Bank M&A Due Diligence: The Complete Guide

Why bank due diligence is different

General M&A diligence asks whether a company's earnings are real and its liabilities disclosed. Bank diligence asks those questions too, but three structural differences change the work entirely.

The balance sheet is the product

In most acquisitions the loan book would be a financing detail. In a bank acquisition it is the asset being bought. Credit quality therefore drives valuation more directly than any revenue multiple: a portfolio carrying under-reserved problem credits is worth materially less than its carrying value, and the gap only appears if diligence reads the reserve methodology rather than the reserve number.

Capital adequacy is a hard constraint, not a preference

A thinly capitalised industrial target is a financing problem. A thinly capitalised bank is a regulatory one. Capital ratios below the regulatory minimum place the institution on the Prompt Corrective Action ladder, which restricts dividends, growth, and executive compensation — restrictions the acquirer inherits and which limit what capital can be deployed post-close.

A regulator has to approve the deal

Bank and credit union transactions require approval from a prudential regulator — the OCC, Federal Reserve, FDIC, a state banking department, or the NCUA. Approval turns partly on the acquirer's own supervisory record, including its CRA rating and BSA/AML programme. Diligence that only examines the target misses half the risk of the transaction failing to close.

The eight risk categories

Anweshna scores bank deal documents across eight categories weighted to reflect how much each one actually moves a transaction. The structure maps closely onto the CAMELS framework examiners use — capital, asset quality, management, earnings, liquidity — with enforcement history and financial-crime compliance broken out as categories of their own.

Asset quality: the thresholds that matter

Asset quality carries the joint-heaviest weight because it is where a bank's stated value and its real value diverge most often. Four measures do most of the work.

• Non-performing loan ratio above 5% — a screening threshold we apply, not a regulatory limit. Read it as a trend, not a snapshot; a rising NPL ratio with a flat reserve is worse than a higher static one.
• A reserve that has not moved as the portfolio's risk profile has — flat ALLL coverage against rising classified assets, or a reserve that looks derived from a prior-period plug rather than from current loss experience. The signal is the direction of travel, not any single coverage ratio. Under-reserving inflates both current earnings and stated capital, so this one measure distorts two other categories at once.
• Single-borrower concentration above 10% of capital — one relationship large enough that its failure is a capital event rather than a credit event. This is a screening threshold we apply, not a legal ceiling: the statutory lending limit for a national bank is 15% of capital and surplus, plus a further 10% where the excess is fully secured by readily marketable collateral (12 CFR § 32.3(a)).
• CRE concentration above 300% of total risk-based capital — one of the two supervisory screening criteria in the 2006 interagency CRE guidance, and only where the portfolio has also grown 50% or more over the prior 36 months; construction and land development at 100% or more of total capital is the separate first criterion. Exceeding it does not prohibit a transaction, but it invites supervisory scrutiny and should drive downside stress testing during diligence.

OREO deserves its own line

Other Real Estate Owned — property taken through foreclosure — is often folded into a general credit discussion. It should not be. OREO growth year over year is an independent leading indicator: it signals foreclosures accelerating through the pipeline, and it carries diligence questions the NPL number does not. Carrying values need testing against current appraisals, holding costs accrue, land and commercial parcels carry potential environmental liability, and disposal timelines are frequently optimistic.

Anweshna treats OREO as a mandatory standalone finding for exactly this reason — it will not be subsumed into the NPL or reserve findings even when those dominate the category.

Regulatory capital and the PCA ladder

Capital adequacy is the foundation of bank solvency, and it is the constraint that most directly limits what an acquirer can do after closing. The measures that matter are CET1 and Tier 1 ratios against their regulatory minimums, the leverage ratio — below 4.0% an institution cannot be "adequately capitalized" and falls into the undercapitalized PCA category (12 CFR § 324.403) — and the institution's Prompt Corrective Action category.

Two disclosures deserve particular attention because they are admissions rather than metrics. A capital restoration plan exists only because a breach occurred. A capital covenant violation is similarly self-reporting. Either one places the target in the undercapitalised range regardless of how the current-quarter ratio reads, and remediation being underway does not neutralise it: the restrictions on dividends, growth and compensation persist through the remediation period, and the acquirer inherits them.

Enforcement history — including resolved actions

Enforcement is where standard diligence logic most often fails, because standard logic discounts anything the target describes as resolved.

The disclosures that trigger this category include formal agreements with a regulator, consent orders and C&Ds, Matters Requiring Attention and Matters Requiring Immediate Attention, civil money penalties, CAMELS downgrades, OCC dividend restrictions, Federal Reserve enforcement actions, and state attorney general investigations.

Civil Investigative Demands are separate findings

A Civil Investigative Demand from the CFPB, DOJ, a state attorney general or another regulator is not a footnote to an existing consent order, and Anweshna will not roll it into one. A CID is a distinct pre-enforcement investigation with its own document-production obligations, its own timeline uncertainty, and its own potential to produce a separate consent order and separate civil money penalties. An acquirer has to price it independently of whatever enforcement action is already on the record.

Earnings quality and the DTA trap

Reported net income is the number most easily made to look better than the underlying business. In banking the most common mechanism is the deferred tax asset.

When reported net income is entirely attributable to a DTA release, the institution has an underlying pre-tax loss. The release converts an accounting judgement — that future profits will exist to use the asset against — into current reported earnings. If a valuation allowance is required, or if DTA realizability is under review by external auditors or tax counsel, that judgement is already contested. Two things follow: earnings are not sustainable, and capital adequacy is overstated, because the DTA sits inside the capital calculation.

Alongside this, the category tracks non-interest income composition, one-time charges dressed as recurring performance, provision trends read against the asset-quality picture, and net interest margin compression.

BSA/AML, sanctions and the deal-killer category

Financial-crime compliance is the category most likely to stop a transaction outright rather than reprice it, because the findings tend to be binary and because they bear directly on whether the regulator approves the deal at all.

• Any OFAC or SDN list match — treated as an absolute finding, not a graduated one.
• CDD/KYC deficiency findings — customer due diligence gaps are programme failures, and programme failures are what consent orders are built from.
• SAR timeliness violations — late Suspicious Activity Report filing indicates the monitoring system is not functioning, independent of whether the underlying activity was material.
• BSA/AML audit findings — internal or external, these frequently precede formal enforcement by a year or more, which makes them the earliest reliable signal available in diligence.

An acquirer's own BSA/AML programme is also assessed by the regulator when it reviews the application. A target with a weak programme therefore creates two problems: the remediation cost, and the risk that the combined institution's compliance posture delays or blocks approval.

Bank M&A due diligence checklist

What to request, what to test, and the finding that should stop you.

The regulatory approval path

Approval is a workstream, not a formality, and it runs in parallel with commercial diligence rather than after it.

1. Identify the approving agency — OCC, Federal Reserve, FDIC, state banking department, or NCUA for credit unions, depending on charter and holding-company structure.
2. Assess the acquirer's own record — supervisory rating, CRA performance and BSA/AML programme are all weighed. A weak acquirer record delays approval regardless of target quality.
3. Model pro-forma capital — the combined institution must be well capitalised on day one, including purchase accounting marks on the acquired loan book.
4. Test concentration and competition — deposit market share in overlapping markets can draw scrutiny or divestiture conditions.
5. Prepare for the comment period — applications are public and community groups may file comments, particularly where CRA performance or branch closures are at issue.

Findings from the diligence categories above feed this process directly. An unresolved enforcement action or a BSA/AML programme weakness is not only a valuation issue — it is a reason the application itself may stall.

Red flags that stop bank deals

Ranked by how often they end a transaction rather than reprice it:

1. An OFAC or SDN match — binary, and directly relevant to approval.
2. An open or recently resolved consent order — inherited restrictions plus approval risk.
3. Capital below the regulatory minimum — limits post-close capital deployment and may require an injection the model did not assume.
4. Reserves materially below peer coverage — implies a write-down that moves the purchase price.
5. Net income dependent on a DTA release — the earnings being paid for do not exist on a pre-tax basis.
6. CRE concentration well above 300% of risk-based capital with rapid recent growth — concentration risk plus supervisory attention.
7. A Civil Investigative Demand in progress — unbounded timeline and unquantified penalty exposure.

Sources

Primary sources for the statutory and supervisory figures cited on this page. Each was fetched and read before being cited. Thresholds change — verify current requirements with the relevant agency before relying on them. Screening thresholds that are ours rather than a regulator's are labelled as such in the text and are deliberately not cited here.

1. Interagency guidance on commercial real estate concentrations, 71 FR 74580 (12 December 2006) — the two supervisory screening criteria: construction, land development and other land loans at 100% or more of total capital; or total commercial real estate loans at 300% or more of total capital and a CRE portfolio that has grown 50% or more over the prior 36 months. “Total capital” means total risk-based capital as reported on Call Report schedule RC-R.
2. Prompt Corrective Action capital categories, 12 CFR § 324.403 — an institution must hold a leverage ratio of 4.0% or greater to be “adequately capitalized”; below 4.0% it is “undercapitalized”. Also the source for the total risk-based (8.0%), tier 1 (6.0%) and CET1 (4.5%) minimums for that category.
3. Single-borrower lending limit, 12 CFR § 32.3(a) — a national bank's or savings association's total loans to one borrower may not exceed 15% of capital and surplus, plus a further 10% where the excess is fully secured by readily marketable collateral. The 10% figure used on this page is a screening trigger, not this legal limit.

Bank M&A due diligence FAQ

Screen each category