Step‑by‑step Guide to the M&A Due Diligence Process in Spain, Tech, Life Sciences & Cross‑border Checklists

Last updated: 28 May 2026

The M&A due diligence process in Spain is the structured investigation a buyer, and, increasingly, a well-prepared seller, undertakes before committing to an acquisition or disposal. It covers legal, financial, tax, employment, intellectual-property, IT, regulatory and environmental workstreams, and its scope has widened materially since Real Decreto 571/2023 expanded the foreign-direct-investment (FDI) screening regime built on Law 19/2003 and Real Decreto-ley 8/2020. This guide walks general counsel, in-house M&A teams, PE/VC buyers and founders through every stage, from data-room preparation to post-closing remediation, with dedicated checklists for Tech and Life Sciences transactions and the timeline, document and cost tables needed to plan a deal in 2026.

Whether you are a domestic buyer, a foreign acquirer subject to FDI pre-notification, or a seller assembling a vendor due diligence pack, the sequenced procedure below sets out exactly what to do, who does it and how long each step takes.

Overview of the M&A Due Diligence Process in Spain and Who It Applies To

Due diligence in a Spanish M&A transaction serves two core purposes: it lets the buyer identify and price risk before signing a share-purchase agreement (SPA), and it generates the evidence base for the representations, warranties and indemnities that protect both sides after closing. In practice, due diligence splits into buyer-side DD (the default) and seller or vendor DD, where the target company pre-packages verified information to accelerate a competitive process or auction.

A full-scope exercise typically includes the following workstreams, running partly in parallel:

• Legal, corporate structure, contracts, IP, employment, litigation, real estate.
• Financial, historical accounts, working-capital analysis, quality of earnings.
• Tax, filed returns, open assessments, transfer-pricing exposure.
• Commercial / market, customer concentration, pipeline, competitive position.
• IT / IP, system architecture, source-code ownership, open-source dependencies, data-protection compliance.
• Regulatory, sector licences, product registrations (notably AEMPS for Life Sciences), FDI clearance.
• ESG / compliance, anti-corruption, sanctions screening, environmental liabilities.

Since 2023, every cross-border transaction touching strategic sectors must factor in FDI screening checks under the regime consolidated by Real Decreto 571/2023. Investments made without the required authorisation may be deemed to lack legal effect, so early regulatory mapping is now a deal-critical first step, not an afterthought. The sections below set out M&A due diligence Spain requirements in the order you will encounter them.

Eligibility, Prerequisites and FDI Screening Triggers

Not every Spanish deal triggers a regulatory pre-notification. Understanding whether yours does, and how early to act, is the single most important prerequisite before launching formal due diligence.

Under the FDI regime consolidated by Real Decreto 571/2023 (implementing Law 19/2003 and the temporary measures introduced by RDL 8/2020), prior authorisation or a mandatory declaration is required when a foreign investor acquires or increases a stake in a Spanish company operating in any of the following strategic sectors:

• Critical infrastructure, energy, transport, water, health, communications, media, data processing, aerospace, defence, electoral, financial.
• Critical technologies, artificial intelligence, robotics, semiconductors, cybersecurity, quantum, nuclear, aerospace, defence, dual-use.
• Sensitive data and media, access to personal or classified data at scale.
• Pharmaceuticals, clinical and medical devices.
• Key inputs and food security.

The regime applies to investors resident outside the EU/EFTA and, in certain circumstances, to EU-resident investors controlled by non-EU entities. Thresholds vary: for listed companies, a 10% stake or board-seat trigger applies; for unlisted targets in sensitive sectors, any acquisition of effective control can be caught. An investment completed without the required authorisation may be suspended in its legal effects until regularised, and the Council of Ministers may impose sanctions.

The practical takeaway: run FDI screening checks Spain before, or at the latest concurrently with, the first round of information requests.

Step‑by‑Step M&A Due Diligence Procedure

The following numbered procedure represents the typical sequencing for a private M&A transaction in Spain. Public-company deals add CNMV pre-offer and post-offer filing steps, but the core due diligence workstreams remain the same.

Step 0, Prepare the Seller Due Diligence Pack and Virtual Data Room

The seller (or its advisers) assembles the corporate, financial, tax, employment, IP, IT, regulatory and litigation records listed in the documents table below and uploads them to a secure virtual data room (VDR). A well-indexed VDR accelerates buyer review by weeks. Sellers should agree a standard folder taxonomy with counsel before populating the room and ensure all documents that will be reviewed by foreign-language buyers include certified English translations where the original is in Spanish.

Step 1, Issue the Initial Information Request and Begin Q&A

Buyer counsel issues a due diligence request list (DDRL) tailored to the target’s sector. For Tech transactions, this will emphasise IP ownership chains, open-source software inventories and data-transfer mechanisms. For Life Sciences deals, the list front-loads AEMPS registration status, clinical-trial records and pharmacovigilance files. The seller’s deal team responds through the VDR’s Q&A module, creating an auditable trail of supplemental disclosures.

Step 2, Conduct the Legal and Regulatory Review

This is the heaviest workstream. Buyer counsel reviews corporate records, material contracts, employment arrangements, litigation files, real-estate titles, insurance coverage and regulatory licences. Two sector-specific sub-workstreams deserve separate attention:

Tech M&A Due Diligence Spain, Sector Checklist

• IP ownership and chain of title. Confirm that all patents, trademarks and copyrights are properly assigned to the target (not to founders personally). Check assignment clauses in employee and contractor agreements.
• Open-source software (OSS) inventory. Identify copyleft and permissive licences; flag any GPL-licensed code embedded in proprietary products.
• Software licence compliance. Verify enterprise licence counts and transferability on change of control.
• IT security posture. Request SOC 2 reports, penetration-test results and incident-response logs.
• Data protection and international transfers. Map personal-data flows, verify Standard Contractual Clauses (SCCs) or other transfer mechanisms, and review any correspondence with the AEPD.
• Cloud-contract migration. Identify key SaaS and IaaS agreements and assess change-of-control or assignment restrictions.

Life Sciences Due Diligence Spain, Sector Checklist

• AEMPS product registrations and marketing authorisations. Confirm validity, conditions, renewal dates and any ongoing variations.
• Clinical-trial records. Obtain investigator brochures, trial registrations, regulatory approvals and data-integrity audit reports.
• Pharmacovigilance system. Review the Qualified Person for Pharmacovigilance (QPPV) appointment, periodic safety update reports (PSURs) and risk-management plans.
• Manufacturing and import licences. Verify GMP certificates and any site-specific conditions imposed by AEMPS.
• CE markings and notified-body status (for medical devices under the MDR).

Step 3, Complete Financial and Tax Due Diligence

Financial advisers reconcile audited accounts against management figures, analyse working-capital trends, assess quality of earnings and flag off-balance-sheet liabilities. Tax DD covers corporate-income-tax returns, VAT compliance, transfer-pricing documentation and any ongoing disputes with the Agencia Tributaria. In cross-border deals, particular attention goes to withholding-tax structures and the availability of treaty relief.

Step 4, Run ESG, Compliance and AML / Sanctions Checks

Third-party screening providers run sanctions, PEP and adverse-media checks on the target’s shareholders, directors and key counterparties. Compliance counsel reviews the target’s anti-corruption policies, gifts-and-hospitality registers and any whistleblower reports. Environmental DD (contaminated-land assessments, emissions permits) is added for industrial or manufacturing targets.

Step 5, Draft the DD Report and Negotiate Conditionality

Buyer counsel consolidates findings into a red-flags report, prioritising issues by financial impact and deal-blocking potential. Findings feed directly into SPA negotiation: material risks become specific indemnities, warranty qualifications, escrow holdbacks or purchase-price adjustments. Warranty-and-indemnity (W&I) insurance underwriters receive the DD report to underwrite their policies, so completeness matters.

Step 6, File FDI Pre‑Notification or Authorisation and CNMV Filings

If the FDI screening analysis from Step 0 confirmed a filing obligation, the buyer, typically through legal counsel, prepares the pre-notification or prior-authorisation package and files it with the Subdirectorate General for Foreign Investment (Registro de Inversiones Exteriores). Under Real Decreto 571/2023, the authorities have a review period that can extend from 30 to 90 days and may be lengthened further if in-depth analysis is required. Deal effects remain suspended until clearance is granted. For public-company transactions, pre-offer notifications and post-offer filings with the CNMV run in parallel with separate regulatory timelines.

Step 7, Post‑Closing Integration and Remediation Monitoring

After closing, the buyer monitors indemnity-claim deadlines (commonly 18–24 months for general warranties, longer for tax and fundamental warranties), executes any required regulatory novations (e.g., AEMPS licence-holder changes) and implements remediation plans identified during DD. Industry observers expect that the ongoing expansion of FDI reporting obligations will also require post-closing compliance filings for certain transactions.

Documents Needed for M&A Due Diligence in Spain, Complete Checklist

The table below is the core due diligence checklist Spain deal teams should use when building a VDR or scoping a buyer DDRL. Documents should be provided in Spanish originals with certified English translations where a foreign buyer is involved.

Practitioners recommend that sellers pre-populate the VDR against this checklist before the buyer’s first information request. Gaps in the room signal risk and invite deeper buyer scrutiny, or price adjustments.

Due Diligence Timeline Spain, Key Deadlines by Deal Type

The overall due diligence timeline Spain deal teams should plan for depends on three variables: deal complexity, sector-specific regulatory requirements and whether FDI clearance is needed.

The critical-path item in cross-border deals is FDI screening. Under Real Decreto 571/2023, the review period can run from 30 days to 90 days and may be extended if the Council of Ministers requires in-depth analysis. Because the investment’s legal effects are suspended until clearance is granted, buyers must file early, ideally before or during the main DD phase, to avoid compressing the negotiation window.

M&A Cost Spain, Fees, Budgets and Tax Considerations

The following table sets out typical cost ranges for each workstream. All figures are indicative estimates; actual fees vary by firm, deal size and complexity. Buyers should request fixed-fee proposals wherever possible and budget a 10–25 % contingency for unexpected regulatory or FDI items.

Transfer tax (ITP) at regional rates may apply to asset deals; share deals are generally exempt from ITP but subject to corporate-income-tax analysis on capital gains. Stamp duty (AJD) may apply to notarised documents. Tax structuring should be agreed before signing to avoid double charges.

What Changes in 2026, FDI Screening and Practical Compliance

The single most consequential regulatory development affecting the M&A due diligence process in Spain in recent years is the consolidation of the FDI screening regime through Real Decreto 571/2023, which details the suspension-of-liberalisation mechanism originally introduced by RDL 8/2020 and anchored in Law 19/2003.

The practical effects for deal teams in 2026 are threefold:

1. Mandatory declarations. Even where prior authorisation is not required, certain foreign investments must be declared to the Registro de Inversiones Exteriores using the prescribed forms (DP‑1, D‑1A, D‑1B). Failure to declare does not void the investment but triggers administrative sanctions.
2. Suspension of legal effects. Where prior authorisation is required, investments in strategic sectors by non-EU/EFTA investors, the transaction’s legal effects are suspended until the Council of Ministers grants clearance. Completing without authorisation risks the investment being declared void.
3. Expanded sanctioning regime. Real Decreto 571/2023 broadens the categories of infringement and the range of available sanctions, including fines and mandatory divestiture.

The procedural checklist for FDI screening checks Spain is straightforward but time-sensitive:

1. Identify whether the target operates in a strategic sector covered by the regime.
2. Confirm the investor’s nationality and ultimate-beneficial-owner chain (including indirect non-EU control).
3. Prepare the pre-notification or prior-authorisation package with supporting documentation.
4. File with the Subdirectorate General for Foreign Investment and allow 30–90+ days for review.
5. Do not close or exercise any rights under the investment until clearance is received.

Industry observers expect the Spanish authorities to continue broadening the definition of “critical technology” in line with the EU’s evolving FDI Screening Regulation, making early legal assessment of sector classification increasingly important.

Common Pitfalls in Spanish M&A Due Diligence, and How to Avoid Them

• Under-estimating FDI and sector-regulator timing. The 30–90-day review window can derail deal calendars if filed late. Mitigation: run a preliminary FDI-screening assessment before or at the LOI stage and file as early as commercially feasible.
• Missing Spanish employment liabilities. Severance obligations, collective-bargaining commitments and pending labour claims are frequently larger than foreign buyers expect. Mitigation: obtain a full headcount register, copies of all collective agreements and a labour-counsel review before signing.
• Ignoring IP chain of title and open-source risk. In Spanish Tech companies, IP is sometimes held by founders or contractors rather than the corporate entity. Copyleft OSS licences can restrict commercialisation. Mitigation: obtain assignment confirmations for all material IP and commission a dedicated OSS audit.
• Data-protection gaps in international transfers. Transfers of personal data outside the EEA without valid SCCs or an adequacy decision expose the buyer to AEPD enforcement action. Mitigation: map all data flows, verify transfer mechanisms and conduct Data Protection Impact Assessments (DPIAs) where required.
• Relying on seller representations without verified evidence. Warranties in the SPA are only as good as the evidence behind them. Mitigation: insist on a properly indexed VDR, independent verification of key claims, escrow holdbacks for identified risks and W&I insurance where available.

Sources

1. BOE, Real Decreto 571/2023
2. Ministerio de Industria, Registro de Inversiones Exteriores
3. Agencia Española de Protección de Datos (AEPD)
4. Agencia Española de Medicamentos y Productos Sanitarios (AEMPS)
5. Comisión Nacional del Mercado de Valores (CNMV)
6. Baker McKenzie, Spain M&A Quick Reference Guide
7. Cuatrecasas, FDI Overview (Spain)
8. IBA, Negotiating M&A in Spain