The 7 Risks Most Frequently Overlooked In Legal Due Diligence

In corporate mergers and acquisitions, the due diligence process constitutes the fundamental stage during which the buyer conducts an in-depth analysis of the target company's legal, financial and operational structure, enabling the buyer to make an informed investment decision. This process is not limited to merely ascertaining the current situation; it also plays a decisive role in anticipating hidden risks and liabilities to which the acquirer may be exposed following completion, and in ensuring these are properly reflected in the contractual framework. However, in practice, due diligence reviews are conducted using standard checklists and are largely confined to document verification; this approach creates fertile ground for many critical risk items to be overlooked.

The specific conditions of Turkish law and the business environment introduce an additional layer of complexity to the due diligence process. Key risk areas, both from a legal and financial perspective, include change-of-control clauses in contracts, guarantees, related-party risks arising from intra-group transactions, intellectual property, compliance issues under personal data protection legislation (KVKK), Social Security Institution (SGK) premium obligations and tax risks. Below, the risk areas most frequently encountered in company acquisitions under Turkish law and carrying liability potential are addressed alongside practical findings and review recommendations.

1.     Change-of-Control Clauses

While contracts are included within the scope of due diligence, the review is often limited to contract terms, penalty clauses and, in financial contracts, outstanding debt balances, interest rates and maturity dates. The risks most likely to be overlooked in this context can be summarised as follows:

·       Change-of-control clauses, which attach various legal consequences to a change in the ownership structure or management of the target company, are frequently encountered in contracts to which the target company is a party. Such clauses may require the counterparty's consent in long-term supply and customer agreements, accelerate the debt or require prior notification in bank credit agreements, suspend or terminate licence rights in licence and franchise agreements, and make the validity of the transfer subject to the agent's consent in dealership and agency agreements. Failure to comply with notification or consent obligations may trigger contractual default provisions; completing the closing without obtaining the consent of the relevant parties may simultaneously expose both the target company's financing structure and its critical commercial relationships to the risk of unravelling.

·       It is common in Turkish banking practice for the majority shareholder or the person actually managing the company to become a party to the credit agreement as guarantor. However, personal guarantees may also be undertaken in commercial real estate lease agreements, supplier agreements and certain dealership arrangements. This guarantee relationship, governed by Articles 581 to 603 of the Turkish Code of Obligations, does not automatically terminate upon the transfer of shares; liability persists even where the guarantor shareholder or manager has severed their connection with the company. The full identification of guarantee risks prior to closing, from the perspective of both the buyer and the seller, will prevent unknown liabilities from coming to light following closing..

Given these risks, it is important to carefully evaluate the change-of-control provisions and guarantee / suretship / security structures in all agreements.

2.     Intra-Group Transactions and Related Party Risks

Intra-group transactions may be either given a limited review or addressed solely from a transfer pricing perspective during due diligence processes. The risks most likely to be overlooked in the context of intra-group transactions can be summarised as follows:

·       Article 202 of the Turkish Commercial Code stipulates that a controlling shareholder or controlling company may not impose obligations on the target company on terms inconsistent with arm's length principles. The determination of intra-group service fees, rental payments and financing costs outside arm's length parameters may give rise to tax assessment risks and potential legal actions by minority shareholders.

·       Situations where the target company has provided a mortgage or guarantee for a bank loan of another group company, yet this obligation is reflected in the financial statement notes only in general terms, are among the risks commonly encountered in practice.

·       Unusual dividend payments made prior to the acquisition, shareholder advances extended without a board resolution, and debt transfers to a group company may indicate that the target company's asset structure has been weakened ahead of the transaction.

·       If the target company obtains critical services such as accounting, IT infrastructure or payroll management from another company within the group, the post-closing status of these services must be clarified in advance.

3.     Intellectual Property Deficiencies and Ownership Issues

Whilst intellectual property reviews are becoming increasingly common in due diligence processes, they often do not go beyond verifying TÜRKPATENT registration certificates. The risks most likely to be overlooked in the context of intellectual property can be summarised as follows:

·       The protection afforded to unregistered signs under the Industrial Property Law No. 6769 is limited. A trademark that the target company has long used but never registered may be registered by a third party during or immediately following the acquisition process, thereby becoming the subject of an objection.

·       Under Law No. 5846 on Intellectual and Artistic Works, the economic rights to intellectual property created by an employee in the course of their work generally belong to the employer; however, the absence of an explicit assignment clause in employment contracts may render this right subject to dispute. Software produced by former developers under employment contracts lacking an assignment clause may become the subject of a challenge in the future.

4.     IT Infrastructure and Software Usage Risks

IT infrastructure is often not addressed during due diligence processes. Yet the target company's digital assets and system architecture directly determine both post-acquisition operational continuity and the hidden cost burden assumed by the purchaser. The risks most likely to be overlooked within the scope of IT infrastructure can be summarised as follows:

·       Where enterprise software systems / licences are tied to a specific legal entity or number of users, a change in the company structure may give rise to unforeseen additional licensing costs.

·       The use of unlicensed software carries legal liability and reputational risks.

·       Third-party IT service arrangements (managed service providers, data centre agreements) may include contracts that will expire or require renegotiation following closing.

It is important to compile an IT asset inventory, review licence terms in the context of transfer scenarios, and assess the post-closing validity of managed IT service contracts.

5.     Compliance with the Law on the Protection of Personal Data

Obligations under the Law on the Protection of Personal Data No. 6698 are frequently overlooked during due diligence processes. However, non-compliance can result in consequences such as administrative fines and criminal complaints, making it a decisive factor in the accurate pricing of acquired risks. The risks most likely to be overlooked in terms of compliance can be summarised as follows:

·       It must be investigated whether the obligation to register with the Data Controllers' Registry (VERBİS) has been fulfilled.

·       The compliance of information notices and explicit consent forms directed at employees, customers and third parties with current legislation must be assessed.

·       It must be investigated whether any previous personal data breach has been reported to the Personal Data Protection Authority and the data subjects concerned.

·       It must also be examined whether processing activities involving special categories of personal data (health data, biometric data, etc.) satisfy the stricter conditions set out under the relevant legislation.

6.     Social Security Contribution Debts and Employment Law Obligations

Employment law and Social Security Institution obligations are frequently treated as a "standard check" item in due diligence processes. Indeed, when this area is glossed over with a superficial review, it can become one of the sources of unforeseen liabilities. Accordingly, when examining the target company's SGK obligations, the review must go beyond an SGK debt query. A comparative analysis of recent monthly premium and service declarations against withholding tax returns, an investigation into disputes involving current and former employees, and a review of subcontractor agreements are of significant importance.

7.     Tax Liabilities and Tax Risks

While tax risk features within the scope of due diligence processes, the review may be limited to a no-debt certificate obtained from the Revenue Administration (GİB) and a check of filed tax returns. Taking into account the tax risks that both the buyer and the seller may subsequently encounter, it is of considerable importance to assess recent tax returns alongside a tax audit status letter to be obtained from the Revenue Administration, and to review the adequacy of transfer pricing documentation with a specialist tax adviser.

In conclusion, the primary function of the due diligence process is not merely to list issues, but to provide the parties with an informed and protected right to choose before any agreements are signed. It would be beneficial for the due diligence checklists to include specialized review items for the Social Security Institution (SGK), tax matters, financial agreements, intra-group transactions, intellectual property, IT, and the Personal Data Protection Law (KVKK); for the legal, tax, and financial advisory teams to work in an integrated manner; for identified risks to be reflected in the seller’s disclosures, representations, and warranty provisions, as well as in indemnification mechanisms; and for the post-closing obligations program to be designed in advance.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.