Concentration Risk

Concentration risk is the risk of a large loss because too much of a firm's business depends on a single borrower, counterparty, sector, country, funding source, customer or supplier. If that one exposure fails, the damage is out of proportion to what a spread-out portfolio would suffer. Banks, insurers, investment funds and payment companies all measure and limit it.

The idea began in lending, where it is part of credit risk, but it now covers funding, operations and revenue as well. It is the opposite side of diversification. Bank supervisors set hard limits on single-name exposures through the Basel large exposures standard, and the same arithmetic used to measure market concentration in competition law, the Herfindahl–Hirschman Index, is often used inside firms to measure their own concentration.

Imagine a small bakery that sells almost all of its bread to one hotel. Business is good, until the hotel closes for renovation or finds a cheaper supplier. Overnight the bakery loses most of its income, even though nothing is wrong with its bread. A rival bakery that sells to twenty cafés would barely notice one customer leaving.

The same applies to a bank that lends heavily to one developer, a fund that holds mostly one stock, or a money transfer company that sends all its payouts through one partner. Concentration often builds up quietly because the big relationship is profitable and easy. The risk only becomes visible when that one relationship goes wrong, and by then there is little time to adjust.

• Single-name. Large exposure to one borrower or counterparty, or to a group of connected companies.
• Sector and geography. Many loans to one industry, such as commercial property, or one region, which can fail together in a downturn; this links to sovereign risk when the exposure is to one country.
• Funding. Reliance on a few large depositors or one type of funding. Silicon Valley Bank, which failed in March 2023, had a deposit base dominated by technology and venture-capital clients, most of it above the deposit insurance limit, and those depositors withdrew together.
• Operational and supplier. Dependence on one processor, cloud provider or sponsor bank, which overlaps with third-party risk.
• Revenue and customer. A payment company earning most of its volume from a handful of merchants, or a money transmitter relying on one payment corridor or one payout partner.

A common measure is the Herfindahl–Hirschman Index (HHI), the sum of the squared shares of each exposure:

• $s_i$ is the share of exposure $i$ in the total, written in percentage points (so 40% is 40).
• $n$ is the number of exposures, such as borrowers, merchants or partners.
• The result runs from close to 0 (many tiny exposures) to 10,000 (one exposure holding 100%).

Worked example: a remittance firm pays out through four partners with shares of 50%, 30%, 10% and 10%. Its HHI is $50^2 + 30^2 + 10^2 + 10^2 = 2{,}500 + 900 + 100 + 100 = 3{,}600$. If it rebalanced to four equal partners at 25% each, the HHI would fall to $4 \times 625 = 2{,}500$. Squaring gives extra weight to the largest shares, which is why the index reacts strongly to one dominant exposure. For comparison, the 2023 US Merger Guidelines, used in antitrust review, describe a market with an HHI above 1,800 as highly concentrated.

The Basel Committee's large exposures framework, in force since 1 January 2019, applies to internationally active banks:

• A large exposure is one equal to or above 10% of the bank's Tier 1 capital, and must be reported.
• Total exposure to a single counterparty or group of connected counterparties must not exceed 25% of Tier 1 capital.
• A global systemically important bank may not have more than 15% of its Tier 1 capital exposed to another such bank.

National rules implement this in their own way, alongside other regulatory capital requirements under Basel III. Sector concentration has no single numeric cap, but supervisors expect banks to set internal exposure limits and to hold extra capital where their portfolios are lumpy. For investment funds, diversification rules play the same role, such as the limits on holdings of a single issuer in European UCITS funds.

Firms usually combine limits, monitoring and deliberate spreading:

• Setting limits by name, sector, country and product, approved by the board as part of risk management.
• Aggregating exposures to connected parties, since separate subsidiaries of one group can fail together.
• Stress testing scenarios in which the largest exposures default or leave, and reviewing the effect on capital and liquidity.
• Reducing exposure through loan sales, syndication, collateral, hedging or instruments such as a credit default swap.
• For payment and fintech firms, keeping a second processor, banking partner or payout route ready, often through payment orchestration.

Concentration is not always avoidable or bad. A small community lender naturally serves one region, and a specialist firm earns its margin by knowing one sector well. Measures such as the HHI ignore correlation: twenty borrowers in the same industry can behave like one. Data can also be misleading when exposures are linked through ownership, guarantees or a shared supplier that is not visible on the balance sheet. For these reasons supervisors treat concentration as a matter of judgment as well as arithmetic, and connect it to systemic risk when many firms crowd into the same exposures.

• Bank for International Settlements: The treatment of large exposures in the Basel capital standards