do we have to fill in all onboarding questionnaires again after an acquisition
After a merger, the chain file must be updated again, the old answers are not carried forward automatically
Yes, in practice you have to fill in a large part again, but not because the questionnaire changes — because the company behind it changes. A merger or acquisition affects precisely the fields that customers request most often: the legal form, the registration number under which the enterprise is registered, sometimes the registered name and almost always the number of employees and revenue now that two entities have been combined. Each of those fields is a separate answer in the chain file. If the source changes, the answer must be confirmed again — not because we require it, but because the answer would otherwise correspond to a situation that no longer exists.
What does not necessarily change: certifications, insurance policies and policy documents that remain in the name of the acquired or surviving entity. An ISO 27001 certificate or a liability insurance policy continues as long as the legal entity that holds the certificate or policy remains in existence. Check each piece of evidence after the transaction to see whose name it is in — that determines whether the field in the file keeps the same answer or needs an update. In a legal merger where one entity disappears, certificates and policies of that disappeared entity often lapse and a new version in the name of the surviving party must be obtained.
Why this differs per field, not per questionnaire
This does not follow from a single rule, but from the nature of the chain file itself: each answer is linked to a fact about the company, and the Trade Register Act 2007 is leading for what is officially recorded about that company — name, legal form, registration number and place of business. After a merger, the registration with the Chamber of Commerce is updated, and that is the moment when the corresponding fields in the file must be reviewed. For figures such as the number of employees and annual revenue, a merger changes the underlying count, so those answers are by definition outdated as soon as the transaction is completed — regardless of which portal ever requested them.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.