Insurance agency acquisition checklist: the data due diligence skips

An insurance agency acquisition checklist should cover the data that decides the integration as well as the revenue, carrier contracts and staff that decide the price. The usual due diligence list asks for commission statements, carrier contracts, loss ratios, leases and employment agreements. It does not always ask for the seller's agency management system export, a count of duplicate clients, how often policy records disagree with their declarations pages, which coverages clients declined without signing, or which producers are licensed and appointed where. Those items decide how long the integration takes, what it costs and what errors-and-omissions exposure the buyer takes on, and most of them can be checked before closing. Botminds' Agency Acquisition Data Migration reads a seller's export and documents with six agents, so the same work that runs the integration can run on a diligence extract first.

The checklist below is the data half of due diligence. Each item says what it reveals, so the deal team can decide which ones matter for this seller.

What is on an insurance agency due diligence checklist?

Two kinds of item: the ones that price the deal and the ones that decide whether the book can be run after it. The first kind is familiar: revenue and commission history by carrier, carrier contracts and any change-of-control terms, contingent commission arrangements, producer and employment agreements, leases, litigation and the seller's financial statements. The second kind is the data in the seller's systems, and it is where the post-close surprises come from.

The two kinds are connected. A book whose clients appear twice, whose policies disagree with their declarations pages and whose renewals land with carriers the buyer is not appointed with costs more to integrate and loses more commission in the first renewal season. Checking the data in diligence turns those into numbers the deal model can use. Insurance data integration after an acquisition shows how to price them.

Can a seller share client data before closing?

Yes, for a proposed sale, within limits. The federal privacy law for financial institutions, which covers insurance agencies, exempts from its notice and opt-out rules a disclosure of customers' nonpublic personal information made "in connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal information concerns solely consumers of such business or unit" (15 U.S.C. §6802(e)(7)). The NAIC's privacy model regulation, which states use for their insurance privacy rules, carries the same exception (NAIC Model #672, §17).

Privacy law lets the seller's customer data be read before you sign. Read after closing, the same data stops being diligence and becomes the integration's first surprise.

The exception permits the disclosure; it does not make the data any less sensitive once disclosed. Diligence extracts belong under a confidentiality agreement that limits use to evaluating the deal, names who may see the data, and requires its return or destruction if the deal does not close. State law can add to the federal floor, so the buyer's counsel should confirm the seller's state rules before the extract moves. A sensible middle course is an extract that is complete for structure, codes, counts and notes but masks tax IDs and dates of birth until the deal is signed.

What data should you review before buying an agency?

Enough of the seller's agency management system to count the work: the table list and row counts, every code list, client records with their identifiers, policies with their terms and premiums, a sample of declarations pages, activity notes and the renewal list for the months after close. With those, the integration team can measure what the deal team would otherwise guess.

Four counts matter most. How many fields and code values will need a person, because the seller's codes are ambiguous. How many client records are duplicates, inside the book and against the buyer's own. How many policies disagree with their declarations pages. And how many renewals in the first ninety days land with carriers the buyer has no appointment with. In the solution's fictional sample acquisition, those counts were 11 doubtful fields and 32 doubtful code values, 187 duplicate clusters of which 38 crossed both books, 142 policies that disagreed with their pages, and 47 renewals in thirteen weeks with seven carriers the buyer was not appointed with. Each is a line in the integration plan, and each could have been counted before signing.

The counts a diligence extract can produce before you sign

What licensing checks are needed when buying an agency?

Four: the agency's own licence, its designated responsible producer, each producer's licences and lines of authority, and each person's fitness to work in insurance at all. Under the NAIC's model producer licensing act a business entity acting as a producer needs its own licence and must designate a licensed producer responsible for its compliance (NAIC Model #218, §6); a licence belongs to the person or entity it was issued to, so in an asset purchase the buyer's entity needs its own in each state where it will sell.

Names need a check too, if the buyer will keep trading under the seller's name. The model act provides: "An insurance producer doing business under any name other than the producer's legal name is required to notify the insurance commissioner prior to using the assumed name" (NAIC Model #218, §10). And where the seller is an estate, the same act lets a commissioner issue a temporary licence "for a period not to exceed one hundred eighty (180) days" to a surviving spouse or representative, among other purposes "to allow adequate time for the sale of the insurance business owned by the producer" (§11), which sets the clock on that kind of deal.

Fitness is a federal question as well as a state one. Under 18 U.S.C. §1033, a person convicted of a felony involving dishonesty or a breach of trust who willfully engages in the business of insurance commits a federal crime unless an insurance regulator has given written consent, and so does anyone who willfully permits that person to participate (18 U.S.C. §1033(e)). Staff who come over with the book, licensed or not, belong in the buyer's onboarding checks before day one.

How do you check producer licenses in an acquisition?

Against the regulators' own records, producer by producer and state by state, before close. The National Insurance Producer Registry, a non-profit affiliate of the NAIC, built the Producer Database, which the NAIC describes as the national repository for producer licence information (NAIC Insurance Department Resources Report, 2023); state lookups and NIPR's services draw on it. For each producer, confirm the resident and non-resident licences, the lines of authority, the expiry dates and continuing education status, and compare them with the lines and states the producer actually wrote in the seller's book.

The comparison is the point. A producer licensed for property and casualty in Kansas who wrote a client's location in Missouri is a question; so is a renewal commission on a policy first sold before the producer was licensed. Under the model act, renewal and deferred commissions may be paid only if the producer was licensed when the policy was sold (NAIC Model #218, §13), which makes the seller's producer codes and sale dates diligence data, not payroll data.

What happens to carrier appointments when an agency is sold?

They do not move with the book. An appointment is an insurer's authorisation of a particular producer or agency, so the buyer writes the acquired business under its own appointments with each carrier, and where it has none, it needs one before the renewal or a different market. The model act requires the insurer to file a notice of appointment within fifteen days of the agency contract or the first application, whichever comes first, and to notify the regulator within thirty days when it ends one (NAIC Model #218, §§14–15); a purchase agreement can also let renewals continue under the seller's codes for a period after close, as the sample's did.

Getting this wrong is expensive in a way regulators record. In a 2020 consent order, the Kansas Insurance Department found that over three years one insurer had issued 670 policies through 161 producers who were not appointed at the time of sale, and imposed a $60,000 penalty; the insurer neither admitted nor denied the findings and had built system checks so policies issue only when licensing and appointment requirements are met (Kansas Insurance Department, Docket 81589). That was a carrier's failure, but the lesson for an acquirer is the same: match renewals to appointments before they renew, not after.

Renewals matched to appointments, carrier by carrier and week by week

Flood and other programme business that moves only at renewal

Some business cannot be moved by a data load at all. Federal flood insurance is the clearest case. When an agent moves existing business from one insurer to another, the flood manual says, "Such a transfer occurs through a renewal notice issued by the receiving insurer but otherwise resembles the process for new business." The receiving insurer can generate that renewal notice only within 90 days of the policy's expiration date (FEMA, NFIP Flood Insurance Manual, October 2025).

For diligence, that means counting the seller's flood policies by expiry month and by the insurer that writes them, and confirming whether the buyer can write with the same insurer. A book with flood policies expiring all year needs a year to move them, and each one needs the information the receiving insurer must collect, from the prior declarations page to an elevation certificate where one exists. Other residual-market and programme business can carry similar rules; list each programme in the seller's book and read its manual.

What red flags appear in agency due diligence?

In the data, a red flag is anything that predicts work or exposure the price does not reflect. The table below lists the ones a diligence extract can show, with what each tends to mean.

How do you value an agency's book of business data?

Not as a multiple, but as a set of costs and risks the price should reflect. A clean book and a messy book with the same commission revenue are not worth the same to the buyer, because one integrates in weeks and keeps its renewals, and the other spends its first renewal season on duplicates, wrong codes and appointment gaps.

Price four things from the extract: the integration hours the data will need; the commission on renewals at risk because they land with carriers the buyer is not appointed with or under producers who cannot be paid; the E&O exposures found in the notes, which bear on the tail and on the indemnity terms; and the records the buyer must keep readable after the seller's system is switched off. The sample book's tie-out shows the scale of the second item: $1,862,300 of annual commission on $14,218,640 of written premium, with 47 renewals in the first thirteen weeks headed to seven carriers the buyer was not yet appointed with.

Data security when the seller's export changes hands

The export is the most sensitive file in the deal, and the duties that attach to it depend on the size of the parties. The NAIC's Insurance Data Security Model Law requires licensees to run an information security programme and oversee their service providers, and then provides an exception for the smallest: "A Licensee with fewer than ten employees, including any independent contractors, is exempt from Section 4 of this Act." Section 4 is where those duties sit (NAIC Model #668, §10). States that adopted the model may have changed it, so check the buyer's and the seller's states.

The practical consequence is that a small seller may never have had a written security programme, and the buyer, often larger, inherits the data into one. Ask where the seller's data lives, who has access, which vendors hold copies, and how the extract will be moved, and plan the disposal of every copy made for the deal. The record retention guide covers what must be kept and what can be destroyed.

Questions people ask

When should the data checks happen in an agency acquisition?

As soon as the letter of intent is signed and a confidentiality agreement is in place. The federal privacy law allows disclosure for a proposed sale, so the extract can be read before closing, while what it shows can still change the price, the tail or the indemnity terms.

What is a book of business transfer?

The move of a set of policies from one agent or agency to another, usually at renewal and carrier by carrier. Some programmes have their own procedure: federal flood policies move through a renewal notice from the receiving insurer within 90 days of expiration.

Do the seller's carrier appointments transfer to the buyer?

No. Appointments are granted by each insurer to a specific producer or agency, so the buyer needs its own with each carrier it will write with. A purchase agreement can allow renewals under the seller's codes for a set period while the buyer's appointments are put in place.

What should the seller provide in the data room?

The agency management system's table list and row counts, its code lists, a structured extract of clients, policies and renewals, a sample of declarations pages and activity notes, producer licence and appointment lists, open claims and the E&O policy. Masking tax IDs until signing is a reasonable compromise.

Who on the buyer's side should review the data?

The integration manager and data migration analyst for the counts and codes, the E&O and compliance lead for the notes, claims and E&O policy, and licensing staff for producers and appointments. The integration team guide describes each seat.