Escrow and Asset Transfer: How Closing Actually Works When Buying an Online Business

What Happens Between Signing the LOI and Celebrating?

There is a gap between "deal agreed" and "business yours" that first-time buyers consistently underestimate. That gap is the closing process — and the most dangerous moment is when your money leaves your bank account while the assets are not yet in your hands.

Escrow fixes that problem. It acts as a neutral third party holding your funds until both sides confirm the transfer is complete. But escrow is only one piece of the closing puzzle. The bigger challenge is the asset transfer itself: making sure every domain, analytics account, social profile, ad account, code repository, and email list actually lands under your control — not just "transferred in principle."

This guide walks you through the mechanics, step by step.

How Online Business Escrow Works

The Basic Flow

A standard escrow for an online business acquisition goes through five stages:

• 1. Both parties agree on an escrow service — either the marketplace's built-in escrow (Empire Flippers, Acquire.com) or a third-party service (Escrow.com is the most common outside marketplaces).
• 2. The buyer deposits funds — typically the full purchase price, sometimes minus a holdback agreed in the LOI.
• 3. The inspection period opens — the buyer has a fixed window (usually 7 to 30 days) to verify assets, test access, and confirm everything matches what was sold.
• 4. Both parties confirm satisfaction — the buyer clicks "release funds" or the funds release automatically at the end of the inspection window.
• 5. Funds transfer to the seller — escrow releases the money, minus its fee (typically 0.89%–3.25% depending on the platform and deal size).

Holdbacks: How to Protect Yourself Post-Close

For any deal above USD 100,000, consider negotiating a holdback — a portion of the purchase price (commonly 10–15%) withheld from the seller for 30 to 90 days post-close. The holdback is released only if no material breach of seller representations surfaces during that window.

Common scenarios that trigger holdback disputes:

• Revenue materially lower than represented in the first month after closing
• A key traffic source (Google ranking, ad account, affiliate program) collapses within 30 days
• Seller representations about subscriber counts or customer contracts turn out to be inaccurate

Holdbacks are best handled inside the escrow structure itself, with clear release conditions defined in the Asset Purchase Agreement (APA).

The Asset Transfer Checklist

This is where most first-time buyers get caught. "The seller transferred it" sounds complete — but what does that actually mean for each asset type? Here is the full list of what needs to move and how to verify each one.

Domain Name

What to do: Transfer the registrar account or initiate a domain transfer to your own registrar. Do not accept "I'll point it at your server" — you need to own the registrar record. Verification: Log in to the registrar account and confirm the registrant contact shows your information. Generate a domain auth code yourself to prove you have full access. Watch out for: Domains locked for 60 days after a recent registrar transfer. Check transfer eligibility before closing if you want to move the domain immediately.

Analytics (GA4, Search Console)

What to do: Request admin access to the GA4 property and Google Search Console property — not a shared link, not a cloned view, the actual property. For GA4, this means being added as Editor or Administrator to the property itself. Verification: Confirm you can see historical data going back at least 12 months. Historical data does not transfer — if the seller only adds you as a user on closing day, you lose the history when they remove their account. Watch out for: Sellers who verified Search Console via meta tag or DNS record tied to their own domain. If their verification method disappears, you lose GSC access. Add your own verification method before the seller removes theirs.

Hosting and Server Access

What to do: Get SSH access, cPanel/Plesk login, or full credentials to the hosting account. The goal is to manage the server yourself without depending on the seller. Verification: Log in and confirm your access level. Deploy a test change (rename a file, update a setting) to confirm you have write permissions.

Email and Domain Email

What to do: Transfer domain email accounts (info@, contact@, newsletter@) — either by migrating to your own Google Workspace / Microsoft 365 or by getting the credentials to the existing email service. Verification: Send and receive a test email from each address. Confirm that any email sequences or autoresponders are still functional.

Social Media Accounts

What to do: Change the login email and phone number on each social account to yours before releasing escrow. Instagram, Facebook, Twitter/X, LinkedIn, Pinterest, TikTok — do each individually. Verification: Log in from a fresh browser session (incognito, different device) using the new credentials to confirm the transfer is clean. Watch out for: Platform restrictions on account transfers. The practical risk is low, but it is worth knowing some platforms technically prohibit transfers in their ToS.

Ad Accounts (Google Ads, Meta Ads, Amazon)

What to do: The cleanest approach is adding your own ad account to the campaign manager (not transferring the seller's account), then importing campaigns and historical data. Most platforms support this workflow. Verification: Confirm you can see campaign history, audiences, and pixel data. Account transfers often lose some historical signals — account for this in your first-30-day plan.

Email List (Klaviyo, Mailchimp, ActiveCampaign, ConvertKit)

What to do: Transfer the email platform account rather than just the list export. Transferring the account preserves open rates, engagement history, and automations. Verification: Send a test campaign to a segment of 10–20 subscribers and confirm delivery. Check that automations trigger correctly.

Code Repository (GitHub, GitLab)

What to do: Transfer the GitHub organization or repository to your account. For SaaS businesses, also transfer deployment pipelines (Vercel, Netlify, Railway, Render, etc.). Verification: Merge a small pull request or trigger a deployment from your account. Confirm CI/CD credentials and secrets have been rotated to eliminate seller access.

Subscriptions and API Keys

What to do: Generate a full list of third-party subscriptions: payment processors, CDN, monitoring tools, databases, AI APIs, affiliate program accounts. Rotate all API keys and transfer billing to your payment method. Verification: Go through bank and credit card statements from the past 90 days and cross-reference against the subscription list. Missing one recurring USD 200/month charge is an unpleasant surprise three months post-close.

Verifying Before You Release Escrow

The inspection period is your window. Use it — do not release funds the same day you receive access.

Here is a structured verification protocol:

Days 1–2: Confirm access to all critical assets (domain, hosting, GA4, GSC, ad accounts, email list). Flag any missing or partial access immediately to the seller and the escrow agent. Days 3–5: Validate traffic. Cross-reference GA4 data with ad spend reports and revenue data for the past 90 days. Look for anomalies — traffic spikes that do not match revenue, unusually low bounce rates, referral traffic from unrecognised sources. Days 6–7: Test the core revenue engine. Place a real transaction if it is an e-commerce or SaaS business. Confirm the payment processor integration, product fulfilment workflow, and key automations. Days 8+: Secondary verification — email subscribers (are they real?), backlinks (any toxic links built right before the sale?), pending legal issues (domain disputes, DMCA claims, outstanding refund requests).

If something material is wrong, this is the time to flag it. Once you release escrow, your leverage disappears.

Common Closing Mistakes

Releasing escrow before all accounts are transferred. The most common mistake. "The seller will add me to the remaining accounts after" becomes "the seller is unresponsive" very quickly once the money has moved. Accepting "view access" instead of ownership. You need admin control, not just a shared login. View-only analytics or a Shopify collaborator account are not the same as ownership. Not rotating credentials immediately. Once you have access, change all passwords, revoke all other admin users, and rotate API keys. Every day you delay is a window for inadvertent — or intentional — seller access. Skipping the 90-day revenue cross-check. Always reconcile revenue data in the platform (Shopify, Stripe, AdSense) against what was represented in the listing. Sellers occasionally cherry-pick a strong period for the teaser financials. Forgetting domain auto-renewal. A domain that expires three months after closing because the seller's credit card was on file is a painful way to lose a business you just paid for.

What to Do After a Smooth Close

Once escrow releases and all assets are in your hands:

• 1. Notify key partners — suppliers, affiliates, and contractors who worked with the seller. You are now the point of contact.
• 2. Set up monitoring — Google Analytics alerts, Search Console email notifications, uptime monitoring.
• 3. Audit all recurring costs — you should now have a complete picture of the business's true monthly cost base.
• 4. Document everything you inherited — passwords, processes, supplier contacts, content calendars.
• 5. Plan your first 90 days — resist the urge to change too much too fast. Understand the business before you optimise it.

The closing is the finish line for the deal. For the business, it is the starting line.

Ready to find your next acquisition? Browse deals on Flipagora — Flippy has built the widest aggregated view of online businesses for sale, from content sites to micro-SaaS, updated daily.