A padded or partly fictitious customer list is a specific, checkable risk — not the same question as whether a target’s real customers are too concentrated. And because a buyer is contractually barred from simply calling the names on the list before closing, verifying it is real has to work entirely from records already inside the data room.
Key takeaways
Deavo’s own standard non-disclosure agreement, used across its brokered deals, is explicit on this point: a recipient may not contact “employees, customers, suppliers or landlord” without the discloser’s prior written consent, and may not use the confidential information to solicit either employees or customers (deavo, NDA terms). That restriction exists for a real reason — a target whose customers or staff learn a sale is underway before it closes can suffer real damage to the relationships being sold — but it means a buyer cannot simply pick up the phone and ask the twenty largest names on a customer list whether they are, in fact, customers.
A customer list is real to the extent it reflects an actual, paid, repeating transaction history — not the extent to which a name appears on a spreadsheet the seller compiled. The core verification technique reconciles every name on the list against the general ledger: does each listed customer correspond to actual invoiced revenue, was it actually paid, and does the pattern repeat across more than one period for any account described as recurring. A one-time bulk sale recorded as though it were the start of a recurring relationship, or a customer that appears once and never again despite being labelled “active,” are both findings this reconciliation surfaces without a single phone call.
The same technique catches simpler problems too — duplicate or padded entries sharing a billing address, contact email or phone number across supposedly distinct accounts are a mechanical check against the underlying records, not a judgment call, and take minutes to run once the invoicing data is in hand.
Reading a target’s financial statements for red flags includes checking for “a gap between what is reported on the financial statements and what was filed with the CRA or reported for GST/HST” (deavo, reading financial statements). Applied to a customer list specifically: total revenue attributed to the named customers on the list should reconcile against total revenue reported for GST/HST purposes over the same period — a material, unexplained gap is one of the more reliable signals that reported customer revenue includes something that was not an actual arm’s-length sale. The underlying source documents for this check have to exist and be retained under the Income Tax Act’s six-year record-keeping rule (ITA s. 230(4)(b)), so a seller genuinely unable to produce them for a sampled period is itself informative.
Verifying that customers are real is a separate question from whether the relationship survives the change of ownership. On an asset purchase specifically, customer contracts do not transfer automatically — if a contract restricts assignment without the customer’s consent, “that consent needs to be obtained, or the buyer may not actually be entitled to enforce — or benefit from — that agreement going forward” (treadstonelaw, customer contract consents). Silence in a contract on assignment is not the same as automatic permission (treadstonelaw), and change-of-control clauses can apply even where a contract does not explicitly restrict assignment. A genuinely real, well-verified customer list built on contracts that will not assign cleanly is still a list a buyer may not actually be buying.
The general ledger reconciliation is the core technique, but it is not the only record a buyer can check without contacting anyone. Where the business processes card or online payments, the payment processor’s own settlement records are a second, independently generated source that has to agree with what the ledger shows for the same transactions — a discrepancy between the two is harder for anyone to have manufactured than a single set of internally kept books, precisely because the processor’s records were not created by the business being sold. The same logic applies to bank deposit records used for receivables verification elsewhere in diligence: an external, third-party record corroborating an internal one is worth more than either alone.
The no-contact restriction is not permanent — it applies without the seller’s prior written consent, and sellers routinely grant that consent for a defined set of reference calls once a deal reaches a definitive agreement stage, where the risk of the sale becoming prematurely known is lower and the buyer’s need for direct confirmation is highest. Building the strongest possible record-based case before that point makes the eventual reference calls a confirmation exercise rather than the first time the buyer is testing whether the list holds up.
For the broader question of revenue quality and customer concentration — a related but distinct assessment from whether the list is authentic — a fuller framework is set out separately, covering concentration analysis and contract review as a package.
To illustrate the mechanics only — the figures are a scenario, not a benchmark — a wholesale distributor’s customer list shows forty-one active accounts. Reconciling the list against the general ledger finds that three of those accounts — described on the list as separate regional buyers — share the same billing address and the same contact phone number, and together account for $95,000 of the $110,000 in revenue attributed to those three names combined in a single quarter, with no repeat billing in any other quarter that year.
The buyer treats those three accounts as a single, non-recurring customer rather than three separate ongoing relationships, revises the concentration analysis accordingly, and raises the finding with the seller before finalizing price — a conclusion reached entirely from the ledger and contact-record cross-check, without contacting the customer in question.
Related: aged receivables and what they say about collections, the fuller guide on testing a target’s customer base, a related case file on a customer list that did not survive the handover.
Only with the discloser’s prior written consent under the confidentiality agreement governing the deal — sellers sometimes grant limited consent for specific reference calls once a definitive agreement is signed, but unauthorized contact is a breach of the standard NDA terms.
Reconciling total revenue attributed to the listed customers against what the business reported for GST/HST over the same period — a material, unexplained gap is one of the clearest signals worth investigating further.
No — those are separate questions. A real, verified customer can still be lost on an asset purchase if the underlying contract restricts assignment and the customer’s consent is not obtained before closing.
It can be, where the business processes card or online payments — because the processor generates its own settlement records independently of the business being sold, agreement between the two sources is harder to manufacture than either record alone, and a discrepancy is worth investigating directly.
A short call is enough to set up the reconciliation before the data room even opens fully.
Nobody publishes Canadian transaction data, so every valuation in this country quotes an American benchmark. We are building the Canadian one — multiples, asking-to-sale spreads and days on market, by sector and by city. Leave an email and you will see it first.
No pitch, no listings. One email when the first report lands.
