COMPLIANCE & RIGHT · TREATY
Compliance risks often become visible late in the purchase of a company: An intermediary contract is unusually remunerated, important software must not be transferred or an official request is still open. Such findings influence purchase decision, contract design and work after execution. We support the legal review and classification of identified risks.
Align the scope of the audit to the target company
A compliance due diligence needs a clear order. Industry, locations, sales channels, products and key business partners determine which documents and processes are particularly relevant. A mere query as to whether there is a compliance manual says little about the actual organization.
The audit may include information and completed investigations, administrative procedures, exceptional payments, export transactions, rights to software and technical documents, data protection organisation as well as essential personnel and supplier risks. The scope and depth of the test shall be determined by risk and time available. Open questions must be identified as such in the report.
Distinguishing Share Buying and Acquisition of Individual Assets
When purchasing shares, the target company remains in principle the bearer of its rights and obligations. Existing risks do not disappear due to the change of company. When acquiring individual assets, transferability and consent requirements must be examined; statutory liability amounts may be added. § 25 HGB and § 613a BGB show why the general statement "no legacy liabilities are taken over in the asset deal".
Depending on the transaction, merger control and investment audit are added. Up to the permitted execution, competitively sensitive information and the operational autonomy of the parties involved must be protected. A clean team procedure can structure the exchange of information, but must be concrete.
Translate results into the purchase contract
A identified risk should be assigned to a contractual or organisational measure. Additional information, a condition for execution, a concrete guarantee or exemption, a purchase price mechanism or a binding action plan are possible. Which solution is suitable depends on whether the risk is already realised, yet avoidable or insufficiently clarified.
A general compliance guarantee does not replace the treatment of known facts. Disclosure, rules of knowledge, liability limits, deadlines and handling of third-party claims must fit together. Insurance coverage must also be examined in the specific contract; known risks are not automatically covered.
Confidentiality and data in the data area
Even the due diligence can trigger its own legal issues. Personal data, customer secrets and competitively sensitive information must not be disclosed indiscriminately. A purpose-based selection, graduated accesses and, where appropriate, anonymisation or summary are required. The documentation of the data space will later also help to understand the scope of disclosure.
After completion, implementation begins
A final report should be translated into concrete tasks. Who takes over open government communication? Which intermediary contracts are renegotiated? Which access points, hotlines and guidelines need to be adapted? Those responsible and deadlines are set for urgent risks and implementation is being followed up.
An existing system should not be replaced unaudited by Group requirements. Local obligations, participation and contractual ties can require individual solutions. Also the backup of relevant documents must be planned before a system migration.
We can take over a defined topic or the coordination of a legal compliance audit. For the Request transaction structure, target industry, country reference, schedule and known abnormalities are helpful. A first audit plan identifies documents, contact persons and the limits of the investigation.
Legal basis and decisions: § 25 HGB – Liability for company continuity; § 613a BGB – Transfer of operations; GWB, in particular §§ 35 et seq. and § 41; External Trade Regulation.
Situation as at 2 November 2026.
Further reading: Trade secrets and know-how · Software, licences and open source · Corporate groups and international business
Four practical examples
The following fictitious cases illustrate typical examination questions. The concrete solution depends on the circumstances of the individual case.
01 · Unusual intermediary agreement
In the data room there is a high commission for success. performance, payee and business reference shall be examined prior to signature; Findings feed into purchasing decision and contract design.
02 · Open authorities request
The target company mentions an ongoing procedure only late. The scope of the audit, possible economic consequences and necessary hedges will be reassessed.
03 · Software without a clear right chain
Major programs were created by free developers. Use and transmission rights will be examined and necessary agreements planned before or after execution.
04 · Integration after acquisition
According to closing, guidelines of the buyer group should apply. Responsibilities, training and local specificities are provided with deadlines and responsible persons in the integration plan.
Your next step
Do you want to transfer the requirements to your company or have a specific process checked? A brief description and a reference to existing deadlines are sufficient for the first contact. We shall vote on the scope of examination and compensation prior to commissioning.