.jpg)
What Is a CIM in M&A? The Confidential Information Memorandum Explained
A CIM, or confidential information memorandum, is the main selling document in an M&A process. It is the detailed written case for buying your business, prepared by your advisor, sent to qualified buyers once they have signed an NDA, and designed to take a reader from mild curiosity to a considered offer without a single phone call.
It is also longer than most founders expect. Financial Edge Training puts a typical CIM at anywhere from 30 to over 150 pages, depending on the depth of the business being described. That length is the source of most confusion about what a CIM actually is: it is not a pitch deck, not a prospectus in the securities sense, and not the same thing as the data room that follows it.
This page covers what a CIM contains, where it sits relative to the other documents in a sale, what a SaaS CIM needs that a generic one does not, and the liability rules that govern what it can say. That last part gets very little attention elsewhere and it is the part a founder signs off on. For the process around all of it, see how to sell a SaaS business.
What a CIM is, precisely
A CIM is the sell-side document that presents a business to qualified buyers after an NDA. It is prepared by the advisor, it names the company, and it carries the full commercial argument: what the business does, how it makes money, why the numbers look as they do, and what a buyer could do with it.
Three features define it. It is confidential, which is why it is gated behind an NDA and why version control matters. It is informational rather than contractual, meaning nothing in it forms part of the eventual agreement. And it is persuasive, in the specific sense that it is meant to be accurate and complete while still making the strongest honest case.
The document goes by several names depending on who is running the process. Information memorandum, IM, offering memorandum, deal book and selling memorandum all describe the same thing. Outside the United States, information memorandum is the more common term. A related document, the confidential information presentation or CIP, is a shorter slide version, typically around 30 pages, used where a full written memorandum would be more than the deal needs.
What goes in a CIM
The section order varies by advisor, but the content is fairly standardised. A reader should be able to answer every obvious first-round question without asking one.
Every claim in the right-hand column should be verifiable from the data room. The CIM makes the argument; the data room proves it.
CIM, teaser, management presentation and data room
The CIM sits third in a sequence of four, and each step reveals more than the last. The teaser comes first: one or two anonymised pages sent without an NDA, enough for a buyer to decide whether to ask for more. The CIM follows once the NDA is signed, and it names the company. The management presentation comes after initial interest and puts the team in front of the buyer. The data room comes last and contains the source documents rather than the narrative.
Getting the order right matters because each document assumes the reader has absorbed the one before it. A CIM written as though the reader knows nothing wastes the first ten pages. A CIM written as though the reader has already done diligence skips the argument entirely. Our guide to the documents you need to sell a SaaS company covers the data room end of this sequence in detail.
How long should a CIM be?
Long enough to answer the obvious questions and no longer. The 30 to 150 page range reflects genuine differences in business complexity rather than differences in effort, and a longer document is not a stronger one.
For a SaaS business between $1 million and $20 million in enterprise value, 30 to 50 pages is usually right. Above that, more customers, more contracts and more corporate history push it up. What does not change is that a buyer decides whether to keep reading in the first few pages, so the executive summary carries a disproportionate share of the work.
What a SaaS CIM must carry that a generic one does not
A SaaS CIM lives or dies on metric definitions. Two companies can report the same ARR and mean different things by it, so a buyer reading a SaaS CIM is checking your definitions as closely as your numbers.
Three things belong in every SaaS CIM and are frequently missing. First, an ARR to recognised revenue bridge, so a reader can reconcile the headline figure to the financial statements. Second, retention stated twice: gross revenue retention and net revenue retention, each with the formula written out. ChartMogul's study of roughly 3,500 software companies puts median B2B SaaS net revenue retention at 82%, with the upper quartile at 97%, so a buyer has a reference point whether you supply one or not. Third, cohort retention by signup month rather than aggregate churn, because the aggregate hides the shape.
Beyond the metrics, a 2026 SaaS CIM should pre-empt the technology question. In SRS Acquiom's 2026 survey of 150 senior dealmakers, 84% expect greater scrutiny of cybersecurity diligence and 51% already call technology diligence the most demanding part of a review. A short architecture note, a dependency summary and a line on security certifications belong in the CIM rather than waiting for diligence. Our guides to the metrics that drive SaaS valuations and SaaS valuation multiples by ARR, growth and retention cover which of these move price.
The legal frame: a CIM is marketing, but it is not exempt
A CIM is not a prospectus. A private M&A sale is not a registered securities offering, so none of the registration and disclosure machinery that governs a public offering applies. Founders sometimes take that to mean the CIM is a pure marketing document with no legal consequence attached. That is the wrong conclusion.
If the transaction is structured as a share sale, it is a sale of a security, and the antifraud rule follows it. Rule 10b-5 makes it unlawful to make any untrue statement of a material fact, or to omit to state a material fact necessary in order to make the statements made not misleading, in connection with the purchase or sale of any security. As the Cornell Legal Information Institute notes, the rule reaches private placements as well as public offerings, and a claim requires a material misrepresentation, scienter, reliance and damages.
The boundary was sharpened recently. In Macquarie Infrastructure Corp v. Moab Partners, decided in 2024, the Supreme Court held that Rule 10b-5(b) does not proscribe pure omissions. Liability attaches to untrue statements and to half-truths, meaning statements that become misleading because of what was left out, but not to silence alone. The practical reading for a seller is narrower than it first appears: once you make a claim in the CIM, you own everything needed to keep that claim from misleading. Saying nothing about a topic is safer than saying half of it.
This is why CIMs carry disclaimer language, why projections are labelled as management estimates with assumptions stated, and why the document says it does not form part of any agreement. It is also why the representations and warranties in the purchase agreement, not the CIM, are what a buyer contractually relies on. None of this is legal advice and the structure of your deal changes the analysis, so have your own counsel review the CIM before it goes out. The working rule is simpler than the law: put nothing in a CIM you would not want to defend line by line in diligence.
Who writes the CIM, and what you have to supply
The advisor writes it. Financial Edge Training notes that the investment banking deal team both creates the CIM and runs the buyer solicitation, working from information the company provides. That division of labour is the point: the advisor knows what buyers ask and how to frame an answer, and you know the business.
What you supply is the raw material. Accrual-basis financials, the cohort and retention exports, the contract schedule, the org chart, the product and architecture notes, and an honest account of why the numbers moved when they moved. A sell-side quality of earnings review is worth considering above roughly $10 million in enterprise value, and our guide to quality of earnings in tech M&A covers what one involves.
Preparing that material is the long pole, not the drafting. Datasite's 1H26 data puts the median time to assemble a data room at 12 days, which is achievable only because it assumes the underlying documents already exist. Expect two to four weeks for CIM drafting and review once the inputs are ready. FE International's investment banking team handles this end of the process directly.
Five things that weaken a CIM
- Undefined metrics. An ARR figure with no stated definition invites a buyer to compute their own, usually less favourably.
- Projections with no assumptions. A hockey stick with no stated drivers reads as optimism rather than as a plan, and it undermines the historicals next to it.
- Omitting a known issue. Customer concentration, a pending claim, a key person leaving: a buyer finds these in diligence, and finding them late costs more than disclosing them early.
- Length used as a substitute for clarity. A 120-page CIM for a $4 million business signals padding, not depth.
- Claims the data room contradicts. Every number in the CIM should trace to a document a buyer can open. The buyer-side diligence checklist shows what they will be reconciling it against.
The common thread is that a CIM is judged on whether it survives contact with evidence. Deloitte puts the median gap between signing and closing at about three months, and every unresolved gap between the CIM and the data room is something to be relitigated during it.
Getting the CIM right
So what is a CIM in M&A? It is the document that does the selling while you carry on running the business. Thirty to a hundred and fifty pages, gated behind an NDA, written by your advisor, and judged on one test: does every claim in it survive contact with the data room. Define your metrics, state your assumptions, disclose what a buyer would find anyway, and keep it as short as the business allows.
FE International has completed more than 1,500 transactions since 2010 with a 94.1% success rate on private sales and acquisitions, and we handle SaaS sales end to end, including preparing the CIM and running the buyer process around it. If you want to know what your CIM would need to say, that is a good place to start the conversation.
