A practical guide to insurance M&A due diligence covering carrier appointments, E&O history, loss reserve analysis, reinsurance treaties, and how to structure the data room folder tree for an insurance company acquisition.
Insurance acquisitions move at the pace of regulators, not bankers. A buyer who uploads a clean folder tree on day one and answers every state-department information request within 48 hours closes in seven months. A buyer who improvises the data room mid-process closes in fourteen months, if at all.
This guide covers the documents you need, the questions you must answer, and the data room setup that keeps both timelines and regulators happy.
Hartwell Regional Insurance Group is a $340 million property-and-casualty carrier operating across eight southeastern states. A private equity-backed consolidator has agreed to acquire Hartwell at 1.3x book value. The deal closes only after each state insurance department approves the Form A change-of-control filing, a process that runs in parallel with financial and legal due diligence.
The sell-side advisor has set up a virtual data room and given the buy-side team 60 days to complete their review before the Form A deadline. Here is what they are looking at.
The book of business is the core asset. Due diligence must establish:
In-force policy count and premium by line. Break this down by personal lines (homeowners, auto) and commercial lines (general liability, commercial property, workers comp). Ask for a data extract, not a summary PDF, so your actuaries can model loss emergence by vintage.
Carrier appointments. Hartwell writes through 220 independent agents. Each agent holds a carrier appointment contract with termination-for-convenience clauses. A thorough review identifies which top-20 agents by premium volume have agreements that allow the agent to move their book within 90 days of a change of control. In Hartwell's case, three agents accounting for $28 million in annual premium have such clauses. The buyer must factor in a retention haircut or secure commitment letters from those agents before close.
Renewal rates and lapse history. Pull three years of policy renewal and non-renewal data segmented by state, line, and agent. A sudden drop in renewal rates in one state 18 months ago may signal a regulatory issue or a competitor price action. Either way, you need to know before you bid.
Geographic concentration. Hartwell writes 44% of its homeowners premium within 30 miles of the Gulf Coast. A buyer without a matching catastrophe reinsurance program is acquiring a tail risk it cannot manage on day one.
For any intermediary or managing general agent (MGA) within the target group, E&O history is a material diligence item. Request:
A pattern of E&O claims in a particular state or line of business often predicts the regulatory scrutiny your Form A will attract. Disclose early.
Loss reserves are the largest liability on an insurance carrier's balance sheet, and the most subjective. Your actuaries will request:
Reserve development triangles. A 10-year loss development triangle by line of business shows whether Hartwell's historical reserves have been adequate. Consistent adverse development (reserves that have grown after initial estimate) is a red flag. Consistent favorable development could signal conservative reserving (good) or premium growth masking inadequacy (bad).
Appointed actuary's report. The annual actuarial opinion and supporting analysis, including the range of reasonable estimates and the selected reserve position.
Case reserve philosophy. How does Hartwell set initial case reserves on a new claim? Do claims handlers follow a bright-line authority matrix or use individual judgment? An inconsistent philosophy produces volatile development.
Catastrophe reserves. In a Gulf-exposed book, separate cat reserves for open named-storm events. Confirm the reinsurance recovery receivable is collectible (counterparty credit quality matters).
IBNR assumptions. The incurred-but-not-reported reserve is the most judgment-sensitive item. Ask the appointed actuary to walk your team through the key actuarial assumptions and the sensitivity of the IBNR to changes in loss emergence.
A one-point change in the combined loss ratio on a $340 million book is $3.4 million. Reserve adequacy is not a compliance formality.
Reinsurance contracts are assets and obligations that transfer with the carrier. Review:
Treaty terms and expiry. Quota share and excess-of-loss treaties typically renew 1 January. A deal closing 1 March means the buyer negotiated renewal on January 1 without full visibility into the transaction. Confirm treaty terms are assignable or that the reinsurer has agreed to novate.
Reinsurance recoverables. What is owed from reinsurers on open claims? Examine counterparty credit ratings. A recoverable from a reinsurer on watch for downgrade is partially impaired from day one.
Retrocession. Does Hartwell itself buy protection above its treaty layer? If yes, confirm that retrocession is also assignable.
Commutation options. Some treaties allow the ceding company to commute (buy out) open reserves at a negotiated discount. If a legacy treaty carries adverse development risk, a commutation before close can clean up the balance sheet, but it crystallizes the loss. Factor this into the purchase price adjustment mechanism.
Insurance is state-regulated in the United States. The Form A change-of-control filing requires approval from each state where the target holds a certificate of authority, and that approval process involves a full financial review of the acquirer.
Assemble the following in the data room before filing:
Three states in Hartwell's footprint have 120-day review clocks. Two have 90-day clocks. Build your outside date with the slowest regulator in mind.
The following structure follows the LSEG Datasite convention that most sell-side M&A counsel recognize, adapted for insurance specifics. Using a consistent, industry-standard layout reduces the number of information requests from the buyer's counsel and their actuaries.
01 Corporate
01.1 Certificate of authority by state
01.2 Articles of incorporation / charter
01.3 Board minutes (3 years)
01.4 Officer and director list
01.5 Organizational chart
02 Financial
02.1 Statutory annual statements (5 years)
02.2 GAAP financial statements (audited, 3 years)
02.3 Management accounts (trailing 12 months)
02.4 Actuarial reports and reserve triangles
02.5 Reinsurance treaties and schedules
02.6 Reinsurance recoverables summary
03 Book of Business
03.1 Policy count and premium by line (monthly, 3 years)
03.2 Carrier appointment agreements
03.3 Agency production reports (top 50 agents)
03.4 Renewal and lapse analysis
03.5 Geographic premium distribution
04 Claims
04.1 Large-loss register (claims > $500K)
04.2 Open catastrophe reserves
04.3 E&O history and current policy
05 Legal
05.1 Material contracts
05.2 Pending and threatened litigation
05.3 Regulatory orders and consent agreements
05.4 IP and technology licenses
06 Regulatory
06.1 State department correspondence (3 years)
06.2 Market conduct examination reports
06.3 Financial examination reports
06.4 Premium tax filings
07 HR and Compensation
07.1 Organizational chart with headcount
07.2 Key-person agreements and retention plans
07.3 Employee benefit plans
08 IT and Systems
08.1 Policy administration system (vendor, version, contract)
08.2 Disaster recovery and business continuity plan
08.3 Cybersecurity assessment (most recent)
08.4 Data breach history
09 Transaction
09.1 LOI / term sheet
09.2 Representations and warranties draft
09.3 Form A draft (confidential)
The actuarial team typically asks for folders 02 and 03 in the first week. Regulatory counsel focuses on folder 06. Investment bankers and financial advisors work through 02 and 05 simultaneously. Having the folder tree populated before buyer access opens saves two to three weeks of back-and-forth requests.
Insurance due diligence exposes policyholder data (claims records, medical histories, loss runs). That data is subject to state insurance privacy regulations and, where the carrier holds health data, HIPAA. Your data room must:
Enforce view-only on policyholder-level files. No download, no print. Watermarks with the viewer's name and access timestamp on every page.
Limit clean-team access. If the acquirer includes a competitor or a strategic buyer who also writes in Hartwell's territory, antitrust counsel will require a clean-team arrangement. The data room must support a separate permission group with restricted folder access and full audit logging of who viewed what.
Produce an exportable audit trail. State insurance departments in Form A reviews sometimes ask for evidence of how diligence was conducted. A timestamped PDF of every document access event, by user and folder, satisfies that request in minutes rather than days.
Support SOC 2 Type II and ISO 27001 certifications. Several state departments are now asking acquirers to confirm the data room platform's security certifications as part of the Form A review. Papermark holds both certifications and offers EU hosting, which matters if the acquirer has European operations subject to GDPR.
Papermark's Data Rooms plan ($99/month) supports all of the above: view-only permissions, dynamic watermarks, NDA gating at room entry, per-user analytics, and an exportable audit log. The Plus plan ($249/month) adds the Q&A module, which is useful for coordinating the volume of actuary, counsel, and regulatory questions that a carrier acquisition generates.
Accepting a reserve summary instead of the triangles. A summary number means nothing without the development history. Insist on 10 years of triangles by line.
Overlooking agent concentration. The top five agents by premium often represent 30-40% of the book. If any have change-of-control clauses, price for attrition.
Treating reinsurance as balance sheet netting. A reinsurance recoverable is only as good as the counterparty. Stress-test the recovery assumption against a reinsurer downgrade.
Filing Form A before the data room is complete. Regulators ask questions. If the file is incomplete, the department pauses its review clock pending the response. That pause can add 60 days to a deal that was already at the outer edge of the outside date.
Ignoring IT and policy administration systems. Migrating a legacy policy admin system post-close is a multi-year project. Understanding the technical debt before signing prevents post-close surprises.
Not securing key-person retention. An insurance carrier's underwriting profit is partly the institutional knowledge of its senior underwriters. If the top two commercial-lines underwriters can walk on day 61, price the replacement cost.
What is the typical timeline for an insurance carrier acquisition?
From LOI to close, a mid-market insurance carrier acquisition takes seven to twelve months. The Form A review process drives the timeline: the slowest state in a multi-state footprint typically has a 120-day statutory review period, and regulators can pause the clock with information requests.
Does the buyer need to file in every state where the target has a certificate of authority?
Yes. Each state where the target writes business and holds a certificate of authority requires its own Form A filing. A 12-state footprint means 12 parallel regulatory processes, each with its own information requirements and review timeline.
How do reserve adequacy and purchase price adjustment work together?
Most insurance M&A purchase agreements include a reserve development mechanism: if reserves develop adversely after close beyond an agreed threshold, the seller provides a dollar-for-dollar indemnity up to a cap. The exact threshold and cap are negotiated based on the appointed actuary's range of reasonable estimates.
What is a clean-team arrangement and when is it required?
A clean-team arrangement limits access to competitively sensitive information (customer pricing, underwriting guidelines) to a small ring-fenced group on the buy-side who are not operational decision-makers. It is required by antitrust counsel whenever the acquirer competes in the same lines and geographies as the target.
How should policyholder data be handled in the data room?
Policyholder-level data should be masked or anonymized before upload wherever possible. Where it cannot be, restrict it to a separate folder with view-only access, dynamic watermarks, and a specific NDA covering data protection. Confirm the data room platform is HIPAA-capable if health data is involved.
What certifications should an insurance M&A data room platform hold?
At minimum: SOC 2 Type II (controls over security, availability, and confidentiality verified by an independent auditor) and ISO 27001 (information security management system). GDPR-compliant EU hosting matters for cross-border deals. Several state insurance departments now ask for evidence of the data room platform's security posture as part of their Form A review.
Can the Q&A module replace email for regulatory queries?
It can, for buy-side and sell-side coordination. It cannot replace the formal correspondence channel with state departments, which has its own submission requirements. Use the Q&A module to coordinate your internal response team before sending the formal reply to the regulator.
What happens if a key reinsurance treaty is not assignable?
The seller must obtain a consent-to-assignment from the reinsurer, or the parties must negotiate a novation. If neither is possible, the deal economics change: the buyer is acquiring a risk that loses its reinsurance cover at the first renewal after close. Price accordingly, and build the reinsurance replacement cost into the model.
For an overview of the leading virtual data room platforms for M&A deals, see our best virtual data room for mergers and acquisitions guide. For due diligence checklists and document management, see our best virtual data room for due diligence comparison.
Førstegangskøber? Founder, der forbereder et exit? Her er den praktiske M&A due diligence-checkliste, du faktisk har brug for, plus hvordan du organiserer det hele i et data room, der ikke driver købere til vanvid.
Komplet guide til pharmaceutical due diligence, inklusive regulatoriske krav, FDA-compliance, produktvurdering og branchespecifikke overvejelser for M&A-transaktioner i pharma-sektoren.
Virkelig historie om et produktionsopkøb på $50M: hvordan target-virksomheden brugte VDR-funktioner til at accelerere due diligence, håndtere flere bydere og lukke 6 uger hurtigere end forventet.
Komplet guide til operational due diligence, inklusive framework, checkliste og best practices til vurdering af target companies' drift, mennesker, systemer og compliance i M&A-deals.