Deposit Concentration KRIs: Measuring Customer, Sector, and Platform Dependency

By December 31, 2022, 94% of Silicon Valley Bank’s deposits were uninsured. More than half came from technology companies whose venture capital funding cycles were tightly correlated. When the run began on March 9, 2023, $42 billion left the bank in hours — with another $100 billion staged to follow.

The Federal Reserve’s post-mortem on SVB confirmed what liquidity risk practitioners had long known: the concentration wasn’t a surprise buried in data. It was a known attribute of SVB’s business model that nobody had translated into actionable, threshold-bound KRIs with pre-specified escalation responses.

That’s the deposit concentration KRI problem in a case study. The data existed. The risk was visible. The metrics didn’t capture the shape of it — and when pressure arrived, the escalation design wasn’t fast enough to matter.

TL;DR

• Deposit concentration KRIs measure how dependent your funding base is on a narrow group of customers, industries, or channels — not just total funding volume.
• SVB’s failure was a concentration failure: 94% uninsured, 50%+ tech-sector, highly correlated depositors. The concentration data existed; the KRI thresholds and escalation protocols didn’t.
• Three distinct concentration types require separate KRIs: customer-level, sector/industry-level, and platform/channel-level.
• Brokered and fintech-platform deposits create functional concentration even when underlying accounts appear individually diversified.
• Thresholds must be calibrated to your deposit composition — not copied from benchmarks. A 20% sector limit appropriate for a diversified community bank is meaningless for a niche lender with correlated depositors.

Why Aggregate Metrics Miss the Risk

Most liquidity dashboards track total deposit volume, deposit growth rates, and wholesale-versus-retail funding splits. These are necessary. They’re not sufficient.

The problem with aggregate metrics is that they hide distribution. A bank with $10 billion in deposits and 2% month-over-month growth looks fine in aggregate. The same bank with 40% of its deposits concentrated in three corporate customers from the same industry — all uninsured — has a fundamentally different risk profile that aggregate reporting won’t reveal until the run starts.

Concentration risk is distribution risk. The KRI framework needs to answer two questions:

1. How dependent are we on any single customer, sector, or channel?
2. If that segment experiences stress, how fast could our funding leave?

Speed is what made SVB’s concentration catastrophic. Technology companies with VC funding cycles, monitored by VC firms communicating in real time, could coordinate withdrawal behavior faster than any retail depositor network. Mobile banking removed the friction that once gave institutions a response window. The FDIC’s post-SVB lessons review documented that same-day and next-day payment rails have meaningfully accelerated how quickly concentrated deposit bases can move compared to earlier decades.

Sector correlation is a speed multiplier, not just a concentration amplifier. Design your KRIs accordingly.

Three Concentration Types That Require Separate KRIs

1. Customer-Level Concentration

Top-depositor concentration is the most direct measure. The percentage of total deposits represented by your ten largest, twenty-five largest, or fifty largest depositors tells you how much of your funding base depends on a handful of relationships — and how much runway you’d lose if any of them withdrew.

Calibrate these thresholds to your institution’s historical data and depositor composition — not to industry benchmarks. A community bank with stable municipal depositors that has historically run a 22% top-10 concentration may have appropriate monitoring in place for that level. A fintech-adjacent bank whose top depositors are institutional and highly rate-sensitive needs a tighter amber threshold and faster escalation.

What most programs miss: behavioral signals at the individual depositor level. Knowing that your largest depositor represents 8% of total deposits is useful. Knowing that their account balance has declined 30% over the past 60 days — visible through your own transaction data — is actionable. Deposit concentration KRIs should include balance trend monitoring for top depositors as a leading indicator, not just a static concentration percentage.

2. Sector and Industry Concentration

Sector concentration matters because it creates correlation. The risk isn’t just that one segment is large — it’s that stress hitting that segment hits multiple depositors simultaneously, and those depositors may respond in coordinated ways. SVB’s tech concentration didn’t mean one sector was exposed; it meant that a single macroeconomic event (rising rates compressing VC funding) could trigger correlated withdrawal across more than half the deposit base.

The uninsured deposit KRI deserves special attention. Uninsured depositors behave differently than insured depositors under stress — they have a direct financial incentive to move first. SVB’s 94% uninsured deposit ratio wasn’t the only reason for the speed of the run, but it was a structural factor that made coordinated withdrawal behavior both rational and swift.

An institution whose uninsured deposit share crosses the amber threshold should immediately review whether its CFP run-off assumptions reflect the behavioral characteristics of its specific depositor base — not industry-average assumptions built for a different composition.

3. Platform and Channel Concentration

This is the fastest-growing concentration type and the most poorly measured by traditional institutions.

Fintech-platform and brokered deposits look diversified on the surface. A bank-as-a-service partnership might bring in 80,000 individual consumer accounts — each small, each appearing diversified across thousands of customers. But if those accounts exist because of a single fintech partner relationship, and that partner exits or encounters financial stress, the accounts don’t stay. The functional concentration is at the partner level, not the individual account level.

The same logic applies to deposit sweep networks and digital broker platforms, where individual consumer deposits are delivered — and can be recalled — through a small number of intermediary relationships.

For institutions with BaaS partnerships, the concentration KRI needs a second dimension: the financial and operational health of the partner itself. If a fintech partner’s business is deteriorating — declining transaction volumes, rising complaint rates, regulatory scrutiny, reduced capital runway — that’s a leading indicator for the platform deposit relationship long before the partner actually withdraws.

This monitoring belongs in your vendor risk management program, connected explicitly to the deposit concentration KRI so the data informs the risk dashboard — not sitting in a separate TPRM review cycle that never reaches the ALCO.

When Concentration KRIs Should Trigger CFP Assumption Review

Most contingency funding plans have run-off assumptions baked in — the percentage of deposits expected to leave over various stress horizons. The problem is that these assumptions are typically calibrated to historical averages, not to the current concentration profile.

If your deposit composition has materially shifted, you should be triggering a CFP assumption review — not waiting for the next annual cycle.

Triggers for mandatory CFP assumption review:

• Sector concentration crosses amber threshold. If tech deposits grow from 18% to 26% of total, the run-off assumption for that segment needs to be stress-tested against the new exposure level.
• New fintech partner onboarded representing >5% of deposits at maturity. Any BaaS partnership of that size should trigger a deposit run-off scenario for that specific channel before the partnership goes live.
• Uninsured deposit share increases by 5+ percentage points. A shift from 38% to 44% uninsured is a structural change, not noise. Run-off assumptions calibrated for 38% are wrong for 44%.
• New product launch targeting a specific sector. A new cash management product targeting a single industry creates sector concentration that didn’t exist before launch. The CFP should be updated before the product goes live, not after it’s fully funded.

See Contingency Funding Plan Triggers: How to Set Liquidity Thresholds You Can Defend to Regulators for detailed methodology on calibrating CFP activation thresholds to your institution’s specific concentration profile.

Connecting Concentration KRIs to Early Warning Indicators

Concentration KRIs tell you where the exposure sits. Early warning indicators tell you whether that exposure is becoming active — whether depositors in a concentrated segment are showing behavioral signals of withdrawal.

The handoff between the two is what most programs get wrong. A sector concentration KRI sitting at amber while early warning indicators in that sector are already moving — declining account balances, increased wire activity, reducing average deposit balances across the segment — means the KRI is telling you about structure while the EWIs are telling you about an event in progress. Both matter. They need to be connected.

The CFP activation framework should explicitly bridge concentration KRI levels to operational EWI thresholds — so that when a concentration is amber and an EWI in that segment fires, the escalation response is automatic, not a management judgment call about whether the metric “really” means something.

For a complete treatment of how EWIs and KRIs should be designed together and connected to CFP activation tiers, see Early Warning Indicators vs KRIs: How Liquidity Teams Should Use Both.

The SVB Lesson: What the KRI Program Should Have Caught Earlier

The Federal Reserve’s material loss review of SVB is specific about where internal risk management failed. SVB management knew about the concentration. Examiners were raising concerns as early as 2019. The problem wasn’t information — it was that the concentration wasn’t translated into actionable KRIs with pre-specified, mandatory escalation responses.

Internal stress tests were running and showing liquidity pressure by mid-2022. The documented management response — increasing funding capacity — was directionally correct but “not rapidly undertaken or fully executed” (Fed review, p. 53). That’s a description of a governance design failure: stress indicators triggered management attention, but not pre-specified, time-bound, mandatory escalation that didn’t depend on management judgment under pressure.

The implication for KRI design: thresholds need pre-specified responses that are operationally mandatory, not advisory. “Management will review” is not a control. “Treasury notifies ALCO chair within 24 hours; ALCO convenes within 3 business days; CFP tier reviewed” is a control.

See Lessons from SVB & Signature Bank: What Their Liquidity Failures Mean for Your CFP for a detailed walkthrough of how the CFP design gaps contributed to the failure.

So What Does This Mean for Your Program?

Deposit concentration KRIs fail in predictable ways, and they’re usually fixable once the failure mode is visible:

The calibration is stale. The top-10 threshold was set two years ago when the deposit mix was different. Three new fintech partnerships and a commercial product launch later, the threshold still says amber at 20% — a number that no longer reflects the risk.

The cadence is wrong. Concentration data reaches ALCO monthly. But if tech-sector deposits are moving daily — driven by macroeconomic news and peer communication — a monthly report shows the outcome of a stress event, not the onset.

The CFP is disconnected. The concentration KRI exists on the risk dashboard. The CFP run-off assumptions exist in a separate document. Nobody has verified that the assumptions reflect the current concentration levels. They almost certainly don’t.

The fix isn’t adding more metrics. It’s calibrating the ones you have to your actual deposit composition, connecting them to your CFP assumptions with explicit triggers, and building escalation protocols that specify who acts, within what timeframe, with what required response — before the first threshold fires.

If your program needs pre-built deposit concentration and liquidity KRIs with green/amber/red thresholds, data source mapping, owner fields, and escalation triggers ready to deploy, the KRI Library (132 Key Risk Indicators) includes the financial risk domain — covering deposit concentration, runoff rates, wholesale funding dependency, and more. Get the KRI Library →