Imagine your routine monthly retainer charge fails because the client's credit card was declined. You email the VP of Marketing who championed your web agency for three years and get an automated bounce-back: "This inbox is no longer monitored."
Your client has been acquired.
Acquisitions are frequent. LSEG data shows global announced M&A reached roughly $4.6 trillion in 2025, up 49% from 2024 and the highest total since 2021. That means more of your clients, especially mid-sized brands that are natural acquisition targets, will eventually be bought. Buyers focus on finance, legal-entity structure, and leadership alignment. Domain registrations, DNS, hosting accounts, plugin licenses, and agency retainers are easy to overlook in that work.
This is the Client M&A Renewal Trap. After a deal closes, billing entities can be merged or retired, your primary contacts may leave, and payment methods may be cancelled. Meanwhile the client's web infrastructure keeps running on expiration clocks that nobody at the new parent company knows about.
If your agency relies on reactive account management, an acquisition can mean churn, unpaid invoices, or an emergency outage. If you have a plan in place, it can become a chance to deepen the relationship with a larger parent company.
The Anatomy of the M&A Renewal Trap
Most of the damage after a client acquisition is operational rather than legal. Where the deal is structured as a share purchase, the client's legal entity usually survives and your contract technically stays in force. Even so, payment methods, approvers, and email addresses can still change.
┌─────────────────────────────────────────────────────────┐
│ Client Acquired │
└──────────────────────────┬──────────────────────────────┘
│
┌─────────────┴─────────────┐
▼ ▼
Operational Disruption Infrastructure Vulnerability
• Payment methods closed • Registrant/contact emails go dark
• Primary contacts leave • Renewal reminders go unread
• Vendor records reset • Agency-billed services lapse
│ │
└─────────────┬─────────────┘
▼
┌─────────────────────────────────────────────────────────┐
│ Agency Action: Transition Playbook │
└─────────────────────────────────────────────────────────┘
1. The Disappearing Billing Entity
After an acquisition, the target's finance function is often folded into the parent's. Corporate cards tied to the old entity may be cancelled. Invoices may have to go through the parent's procurement and accounts payable process. That usually means formal vendor onboarding, such as tax forms and banking details, and payment cycles that differ from what a small agency is used to.
2. The Contact Void
The people who understood your agency's value may be reassigned, laid off, or may leave. Their mailboxes can be shut down quickly. Your agency may lose its internal advocate before the new owner has reviewed your service agreement.
3. The Silent Infrastructure Expiration
Web agencies often hold or re-bill infrastructure on a client's behalf:
- Domain registrations and SSL/TLS certificates: These sit in registrar or certificate accounts that may be tied to an individual employee's email address.
- Agency-billed plugins and SaaS: Premium licenses (for example Gravity Forms, WP Rocket, or ACF PRO) may sit under an agency master account.
- Managed hosting and cloud accounts: Platforms such as AWS, WP Engine, Kinsta, or Pantheon may be billed to the agency.
Domain renewal reminders go to the registrant's email address, so a dead inbox means the reminders go unread. ICANN's Expired Registration Recovery Policy requires registrars of generic TLDs to send expiration notices about one month and one week before expiry, plus another within five days after expiry. Those notices still depend on a monitored address. If nobody acts, the domain can be deleted. ICANN's policy gives gTLD registrants a 30-day Redemption Grace Period after deletion, during which the registry must disable DNS resolution. A site can therefore be offline well before the domain is gone for good.
Certificate cycles are getting shorter too. Under CA/Browser Forum Ballot SC-081v3, the maximum validity of public TLS certificates dropped to 200 days on March 15, 2026, falls to 100 days in March 2027, and to 47 days in March 2029. An account that nobody monitors will hit expirations more often over time.
When these services lapse, the result can be site outages, lost email, and a client who blames the agency.
Stage 1: Auditing Your Technical Assets
When an acquisition is announced, or when a payment fails unexpectedly, audit every digital asset tied to the client account.
Illustrative Risk Matrix (agency judgment, not an industry standard)
┌───────────────────────┬────────────┬──────────────────────────────┐
│ Asset Category │ Risk Level │ Typical Failure Mode │
├───────────────────────┼────────────┼──────────────────────────────┤
│ Domain & DNS │ Critical │ Missed renewal, stalled │
│ │ │ contact change, transfer lock│
│ Hosting & Cloud │ High │ Suspension after failed │
│ │ │ payment │
│ Premium Plugins/SaaS │ High │ Lapsed licenses, no updates │
│ Retainer Agreement │ Medium │ Unpaid invoices, unclear │
│ │ │ scope │
└───────────────────────┴────────────┴──────────────────────────────┘
For each asset, record:
- Who owns it (client or agency)
- Which account and email address it is tied to
- Who pays for it
- When it renews
Navigating Registrant Changes and Transfer Locks
Domain management is often the trickiest part of a corporate transition. Under ICANN's Transfer Policy, which applies to gTLDs such as .com, .net, and .org, a "Change of Registrant" is a material change to the registrant's name, organization, or email address. The registrar must obtain consent from both the prior and new registrant (or their designated agents). The registrar must also impose a 60-day inter-registrar transfer lock afterward, unless the registrant opted out before the change was requested.
Three practical points follow:
- The lock only blocks transfers to another registrar. It does not stop renewals or DNS edits.
- Registrars decide whether to offer the opt-out. If you plan to change registrant details and move registrars, transfer first and change the registrant afterward, or opt out of the lock before the change is requested.
- The rules are changing. In March 2025 the GNSO Council adopted Transfer Policy recommendations that would drop the Change of Registrant lock and shorten the lock after new registrations and transfers from 60 to 30 days. Rollout varies by registrar, so confirm the current rule with the registrar before relying on either number. Country-code domains (.uk, .de, .ca and others) follow their own registries' rules.
When the acquired company's legal name or contact details change during rebranding, work through this checklist:
-
Check lock status. Look up the domain via RDAP and ask the registrar directly. Since January 28, 2025, ICANN no longer requires gTLD registries and registrars to run port-43 WHOIS, so RDAP is the authoritative source for gTLD registration data. Registrars are not required to use a specific EPP status code for the Change of Registrant lock. A
clientTransferProhibitedstatus is also the ordinary registrar lock that owners can toggle, so the status code alone doesn't tell you why a domain is locked. - Verify access to the registrant email. If the registrant email sits on a mailbox that is being shut down, consent and notification emails will bounce. A pending Change of Registrant request that isn't confirmed within the registrar's window (capped at 60 days) simply doesn't proceed, and the old contact data stays on file.
- Confirm who can request a transfer code. Under ICANN's updated rules, the Transfer Authorization Code (TAC) is generated only when the registrant requests it and expires after 14 days by default. Generating a code early and filing it away will not work. Instead, make sure someone with a working login at the client can request a fresh code when you need one.
Stage 2: The Operational Playbook for Agency Transitions
When an acquisition is confirmed, follow a structured plan covering billing, infrastructure, and legal continuity. The day ranges below are a suggested sequence, not an industry standard. Compress or stretch them to fit the deal.
-
Triage and adjust billing (suggested: days 1–3)
- Stop retrying cards you know are closed. Repeated failed charges create noise and fees. Send a manual invoice instead.
- Flag the account internally. Mark the client "In Transition – Pending Re-assignment."
- Document active work. List open tickets, pending deployments, and deliverables in progress.
-
Identify and engage the new decision-makers (suggested: days 4–10)
- Trace stakeholders. Search LinkedIn and company news for integration leads and digital or marketing heads at the parent company.
- Contact accounts payable. Ask the parent's AP team for its vendor onboarding requirements. A U.S. agency will typically provide an IRS Form W-9. A non-U.S. agency will provide a W-8 form, which is W-8BEN for individuals and W-8BEN-E for entities.
- Send a concise executive summary. Cover the site's architecture, active integrations, hosting setup, and current retainer scope.
-
Move infrastructure into the client's name (suggested: days 11–20)
- Shift subscriptions. Move client-specific SaaS, plugin, and hosting fees off agency cards and onto client-owned accounts wherever the vendor's terms allow it.
- Secure DNS access. Make sure at least two trusted people can reach DNS management (Cloudflare, Route 53, or wherever it lives) so IT migrations don't cause accidental outages.
-
Update registrant contacts carefully. Move registrant details to a monitored, role-based address (such as
domains@parentcompany.com) instead of an individual's inbox. Plan around the Change of Registrant process and lock described in Stage 1.
-
Confirm or re-paper the contract (suggested: days 21–30)
- Find out the deal structure. Whether anything must be re-signed depends on it (see Stage 4).
- Align commercial terms. Update invoicing cycles, payment terms, and approval hierarchies to the parent's vendor requirements.
Stage 3: Securing Infrastructure Continuity
Agency-Billed Plugins and SaaS
Agencies often buy multi-site or developer licenses for premium plugins and fold the cost into monthly retainers.
- The risk: If the client relationship ends or enters limbo, you may stop paying for licenses the client's site depends on. Most commercial plugins keep running the installed version after a license lapses, but they stop receiving updates and support. Some features that rely on the vendor's servers may also stop working. Behavior differs by vendor, so check each one's terms. Also check whether your license is even transferable to the client, since many agency licenses are not.
- The resolution: Offer an Infrastructure Transition Package. List every active license on the site, give the client direct purchase links, and offer a fixed-fee service to help them buy and configure their own licenses and API keys.
Managed Hosting and Cloud Infrastructure
If hosting runs under your agency's master account (AWS, Pantheon, WP Engine, Kinsta, or similar):
- Don't shut hosting off abruptly. Pulling a site offline mid-integration damages trust and may breach your agreement. Have counsel review your termination and notice rights first.
- Give clear written notice of separation. State that hosting must move to a client-owned account by a specific date. Thirty days is a common starting point, but follow whatever your contract requires.
- Provide full exports. Supply a database dump, media library, and environment configuration through secure storage. This supports a clean handoff and protects your own hosting account.
Stage 4: Re-Signing and Contract Novation
Whether your contract needs any paperwork depends on how the deal was structured:
- Stock (share) purchase: The client's legal entity stays the same, so contracts usually remain in place, unless they contain change-of-control provisions.
- Asset purchase: Contracts generally have to be assigned to the buyer, and anti-assignment clauses typically require the counterparty's consent. That counterparty is you.
- Change-of-control clauses: A change-of-control clause operates separately from an anti-assignment clause and can grant consent or termination rights even in a stock deal.
Read your own MSA's assignment and change-of-control language first. It tells you which of the options below you need.
| Feature | Assignment | Novation | New MSA |
|---|---|---|---|
| What it does | Transfers the client's rights to another entity | Replaces the original party with a new one and releases the original from obligations | Replaces the old contract with new terms |
| Consent needed | Depends on the contract's assignment clause | Agreement of all parties | Agreement of both parties |
| Best used for | Simple transfers where the contract permits it | Keeping identical terms while changing the contracting entity | Expanding scope or adapting to the parent's procurement rules |
| Main risk | Original party may remain liable | Opens a negotiation if the new party pushes for changes | Invites a full procurement and legal review |
Novation differs from assignment in that it moves obligations as well as rights, and it generally requires everyone's consent. Treat any timeline you give a client as an estimate, because enterprise procurement can take weeks or longer.
Crafting an Effective Change-of-Control Clause
To protect your agency in future engagements, consider adding a clause like the one below to your standard MSA. It is a sample for discussion, not legal advice. Have a qualified attorney adapt it to your jurisdiction. Enforceability varies, and confidentiality rules around deals can make advance notice impractical.
Corporate Successors and Change of Control: If Client undergoes a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets or equity (a "Change of Control"), Client shall give Agency written notice at least thirty (30) days before the effective date or, where advance notice is prohibited by law or confidentiality obligations, within five (5) business days after closing. Continued provision of services after a Change of Control is conditioned on either (a) the surviving or acquiring entity's written assumption of this Agreement, or (b) execution of a new services agreement. Fees accrued through the effective date of the Change of Control are due and payable upon closing or on the original due date, whichever is earlier.
Stage 5: Turning M&A Risk into Agency Growth
Acquisitions are also a chance to expand your presence. Parent companies often buy smaller brands without the internal capacity to manage their web platforms.
Positioning Your Agency for Post-Acquisition Growth
┌─────────────────────────────────────────────────────────┐
│ Acquiring Parent Company │
└──────────────────────────┬──────────────────────────────┘
│
┌─────────────┴─────────────┐
▼ ▼
Technical Audit Package Enterprise Onboarding
• Site security review • Platform standardization
• Code quality review • SLA and reporting upgrades
• Integration mapping • Multi-site management
│ │
└─────────────┬─────────────┘
▼
┌─────────────────────────────────────────────────────────┐
│ Expanded Agency Mandate │
└─────────────────────────────────────────────────────────┘
- Deliver a "Day-1" digital asset summary. Give the parent's leadership a clear overview of the site's codebase, hosting and domain inventory, third-party integrations, and analytics setup.
- Highlight your institutional knowledge. Your team already knows the brand's custom code, integrations, and performance history, which lowers transition risk for the incoming marketing team.
- Propose upgrades where they are warranted. Use the integration window to raise technical improvements the new owner may not know about, such as consolidating hosting or fixing accessibility gaps. The European Accessibility Act, for example, has applied to covered e-commerce services since June 28, 2025. It exempts microenterprises providing services, defined as fewer than 10 staff and no more than €2 million in turnover or balance sheet total. A parent company that sells to EU consumers may face requirements the acquired brand did not.
Proactive Client Acquisition Checklist
Keep this checklist handy so a client acquisition doesn't catch you off guard:
- Verify registrant contacts: Confirm every domain's registrant email points to a monitored, role-based address, not one person's inbox.
- Know who can request transfer codes: Make sure someone with a working registrar login can generate a Transfer Authorization Code on demand.
- Separate software licensing: Move client-specific tools to direct billing where vendor terms permit.
- Maintain an infrastructure inventory: Record each domain, certificate, hosting plan, license, and API connection, along with its owner, payer, account email, and renewal date.
- Include change-of-control terms: Make sure every client MSA covers assignment, notice, and successor obligations. Have an attorney review them.
- Standardize vendor onboarding: Keep an up-to-date vendor packet ready (W-9 or the appropriate W-8 form, banking details, insurance certificates) for corporate procurement teams.
By tracking assets, contacts, and contract terms before an acquisition happens, your agency can keep services running, protect revenue, and build a strong relationship with the new owner.
Originally published at https://instarenewal.com/blog/the-client-m-a-renewal-trap-what-happens-when-your-client-gets-acquired
Top comments (0)