Skip to main content
milly logo
Tactical · prose B14 For Buyers · Streamlining Due Diligence

Staged disclosure — what to release, and when.

About a third of signed LOIs never reach funding — which means a seller who discloses everything up front has handed sensitive data to a buyer who may walk. Staged disclosure releases information in four stages mapped to deal milestones, so the most damaging material only unlocks once the buyer has committed. And how a buyer responds to staging is itself a signal.

The case for staged disclosure is a single statistic: about a third of signed LOIs never reach funding. A seller who opens the full data room at first contact has handed their fully-identified client list, producer comp, and carrier loss runs to a buyer who has roughly a one-in-three chance of walking — and who is sometimes a competitor in disguise. Staging solves this by tying the sensitivity of what's released to the seriousness of the buyer's commitment, so the most damaging material only unlocks once the buyer has skin in the game.

§ 01 · The four-stage protocolDisclosure mapped to milestones.

StageWhat unlocks
Stage 1 (pre-IOI, NDA)Aggregated financials, carrier mix, headcount
Stage 2 (post-IOI, pre-LOI)Operations + HR, anonymized
Stage 3 (signed LOI + exclusivity)Carrier contracts, named producer detail
Stage 4 (signed PA + funding committed)Fully-identified customer data

The protocol maps four disclosure stages to four deal milestones. Stage 1, pre-indication-of-interest and under NDA, releases aggregated financials, carrier mix, and headcount — and that's sufficient for an IOI; a buyer who needs more than that to issue an indication isn't running a real process, which is itself a tell on buyer sophistication. Stage 2, post-IOI and pre-LOI, releases operations and HR data, anonymized. Stage 3, conditioned on a signed LOI with exclusivity, unlocks carrier appointment letters, contingency agreements, named producer comp and employment and non-piracy agreements, and top-carrier loss runs — and the change-of-control clauses. Stage 4, at signed purchase agreement with funding committed and closing imminent, releases fully-identified customer data. Each unlock requires the milestone before it, so a buyer earns access to more sensitive material by committing further. The data room that enforces these gates is covered in the virtual data room.

§ 02 · Three damage categoriesWhat premature release costs.

Journal axiom · 1 of 2

Premature release does damage in three categories. Competitive-intelligence leakage — a market map of accounts, splits, and loss runs handed to a potential competitor. Producer and staff destabilization — a poaching map of who earns what. And client-relationship damage — a direct customer-contact map. The absolute rule that follows: never permit direct customer contact pre-close, and not even after PA signing until funding is committed — the single highest-stakes staging discipline.

The three damage categories are why the staging discipline is non-negotiable on the most sensitive material. A fully-identified client list with splits and loss runs is a competitive market map — in the hands of a buyer who walks (or a competitor posing as one), it's a roadmap to poach the book. Named producer comp is a poaching map for the staff. And fully-identified customer contacts are an invitation to direct outreach that can destabilize the very relationships the buyer is paying for. The highest-stakes rule is the prohibition on direct customer contact: not before close, and not even after the purchase agreement is signed until funding is actually committed — because a deal can still collapse between PA and funding, and a customer who's been contacted by a buyer who then vanishes is a damaged relationship the seller is left holding.

§ 03 · Anonymization and re-identificationThe Stage-2 discipline.

Stage 2 is where anonymization does its work, and where it most often fails. The standard is producer-by-producer codes ("Producer 01"), an org chart by role and tenure rather than names, an anonymized analysis of lost large accounts over 36 months, and retention by line of business — enough for a buyer to assess the operation without a poaching map. The trap is re-identification risk: if a single client is 35% of a line, or a producer has a one-of-a-kind specialty concentration, the "anonymized" data points straight back to the real party, so the seller must audit for re-identification before release rather than assuming codes are sufficient. Lazy anonymization — codes that don't actually obscure identity — is one of the four common staging mistakes, and it defeats the entire protocol. Proper anonymization lets a buyer do real Stage-2 diligence on the operation while the identities stay protected until the buyer has signed an LOI with exclusivity. How AMS integration enforces the aggregated-then-identified boundary is in AMS integration diligence.

§ 04 · Four mistakes and the buyer signalProtecting the protocol.

Four common mistakes break staged disclosure, and each undoes the protection. Releasing Stage-3 material during the IOI phase — a single "just one carrier contract" exception undoes the whole protocol. Lazy anonymization with re-identification risk. Allowing pre-close direct customer contact. And letting the NDA expire when the deal does — the confidentiality and non-use obligations need a 2–3 year minimum tail to survive a deal failure, because that's the enforcement mechanism against post-failure competitive misuse. The most useful read for a buyer's own conduct is the signal staging sends: a buyer pushing for Stage-4 access on day 1 is flashing three bad signals — they don't understand the asset (Stage 1 is enough for an IOI), they don't respect the seller, and they can't be trusted post-close. Sellers notice, which is why they pick respectful buyers at slightly lower headline prices for the certainty-of-close and integration-quality dividend. For a buyer, the lesson cuts both ways: respect the staging, and you signal the kind of acquirer a seller wants to choose. The protections that pair with disclosure — reps, escrow, and the rest — are in retrade defense.

Terminology on this shelf

Four-stage protocol
Aggregated (pre-IOI) → anonymized ops/HR (pre-LOI) → carrier/producer (signed LOI) → identified customers (signed PA + funding).
Three damage categories
Competitive-intelligence leakage, producer/staff destabilization, client-relationship damage.
The no-contact rule
Never direct customer contact pre-close — and not after PA until funding is committed.
Re-identification risk
Anonymized data that points back to a real party via concentration — audit before release.
NDA tail
2–3 year minimum survival of confidentiality past a deal failure.
Stage-4-on-day-1 signal
A buyer pushing for identified data early — three bad signals about understanding, respect, and trust.

From the buyer theme

One piece every other Tuesday.

The next long-form piece in your inbox the morning it goes live. No marketing. Unsubscribe in one click.

Anonymous by default · One click to unsubscribe