Enhanced due diligence (EDD) is a risk-based investigation that goes beyond standard identity, ownership, financial, reputational, sanctions, and compliance checks. In documented transactions, it has protected hundreds of millions of dollars: Verizon reduced its Yahoo acquisition price by approximately $350 million after investigating major data breaches, while Binance withdrew from its proposed acquisition of FTX after reviewing FTX’s financial and operational problems. These cases, alongside counterexamples such as Hewlett-Packard’s costly Autonomy acquisition, show how EDD can expose hidden liabilities before money changes hands, reduce transaction losses, and prevent regulatory, cyber, fraud, and reputational damage.

How Enhanced Due Diligence Protects Transaction Value

Enhanced due diligence is a deeper and more targeted form of due diligence applied when a customer, transaction, acquisition, jurisdiction, ownership structure, or business activity presents elevated risk. The Financial Action Task Force defines the broader due-diligence framework as a risk-based process that requires organizations to identify and verify customers, understand beneficial ownership, assess the purpose and nature of relationships, and conduct ongoing monitoring. EDD extends that process through additional investigation, corroboration, source-of-wealth analysis, adverse-media review, forensic accounting, cyber assessment, sanctions screening, and interviews.

The central economic value of EDD is loss avoidance. The Association of Certified Fraud Examiners’ 2024 global fraud study found that organizations lose an estimated 5% of annual revenue to fraud, with a median reported fraud loss of $145,000 and a median duration of 12 months. The study also found that proactive controls such as hotlines, management review, and anti-fraud testing can reduce both losses and the time fraud remains undetected. In mergers, acquisitions, banking, and investment decisions, the potential loss can be substantially larger because one hidden liability may affect the entire enterprise.

Financial and forensic EDD

Financial EDD tests whether reported revenue, customers, cash flows, debt, working capital, tax obligations, and forecasts are reliable. Forensic EDD goes further by searching for fabricated customers, related-party transactions, concealed liabilities, unusual payment patterns, and accounting manipulation. These forms of EDD are especially important when a target company has rapid growth, opaque ownership, unusually high margins, extensive use of intermediaries, or operations in jurisdictions with limited transparency.

Compliance, sanctions, and beneficial-ownership EDD

Compliance EDD identifies the individuals who ultimately own or control an entity and evaluates exposure to corruption, money laundering, sanctions, export controls, politically exposed persons, and regulatory enforcement. A standard database check may identify a name, but enhanced investigation seeks corroborating documents, corporate records, litigation history, source-of-funds evidence, and explanations for unusual ownership or payment structures.

Cybersecurity and data-protection EDD

Cyber EDD examines breach history, identity-access controls, unpatched vulnerabilities, encryption, incident response, privacy compliance, vendor risk, and the quality of a target’s security team. IBM’s 2024 Cost of a Data Breach Report placed the global average cost of a data breach at $4.88 million. For a large digital company, however, the financial impact may include customer notification, litigation, regulatory penalties, lost revenue, remediation, and a significant reduction in enterprise value.

Verizon’s Cybersecurity EDD Reduced Yahoo’s Acquisition Price

Verizon’s acquisition of Yahoo is one of the clearest public examples of enhanced cyber due diligence affecting transaction value. In 2016, Verizon agreed to acquire Yahoo’s operating business for approximately $4.83 billion. During the acquisition process, Yahoo disclosed major cybersecurity incidents involving hundreds of millions of user accounts. Subsequent disclosures expanded the known scale of the breaches, including the 2013 compromise that Yahoo later said affected all of its approximately three billion accounts.

How the EDD changed the transaction

Verizon’s review examined the scope of the breaches, the reliability of Yahoo’s disclosures, potential regulatory exposure, litigation risk, and the cost of remediation. In 2017, the parties amended the agreement and reduced the purchase price by approximately $350 million, lowering it to about $4.48 billion. Yahoo and Verizon also agreed to share certain liabilities connected to the incidents.

Why the case matters

The $350 million reduction illustrates that EDD does not always end with a rejected transaction. It can produce a better price, revised warranties, indemnities, escrow arrangements, or post-closing obligations. The case also demonstrates why ordinary financial due diligence is insufficient for technology acquisitions: a target can have valuable users and advertising assets while simultaneously carrying large, undisclosed cyber liabilities.

A useful chart for this case would compare the original $4.83 billion purchase price with the amended $4.48 billion price and display the $350 million reduction as a separate liability-adjustment bar.

Binance’s EDD Halted Its Proposed FTX Acquisition

Binance’s proposed acquisition of FTX in November 2022 shows how EDD can prevent an organization from assuming a potentially catastrophic liability. Binance initially signed a nonbinding agreement to acquire FTX.com after FTX experienced a severe liquidity crisis. Binance then stated that its corporate due diligence, together with reports concerning mishandled customer funds and investigations by regulators, led it to abandon the transaction.

A decision based on incomplete and deteriorating information

The proposed transaction was never completed, so there is no independently verifiable dollar figure that can be described as Binance’s realized savings. Nevertheless, the withdrawal prevented Binance from acquiring FTX’s disputed assets, liabilities, customer claims, regulatory exposure, and potential litigation. FTX subsequently filed for bankruptcy, and court filings described a multibillion-dollar gap between customer claims and available liquid assets at the time of the collapse.

The EDD lesson

This case highlights the value of a stop decision. EDD is not merely a process for approving transactions; it is also a control that gives an organization evidence to pause, renegotiate, or walk away. In high-velocity deals, investigators should test whether customer assets are segregated, liabilities are complete, governance is independent, and reported liquidity is supported by verifiable cash and collateral.

Visa’s Plaid Review Prevented a High-Risk Acquisition

Visa announced in January 2020 that it would acquire financial-data connectivity company Plaid for approximately $5.3 billion. The transaction faced scrutiny from the U.S. Department of Justice, which alleged that Visa maintained a monopoly in the online debit market and that the acquisition could reduce competition. Visa and Plaid eventually abandoned the transaction in January 2021.

Regulatory EDD as a form of capital protection

The abandoned transaction cannot be described as a confirmed $5.3 billion saving because Visa did not publicly state that it avoided a specific loss of that amount. However, regulatory EDD identified a material antitrust risk before closing. Walking away prevented Visa from committing additional integration resources to a transaction that could have faced prolonged litigation, structural remedies, or forced divestiture.

Why regulatory risk belongs in EDD

A transaction may be financially attractive but legally unworkable. Antitrust, foreign-investment, export-control, privacy, and sector-specific licensing reviews should therefore be integrated into EDD rather than treated as closing formalities. The Plaid case shows that an expensive abandoned deal may still represent disciplined risk management when the alternative is acquiring an asset that cannot be used as planned.

Autonomy Shows the Cost of Inadequate Enhanced Due Diligence

Hewlett-Packard’s 2011 acquisition of British software company Autonomy is a major counterexample. HP paid approximately $11.1 billion for Autonomy, but later alleged that accounting improprieties had materially distorted the company’s financial performance. HP recorded an $8.8 billion impairment charge in 2012, including approximately $5.1 billion attributed to accounting misrepresentations and other issues.

The missed warning signs

Reports and subsequent investigations focused on revenue recognition, channel transactions, hardware resales, related-party relationships, and the quality of reported growth. HP said its post-acquisition review uncovered serious accounting problems, while former Autonomy executives disputed the allegations. The U.K. Serious Fraud Office later closed its investigation without bringing charges, and litigation over responsibility continued for years.

What the counterexample proves

The Autonomy case demonstrates that conventional diligence can fail when buyers rely too heavily on management representations, audited accounts, or compressed deal timelines. An independent EDD program would typically test revenue with customers, trace cash receipts, examine reseller economics, investigate related parties, compare contracts with invoices, and challenge growth that does not produce corresponding cash flow.

How Organizations Convert EDD Findings Into Million-Dollar Protection

Use a risk trigger before expanding the investigation

EDD should be triggered by risk indicators such as politically exposed ownership, high-risk jurisdictions, unexplained wealth, complex nominee structures, unusual margins, rapid customer growth, weak governance, prior breaches, regulatory inquiries, or transactions involving intermediaries. A risk-based trigger prevents organizations from applying the same costly investigation to every low-risk relationship.

Test evidence rather than accepting representations

Effective EDD corroborates management claims with independent evidence. Investigators can confirm customers directly, reconcile bank statements to revenue, inspect beneficial-ownership records, review source-of-funds documentation, conduct site visits, analyze litigation, and compare public statements with internal records. The objective is not to collect more documents; it is to verify whether the economic story is coherent.

Quantify exposure and connect it to a decision

EDD findings should be translated into a financial decision. A cyber finding may justify a price reduction or escrow. A sanctions concern may require terminating the relationship. A revenue-quality issue may change the valuation multiple. A regulatory risk may require a closing condition or a decision to abandon the deal. Without a defined decision threshold, EDD can become a report that does not protect capital.

Continue monitoring after closing

EDD is not complete when a contract is signed. Beneficial owners can change, sanctions can be imposed, cyber vulnerabilities can emerge, and previously hidden liabilities can surface. Ongoing transaction monitoring, adverse-media screening, access reviews, financial testing, and periodic ownership refreshes help preserve the value of the initial investigation.

Conclusion: Enhanced Due Diligence Turns Hidden Risk Into Negotiating Power

Enhanced due diligence is a structured risk-based investigation designed to uncover information that ordinary checks may miss. Verizon’s Yahoo review produced an approximately $350 million purchase-price reduction; Binance’s review of FTX supported a decision to withdraw from a potentially destructive acquisition; and Visa’s regulatory review helped it avoid completing a $5.3 billion transaction facing serious antitrust challenges. By contrast, HP’s Autonomy experience shows how inadequate financial and forensic EDD can contribute to an $8.8 billion impairment.

The broader lesson is that EDD should be treated as an investment-protection mechanism rather than an administrative burden. Boards, investors, banks, procurement teams, and compliance officers should define risk triggers, independently verify material claims, quantify potential exposure, and establish clear walk-away or renegotiation thresholds. Further reading should include the Financial Action Task Force’s risk-based guidance, the Association of Certified Fraud Examiners’ occupational-fraud research, IBM’s data-breach cost studies, and transaction-specific regulatory filings.

Sources: Financial Action Task Force, Guidance on the Risk-Based Approach to Customer Due Diligence, https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-rba-customer-due-diligence.html; Association of Certified Fraud Examiners, Occupational Fraud 2024: A Report to the Nations, https://www.acfe.com/fraud-resources/report-to-the-nations; IBM, Cost of a Data Breach Report 2024, https://www.ibm.com/reports/data-breach; Verizon, Yahoo and Verizon Amend Definitive Agreement, https://www.verizon.com/about/news/yahoo-verizon-amend-definitive-agreement; Yahoo, Yahoo Announces All Three Billion Accounts Were Affected by 2013 Data Theft, https://www.yahoo.com/tech/yahoo-announces-three-billion-accounts-affected-2013-data-theft-203057155.html; U.S. Department of Justice, Justice Department Files Antitrust Lawsuit to Block Visa’s Proposed Acquisition of Plaid, https://www.justice.gov/opa/pr/justice-department-files-antitrust-lawsuit-block-visas-proposed-acquisition-plaid; Visa, Visa and Plaid Abandon Proposed Acquisition, https://investor.visa.com/news/news-details/2021/Visa-and-Plaid-Abandon-Proposed-Acquisition/default.aspx; Hewlett-Packard, HP Announces Preliminary Results of Autonomy Investigation, https://investors.hp.com/news/news-details/2012/HP-Announces-Preliminary-Results-of-Autonomy-Investigation/default.aspx; U.S. Bankruptcy Court for the District of Delaware, FTX Trading Ltd. Chapter 11 Court Filings, https://cases.ra.kroll.com/FTX/.