Running financial due diligence on a retail acquisition target
A private equity associate opens the data room for a 140-store apparel chain and finds something the seller's investment banker didn't highlight: $180 million in off-balance-sheet lease commitments, a single supplier providing 40% of inventory, and an unresolved card-network chargeback dispute worth $6 million. None of that showed up in the headline EBITDAEBITDAEBITDA (Earnings Before Interest, Taxes, Depreciation, and Amortization) measures a company's operating profitability before financing and accounting decisions, used to compare core performance across firms.View full definition → multiple. All of it changes the price.
This is the reality of retail financial due diligence (DD): the risks that move valuation are rarely in the income statement. They're buried in leases, supplier contracts, payment processing terms, and compliance files.
Why retail DD is different
Retail businesses look simple (sell goods, collect cash) but carry structural risks that other sectors don't:
- Heavy fixed lease obligations tied to physical stores
- Concentrated supplier and logistics dependencies
- High-volume card transactions exposed to chargeback and fraud rules
- Multi-jurisdiction consumer protection and labor regulation
A generic M&A checklist (revenue quality, working capitalworking capitalWorking capital is the difference between a company's current assets and current liabilities, measuring short-term liquidity and the funds available to run daily operations.View full definition →, debt schedule) misses all four. A retail-specific DD process has to test them explicitly.
Red flag 1: lease liabilities
Since ASC 842 (US GAAPUS GAAPThe standard set of accounting rules companies follow to prepare consistent, comparable financial statements, dominant in US reporting.View full definition → lease accounting standard, effective for most companies since 2019) and IFRS 16 (the equivalent international standard, effective 2019), operating leases must appear on the balance sheet as a "right-of-use asset" and a corresponding lease liability. This closed the old loophole where retailers kept billions in store leases off-balance-sheet.
But DD still needs to go deeper than the balance sheet number:
- Lease term vs. store performance: A 10-year lease on a declining-sales location is a liability the buyer inherits, not an asset.
- Renewal options and escalators: Many US retail leases include annual rent escalators (commonly 2 to 4%, as an estimate) that compound over a decade.
- Change-of-control clauses: Some landlords can terminate or renegotiate leases when ownership changes. This is critical in a buyout and often missed.
- Percentage rent: Common in shopping malls, where rent scales with store sales, meaning a rent bill can rise even without a lease renewal.
Worked example: Target has 140 stores, average annual rent $220,000, average remaining term 6 years, no early termination rights.
Total remaining fixed lease liability ≈ 140 × $220,000 × 6 = $184.8 million.
If 20 of those stores are loss-making and locked in for the full term, that's a genuine liability a buyer should price into the deal, not just a note in the appendix.
Red flag 2: supplier concentration
Retail margins depend on supply chain terms. DD should quantify:
- % of cost of goods sold (COGS) from top 3 suppliers. Above 30 to 40% (a common informal threshold used by DD teams) signals pricing power risk.
- Payment terms drift. If days payable outstanding (DPO) has been quietly extended to prop up cash flow, that's a working capital risk that reverses post-close.
- Exclusive or single-source contracts. A private-label supplier relationship without a backup manufacturer is a single point of failure.
A useful public reference for benchmarking supply chain and working capital norms is CFI's guide to working capital metrics, which is free and retailer-relevant.
Red flag 3: chargeback and payment exposure
Retailers processing card payments operate under rules set by the card networks (Visa, Mastercard) and, in the US, oversight touching the Durbin Amendment (part of the Dodd-Frank Act, which regulates debit card interchange fees) and PCI DSS (Payment Card Industry Data Security Standard, a private-sector security requirement for handling card data, not a government law but contractually mandatory).
Chargebacks (customer-initiated payment reversals, often for fraud or disputed transactions) matter in DD because:
- High chargeback ratios (commonly a red flag above 1% of transaction volume, per card network guidelines) can trigger network fines or processor account termination.
- E-commerce and BNPL (buy-now-pay-later) heavy retailers carry higher chargeback exposure than in-store-only chains.
- A pending processor dispute is a contingent liability that should be escrowed or price-adjusted, not ignored.
Check to run: pull 24 months of chargeback data by channel, and confirm no processor has issued a warning notice or reserve requirement. A processor holding a rolling reserve (withholding a percentage of sales pending dispute resolution) is a real cash flow drag that reduces the target's usable working capital.
Red flag 4: regulatory fines and compliance exposure
Retail regulation spans several bodies depending on geography:
- FTC (Federal Trade Commission) in the US: enforces advertising, pricing, and data privacy rules.
- CFPB (Consumer Financial Protection Bureau) in the US: relevant if the target offers store credit, financing, or BNPL products.
- CMA (Competition and Markets Authority) in the UK and European Commission DG COMP in the EU: enforce competition law and consumer protection, including the EU's Unfair Commercial Practices Directive.
- GDPR (General Data Protection Regulation) in the EU/UK: fines for mishandled customer loyaltycustomer loyaltyYour customers' propensity to repeatedly purchase from you and resist competitive offers, driven by satisfaction, habit, trust, and switching costs.View full definition → or payment data can reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → up to 4% of global annual turnover.
DD should request:
- All regulatory correspondence and consent decrees from the past 5 years.
- Any pending class actions (common in US retail around labor classification or accessibility, e.g. ADA, Americans with Disabilities Act, website compliance suits).
- Data breach history and associated notification costs, since breach remediation in the US commonly runs into millions once notification, credit monitoring, and legal costs are included (estimate, varies widely by breach size).
Unresolved fines or open investigations should be treated as a holdback (a portion of purchase price withheld in escrow) rather than assumed away.
Knowledge check
1. Why do generic M&A due diligence checklists tend to miss the risks that most affect retail valuations?
2. Since ASC 842 and IFRS 16 took effect, what changed regarding operating leases in retail financial statements?
3. A target has a 10-year lease on a store with declining sales. Why is this a key due diligence concern even though the lease liability now appears on the balance sheet?
4. Select ALL correct answers about structural risks that make retail financial due diligence different from a generic M&A review.
Select all the correct answers.
5. Select ALL correct answers about why lease escalators and renewal terms matter in retail due diligence, even after leases are on the balance sheet.
Select all the correct answers.
Building the DD checklist
A workable retail financial DD checklist condenses to five modules:
| Module | Core Question | Typical Data Requested |
|---|---|---|
| Lease liability | What are total fixed and contingent rent obligations? | Lease schedule, escalators, change-of-control clauses |
| Supplier concentration | How dependent is COGS on few vendors? | Top 10 supplier list, contract terms, DPO trend |
| Payment/chargeback | What is contingent processor liability? | 24-month chargeback data, processor agreements, reserve balances |
| Regulatory exposure | What fines or suits are open or probable? | Correspondence with regulators, litigation log, breach history |
| Working capital quality | Is cash flow real or manufactured pre-sale? | Inventory aging, DPO/DSO trend, return reserves |
Each red flag should mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → to a specific price or structure adjustment: a purchase price reduction, an escrow holdback, a warranty in the sale agreement, or a walk-away condition.
How Private Equity Firms Do Due Diligence
Key Takeaways
- Lease liabilities under ASC 842/IFRSIFRSThe global accounting rulebook that governs how companies report financial results, used across the EU and 140+ jurisdictions.View full definition → 16 are now on-balance-sheet, but DD must still stress-test store-level performance against remaining lease term and escalators, not just the headline number.
- Supplier concentration above roughly 30 to 40% of COGS is a common informal threshold that should trigger contract review and continuity planning.
- Chargeback ratios and processor reserve holds are real, quantifiable liabilities: request 24 months of data by channel before signing.
- Open regulatory investigations (FTC, CFPB, CMA, GDPRGDPREU regulation governing how organizations collect, store and use personal data, with fines tied to global revenue for breaches.View full definition →-related) should convert into escrow holdbacks or price adjustments, never be waved through as "pending."
- Every red flag identified in DD should tie to a concrete deal mechanic: price cut, holdback, warranty, or walk-away clause, not just a footnote in the report.