Buying a company today isn’t like it was five years ago. The world doesn’t just have economic cycles-it has fractures. Sanctions pop up overnight. Key suppliers vanish because of geopolitical shifts. Top engineers leave because their home country just banned tech exports. If you’re doing M&A and ignoring these three things-sanctions, supply chains, and talent-you’re not doing diligence. You’re gambling.
Sanctions Are No Longer Just for Big Banks
In 2023, the U.S. Treasury added 1,200 new entities to its sanctions list. In 2024, that number jumped to 2,100. Most of them weren’t Russian oligarchs or Iranian nuclear labs. They were mid-sized manufacturers in Belarus, logistics firms in the UAE, and software developers in India with ties to Chinese defense contractors. If your target company uses any of them-even indirectly-you’re on the hook.
One U.S. private equity firm bought a German industrial automation company in early 2024. Three months later, they found the target had sourced circuit boards from a supplier in Kazakhstan that was 12% owned by a Russian entity listed under OFAC’s SDN list. The deal collapsed. The buyer lost $18 million in legal fees and lost a year of strategic momentum.
Sanctions diligence now means more than checking the target’s direct vendors. You need to map the third- and fourth-tier suppliers. Use tools like Refinitiv World-Check or LexisNexis Risk Solutions. But don’t rely on software alone. Talk to the CFO. Ask: "Who’s your smallest vendor that you don’t even track?" That’s where the risk hides.
Supply Chains Are No Longer Linear
Remember when supply chains were just about shipping goods from China to the U.S.? Now they’re tangled webs of geopolitical risk. A single chip shortage can kill a $500 million deal. A factory in Vietnam gets hit by flooding, and suddenly your target’s production halts for six weeks.
In 2024, a U.S. medical device company acquired a Polish contract manufacturer. The deal looked solid-low labor costs, strong quality ratings. But during diligence, they found 78% of the raw materials came from a single supplier in Ukraine. The war had already disrupted shipments three times that year. The supplier wasn’t even on the target’s risk dashboard because they were classified as "low-value."
Today’s supply chain diligence requires three things:
- Map every Tier 1-4 supplier by geography and political risk rating.
- Verify dual-use materials-things like rare earths, high-purity silicon, or encryption software-that could trigger export controls.
- Test resilience: What happens if one country cuts off exports? Does the target have a Plan B? Or are they just hoping for the best?
Don’t trust spreadsheets. Walk the factory floor. Ask the plant manager: "What’s the one thing that, if it vanished tomorrow, would shut you down?" Their answer is your red flag.
Talent Is the New Currency
Every deal has a valuation. But the real value? The people who make it work. And right now, talent is fleeing unstable regions. In 2025, over 40% of engineers in Eastern Europe and Central Asia are actively looking to relocate. If your target relies on a team in Kyiv, Minsk, or Tbilisi, you’re buying a company with a ticking clock.
A California-based AI startup bought a Ukrainian machine learning firm in late 2023. The team was brilliant. The IP was cutting-edge. But during due diligence, they didn’t ask about visas. Within six months, half the team had left for Poland, Germany, or Canada. The company’s valuation dropped 60% because the core talent was gone-and the codebase was tied to people who no longer worked there.
Talent diligence isn’t about headcounts. It’s about:
- Where are your key engineers, scientists, and sales leaders based?
- What’s their visa or work permit status?
- Are they eligible to move? Would they even want to?
- Is their knowledge documented-or is it locked in their heads?
Ask the CEO: "If we moved your entire team to Austin tomorrow, what would break?" If they hesitate, you’ve found your risk.
Putting It All Together: The New Diligence Framework
You can’t just add these three checks to your old due diligence checklist. You need a new system. Here’s how top firms are doing it now:
Step 1: Build a Risk Heat Map
Use a simple 3x3 grid. On one axis: sanctions, supply chains, talent. On the other: likelihood and impact. Color-code each risk. Red means stop. Yellow means negotiate. Green means proceed.
Step 2: Require a "Single Point of Failure" Report
Ask the seller to list the top three things that could collapse the business in 90 days. If they don’t have one, they’re not being honest.
Step 3: Lock in Key Talent Before Closing
Don’t wait until the deal closes to offer retention bonuses. Start talks during diligence. Get signed letters of intent from your top 5 critical people before you sign the purchase agreement.
Step 4: Build a Contingency Budget
Set aside 5-10% of the deal value for emergency fixes. It might be retooling a supply chain, relocating staff, or paying legal fees to unwind a sanctions violation. This isn’t a luxury. It’s insurance.
What Happens When You Skip This?
Last year, a Fortune 500 company bought a Canadian tech firm that specialized in drone navigation software. The deal closed in January. By March, the target’s lead developer was flagged by U.S. export control authorities because he’d previously worked on a defense project in China. The company was forced to halt sales to 70% of its customers. The buyer had to pay $22 million in fines and lost $180 million in projected revenue.
That’s not an outlier. It’s the new normal.
Companies that still treat M&A diligence like a paperwork exercise are getting burned. The risks aren’t theoretical. They’re real, immediate, and expensive. The winners aren’t the ones who move fastest. They’re the ones who ask the hardest questions-and listen to the answers.
What Comes Next?
By 2026, the most successful acquirers won’t just buy companies. They’ll buy ecosystems. That means understanding not just who owns what, but who *works* where, what *materials* they use, and who *controls* the flow of money.
If you’re planning a deal in 2025 or beyond, don’t just ask: "Is the company profitable?" Ask: "Can it survive the next crisis?"
What’s the biggest mistake companies make in M&A diligence today?
They focus only on financials and legal documents and ignore the human and operational risks-like key staff leaving, supply chains breaking, or hidden sanctions ties. The biggest deals fail not because of bad numbers, but because of blind spots in these three areas.
Do I need to hire outside consultants for sanctions and supply chain checks?
Not always, but you should. Internal teams can handle basic checks, but complex global supply chains or layered ownership structures need specialized tools and expertise. Firms like Control Risks, Kroll, or Deloitte’s geopolitical risk teams can map third-party connections you’d never see on your own. The cost is far less than a failed deal.
How do I know if talent is truly at risk in a target company?
Look at mobility patterns. Are employees from high-risk regions already applying for visas abroad? Are they using LinkedIn to signal they’re open to relocation? Check immigration data for their home countries-many governments now publish outbound visa trends. If 20% of the engineering team is from Ukraine and Canada’s skilled worker program has a 30% approval rate for them, that’s a red flag.
Can I still close a deal if there are risks in these areas?
Yes-but only if you adjust the price, timeline, or structure. If a key supplier is in a sanctioned country, demand a 12-month transition plan with penalties if it’s not met. If talent is fleeing, require retention bonuses to be paid upfront. Don’t ignore the risk. Bake it into the deal.
Is this only relevant for big deals?
No. In fact, small deals are more vulnerable. Big companies have teams and budgets for deep diligence. Small buyers often skip it to save time and money. That’s why 70% of M&A failures in 2024 happened in deals under $50 million. Risk doesn’t care about deal size.
