Concentration Risk

Overview

Concentration risk occurs when too much value, activity, or dependency is placed in a limited number of sources. It can involve customers, banks, custodians, stablecoins, cloud providers, validators, geographic regions, liquidity venues, technologies, or correlated counterparties.

Individual exposures may appear acceptable while their combined dependency creates systemic vulnerability. Several named providers can still represent one concentration if they share infrastructure, ownership, collateral, jurisdiction, or a common failure mode.

Organizations should aggregate exposures across legal entities and hidden dependencies, define limits, stress-test common failures, diversify where practical, and maintain credible alternatives. Diversification by count alone is insufficient when alternatives cannot absorb volume during a disruption. Exit feasibility also matters under stressed market conditions.

Concentration Risk is used to find exposure hidden by aggregate diversification; for example, many nominal counterparties may still depend on one custodian, cloud region, stablecoin issuer, or banking partner.

Concentration risk is the possibility of disproportionate loss because exposure depends heavily on one asset, counterparty, provider, location, or control point. Concentration risk depends on shared failure modes, so meaningful diversification requires independent capacity rather than simply more provider names.

For Concentration Risk, the assessment should evaluate the use of exposure depends heavily on one asset, counterparty, provider, location, or control point. The assessment record should separate observed evidence supporting the use of exposure depends heavily on one asset, counterparty, provider, location, or control point from assumptions, state the time horizon and existing controls, and identify who owns any remaining exposure. Monitoring should test whether the conditions described in the use of exposure depends heavily on one asset, counterparty, provider, location, or control point have changed enough to require a new rating, treatment, or approval.