Decide whether you are buying an account or an app
Deals involving a live app come in two shapes. In the first, the whole developer account moves with every app under it. In the second, the account stays put and a single app is transferred into your own account. The first gives you the account entity and its full history; the second gives you one app with its users and ratings. The checks differ. A full account needs a review of status, identity details and all listed apps. A single-app transfer depends on whether Play Console's app transfer feature applies to that app, and its restrictions should be read from the current help documentation. Settle this before anything else, or the rest of the checklist will not line up.
Control means owner, two-step verification and recovery, all changed together
A username and password are only the surface. Real control sits in the Google account tied to the owner role, the device holding two-step verification, the recovery email and phone, and the users and permissions list inside Play Console. If the seller keeps any recovery path, or another member retains admin rights, the previous holder can get back in after handover. Three tests are enough: only you can complete two-step verification, every recovery method is yours, and the permissions list contains no one you do not recognize. If any of those fails, the handover is not finished.
Signing and package name decide whether you can ship updates
The package name of a published app cannot change, and updates must match the original signing identity. The deciding question is whether the app uses Play App Signing. If it does, Google holds the app signing key and you manage an upload key that can be reset through the platform process, so the risk is lower. If the app is older and still signed with a self-managed keystore, losing the keystore or its passwords means you cannot publish updates under the same identity, and users would have to move to a new package. Ask how the app is signed. For self-managed keys, require the keystore, alias and passwords, then run a test build right after handover. If the key cannot be produced, reprice or walk away.
Payments are tied to the entity, not to the app
If the app has in-app purchases, subscriptions or paid downloads, the payments profile, merchant details and tax information are bound to the account holder. Get clear answers to three things: where future subscription revenue will be paid, who owns earnings that have not yet settled, and whether changing the name, address or payout account triggers re-verification. All changes should go through the platform's normal process, with information that matches the real holder. If the seller's entity differs from yours and the app relies on subscription income, expect a gap around settlement periods rather than seamless continuity.
Linked services outside Play Console often break first
Many apps depend on things that do not live in Play Console. Check who owns the Firebase project, the AdMob account and app IDs, any Google Ads app campaign links, the service account used for the Play Developer API, OAuth clients for sign-in and push, and the dashboards for third-party SDKs. If any of these stays with the seller, ad revenue, login or notifications may stop working after handover. Ask for a dependency list that names the current owner of each item and how it will be transferred, and decide on replacements for anything that cannot be moved.
A before-and-after checklist, and when to pause
Before payment, request screenshots of account status, the app list, the signing method for each app, any open policy warnings or appeals, and any review in progress. After handover, change the owner and recovery details, clean up the permissions list, push a test update, confirm you can edit store listing data, privacy policy link and contact email, and check the payments profile status. Pause the deal if the account has unresolved violations or suspension history, if the seller cannot prove control over the account and linked services, if the signing is self-managed and the keystore is missing, or if you are asked to submit details that do not match the actual holder in order to pass verification. Policies and verification rules change, so rely on the platform's current pages.