Due Diligence Checklist for Startups: 2026 Guide + Download

Most fundraising delays don't happen in the pitch. They happen in due diligence, after the term sheet, when an associate opens the data room and starts a list of everything that doesn't tie out. This due diligence checklist for startups is the 2026 refresh of the guide we first published in December 2025: what investors actually request, folder by folder and stage by stage, what re-prices a deal, how to prepare, and a CSV you can turn into your own data-room index.

A due diligence checklist is the list of documents and data an investor's team requests to verify what you claimed in the pitch: corporate records and cap table, financials, contracts, customers, product and IP, people, tax and compliance. It arrives with or just after the term sheet. In our work, 7 of 10 founders underestimate what buyers ask for; the folders below are what they ask for.

Startup due diligence in 2026, in one paragraph. The request list arrives with the term sheet, and the published versions agree on its shape: Cooley GO's sample list, Y Combinator's Series A checklist and DocSend's 2026 refresh all ask for corporate records and minutes, the fully diluted cap table and every securities agreement, financial statements and tax returns, material contracts, IP registrations and invention assignments, litigation, and the employee census with compensation and classification. Light diligence (customer calls, a cursory model review) happens before the term sheet; the deep pass (bank statements, background checks, IP and cap-table review) comes after it. Seed diligence typically runs a few weeks and Series A a month or more; YC's estimate is that a data room built in advance cuts as much as a week off a Series A close. What kills deals: a cap table that doesn't reconcile, unassigned IP, revenue recognized ahead of the contract, customer concentration above the 20% flag, unfiled tax, undisclosed disputes. In Waveup's work, 7 of 10 founders underestimate what buyers ask for in diligence.

The figures behind that paragraph are in the table: how long each stage of diligence runs, what a ready data room saves, what the published lists contain, and the two numbers from our own engagements that shape the rest of this guide. Each row carries its source; the sections below explain what to do about them.

What is a due diligence checklist, and when do investors send it?

A due diligence checklist is the request list an investor's lawyers and associates send once commercial terms are agreed, usually with or right after the term sheet, listing every document and dataset they need before wiring. Light checks happen before the term sheet; the deep ones after it. The difference between a 3-week close and a 3-month one is whether the folders already exist.

Diligence runs in two passes, and founders usually plan for only the first. Before a term sheet, a VC does what it can in days: a couple of customer calls, a cursory look at the model, back-channel references and a competitive scan (SaaStr). After the term sheet come the bank statements, formal references, background checks, IP ownership and the legal review of your cap table and any ex-founder issues; most of the deep work now sits after the term sheet, not before it. Y Combinator frames its Series A checklist the same way: the list is what you need ready once the term sheet is signed, and having it in one place before then shortens the close (Y Combinator).

The request list itself is the artifact. Cooley's sample VC diligence request list is 9 categories deep, from board minutes to environmental liabilities (Cooley GO). UK law-firm practice reads the same: the investor's solicitors send a request list after terms are agreed, and the company answers through a virtual data room (Jonathan Lea Network). What's new in 2026 is the AI section: DocSend's refreshed checklist now asks for training-data provenance, third-party model agreements and model-security safeguards alongside the corporate records (DocSend).

The same logic runs wherever risk meets capital. Buyers in an M&A process send a longer version of this list, lenders send a narrower one, and private equity funds send the deepest. VC diligence is lighter and faster than a sale process, but the folders are the same, which is why the checklist below doubles as the skeleton of a sell-side data room and pairs with our CIM example and how to sell your startup guides.

What's on the startup due diligence checklist? The 8 folders

8 folders cover almost every request list we've seen: corporate and cap table, financial, legal and contracts, commercial and customers, product, technology and IP, people and HR, tax, and compliance and data protection. Cooley's sample list and YC's Series A checklist use different headings but the same contents. Build the data room in this order and most requests become a link, not a search.

The folders below merge the published lists (Cooley GO, Y Combinator, DocSend, Hustle Fund, Visible) with what our own data-room index asks for on fundraising and sell-side mandates. Each item carries the reason the investor asks, because knowing the question behind the request is what lets you answer it once instead of five times. The stage tags (All, Seed+, Series A+, Series B+) and a Must, Should or Nice priority for every item are in the downloadable CSV at the end of this section.

1. Corporate records and cap table

This folder answers one question: does the company legally exist in the shape the deck describes, and who owns it? Cap-table problems are the most common legal defect law firms find in VC diligence: shares promised but never recorded, unregistered transfers, versions of the cap table that disagree with the register (Jonathan Lea Network). Pre-seed investors put corporate hygiene above everything else because, with no revenue to audit, it's the one thing they can verify (Charles Hudson, Precursor).

• Certificate of incorporation, bylaws or articles, and every amendment: proves the entity and its share classes are what you say they are.
• Board and shareholder minutes and written consents: every issuance, option grant and financing should have an approval behind it.
• Fully diluted cap table with every SAFE, note, option, warrant and side letter: the investor rebuilds it, and theirs has to match yours.
• Prior financing documents (SAFEs, convertible notes, priced-round agreements): to find caps, discounts, MFN clauses and consent rights that bite in this round.
• Founder stock purchase agreements, vesting schedules and any acceleration: to see how much unvested equity keeps the team in the building.
• Departed co-founders and advisors, what they own and on what terms: dead equity is the pre-seed question asked first.
• Pending or promised equity grants: YC's advice is to clear the backlog before the term sheet, because a term sheet can invalidate the 409A price you would grant at.
• Securities-law exemption evidence for past issuances (Rule 701, blue-sky filings): a Cooley and YC line item founders rarely know exists.

2. Financial

Here investors test whether the numbers in the deck survive contact with the bank account. a16z's data-room guide puts the monthly historical P&L and burn among the five things it wants first, and lists numbers that aren't consistent with the deck as its first red flag (a16z). By Series A, expect audit-ready statements, a cap table on a platform rather than a spreadsheet, and revenue-recognition policies that make ARR defensible (Carta).

• Monthly P&L, balance sheet and cash flow since founding, actuals marked as actuals: the associate reconciles every deck number against these.
• Recent bank statements, reconciled to the books: after the term sheet, the investor checks the cash is real.
• Current cash, monthly burn and runway: they're modeling how many months the round buys.
• Revenue by customer and by type (recurring vs one-off; contracted vs recognized vs cash): revenue recognition is where growth stories quietly shrink.
• Gross margin by product or segment: margins are sticky, so investors read them as the durable part of the unit economics.
• Unit economics: CAC by channel, LTV, payback period: a16z boils it down to whether you make money on the average customer.
• Cohorts and retention, full data rather than the best cohorts: selectively presented metrics are an explicit a16z red flag.
• Financial model and projections with stated assumptions: early-stage investors want the milestone plan to the next round more than a five-year model; see our financial modeling practice for what ties out.

3. Legal and contracts

The contracts folder is where investors look for revenue that isn't really recurring and obligations that follow the money. YC and DocSend both draw the line at any agreement involving more than $25,000 in obligations or payments (Y Combinator). Law firms then read for change-of-control consents, uncapped liability, exclusivity and informal variations that differ from the signed terms (Jonathan Lea Network).

• Standard terms of service, privacy policy and standard form agreements: to see what every customer has actually agreed to.
• Material customer, vendor and partner contracts above the threshold: value, term, renewal, termination and change-of-control clauses.
• Debt: loan agreements, credit lines, guarantees, liens, equipment leases: anything that ranks ahead of the new money.
• Real-property and equipment leases: commitments that survive a pivot.
• Joint-venture, partnership, reseller and distribution agreements: exclusivity that could block a channel or a buyer later.
• NDAs and confidentiality agreements: especially those signed with competitors or potential acquirers.
• Agreements needing consent for this financing: a missing consent is a closing condition nobody planned for.
• Insurance policies (D&O, cyber, general liability): later-stage leads ask; earlier ones note the gap.

4. Commercial, customers and go-to-market

If the financials show what happened, this folder shows why, and whether it repeats. Investors separate contracted revenue from recognized revenue, pipeline, pilots, letters of intent and verbal interest, and they ask you to explain every spike (Hustle Fund). Customer concentration gets its own line: a single customer above about a fifth of revenue is the standard first flag in M&A diligence, and it draws the same question in a VC process (Sofer Advisors).

• Customer list with revenue, start date, contract end and status (anonymized if needed): concentration, tenure and renewal risk in one sheet.
• Top-customer concentration table: disclosed here beats discovered later.
• Churn, retention and net revenue retention by cohort: whether the base compounds or leaks.
• Pipeline, win rates, sales-cycle length and conversion by stage: whether next year's plan is real.
• CAC by channel and channel mix: whether growth is bought, earned or founder-led.
• Customer references, pre-briefed: investors will call; choose who.
• Market research, competitive landscape and the TAM build: a16z says it sizes the market itself, but sector teams still check yours.
• Recent investor updates: seed investors read them to see how you report the bad months; our investor update template is built for that.

5. Product, technology and IP

Two questions: is the product real, and does the company own it? The IP question is the one that kills deals. Paying a contractor does not transfer ownership; without a written assignment the company may hold only limited or implied rights, and problems cluster around code written before incorporation or by freelancers (Jonathan Lea Network). Cooley's list asks outright for the names of anyone who has not signed an invention-assignment agreement (Cooley GO).

• Live demo or walkthrough, product maturity and the roadmap to the next round: to judge how much of the round buys product versus catch-up.
• Architecture overview, tech stack and key dependencies (cloud, model providers, licenses): which supplier can change your cost or your access.
• Invention-assignment agreements from every founder, employee and contractor, plus the list of who hasn't signed: the company must own what it sells.
• Registered IP: patents, trademarks, domains, and any assignments recorded with the registry: proof, not a list.
• Inbound and outbound licenses, an open-source inventory and third-party AI service agreements: DocSend's 2026 list adds training-data provenance and model security here.
• Security posture: access controls, backups, incident history, pen-test results where relevant: scoped to the data you actually hold.
• Technical debt and known risks, stated by you: an unstated dependency is priced harder than a disclosed one.

6. People and HR

Early-stage investing is a bet on the team, so the folder goes past the team slide. YC and Cooley both ask for a list of officers noting anyone not devoting all their business time to the company (Y Combinator). Contractor misclassification is the hidden liability: someone described as self-employed may legally be an employee, with back taxes and statutory rights attached (Jonathan Lea Network).

• Employee and contractor list with title, salary, bonus, commission, classification and location: the payroll the round funds.
• Standard offer letter, employment and consulting templates, plus signed copies for key people: confidentiality and IP terms live here.
• Option plan, grant records, the valuation used to price grants, and the option register reconciled to the cap table: unsigned option promises are a routine red flag.
• Founder time commitment, vesting and leaver terms: what happens to equity if someone leaves.
• Org chart and the hiring plan behind the use of funds: the round, in people.
• Benefit plans, handbook, severance or change-of-control arrangements: obligations triggered by the deal itself.
• Accrued but unpaid salary, PTO and expenses: a Cooley line item that surfaces deferred founder pay.
• Disputes with current or former staff: the most common litigation at pre-seed and seed, per Precursor.

7. Tax

Tax is the folder founders skip and investors don't. Tax warranties are usually the harshest in an investment agreement because penalties are high and a lapse damages good standing; a first-year company that never filed a zero-income return, or missed a franchise tax, has a problem with no quick fix (Legal Nodes). Hustle Fund's list checks bookkeeping, payroll-tax, income-tax and sales-tax processes even at seed (Hustle Fund).

• Filed returns for every year since incorporation, including zero-income years: proof the company is in good standing.
• Franchise-tax and annual-report filings in the state or country of incorporation: cheap to file, expensive to miss.
• Payroll-tax and sales-tax registrations and filings in every jurisdiction where you employ or sell: the liabilities that scale with growth.
• R&D credit or incentive claims, reconciled to the balance sheet and to real R&D spend: investors back-calculate true R&D intensity rather than trust the claim.
• Transfer-pricing documentation for any offshore entity: a Series A expectation for multi-entity groups.
• QSBS or local-equivalent eligibility analysis (SEIS and EIS in the UK): investors ask because it changes their after-tax return.
• Correspondence with any tax authority, open enquiries, penalties: disclose before they find it.

8. Compliance and data protection

This folder grew the most in the last year. The NVCA's October 2025 model documents added two-way representations on US outbound-investment and data-security rules, and Foley advises founders to budget a few weeks before a raise for a regulatory health check against them (Foley & Lardner). For any company selling into Europe, GDPR is on every questionnaire: privacy notices, processor terms, international transfers and breach procedures (Legal Nodes).

• Privacy policy, cookie policy and a data map (what you collect, where it lives, who processes it): the GDPR and CCPA baseline.
• Data-processing agreements, subprocessor list and international-transfer mechanism: B2B customers and investors ask the same questions.
• Licenses, permits and regulatory approvals for your sector (financial services, health, telecoms): a missing authorization can stop the business model.
• Regulator correspondence, including any FDA or equivalent filings: Cooley asks for all of it.
• Sanctions, export-control and AML/KYC policies where relevant: plus the outbound-investment and data-security exposure questions now in NVCA-form deals.
• Beneficial-ownership and foreign-investor analysis: needed to give the new NVCA representations without carve-outs.
• Litigation, threatened claims and settlements, with a written disclosure schedule: late disclosure invites warranty claims after closing.

What do investors actually request at each stage?

Pre-seed diligence is corporate hygiene: cap table, founder vesting, IP assignments, cash. Seed adds financial statements that reconcile to the traction claims, cohorts, contracts and board consents. Series A is the full request list, audit-ready financials and customer calls; Series B and later add third-party verification. In our work, the gap between what founders prepare and what a Series A lead asks for is the biggest source of delay.

Two patterns in the table. The list doesn't get longer at each stage so much as the standard of proof rises: a seed investor accepts a spreadsheet cap table that reconciles, while a Series A lead expects it on a platform with every grant documented (Carta). And the folders never change, which is why building all 8 at seed, even thinly, pays twice: once now and again at the A, when the same associate opens a room that already has the structure. Our seed round benchmarks and Series A benchmarks cover what the metrics inside those folders need to show.

What re-prices or kills a deal in diligence?

Six findings do most of the damage: a cap table that doesn't reconcile, IP that was never assigned to the company, revenue recognized ahead of the contract, one customer worth a fifth or more of revenue, unfiled or unpaid tax, and undisclosed disputes. None is automatically fatal; disputed ownership of core IP and fraud are the ones investors walk from. We've seen the rest cost weeks, valuation, or both.

The consequences run on a scale. Most issues end in remediation or extra protection: corrected records before closing, post-closing undertakings, a specific indemnity. Serious ones reopen the commercial terms: valuation, round size, founder vesting or investor control. Fraud, disputed ownership of core IP or a serious regulatory breach make investors withdraw, and early disclosure with a credible remediation plan is what keeps you on the first rung (Jonathan Lea Network). Here are the six, with what each one costs.

• ❗ Cap-table surprises. A departed co-founder still holding a large stake, an advisor promised equity in an email, a SAFE nobody scheduled. Precursor rebalances cap tables with founders before investing when the ownership story doesn't add up (Charles Hudson); a Series A lead prices the mess into the option pool or the pre-money instead. Our dilution guide shows what that costs.
• ❗ IP not assigned. Code written by a freelancer, a domain registered in a founder's name, a prototype built at a previous employer. Legal Nodes cites a game pulled from Steam after a developer with no assignment filed a copyright claim (Legal Nodes). Fix: signed assignments from every contributor, collected before outreach.
• ❗ Revenue recognition. ARR in the deck that is contracted but not live, annual contracts booked as if fully recognized, pilots counted as customers. a16z's example is a deck stating one ARR figure while the model shows a lower one (a16z). Reconcile contracted, invoiced and cash revenue before anyone else does.
• ❗ Customer concentration. One account above a fifth of revenue is the standard first flag in M&A diligence, and the discount grows as the share does (Sofer Advisors); the thresholds are in the table below. Disclose it with tenure, contract end dates and the expansion story inside the account, or expect the buyer to ask for an earnout instead.
• ❗ Unpaid or unfiled tax. A missed zero-income return, an unpaid franchise tax, sales tax never registered in a state you sell into. Tax warranties are the harshest in the investment agreement, and a missed filing has no quick fix once the penalties are due (Legal Nodes). Bring the filings, or bring the remediation plan and its cost.
• ❗ Litigation and disputes. Claims by former employees or founders are the most common kind at pre-seed and seed (Charles Hudson). Even a minor claim discovered late undermines confidence and invites a warranty claim after closing; a disclosed one with a status and a mitigation plan is just context.

How do you prepare for due diligence?

Build the data room before outreach, not after the term sheet; YC's estimate is that having it ready cuts as much as a week off a Series A close. Mirror the 8 folders, add an index, give every folder an owner, and run one Q&A log so each investor question is answered once. Then reconcile: deck, model, data room and CRM must show the same numbers.

Start with the room. a16z's advice is to have it prepared before you officially kick off the raise and to treat it as a work in progress that grows with investor questions (a16z). Structure it as the folders above, numbered, with an index file at the top and a cover note that says what's in the room and what isn't yet. Our guide to data rooms for startups covers tooling and permissions; the short version is staged access, a light room for first meetings and the full room after the term sheet.

Then assign the answering. Diligence stalls when every question routes through the CEO. Split the folders by owner and name a reviewer, so the person who answers a revenue-recognition question is the one who keeps the books, and the person who answers an IP question has the signed assignments in front of them. The table below is the split we use.

The Q&A log is the tool founders skip. One spreadsheet: question, who asked, date, folder, answer, document link, who approved it. It does three things at once. It stops two investors getting two different answers to the same question. It shows you which folders draw the most questions, which is where the next version of the deck needs work. And it becomes the disclosure record law firms recommend keeping: what was disclosed, to whom, and when (Jonathan Lea Network).

Finally, reconcile before you send anything. In roughly 60% of the models we review, first-year revenue projections are too aggressive by a wide margin, and a data room makes that visible faster than a pitch does. Take a day with the model, the deck, the CRM and the room, and make every metric agree on definition and value. Then be ready to explain the numbers yourself: an investor who has to dig for why churn moved in March will dig everywhere else too.

One more timing rule. If bad news exists, surface it before the term sheet; Lemkin's point is that a hidden problem blowing up after a signed term sheet is the worse outcome (SaaStr). And diligence that drifts past six weeks with no visible progress usually means conviction is fading, not that the associate is slow (SheetVenture).

Where Waveup helps, and where you don't need us

Waveup prepares founders for diligence on both sides of the table: the data room, model and narrative before a raise, and buy-side diligence for clients acquiring a company. Since 2014 our clients have raised $3B+, and the raises we run close 70% faster than founders working alone. If you're pre-seed with a clean cap table and no contractors, this checklist is enough; you don't need us yet.

Most of the due diligence market is built for the buyer: the large consultancies serve corporate acquirers and PE funds on big transactions and publish nothing for the founder being diligenced. We work the other side, startups and growth companies, and we've stood on both: preparing fundraising and sell-side data rooms, and running buy-side diligence for clients making acquisitions. Our due diligence consulting covers financial, commercial and operational diligence, a quality-of-earnings style review of your own numbers before an investor commissions theirs, and the data-room index built against the diligence list.

What that looks like on a raise: a financial model that ties to the data room, so revenue-recognition and cohort questions are answered by a file rather than a call; a cap-table and dilution scenario set before outreach; and a reconciled narrative across deck, model and room, because 7 of 10 investor no-votes trace to narrative and materials rather than the business. Founders running raises solo typically take most of a year; the raises we run through our fundraising advisory closed 70% faster on median. Engagements are scoped after a short diagnostic call, and there is no published price for fundraising work.

When not to hire anyone: pre-seed on SAFEs, a founding team that owns everything, no contractors, no data of consequence. Use the CSV, spend a weekend, and keep the money. Where a lawyer beats us: defective share allotments, missing consents, disputes; that's counsel's job, and we work alongside counsel rather than instead of them. For the firms that do buy-side and M&A diligence at scale, see our top 10 due diligence companies list.