Startup Bank Concentration Risk: Build a Cash-Access Contingency Plan

Startup bank concentration risk is the operational exposure created when one banking institution holds most of your cash, your payment rails, and the authorization paths you need to keep operating.

The decision: can you make payroll and pay critical vendors if your primary bank is disrupted for several days? Most founders can answer how much cash they have. Few can answer how they would reach it.

This guide treats the problem as cash access, not cash yield. It shows you how to measure uninsured exposure per bank, map the dependencies that break first, and rehearse a transfer before you need one.

Key takeaways

• Concentration risk is two problems: how much cash sits above deposit insurance, and how many operations depend on one institution.
• Deposit insurance reduces loss exposure; it does not guarantee uninterrupted access to your payment systems.
• Set a tolerance threshold from your own payroll and critical vendor obligations. No verified universal benchmark exists.
• A plan that has never been rehearsed is a document, not a contingency.

What bank concentration risk means for a startup

Banking regulators use "concentration" for a bank's exposure to a narrow set of assets or depositors. For a startup, the mirror image matters more: your exposure to a single bank.

The cash balance is only the visible half. The hidden half is operational dependency: the payroll provider that pulls funds from one account, the wire and ACH approvals that run through one portal, the corporate cards tied to one account, and the vendor payment instructions saved at one bank.

Use your cash-access map alongside the cash forecast: a balance only funds payroll if the payment path works when you need it.

Why this is real: the SVB failure week

The clearest recent case is Silicon Valley Bank. Two primary sources describe how a concentrated deposit base turned into a run within days.

The Federal Reserve's SVB review says SVB had a highly concentrated business model and a reliance on uninsured deposits. It also says the bank failed its own internal liquidity stress tests, yet was rated satisfactory for management and strong for liquidity from 2017 through 2021.

Reliance on uninsured deposits was one of several vulnerabilities. GAO's analysis puts the figures side by side:

These historical ranges describe banks’ funding, not a recommended startup cash allocation. GAO reported the comparison in April 2023. Use it to understand why uninsured funding can amplify a run.

Bank concentration vs customer concentration

These are different single points of failure. Do not let one conversation absorb the other.

• Bank concentration threatens your access to cash you already have.
• Customer concentration threatens the revenue line that refills the account.

The first is solved with account structure, authorization design, and a drill. The second is solved with pricing, pipeline, and contract strategy. Both belong in your runway model, but they carry different trigger events and different owners.

How to calculate your uninsured exposure per bank

The calculation is simple. The discipline is doing it per institution, every quarter.

The FDIC’s business-account rules generally insure eligible corporate deposits up to $250,000 at each insured bank. Accounts owned by the same corporation at that bank are combined; opening separate payroll and operating accounts there does not multiply coverage. Apply the limit to the legal depositor and insured institution, not to each account:

1. List every bank and account holding company cash, including operating, payroll, and reserve accounts.
2. Aggregate the eligible deposits owned by the same legal entity at each insured institution.
3. For a standard eligible corporate-deposit account, subtract $250,000 from that entity’s aggregate deposits at each bank, with a floor of zero. Confirm any pass-through or sweep coverage separately.
4. The remainder is your uninsured exposure at that bank.

Illustration, not a benchmark: assume one eligible corporation has $3,000,000 in ordinary deposits at one insured bank, with no sweep arrangement or other coverage. Its uninsured balance is $2,750,000. Splitting that cash among several accounts at the same bank does not change the calculation.

Kruze Consulting notes that Mercury and Brex are not technically banks. If part of your cash sits with a fintech front end, confirm which institution actually holds the funds and what coverage applies.

Outside the US, use the applicable national deposit-protection rules and the identity of the institution holding the funds.

How to interpret the number against payroll and vendors

Exposure only means something against obligations. Set a company-specific tolerance threshold from what you must pay if access is lost: one full payroll cycle, payroll taxes and benefits, and the vendors you cannot miss.

Then ask two questions:

• Is uninsured exposure at any single bank larger than the amount you could afford to have unavailable for an extended period?
• Could you fund the next payroll and critical vendor run from cash held somewhere else?

If the answer to the first is yes or the second is no, you have concentration risk, regardless of how large or stable the bank looks. This is a judgment call that depends on your burn, runway, and funding calendar. Fiscallion builds these thresholds into the runway model so the threshold moves when burn moves.

What to do next: map dependencies, then add mitigation paths

Start with access, because access failures happen even when no bank fails.

Map the access dependencies

• Payroll funding source: which account does your payroll provider debit, and can you change it without a long setup?
• Authorization chain: who approves wires and ACH, and what happens if one approver is unavailable?
• Signatories: are there at least two people with authority at every institution?
• Cards: which corporate cards and subscriptions are tied to which account?
• Counterparty instructions: which vendors, landlords, and customers hold your bank details, and who updates them?

Add mitigation paths

• A second banking relationship, funded and fully set up. Kruze's client panel (more than 800 venture-funded startups, released March 28, 2024) reports that almost all startups now maintain at least two banking relationships, and that some VCs demand this in financing documents.
• An insured sweep or reciprocal network.IntraFi's ICS and CDARS divide a large deposit into amounts under the standard FDIC maximum and place them at participating banks, so one relationship can reach insurance at several banks.
• A standby account that is open, verified, and ready to receive funds.

Kruze's data is one firm's client panel, not a market census. It shows how startups reacted. It is not a standard you must match.

Re-run quarterly and on trigger events

New funding round, a burn change, or a VC multi-bank requirement should each trigger a fresh exposure calculation.

The quarterly check runs as a loop:

1. Inventory every bank relationship and the balance at each.
2. Apply the FDIC standard limit to each balance.
3. Compute the uninsured balance per bank.
4. Decision: is uninsured exposure above your tolerance threshold (payroll plus critical vendors)?
5. If yes, apply mitigation: open a second bank relationship, use an insured sweep or reciprocal network, or hold a standby account ready.
6. If no, monitor.
7. Re-run quarterly and on trigger events, then return to step 1.

Common mistakes and the replacement move

Run the contingency drill

The drill is where the plan becomes real. Schedule it with finance, your payroll lead, and whoever holds approval authority.

• Simulate losing access to the primary bank and ask: where does the next payroll come from?
• Have the second approver initiate a transfer to the standby account from scratch.
• Confirm your payroll provider can switch its funding source, and note what it requires.
• Pick five critical vendors and confirm you can send them new payment instructions.
• Record every failed step, assign an owner, and fix it before the next quarter.

Alex Stojanovic’s weekly finance check-up connects account visibility with upcoming payroll, taxes and other payments. It complements the access drill: establish what is due, then test which account can fund it.

The cash-access contingency checklist

Use this as written. It is open, and it needs no email form.

• Every bank and account is listed with its current balance
• Uninsured exposure is calculated per institution against the $250,000 standard FDIC limit
• A tolerance threshold is set from payroll plus critical vendor obligations
• Payroll funding source is documented, and a switch process is confirmed
• At least two people can authorize wires and ACH at every institution
• A second bank relationship or an insured sweep is open and tested
• A standby account is open and verified
• Corporate cards and recurring payments are mapped to their funding accounts
• Vendor and customer payment instructions can be updated by a named owner
• A transfer drill has been completed this quarter, with fixes assigned
• Re-run triggers are logged: new round, burn change, investor multi-bank requirement

If you want senior help owning this inside your forecast and runway model, Fiscallion's financial modeling and board reporting service covers it. Every Fiscallion client works directly with Aleksandar Stojanovic at the CFO layer: a senior partner on every engagement, not an account-manager or junior-team handoff. Aleksandar's FP&A leadership experience was gained through the growth of a SaaS company to €100M ARR. Fiscallion is not a bank, insurer, or treasury vendor.

FAQ

What is concentration risk in banking?

It is the exposure created when a bank depends heavily on a narrow set of assets, funding sources, or depositors. The Federal Reserve's SVB review describes SVB as having a highly concentrated business model and a reliance on uninsured deposits.

For a startup, the same idea applies in reverse: too much cash and too many payment dependencies at one institution.

What is the difference between bank concentration risk and customer concentration risk?

Bank concentration risk is about access to the cash you hold. Customer concentration risk is about the revenue that replenishes it.

One is managed with account structure, authorization design, and drills. The other is managed through pricing, pipeline, and contract terms. Track them separately in your runway model.

What should a startup include in a bank concentration risk contingency plan?

Include a per-bank inventory of balances, an uninsured exposure calculation, and a tolerance threshold based on payroll and critical vendors. Add a map of access dependencies: payroll funding source, authorization chains, signatories, cards, and counterparty instructions.

Then add mitigation paths, a transfer drill, and a quarterly re-run schedule with trigger events. The checklist above covers each item.

How does deposit insurance apply when a startup holds most of its cash at a single bank?

For eligible corporate deposits, the FDIC generally combines accounts owned by the same corporation at one insured bank and covers up to $250,000. Additional accounts or signatories at that bank do not increase the limit. Confirm sweep allocations and pass-through conditions with the institution.

An insured sweep or reciprocal network can divide a large deposit into sub-limit amounts placed at participating banks, giving access to FDIC insurance at several banks through one relationship. Deposit protection does not replace a tested route to payroll cash if your usual bank portal or payment process is unavailable. If you bank outside the US, confirm your national scheme's rules directly.

Make access part of the forecast

Concentration risk is cheap to fix before a disruption and expensive to discover during one. The work is a quarterly exposure calculation, a mapped set of dependencies, and a drill someone owns.

Start with the checklist, set your tolerance threshold, and run the first transfer drill this quarter.