The call usually comes on a Thursday. Closing is scheduled for Monday, and someone on the sell-side has just discovered that a key vendor contract — one that represents roughly 18% of the target company's recurring revenue — contains a change-of-control provision that requires written consent from the counterparty before the transaction closes. The counterparty is aware of the deal. They want a fee to waive the clause. The deal timeline just became a negotiation.
This scenario is not unusual. What is unusual is how late it surfaces. After working through a substantial number of M&A diligence packages, we see a clear pattern: the change-of-control trigger that breaks deals at closing is almost never the one flagged in week one. It's buried in an exhibit, cross-referenced from a master agreement, or sitting in a contract that the due diligence checklist described as a "standard vendor arrangement."
Where Change-of-Control Triggers Actually Hide
The obvious places get checked early. The asset purchase agreement, the SPA, the major customer contracts — counsel flags those in the first review pass. What creates closing-day exposure are the structural hiding spots that standard checklist review tends to miss.
Exhibit B provisions that override the main agreement
Many commercial agreements incorporate exhibits by reference. The main agreement body will contain conventional change-of-control language — consent not required, or consent required only for assignment to a competitor. Then Exhibit B, the service schedule or pricing attachment, includes a sentence that effectively overrides: "Notwithstanding Section 12, any change in control of Customer shall constitute a material modification triggering Counterparty's right to terminate on 30 days' notice."
The exhibit is usually written by someone in the counterparty's legal or finance department who was focused on protecting pricing, not on matching the broader contract's structure. The effect is that the main body reads clean and the exhibit carries a quiet veto right.
License agreements with embedded SaaS terms
Software license agreements from the 2015–2020 period frequently merged legacy perpetual license terms with newer SaaS addenda. The perpetual license body may contain no change-of-control language at all — it was never written for that environment. The SaaS addendum, which was appended two years later when the vendor moved to subscription billing, often imports the vendor's standard SaaS terms by reference. Those standard terms almost universally include change-of-control consent requirements.
The problem is that diligence reviewers see a license agreement dated 2016 and apply a 2016 reading. The addendum from 2019 doesn't get separate treatment because it's labeled as an amendment, not a new contract category.
Government and institutional contracts with regulatory triggers
Contracts with government agencies, hospital systems, or regulated financial institutions frequently contain change-of-control provisions that aren't labeled as such. Instead, they appear as "assignment restrictions," "key personnel requirements," or "certification maintenance obligations." A health system contract may require that the contracting entity maintain its Joint Commission accreditation — and change-of-control to a non-accredited parent can technically trigger a breach claim under that language.
The Structural Reason This Keeps Happening
Change-of-control review is treated as a document-category problem when it's actually a cross-document consistency problem. The standard approach is to build a checklist of contract types — customer contracts, vendor contracts, leases, software licenses — and review each category for change-of-control language. That approach works well for the main body of agreements. It fails on exhibits, addenda, and cross-referenced standard terms because those documents don't always get their own line item on the checklist.
The second structural problem is depth-of-review allocation. On a tight diligence timeline, senior associates spend the most time on the highest-dollar contracts. A $4 million ARR customer contract gets a close reading. A $200,000 vendor contract gets a skim. But the $200,000 vendor contract may be for the CRM platform that processes every sales quote, and its change-of-control consent requirement could give that vendor's sales team substantial renegotiation leverage at precisely the moment the acquirer has least bargaining power.
We want to be clear about what we're not saying here: we're not saying that experienced M&A counsel misses these clauses because they aren't thorough. The issue is that comprehensive cross-document review on large diligence rooms is genuinely difficult to do manually at the pace transactions demand.
What Thorough Change-of-Control Review Actually Requires
Competent change-of-control review on a mid-market deal requires checking three things that a single-pass document read rarely catches:
- Exhibit-level consistency. Every exhibit, schedule, and attachment should be read against the main agreement's change-of-control language to identify overrides. If the main agreement is silent or permissive, the exhibit may impose a more restrictive standard.
- Incorporation-by-reference chains. When a contract incorporates another document by reference — standard terms, service schedules, vendor portals — counsel should obtain and review the incorporated document as part of the same review unit, not treat it as a separate item.
- Terminological breadth. "Change of control" has a standard meaning, but counterparty consent requirements can be triggered by language that doesn't use that phrase: "assignment," "successor entity," "material ownership change," "transfer of substantially all assets," and various context-specific variations. A search for the phrase "change of control" will miss a clause that uses "succession of ownership interest."
Consider a deal we worked on involving the acquisition of a regional professional services firm. The target had 47 active vendor contracts. Standard change-of-control review flagged 6 contracts with explicit consent requirements. A more thorough cross-document review, including exhibits and incorporated terms, identified 4 additional contracts with triggering language in attachments — including one with a $180,000 annual software vendor whose license terms included a right to terminate and renegotiate pricing upon any change in the licensee's controlling ownership. That clause was in a clickwrap addendum the target company had accepted during a software update without separate legal review.
Practical Implications for Diligence Scoping
The question this raises for acquirers' counsel is how to scope change-of-control review without extending diligence timelines into deal-threatening territory. There are a few adjustments that make a material difference:
- Treat exhibits as first-class review units. The diligence checklist should account for exhibit review as a separate line item, not assume that reviewing the main agreement covers its attachments.
- Flag all incorporated-by-reference terms. Any contract that references external standard terms, vendor portals, or published schedules should be flagged for incorporated-document retrieval before review closes.
- Expand the synonym list. The search terms used for change-of-control review should be built around the concept — ownership transfer, control succession, entity change — rather than around the phrase.
- Prioritize by operational dependency, not contract value. The vendor whose platform underlies a core business process carries more risk than the dollar value of their contract suggests.
When we built Undwrlyft's clause extraction approach, the cross-document consistency problem was front-of-mind. The critical change-of-control clause in an M&A deal is rarely sitting in the obvious place. It's almost always buried, cross-referenced, or written in terminology that a keyword search skips. Getting that right is what separates a clean close from a Monday morning phone call about consent fees.