Customer concentration risk is the chance that losing one or a few customers would materially damage a business's revenue and cash flow. It's measured as each customer's share of total revenue, or more precisely with the Herfindahl-Hirschman Index. Most buyers treat 20% or more from a single customer, or 50% or more from the top five, as a signal to dig deeper before writing an offer.
Every acquisition CIM presents customer concentration as a footnote. It deserves to be a section header. A business with $2M in EBITDA and one customer worth 35% of revenue isn't a $2M-EBITDA business with an asterisk; it's a bet on a single relationship that belongs to someone else, at least until you close. This guide covers how to measure concentration precisely, what real institutions actually use as thresholds (not the flat, unsourced percentages that circulate on M&A blogs), how it moves your price and your financing, and the deal-structure levers that let you buy the business anyway, on terms that price the risk correctly.
Key Takeaways
- Concentration is measured as each customer's percentage of total revenue; a top-5 concentration ratio and the Herfindahl-Hirschman Index (HHI) both sharpen the picture beyond a single number.
- Allianz Trade, a real institutional credit insurer, sets its "high concentration" threshold at 20% from a single customer, a genuinely sourced benchmark, not a recycled rule of thumb.
- The SBA's own SOP does not publish a numeric concentration cutoff. What gets called an "SBA rule" is usually individual lender credit policy, often turning cautious above roughly 20% and difficult above roughly 40%.
- A quality-of-earnings review can reveal concentration far worse than the CIM discloses; one documented case saw a top customer's share jump from 20% to over 60% once inter-company revenue was excluded.
- The right response to real concentration usually isn't walking away. It's an earnout, an escrow holdback, or a seller note sized to the actual risk.
How to Calculate Customer Concentration: The Revenue % Formula
The base formula is simple: divide one customer's annual revenue by the business's total annual revenue. A customer generating $400,000 out of $2,000,000 in total revenue represents 20% of revenue, full stop.
Pull this from at least two to three years of financials, not a single trailing-twelve-month snapshot; a customer that's ramping or declining looks very different depending on the window you use. Rank every customer from largest to smallest, and calculate the percentage for each of the top 10, not just the largest one. A business can pass a "no customer over 20%" screen while still having its top 5 customers represent 70% of revenue collectively, which is its own distinct risk.
Beyond the Top Customer: Concentration Ratios and Why One Percentage Isn't Enough
A single-customer percentage tells you about your single biggest point of failure. A top-5 or top-10 concentration ratio, the sum of your largest customers' percentages, tells you how broad or narrow the whole revenue base actually is.
A business with no customer above 15% can still be dangerously concentrated if its top 5 customers combine for 65% of revenue. Calculate both figures. As a starting reference point pulled from real accounting-advisory practice: top-5 concentration under roughly 25% reads as low risk, the 25 to 50% range warrants a closer look, and above 50% is a genuine red flag worth pricing into the deal.
The Herfindahl-Hirschman Index: A Sharper Way to Score Concentration
The Herfindahl-Hirschman Index is a standard antitrust tool, used by the DOJ and FTC to score how concentrated a market is. A small but growing number of M&A practitioners adapt the same math to score how concentrated a customer base is, because it captures shape, not just the size of the largest customer.
The formula: square each customer's revenue share (as a whole number, not a decimal), then sum the squares. A business with 10 equal customers at 10% each scores 1,000. A business with one customer at 50% and nine equal customers splitting the rest scores roughly 2,850, even though "50%" and "one customer over the 20% line" might look similarly alarming at first glance; the HHI number makes clear the second business is meaningfully more exposed.
The DOJ's standard antitrust bands (below 1,500 unconcentrated, 1,500 to 2,500 moderately concentrated, above 2,500 highly concentrated) weren't built for a business with 5 to 10 customers; applied unmodified, a small company's HHI will read "highly concentrated" almost by construction, since a handful of customers can't be evenly spread thin the way an antitrust market is. Use HHI to compare two acquisition targets against each other, or to compare a target against its own prior years, rather than treating the antitrust bands as a pass/fail test.
Risk Thresholds: What Real Institutions Actually Use
Most content on this topic states a threshold as flat fact with no source. Here's what's actually attributable, organized by who's behind each number.
| Threshold | Source | What it actually measures |
|---|---|---|
| Single customer ≥ 10% | GAAP disclosure rule | Public companies must disclose any customer at 10%+ of revenue; a legitimate, sourced bar, though a disclosure trigger, not a risk verdict |
| Single customer ≥ 20% | Allianz Trade (formerly Euler Hermes) | Trade-credit insurance benchmark for "high concentration"; built for B2B credit risk, not acquisition financing specifically |
| Single customer > 40% | SBA-lender practitioner commentary | Informal point where many individual SBA lenders get uncomfortable approving a loan; not official SBA SOP text |
| Top 5 customers under 25% | Services-business rule of thumb | Widely repeated among M&A advisors as a "healthy" benchmark; directional, not tied to one primary source |
| Top 5 customers > 50% | Midwest CPA advisory practice | Real accounting/QoE advisory firm's published red-flag tier from deal experience |
None of these is an official, universal rule, including the ones attributed to a real institution; each measures something slightly different (credit risk, disclosure obligations, lending comfort, advisory experience). Use the table as a range of informed opinion, and weight the lender-practice figures more heavily if you're financing with SBA debt, since that's the party whose comfort level actually gates your close.
How Customer Concentration Moves Your EBITDA Multiple and Purchase Price
Concentrated revenue is worth less than diversified revenue at the same dollar amount, because a buyer is pricing not just current cash flow but the odds that cash flow survives the ownership transition. The exact multiple discount isn't a fixed, universal number, and you should be skeptical of any source that states one (several ranking articles on this topic quote different specific multiples on the same website, which is itself a sign the numbers aren't empirical). What is consistently true directionally: buyers negotiate the price down, restructure more of it into an earnout, or both, in proportion to how much revenue sits with the exposed customer and how replaceable that relationship actually is.
A useful real-world anchor: on a business with $5M in EBITDA where one customer represents 30% of revenue, buyers have negotiated purchase-price reductions in the range of several million dollars off the unadjusted valuation, not a token discount. Scale that logic down to a $500K-EBITDA main street business and the dollar amounts shrink, but the negotiating dynamic is identical: the seller wants credit for the revenue, the buyer wants a discount, insurance, or both for the risk that revenue disappears.
SBA 7(a) Lending and Customer Concentration: Lender Practice vs. Official Policy
If you're skeptical, treat "the SBA requires under 20% concentration" as a myth. The SBA's own SOP does not publish a specific numeric customer-concentration cutoff. What actually happens is that individual SBA lenders apply their own credit-underwriting judgment, primarily by stress-testing debt-service coverage ratio (DSCR) against a scenario where the concentrated customer leaves, and decline or restructure loans that fail that stress test at the lender's own risk tolerance.
In practice, that lender-level caution tends to firm up somewhere around 20% for a single customer, with deals above roughly 40% facing real difficulty getting approved, but neither number is an SBA-mandated bright line. If you're financing with an SBA loan, ask your lender directly, early, how they underwrite concentration and whether they'll require a stress test, a bigger equity injection, or a specific mitigant (like a signed customer contract extension) before they'll approve the deal. Waiting until underwriting to find out is a common way a concentrated deal dies late in the process.
The Quality-of-Earnings Trap: How Inter-Company Revenue Hides Real Concentration
A CIM's stated concentration figure is the seller's number, calculated the seller's way, and it can understate the real exposure. The accounting advisory firm Midwest CPA has published a deal from its own practice where a seller's disclosed concentration of roughly 20% for the top customer turned into more than 60% once the QoE team excluded inter-company revenue that had inflated the total revenue base used in the original calculation.
The lesson isn't that sellers are lying; it's that a percentage is only as good as its denominator. If related-party revenue, one-time contracts, or revenue from an entity under common ownership is included in the total, the concentration percentage is diluted and looks better than reality. Before you trust a CIM's concentration figure, ask what's included in the revenue base it's calculated against, and have your own QoE provider recalculate it independently rather than accepting the seller-prepared number. This is one piece of a broader revenue-quality review; see our guide to analyzing SMB revenue during due diligence for the full verification process.
Red Flag or Manageable Risk? When High Concentration Is Actually Fine
A high percentage isn't automatically dangerous; a low percentage isn't automatically safe. What actually matters is how hard that revenue would be to lose.
Concentration is lower-risk than the raw number suggests when the customer is on a long-term, auto-renewing contract with real switching costs, when the counterparty is a government agency or an investment-grade company unlikely to disappear, or when the relationship predates the current owner by many years and has survived past disruptions. Concentration is higher-risk than the raw number suggests when the relationship is personal to the seller, running on a handshake with no written contract, when the customer has publicly signaled plans to insource or dual-source, or when pricing on that account is unusually favorable in a way a new owner would be pressured to renegotiate.
Read the actual contract before you price the risk. A 25% customer with three years left on an auto-renewing agreement and a real termination penalty is a fundamentally different underwriting question than a 15% customer with no contract at all who deals directly with the departing owner. For the full methodology on pulling and reviewing those contracts, see our customer contract due diligence checklist.
Negotiation Levers: Structuring the Deal Around the Risk You Found
Once you've quantified the concentration and read the underlying contracts, you have several structural tools to price the risk into the deal rather than walking away from an otherwise good business.
| Lever | Typical sizing | What it protects against |
|---|---|---|
| Escrow holdback | 5-15% of purchase price generally; concentration-specific holdbacks often run 10-20%+ | A near-term revenue drop shortly after close, funded from money already set aside |
| Earnout | Structured as a percentage of price tied to revenue or EBITDA targets over 1-3 years | Shifts the risk of customer loss onto the seller, since they only get paid if retention holds |
| Seller note | Varies by deal, commonly 10-30% of price | Keeps the seller financially invested in the business's post-close performance |
| Rep & warranty coverage | Cost scales with deal size and risk profile | Legal recourse if concentration or customer relationships were misrepresented in the deal documents |
| Tiered/contingent pricing | Custom to the deal | Directly ties part of the price to whether the at-risk customer actually renews post-close |
An escrow holdback is the simplest lever and the one most sellers will accept without much friction. An earnout does more work if the real risk is retention over a longer horizon, but it only works if you can measure the outcome cleanly and the seller trusts you to run the business fairly during the earnout period. For a deal where one relationship represents outsized risk, combining a smaller upfront discount with a meaningful escrow tied specifically to that customer's retention is usually the least contentious structure to negotiate.
A Pre-LOI Stress Test: Modeling the Loss of Your Top Customer
Before you sign an LOI on a concentrated business, run the numbers on the scenario you're actually worried about: what happens to debt service if the top customer leaves in year one.
Take the business's EBITDA, subtract the EBITDA contribution from the at-risk customer (revenue times the business's gross margin, roughly), and recalculate your debt-service coverage ratio against your planned loan payment using that reduced number. If your DSCR falls meaningfully below 1.15 to 1.25, the range most SBA lenders want as a cushion, in that downside scenario, you're underwriting a real risk that your financing may not survive, independent of whether the business is otherwise healthy. This is the same math your SBA lender will eventually run; doing it yourself before you're deep into exclusivity means you find out early enough to walk, renegotiate, or restructure, rather than discovering it during underwriting.
Customer concentration risk isn't a reason to pass on an otherwise good business, and it isn't something to wave away because the CIM calls it "manageable." Measure it precisely, know which threshold you're actually applying and who's behind it, read the underlying contracts before you price the risk, and use deal structure, not just the offer price, to shift the risk to the party better positioned to bear it. That's usually enough to close a good deal that a less careful buyer would either overpay for or walk away from entirely.
Frequently asked questions
What percentage of revenue from one customer is considered a red flag?
There's no single official threshold, but the most commonly cited institutional benchmark is Allianz Trade's: a single customer at 20% or more of revenue counts as high concentration. Practitioner sources put the danger zone higher, around 40%, for outright underwriting risk. Treat 20% as the point where you start digging deeper, not the point where you walk away.
How do you calculate customer concentration risk?
Divide each customer's annual revenue by total company revenue to get a percentage, then rank customers from largest to smallest. Sum the top 5 percentages for your top-5 concentration ratio. For a more precise single score, calculate the Herfindahl-Hirschman Index: square each customer's revenue share, then sum the squares.
Is 20% customer concentration too high for an acquisition?
It's worth investigating, not automatically disqualifying. Allianz Trade treats 20% from one customer as the threshold for high concentration in trade-credit risk. Whether it's actually dangerous depends on the contract: a 20% customer on a five-year auto-renewing government contract is a very different risk than a 20% customer who could walk with 30 days' notice.
How does customer concentration affect business valuation?
Buyers typically apply a lower EBITDA multiple, discount the purchase price, or restructure the deal to shift risk to the seller through an earnout or larger escrow holdback. There's no single verified multiple-point discount that applies universally. The size of the adjustment scales with how much revenue is at stake and how replaceable that customer relationship actually is.
Can you get an SBA loan for a business with customer concentration risk?
Yes, but individual lenders apply their own credit-policy scrutiny; the SBA's own SOP does not publish a specific numeric concentration threshold. In practice, many SBA lenders get cautious above roughly 20% from one customer and can decline deals above roughly 40%, based on how it affects the debt-service coverage math if that customer leaves, not a fixed SBA rule.