Your client signed an LOI. The buyer’s team is now inside the data room, and something came up that wasn’t in anyone’s plan.
This is where the deal actually gets negotiated a second time. Not in the term sheet, in the three or four weeks after diligence starts, when a finding turns into a number. There are three ways that happens, and your client needs to know which one they’re facing before they’re in the room.
A retrade is the most visible: the buyer goes back to the agreed price, before close, because something changed their read on risk. An escrow or holdback is quieter: a slice of the purchase price gets set aside after closing, released later only if nothing goes wrong. And an insurance exclusion is the one nobody sees coming: the representations and warranties policy that was supposed to cover this exact category of risk turns out not to, which means the seller carries it instead of the insurer.
None of these are punishment for having a problem. They’re how a buyer prices something they can’t get comfortable with fast enough to just walk or just proceed.
What It Costs
The mechanics are no longer rare. According to SRS Acquiom’s 2026 M&A Deal Terms Study, 88 percent of private-target deals that closed in 2025 included an escrow or holdback. The median size was 10 percent of transaction value, held for a median of 12 months after close. On a mid-size deal, that’s real money sitting untouched for a year while both sides watch to see if anything surfaces.
Insurance changes the math, but only if it actually applies. The study found that deals with representations and warranties insurance carried a median liability cap of just 0.5 percent of transaction value, against 10 percent for deals without it. That’s the whole pitch for RWI: it moves the exposure off the seller’s balance sheet. But it only works if the policy doesn’t carve out the thing that just got found. And sellers are getting warier about what they’ll put in writing here: cybersecurity representations, standard in 95 percent of 2024 deals, dropped to 78 percent in 2025, the sharpest year-over-year decline in the study. That’s not a footnote. It means more deals are closing without a clean cyber rep, and a finding that shows up without one doesn’t have an insurer standing behind it. It has your client.
This is the same mechanism behind the $350 million Verizon cut from the Yahoo deal after undisclosed breaches surfaced. Most of your clients will never be in a headline. The number still moves.
What to Do This Week
- Get an outside look at the environment before the buyer’s team does, not a full audit, a gap check.
- Fix or document anything cheap and fast to close. Cheap now is always cheaper than a retrade later.
- Know the disclosure position going in. An undisclosed known issue is worse than a disclosed one, every time.
- Loop in whoever handles the deal’s insurance early enough to ask what the policy would actually exclude.
When to Call Someone
The trigger is simple: the LOI is signed or close to it, and security hasn’t been part of the conversation yet. That gap is what this piece exists to close.
Line for the Email
Before your buyer’s team finds it, let’s find it first.
References
SRS Acquiom, 2026 M&A Deal Terms Study (analyzing 2,300+ private-target acquisitions closed 2020 to 2025): https://www.srsacquiom.com/our-insights/deal-terms-study/