Buyers accept them because Excel is tedious. That handshake produces retrades.

Read-only access means:

• Shopify staff or collaborator with reports-only scope.
• Stripe/PayPal dashboard invite without payout control.
• Meta Business Manager partner access without billing edit.
• Google Ads read-only via MCC link.
• Klaviyo viewer role.

You are not asking for keys on day one. You are asking for verification parity with what a profit-verified listing already exposed. TrustExits buyers start ahead: listings carry reconciled SDE and channel flags before first call. See Revenue vs Profit for why that layer exists.

How channel dependency changes your checklist weight

Not all 15 points weigh equally on every store.

• Meta-heavy DTC: Weight points 4, 5, 6, 7 heavily. Creative fatigue and account ban risk dominate.
• Google Shopping-led: Weight 7, 8, 3. Feed quality and GMC policy are the moat — or the trap.
• Email-first retention brands: Weight 14, 5, 9. List quality and return economics drive LTV.
• Wholesale hybrid: Weight 3, 11, 12, 15. Terms, inventory, and contract transfer matter as much as ads.

Adjust weights before you price. Same checklist, different emphasis.

Escrow and holdbacks tied to diligence outcomes

Diligence findings should map to deal structure:

• Inventory variance at close: dollar-for-dollar adjustment or holdback until count confirmed.
• Undisclosed GMC warning cleared post-LOI: 5%–10% holdback for 90 days revenue performance.
• Owner transition dependency: earnout tied to 90-day revenue floor or consulting agreement with clawback.
• Return rate ambiguity on new SKU line: shorter holdback triggered if returns exceed disclosed band.

Document these in the asset purchase agreement before escrow opens. Retroactive negotiation after wire is misery.

Buyer prep before you run the checklist

Diligence is not only seller burden. Buyers who show up unprepared waste their own LOI clock.

• Capital and structure ready. Proof of funds or lender term sheet before deep diligence. Sellers ghost buyers who cannot close.
• Operator plan documented. Who runs ads day one? Who handles CS? Gap here becomes a retrade on owner transition fees.
• Practitioner on retainer. One Google/Meta literate hour on points 4–8 catches GMC warnings non-marketers miss.
• Multiple math pre-agreed internally. Base SDE multiple and max channel haircut before emotions attach to the brand story.

Serious buyers on TrustExits filter listings with profit verification already passed — your checklist becomes confirmatory, not archaeological.

Where TrustExits fits for buyers

Every checklist item is easier when the listing pre-verified profit and surfaced channel concentration. Buyers on TrustExits skip repeating points 1–6 from scratch on clean listings — they confirm, they do not reconstruct from zero.

We built the buyer side for operators who close stores, not collect screenshots. Browse profit-verified inventory and filter by channel mix on /buyers.

FAQ

How long does full ecommerce diligence take?

30–45 days for sub-$500k deals with cooperative sellers and read-only access. 60–90 days if books are messy or ad accounts resist transfer review.

Can I skip diligence on a revenue-verified Flippa listing?

No. Revenue verified confirms top line, not SDE or channel risk. Run at least points 1–8 on every store.

What SDE variance is acceptable vs seller claims?

Under 5% with documented add-backs: normal. 5%–10%: retrade conversation. Over 10% without explanation: walk or hard retrade.

Should I hire a diligence firm for a $150k acquisition?

Optional. Many operators run this checklist with a part-time CPA hour block and a Google Ads practitioner review on points 4–8. Firms help above $1M or with legal complexity.

Does TrustExits guarantee all 15 points pass?

We verify profit and channel context pre-listing. Buyers still run confirmatory diligence — especially legal, inventory count, and transfer execution. We reduce surprise, not responsibility.

Buy stores with eyes open. Explore profit-verified listings on TrustExits — then run the checklist before you wire.

---

Related reading & next steps

Keep going with the cluster - or jump straight into a TrustExits tool.

More on this topic

• How Much Is My Ecommerce Business Worth? (2026 Guide)
• Revenue vs Profit: Why "Revenue Verified" Is Not Enough
• How to Sell Your Shopify Store (Complete 2026 Guide)

TrustExits pages worth opening

• /buyers
• free ecommerce valuation estimate
• profit verification methodology
• fees compared
• Primary next step -> /buyers