Corporate and Mergers & Acquisitions (M&A)

What does legal due diligence actually cover in a Malta M&A deal, and how long does it typically take?

In general terms, a legal due diligence on a target confirms whether the company is validly constituted, who owns it, what binds it, and what liabilities could follow it after completion of the acquisition. It usually runs alongside the financial, tax and commercial workstreams, and its findings feed directly into the price, the warranties and indemnities, and the conditions precedent in the SPA. The scope of the legal due diligence depends on the target’s sector and asset base, but most reviews cover the following areas:

• Corporate and title to shares. Constitution in terms of law, the share register and Malta Business Registry filings, beneficial ownership records, pledges or other encumbrances over shares, shareholder agreements, pre-emption rights and board and shareholder approvals.
• Regulatory and licensing. Whether the target holds the licences it needs, and whether a change of control needs prior approval. This matters most for businesses licensed by the MFSA or the MGA, where approval of a new qualifying shareholder can drive the whole deal timetable.
• Merger control and FDI screening. Whether the deal must be notified to the MCCAA under the Control of Concentrations Regulations, or screened by the National Foreign Direct Investment Screening Office.
• Material contracts. Key customer, supplier, financing and joint venture agreements, with a focus on change-of-control and termination rights, exclusivity, non-competes, security packages and guarantees.
• Employment. Contracts, collective agreements, compliance with the applicable employment law , work permits for third-country nationals, incentive schemes and pending disputes.
• Real estate. Title to owned and leased property, which usually involves searches in the Public Registry and Land Registry. It also covers emphyteutical grants and ground rents, hypothecs and privileges.
• Intellectual property and IT. Registered and unregistered rights, ownership of software and content developed by employees or contractors, licences in and out, and key IT and outsourcing arrangements.
• Data protection. GDPR and Data Protection compliance, data transfers and past breaches.
• Litigation and insolvency. Court and tribunal searches, pending or threatened claims, regulatory investigations and insolvency checks.

How long does it take?

Timing depends mostly on (i) how organised the data room is at the start and (ii) the size of the target. As a rough guide:

• Red-flag or limited-scope review of a straightforward target with a well-prepared data room: about 1–3 weeks.
• Full-scope review of a mid-sized business: typically 3–6 weeks, which allows for one or two rounds of follow-up questions.

Two points are worth keeping separate from the DD timetable itself. First, regulatory and merger control approvals take place between signing and closing, and they can add weeks or months regardless of how quickly the review went. Second, a seller who carries out vendor due diligence or prepares a structured data room before the process starts can shorten the buyer’s review considerably, and usually faces fewer difficult points when the SPA is negotiated.

Do we need Malta’s National FDI screening approval before closing, and what triggers it?

Screening of by Malta’s National Foreign Direct Investment Screening Office of certain transactions would be required if

(i) the buyer is a person or company from outside the EU. This includes structures where a non-EU person holds 10% or more of ownership, voting rights or control, directly or indirectly, including through an EU entity.

(ii) The target operates in one of these areas:

1. 1. critical infrastructure, such as energy, transport, communications and defence
   2. critical and dual-use technologies, such as AI, semiconductors and cybersecurity
   3. critical inputs, including food security
   4. sensitive information or personal data
   5. media freedom and pluralism

(iii) The investment creates a lasting, direct link with a Maltese business. Examples include incorporations, share acquisitions, changes of control and asset purchases. Portfolio investments with no aim to influence management are excluded.

See our note on Malta’s FDI screening regime.

What’s the practical difference between a share purchase and an asset or business transfer, and which is more common here?

In a share purchase, the buyer acquires the company itself, so it takes on the whole history of the company along with its licences, contracts and liabilities. In an asset or business transfer, the buyer picks the assets and contracts it wants and can leave unwanted liabilities with the seller. The trade-off is that contracts and licences usually have to be novated or reissued, which often requires consent from counterparties or regulators.