Customer concentration risk: how much is too much

Customer concentration risk is the risk that losing one customer, or a small handful of them, would materially damage a business's revenue, profit or cash flow. There is no single percentage that makes a business too concentrated to buy: a well-documented relationship with a long contract carries different risk from the same percentage sitting on a handshake with no notice period. The useful question is not "what percentage is this," but "how much profit and cash would disappear if this relationship ended tomorrow, and how much warning would we get."

What counts as concentration

Customer concentration is usually measured as revenue share first, because it is the easiest number to pull from the accounts. It is also the least informative one on its own. A customer who buys low-margin stock in bulk can account for a large share of revenue while contributing far less to profit. A customer who pays late, or on long terms, can be a smaller share of revenue but a disproportionate share of the cash tied up in the business at any one time.

A proper view of concentration looks at three figures for each major customer, not one: their share of revenue, their share of gross profit, and their share of outstanding receivables. Where those three figures disagree, the profit and cash figures usually matter more to a buyer than the revenue figure, because revenue is the number a seller's summary slide tends to lead with.

One grouping rule matters before any of those percentages are calculated. Two customers that are legally separate but commonly owned, or several customers that all sell into the same end market and would all be hit by the same downturn, behave as one source of risk even though they look like several accounts on a customer list. Counting them separately understates the real dependence.

The one benchmark that is actually official

Private deals have no regulator setting a pass or fail line, but public company accounting gives a genuine, citable benchmark worth knowing before you invent your own. Under US GAAP, FASB's segment reporting standard treats any single external customer that accounts for 10% or more of a public entity's revenues as a "major customer," triggering a disclosure of that fact and the total revenue involved, without naming the customer. Deloitte's own roadmap on the standard sets out the rule and its detail, including that customers under common control are combined and tested as one, and that a government counts as a single customer regardless of which agency is buying (Deloitte, Roadmap: Segment Reporting, 5.7 Information About Major Customers).

That 10% figure is a disclosure trigger, not a verdict that the business is too risky to own. But it is the closest thing to an official line in the sand, and it is a reasonable first checkpoint: once a single customer clears it, the dependence is worth a proper look rather than a passing mention.

The US Securities and Exchange Commission applies a parallel, less numeric idea at the level of the whole business description. Smaller reporting companies filing with the SEC are specifically asked to address "dependence on one or a few major customers" in the narrative description of their business, under Item 101(h)(4)(vi) of Regulation S-K (17 CFR § 229.101, via Cornell Law School's Legal Information Institute). The rule does not fix a percentage; it simply requires the company to say, in plain terms, whether this dependence exists and what it means.

In the UK, there is no equivalent numeric trigger, but the logic is the same. Every company required to produce a strategic report must describe the principal risks and uncertainties facing the business, under section 414C of the Companies Act 2006, in a way that is proportionate to the size and complexity of the company (legislation.gov.uk, Companies Act 2006, section 414C). A UK business that depends heavily on one customer, and judges that fact material, is expected to say so in exactly the same spirit as the US rules, just without a fixed threshold attached. Private companies below the small companies exemption do not have to file a strategic report at all, which is part of why a buyer cannot simply pull this disclosure from the public record for most small acquisitions and has to test it directly instead.

Why it moves price, not just risk

A buyer who finds real concentration does not usually walk away outright. More often, the finding changes the structure or the price: a lower multiple applied to the earnings, part of the price deferred or tied to retention of the key account, or a seller's note that keeps the previous owner financially exposed to the relationship for a period after completion. What a valuation multiple really means covers why the market applies a lower multiple to earnings it judges less durable, and concentrated revenue is one of the clearest reasons earnings get marked down that way.

Lenders ask the same question from the other side of the table. A bank or finance provider financing an acquisition has to decide whether the cash flow behind the loan would survive the loss of a major account, and heavy dependence on one customer is a standard point lenders press on during underwriting. How small business purchases are funded sets out where that scrutiny sits alongside the rest of the lending decision. A seller who already expects this question, and can show contract terms, tenure and a credible answer to "what happens if they leave," is in a stronger position than one who cannot.

A worked example

The figures below are an illustration built for this article, for a business reporting £1,000,000 of annual revenue, not a description of any real company.

On revenue alone, Customer A looks like the headline risk at 38%. Once gross profit is added, the gap to the next customer widens further, because Customer A carries a higher margin than the rest of the book. Customer B looks smaller on paper but is the weaker relationship: no written contract and a shorter history, against a customer that already clears the 10% level accountants use as their own checkpoint. A buyer working through this table would price in the loss of Customer A as the central scenario to stress-test, and treat the lack of a contract with Customer B as a separate finding to raise before agreeing a price, regardless of its smaller share.

How to test it before you commit

• Ask for revenue by customer for at least the last three years, not just the most recent one, so a sudden rise in one account's share is visible rather than hidden in a single year's snapshot.
• Ask for gross profit by customer where the seller's bookkeeping allows it. If it does not, that itself is worth noting, since it means nobody has been tracking which relationships actually make money.
• Check contract terms, notice periods and renewal history for every customer above the FASB-style 10% checkpoint. A long relationship with no contract is still exposure; the past is not the same as a commitment to the future.
• Group related entities and common end markets together before calculating any percentage, rather than treating affiliated or similarly exposed customers as separate accounts.
• Ask what the owner, specifically, contributes to the key relationships that a new owner would not inherit automatically. Our due diligence checklist for a first acquisition covers how to separate a business's relationships from the owner's personal ones more generally.

What to do next

Build the customer table yourself from the underlying ledger rather than accepting a seller's summary of it, and calculate revenue, gross profit and receivables share for every customer above roughly a tenth of the business, using the accounting profession's own disclosure trigger as your checkpoint rather than a number you picked yourself. Where real concentration exists, decide before you negotiate whether you want a lower price, a retention clause tied to the key account, or a structure such as a seller's note that keeps the previous owner's interests aligned with keeping that customer for a period after completion. If you are unsure how a particular pattern of concentration would be read by other buyers or lenders, it is worth putting the table in front of people who have tested one before; that kind of second opinion is a large part of what the Republic of Investors community is for.

Common questions

Is there a legal limit on how concentrated a business's customer base can be before a sale? No. There is no law preventing the sale of a concentrated business. The 10% figure used in US accounting and securities disclosure is a trigger for telling investors something exists, not a ceiling on what can be sold or bought.

Should I look at revenue concentration or profit concentration? Both, and treat them as separate questions. A customer can be a large share of revenue and a small share of profit, or the other way round, and either pattern changes what losing them would actually cost.

Do several customers owned by the same parent company count as one customer for this purpose? Under the US accounting standard, yes: entities under common control are combined and tested against the 10% threshold as a single customer. It is sensible to apply the same grouping logic in a private deal even where no accounting rule requires it.

Does customer concentration always reduce the price a buyer will pay? Not always, but it is one of the more common reasons a buyer applies a lower multiple or asks for a different deal structure. A long, contracted relationship with a stable customer is a different risk from an informal one with no notice period, even at the same revenue share.

Can a seller reduce customer concentration before going to market? Some sellers try, by signing longer contracts with key accounts or actively growing other customers before a sale. It takes time and does not always succeed, and a buyer should still verify the underlying numbers rather than taking an improvement story at face value.