Acquisition outreach compliance: what M&A teams must know.

Every PE firm or advisor that starts contacting business owners directly eventually asks the same question before the first campaign goes out, not after: is this even legal. Acquisition outreach compliance is not a single rule but a small set of overlapping laws, mostly written for consumer marketing, that apply differently depending on the channel, the recipient, and where they are based, and getting the basics wrong can shut down a campaign or worse, expose the firm to real penalty.

This is written for the people who have to sign off on an origination programme before it launches: deal team leads, compliance officers at boutique banks, and search fund principals doing their own outreach. If you have not yet decided how to run the outreach itself, cold calling vs cold email covers the tradeoff; this post covers what governs each channel once you pick one.

Is cold outreach to business owners legal for M&A deal sourcing?

Yes, in the large majority of cases, because most acquisition outreach is B2B communication to a business contact about a business transaction, which sits outside the strictest consumer-protection rules. The exposure is not that outreach itself is illegal, it is that specific mechanics inside a campaign, an unclear sender, a missing opt-out, a called number on a do-not-call list, can trigger a specific law. Compliance is about the mechanics, not the premise.

Does CAN-SPAM apply to acquisition outreach emails?

Yes, CAN-SPAM applies to any commercial email sent in the United States, including B2B acquisition outreach, and it is more permissive than most teams assume. The CAN-SPAM Act does not require opt-in consent before the first email, which surprises people used to GDPR. It requires accurate sender information, a non-deceptive subject line, a working postal address, and a functioning opt-out honoured within ten business days. Most acquisition outreach programmes already meet this bar without changing anything, provided the sender identity is genuine and every message carries a real way to stop future contact.

• Accurate header and from-address. The email must come from a sender the recipient can identify, not a disguised or spoofed domain.
• Honest subject line. The subject cannot misrepresent the email's content to get an open.
• Physical address. A valid postal address must appear somewhere in the message, typically the footer.
• Working opt-out. A clear way to stop future emails, honoured within ten business days of the request.
• No sending after opt-out. Continuing to email someone who has opted out is the single most common CAN-SPAM violation in outbound campaigns.

Does the National Do Not Call Registry apply to acquisition calls?

Mostly not, because the National Do Not Call Registry and the bulk of Telephone Consumer Protection Act restrictions were built around consumer telemarketing, and calls placed to a business number for a business purpose are generally exempt. The real TCPA exposure in acquisition outreach sits somewhere else: autodialed or pre-recorded calls to a personal mobile number. If a search fund principal or associate is calling a business owner's personal cell rather than the company line, and doing it through an autodialer rather than manually, that call falls under a stricter standard regardless of the business purpose. The safest practice for acquisition calling is manual dialling to a business line, which sidesteps almost all of the TCPA's teeth.

What about GDPR if a target or owner is based in Europe?

GDPR applies once you process personal data belonging to someone in the EU or UK, and a named business owner's contact details count as personal data even in a B2B context, which is a meaningful difference from the US framework. Under the General Data Protection Regulation, outreach to a European owner generally needs a lawful basis, most commonly legitimate interest for a genuine, proportionate business inquiry, plus a clear opt-out and honest disclosure of how the contact detail was sourced. Firms running cross-border programmes, family offices and PE groups sourcing across the UK and EU in particular, should treat every European contact under the stricter standard by default rather than trying to sort US from EU rules mid-campaign.

How do the main channels compare on compliance exposure?

A four-part framework for compliant acquisition outreach

1. 1. Identify the channel and jurisdiction first. US business email, US business calling, and EU contact each sit under a different rule, and the same campaign often needs to run three ways rather than one.
2. 2. Build the opt-out into the system, not the individual message. A suppression list that removes a contact everywhere the moment they ask, rather than relying on someone remembering to update a spreadsheet, is what actually prevents the most common violation.
3. 3. Keep sender identity and purpose honest at every step. A real name, a real reason for the contact, and a straight answer if asked how the contact information was sourced, removes most of the risk in any channel.
4. 4. Log consent basis and opt-outs the way you would log a deal note. If a regulator or an owner ever asks, the answer should be a lookup, not a reconstruction from memory.

Does using an outsourced origination partner change the compliance picture?

It should reduce the risk, not add to it, because a partner running outreach at volume across many mandates has almost always already built the suppression lists, sender verification, and opt-out handling that a single in-house team would otherwise build from scratch for one programme. That is one of the fair questions to ask before hiring one, alongside the others covered in deal origination partner questions to ask. It is worth confirming directly rather than assuming, since a partner's compliance posture becomes the firm's exposure the moment the campaign runs under its name.

What does poor compliance actually cost, beyond the fine?

The larger cost is usually not the penalty, which is rare in practice for a well-run B2B programme, it is the damage to the one thing acquisition outreach depends on: the owner's willingness to keep talking. A deceptive subject line or an ignored opt-out does not just risk a complaint, it burns a contact who might otherwise have been a deal two years from now, which matters more over a full origination programme than any single campaign. Acquisition outreach objections covers how a trust objection like "how did you get my information" gets answered once it comes up, and a clean compliance posture is most of the answer.

The short version

Acquisition outreach compliance is manageable once the rules are separated by channel: CAN-SPAM governs US email and mostly just requires honesty and a working opt-out, the TCPA's real teeth apply to autodialed calls to personal mobiles rather than business lines, and GDPR raises the bar meaningfully for any European contact. None of it should stop a firm from running direct outreach, it should just shape how the programme is built. More on how a compliant programme runs at scale is on how it works and solutions, and firms comparing this against other origination approaches can see the fuller picture on private equity and M&A advisory origination.

Key Terms Glossary

Frequently asked questions