A founder of a 15-person consultancy looks at the revenue breakdown and finds one client accounting for 42% of annual turnover. The relationship is six years old. The client renewed last year. The work is embedded in their systems. Nothing feels precarious today.
The question is not whether 42% is uncomfortable. It clearly is. The question is where the right ceiling sits, and what it actually depends on.
There is no single universally safe percentage. US GAAP requires disclosure when one customer accounts for 10% or more of revenue, a threshold buyers and lenders use as the point where concentration registers in diligence. Finance investors commonly treat 15% as a caution zone. Above 30%, valuations in comparable mid-market transactions can fall by 20 to 35%. None of those are rules for your firm. They are starting points.
What is the real decision here?
There is no universal answer to how much is too much, because the percentage alone does not determine the risk. What matters is how replaceable that client is, whether the relationship is contract-backed or discretionary, and whether its loss would breach your fixed-cost coverage. The decision is about setting a ceiling that fits your business model rather than copying a rule built for a different context.
Three reference points shape the conversation. At 10%, US GAAP requires disclosure, and buyers flag it in diligence. At 15%, finance investors commonly trigger deeper scrutiny, client interviews, and tighter lending terms. At 30%, research on mid-market transactions shows valuation discounts of 20 to 35% compared to well-diversified firms, and lenders may begin to exclude that revenue from borrowing base calculations.
A second variable is hidden sector concentration. A firm with five clients, each below 15%, can look diversified on a headline basis while actually having all five in the same sector. A shock to that sector, a regulatory change, an interest rate move, or a technology disruption, and those firms behave more like one large client than five independent ones. Acquirers and lenders increasingly look through individual names to map the sector exposure underneath.
The decision is therefore two questions at once: where does any single client start to matter financially, and do the clients sitting beneath that threshold carry correlated risk that the headline numbers do not show?
When can higher concentration be accepted?
Higher concentration is manageable when the relationship is structurally sticky. A specialist B2B firm with multi-year contracts, meaningful switching costs, and embedded delivery is in a different position from one relying on discretionary project work from the same source. Contract structure, termination penalties, and depth of the relationship all change what the percentage actually means in practice.
Three conditions support a higher tolerable ceiling.
The first is contract security. If the relationship is governed by a master services agreement with 12 months’ notice and real termination penalties, the risk of sudden departure is materially lower than with a rolling monthly arrangement that can be cancelled at will.
The second is embedded delivery. Where your services are integrated into the client’s systems and processes, switching to a competitor requires months of transition. That stickiness does not eliminate the risk, but it changes the shape of it significantly.
The third is breadth within the relationship. A client representing 25% of revenue but comprising five independently contracted business units, each with separate budget authority, is a different exposure from a single contract with a single decision-maker controlling the same percentage.
A 2021 peer-reviewed study in Frontiers in Public Health examining supplier firms and their major customers found that some level of anchor-client exposure can actually support operational stability and investment capacity. Higher headline concentration does not automatically mean higher risk when the relationship structure supports it.
When does concentration become a structural problem?
Concentration becomes a structural issue when the revenue underpinning it is fragile. Short-term contracts, discretionary spend relationships where the client can pause or redirect at will, and work that depends on a single decision-maker at the client all amplify what the percentage means. A 20% client with no contract is a more dangerous exposure than a 30% client locked into a five-year agreement with embedded delivery.
Beyond contract fragility, two circumstances push the appropriate threshold lower.
The first is exit or debt proximity. Research on mid-market transactions shows that concentration above 30% is associated with valuation discounts of 20 to 35% compared to diversified peers, and lenders may treat that revenue differently in borrowing base calculations. If you expect to seek bank finance or sell within three to five years, the right time to address a client above that mark is now, not the quarter before you go to market.
The second is sector correlation. The FCA and PRA’s Operational Resilience Policy Statement, formalised in 2021, requires firms to identify dependencies and concentrations, including client concentrations, as part of resilience planning. A revenue base spread across ten clients that all sit in the same sector faces correlated failure risk that the headline numbers obscure.
Carillion’s 2018 liquidation, as documented by the National Audit Office, is the reference case. The firm’s portfolio of large, complex public-sector contracts appeared spread across multiple relationships. When delays cascaded across several of those contracts simultaneously, the absence of uncorrelated revenue left no buffer.
What does it actually cost to get this wrong?
Getting the ceiling wrong has costs in three areas. On the operational side, losing a client at 25 to 30% of revenue can wipe out the profit covering your fixed costs overnight. On the financial side, research on mid-market transactions shows valuations can fall 20 to 35% when a single customer exceeds 30% of revenue. On the structural side, bank lending can tighten before you even begin negotiating terms.
The operational cost is the most immediate. A service business with largely fixed costs loses its margin coverage proportionally when a large client departs. Revenue contracts sharply; the cost base does not, at least not in the first quarter.
The financial cost is most visible if you plan to sell or raise debt. Buyers and lenders distinguish between managed concentration risk, one you can document through contract terms, multi-threaded relationships within the account, and evidence of pipeline diversification, and unrecognised concentration. Unrecognised concentration is what produces the valuation haircut. Documented and managed concentration can be priced differently.
The structural cost is the one that catches firms by surprise. The Prudential Regulation Authority requires banks to consider concentration risk in how they assess borrowers. A firm whose largest client represents 30% of receivables may find its borrowing base restricted even before the client relationship shows any sign of strain.
What do you need to ask before you set a ceiling?
Before you set a number, you need answers to a few structural questions about your own firm. The right ceiling for a managed IT provider with five-year contracts is different from the right ceiling for a project-based agency on rolling monthly retainers. Your growth stage, planned exit timeline, and debt position all shift where to draw the line before concentration costs you more than the client is worth.
What does the contract actually say? Multi-year with meaningful notice periods and termination clauses supports a higher ceiling. Rolling monthly with 30 days’ out argues for a tighter one.
If this client disappeared with 90 days’ notice, how many months of operating costs can you cover from the remaining revenue base? Run the number rather than the intuition.
Are you planning to seek bank debt or sell within three to five years? If yes, the valuation and lending implications of concentration above 30% are material now, not in three years’ time.
Do your clients share a sector? Map the underlying exposure before declaring the portfolio diversified.
Are there clients whose regulatory or compliance overhead is disproportionate to their revenue? For AI-enabled service firms delivering into regulated industries, compliance commitments for two large clients in recruitment, credit, or healthcare can outweigh their financial contribution.
Start with 10% as the trigger for tracking renewal risk on each client. Hold 15% as the internal limit if you are within three to five years of exit or looking at bank debt. If a client crosses 25 to 30%, document the mitigants before a diligence team asks. Book a conversation if you want to map your concentration picture and set the right ceilings for where your firm is heading.
