Buying a company, investing in a growing business, or appointing a major commercial partner involves more than agreeing a price and signing documents. A business may have a valid certificate of incorporation but disputed shares, unpaid taxes, pledged assets, weak contracts, or a licence that does not cover its actual activities.
Corporate due diligence in Kenya helps investors and businesses establish what they are acquiring, who has authority to transact, which liabilities may affect the deal, and what protections are needed. It should turn information into decisions: whether to proceed, renegotiate, require corrective action, or withdraw.
This guide answers the questions our clients most frequently ask about corporate and business due diligence in Kenya. The appropriate scope depends on the transaction, industry, ownership structure, and identified risks.
What is Corporate / Business Due Diligence?
Business due diligence is a structured investigation of a business, its owners, assets, obligations, and operations before making an important commercial decision such as buying, investing, partnering, or joint venturing. The exercise tests the seller’s or counterparty’s representations against documents, public records, interviews, and independent verification.
In practical terms, due diligence answers three questions:
- Is the business what it appears to be? Does the company exist in good standing, do the sellers actually own the shares, and does the company own the land, brands, contracts, and licences on which its value depends?
- What liabilities come with it? Tax arrears, pending lawsuits, unpaid statutory deductions, defective titles, regulatory breaches, guarantees and security interests — whether disclosed or hidden.
- What should change because of what we found? Some findings justify walking away; most justify a price adjustment, a condition to be satisfied before completion, or specific contractual protection.
In a share purchase, the buyer steps into the shoes of the former shareholders while the company carries on with all of its history. That is why due diligence is widely regarded as the single most important risk-management tool in Kenyan mergers and acquisitions.
What are the main types of due diligence?
A comprehensive due diligence exercise usually combines several workstreams, each led by the appropriate professional:
- Legal due diligence – constitutional and corporate records, shareholding and beneficial ownership, board resolutions and contracts, verification of title documents such as land and other real/intangible company assets, employment and labour compliance, immigration records, licences, intellectual property, data protection, litigation and regulatory compliance (advocates).
- Financial due diligence – quality of earnings, working capital, net debt, cash flow and accounting policies (accountants).
- Tax due diligence – compliance history with the Kenya Revenue Authority (KRA), exposure to assessments, transfer pricing and the tax consequences of the deal structure.
- Commercial due diligence – market position, customers, competitors and whether the business plan is realistic.
- Operational and technical due diligence – plant and equipment, IT systems, cybersecurity and supply chains. Read our article on Data Privacy in Kenya: A Comprehensive Overview and Compliance with the Data Protection Act, Kenya
- Environmental, social and governance (ESG) due diligence – environmental licensing and contamination audits and approvals by NEMA, labour standards, community relations and governance, increasingly required by development finance institutions and international investors.
- Integrity (KYC/AML) due diligence – the identity, reputation, politically exposed person (PEP) links and sanctions exposure of the company, its owners and directors.
This guide focuses principally on legal due diligence, while flagging where it overlaps with the financial, tax and integrity workstreams.
Who carries out due diligence, and who pays for it?
The party taking on the risk usually commissions and pays for its own due diligence through its advocates, accountants and other advisers. Lenders appoint their own counsel to verify the borrower and the security. In a competitive sale process, a seller may commission vendor due diligence, a report prepared on the seller’s behalf and shared with bidders, to speed up the process and control how issues are presented. Buyers should treat a vendor report as a useful starting point rather than a substitute for their own verification and should seek reliance on it where possible.
When is Business/Corporate Due Diligence Important in Kenya?
Due diligence is critical across several corporate transactions in Kenya and includes:
- Mergers and Acquisitions (M&A): Prior to share purchases, business transfers, or asset acquisitions, to evaluate the target’s true value and ring-fence inherited liabilities. Read more: Understanding Legal Framework on Mergers and Acquisitions in Kenya under the Competition Act and Mergers and Acquisitions in Kenya: A Comprehensive Overview
- Joint Ventures and Strategic Partnerships: When pooling capital, IP, or operational assets with a local or foreign partner to ensure alignment, regulatory compliance, and clean anti-bribery standing. Read more: Joint Venture Agreements in Kenya: A Detailed Legal & Business Guide
- Private Equity and Venture Capital Inflows: Institutional investors conducting Series funding, mezzanine financing, or convertible debt rounds need strict governance and compliance assurances. Read more at A Guide for Foreign Investors Starting a Business in Kenya
- Financing and Lending Transactions: Commercial banks and development finance institutions (DFIs) conduct due diligence before advancing term loans or syndicate facilities to secure enforceable debentures, charges, or corporate guarantees.
- Initial Public Offerings (IPOs) and Cross-Listings: Meeting the disclosure requirements enforced by the Capital Markets Authority (CMA) and Nairobi Securities Exchange (NSE).
- Corporate Restructuring and Re-organization: Internal health checks before spin-offs, group hive-downs, or converting private companies into public limited entities.
- Procurement and Major Supply Contracts: Assessing the counterparty’s capacity to deliver and verifying compliance with the Bribery Act, 2016, and the Public Procurement and Asset Disposal Act (PPADA), 2015, where government contracts are involved.
- Onboarding suppliers, contractors, and business partners, particularly for entities with anti-money laundering or anti-bribery obligations.
Due diligence should begin early enough to influence the transaction. If commercial circumstances require signing before investigations finish, the agreement should clearly address the remaining checks, conditions, payment restrictions, and exit rights.
Is due diligence a legal requirement in Kenya?
For most private transactions, no single statute obliges a buyer to carry out due diligence. Kenyan courts, however, generally hold parties to the bargains they sign, and under the principle of caveat emptor (“let the buyer beware”), a purchaser who did not investigate will often have limited recourse for problems that a reasonable investigation would have revealed. In practice, due diligence becomes indispensable, and in some situations effectively mandatory, because:
- Regulators require it. Merger notifications to the Competition Authority of Kenya (CAK) and change-of-control approvals from sector regulators such as the Central Bank of Kenya, the Insurance Regulatory Authority, the Capital Markets Authority, the Communications Authority and the Energy and Petroleum Regulatory Authority all call for information that only a proper investigation produces.
- Reporting institutions must do it. Banks and other “reporting institutions” under the Proceeds of Crime and Anti-Money Laundering Act must conduct customer due diligence and identify beneficial owners.
- Directors owe duties. Under the Companies Act, 2015, directors must exercise reasonable care, skill and diligence. Approving a major acquisition without adequate investigation can expose them personally.
- Contractual protection depends on it. Warranties and indemnities are negotiated against what is known. You cannot ask for a specific indemnity for a risk you never identified.
What are the key components of an effective corporate due diligence in Kenya?
An effective due diligence is tailored to the transaction, the sector, and the client’s risk appetite. Most Kenyan legal due diligence exercises, however, cover the following core components:
- Corporate identity, status, structure and statutory records.
- Share ownership, beneficial ownership and transfer restrictions and encumbrances.
- Directors, governance, authority and required approvals.
- Accounts, borrowings, guarantees and security arrangements.
- Taxes, statutory deductions and unresolved assessments. For more information on Kenyan taxes, read our article on Comprehensive Guide to Business Taxes in Kenya, 2025
- Material contracts, customers, suppliers and related parties.
- Employees, consultants, pensions and workplace compliance.
- Land, leases, equipment and other operational assets.
- Intellectual property, technology, data protection and cybersecurity.
- Sector licences, permits, regulatory approvals and environmental obligations.
- Litigation, disputes, insolvency, insurance and contingent liabilities.
- Anti-money laundering, anti-bribery and anti-terrorism sanctions.
- The transaction structure, completion requirements and post-completion actions.
The depth should follow the business. A software company’s code ownership and data practices may be central; a manufacturer may need closer attention to machinery, environmental exposure and premises.
What documents should a company prepare for due diligence?
A tailored request commonly includes:
- Incorporation records, articles, current official search and group structure.
- Registers of members and beneficial owners, share records and relevant filings.
- Board and shareholder minutes, resolutions and shareholders’ agreements.
- Financial statements, management accounts, debt and security documents.
- Tax returns, payment records, assessments and correspondence.
- Material customer, supplier, financing, leasing and related-party contracts.
- Employee and consultant records, benefit arrangements and disputes.
- Asset registers, titles, leases, IP records and material licences.
- Litigation schedules, insurance policies and regulatory correspondence.
- Data protection, cybersecurity and anti-bribery policies and incident records.
Collect records through an indexed data room and maintain a request tracker. Explain why a document is unavailable and what alternative evidence can be provided. Do not casually circulate passwords, privileged advice, or sensitive personal records simply because they appear relevant.
What is the corporate due diligence process in Kenya?
Every transaction is different, but a well-run exercise follows a predictable sequence:
- Scoping and engagement. Agree the objectives, the workstreams, materiality thresholds (for example, contracts above a certain value), the reporting format, and the timetable.
- Sign a non-disclosure agreement covering the information to be shared, its permitted use and its return or destruction, and address data protection for any personal data in the data room.
- Information request list (Due Diligence Questionnaire). Issue a tailored due diligence questionnaire and document request list to the target.
- Virtual data room (VDR). The target uploads documents to a secure, indexed data room, with access controls and an audit trail.
- Independent searches. Conduct official searches at the BRS, the relevant land registries, the Collateral Registry, KIPI, the courts and sector regulators, and verify tax compliance status, independently of anything the seller provides.
- Review, interviews and site visits. Analyze the documents, interview management and key staff, and inspect premises and land.
- Follow-up questions. Raise supplementary requests and clarifications through a structured Q&A log.
- Prepare and deliver a due diligence report, usually an executive summary with a red-amber-green risk rating, followed by detailed findings and recommendations.
- Negotiation and documentation. Translate findings into the share or asset purchase agreement, the disclosure letter, conditions precedent, and specific protections.
- Approvals and completion. Obtain CAK, regional and sector regulatory approvals, third-party consents and Land Control Board consents; run “bring-down” searches immediately before completion.
- Post-completion. File changes to directors, shareholders, and beneficial owners; update bank mandates and licences; and implement a plan to remedy identified issues.
How long does due diligence take in Kenya?
As a general guide, a small private company with well-kept records can often be reviewed in two to four weeks; a mid-sized business in four to eight weeks; and a complex, regulated or multi-jurisdictional target in eight weeks or more. Regulatory approval periods are additional. The biggest causes of delay are slow or incomplete responses from the target, missing statutory records, and registry backlogs.
How do due diligence findings affect the transaction documents?
Depending on the seriousness of each finding, it may lead to:
- Walking away, where the issue goes to the root of the deal (for example, the seller does not own the land).
- A price adjustment to reflect a quantified liability.
- A condition precedent, such as clearing tax arrears, regularizing the share register, filing the beneficial ownership register, or obtaining a Land Control Board consent, before completion.
- A specific indemnity for an identified risk, such as a pending tax assessment or lawsuit.
- Warranties backed by a disclosure letter that fairly discloses known exceptions.
- Retention, escrow or deferred consideration, so that funds are available if a claim arises.
- Pre-completion and post-completion undertakings, and, in larger deals, warranty and indemnity insurance.
What are the common pitfalls to avoid in corporate due diligence?
The following mistakes cause the most avoidable losses:
- Over-relying on seller-supplied searches. Always obtain your own official searches and certified copies.
- Committing too early. Signing a binding agreement or paying a large deposit before due diligence removes much of your leverage.
- Ignoring Beneficial Ownership Updates: Failing to confirm whether the target has submitted up-to-date Beneficial Ownership registers, which can lead to regulatory fines or refusal of registry filings.
- Box-ticking. A generic checklist that is not tailored to the sector and the deal misses sector-specific risks.
- Reviewing documents but not reality. Without site visits and management interviews, you may miss occupation of land, idle plant, or a key-person dependency.
- Poor scoping. Too broad a scope buries the material issues; too narrow a scope misses them.
- Gun-jumping. Integrating the businesses, exchanging competitively sensitive information, or taking control before CAK, COMESA, or EAC approval can attract penalties and invalidate the transaction.
- Workstreams in silos. Legal, finance, and tax teams report inconsistently, with no single list of issues.
- Failing to act on findings. A report that is not reflected in the price or the agreement provides no protection.
- Ignoring transaction taxes. Unpaid capital gains tax or stamp duty can delay registration of the transfer.
- Over-relying on warranties. A warranty is only as valuable as the warrantor’s ability to pay; consider retentions, escrow or guarantees.
- Neglecting data protection. Uploading employee and customer personal data without safeguards can itself breach the Data Protection Act, 2019.
- Forgetting post-completion steps. Unfiled changes of shareholders, directors, and beneficial owners create the very problems the next buyer will find.
What are the common red flags for corporate due diligence in Kenya?
The following findings should prompt further/heightened /enhanced investigation, specific contractual protection, or a reconsideration of the deal:
- Disparities in the corporate, shareholding, and beneficial ownership details between BRS and the company’s internal registers.
- Unresolved KRA Audits and Disputed Tax Assessments: Substantial contingent tax claims that could result in agency notices (freezing bank accounts).
- Movable Property and Debenture Encumbrances: Undisclosed floating debentures or notices on the Movable Property Security Rights (MPSR) register that subordinate the investor’s interest.
- Title Irregularities: Irregular land allocations, absence of NEMA/NCA licenses for manufacturing setups, or revoked original grants.
- Unregulated Foreign National Employment: Expatriate key personnel working without valid Class D or G work permits, exposing the company to immigration enforcement and deportation risks.
- Pending Employment Claims: Unaddressed collective grievances, unfair dismissal suits, or unpaid historical pension deductions.
- Data Protection Non-Compliance: Large-scale handling of consumer data without ODPC registration, missing privacy policies, or unrecorded cross-border data routing.
- Bribery and Procurement Irregularities: Ambiguous consultancy fees, off-book accounts, or third-party agent contracts in public sector bidding, triggering exposure under Kenya’s Bribery Act, 2016 and the Anti-Corruption and Economic Crimes Act (ACECA).
Disclaimer: This article provides general information and does not substitute legal advice on specific circumstances of any individual or organization. While the information is accurate as of the date published, we cannot guarantee it remains accurate at the time you read it or that it will stay current. Before acting on any of this information, please seek professional legal advice tailored to your situation.
