The 10% Customer Rule: Reading Concentration Risk in 10-Ks

If a single customer accounts for more than 10% of a company's revenue, the SEC requires disclosure. That one line — often buried in the 10-K — is one of the highest signal-to-noise items in the filing. It tells you who actually pays the bills, and by extension, whose budget cycle, inventory correction, or strategic pivot can blow up next quarter's print.

Here's how to read those disclosures and translate them into a concrete view on cyclical and idiosyncratic risk.

What the 10% rule actually requires

Under Reg S-K Item 101(c) and ASC 280 (segment reporting), a registrant must disclose any customer that accounts for 10% or more of consolidated revenue. The disclosure typically appears in two places:

The 10-K's business or risk factors section, usually naming the customer if material to understanding the business.
The segment footnote, which lists "major customers" by percentage of revenue, sometimes anonymized as "Customer A," "Customer B," etc.

A few practical wrinkles:

The threshold is consolidated revenue, not segment revenue. A customer can be 40% of one segment and still fall below disclosure if the segment is small.
Companies can group affiliated entities (e.g., a parent and its subsidiaries) or split them, and the choice matters. Read the footnote language carefully.
Government customers (the U.S. DoD, for example) are usually disclosed as a single counterparty even though procurement runs through many sub-agencies.
The rule does not require disclosure of customer names in all cases — only that a 10%+ relationship exists. "One customer represented 14% of revenue" is compliant.

If you can't find the disclosure, that itself is information: no single customer is above 10%.

Why concentration amplifies cyclical risk

A diversified customer base smooths demand. When one customer is 20% of revenue, three things get worse simultaneously during a downcycle:

Demand correlation rises. A large customer's inventory destocking moves the whole top line, not just a slice. Apple suppliers (Skyworks, Qorvo, Cirrus Logic) have all lived this — when Apple builds drop 10%, revenue can drop more than 10% because the supplier loses operating leverage too.
Pricing power collapses. A 20% customer knows they are a 20% customer. Renegotiation cycles favor them, particularly when industry capacity is loose. Gross margin compression typically lags the revenue hit by two to four quarters.
Working capital tightens asymmetrically. Big customers extend payment terms during their own cash crunches. Receivables days creep up, then inventory builds because you can't cancel committed supply fast enough.

The practical rule of thumb: a company with one customer above 20% of revenue tends to have operating earnings volatility of meaningful magnitude relative to the underlying end-market cyclicality. The leverage is in the cost structure, not just the top line.

A framework for sizing the risk

When you see a concentration disclosure, run through four questions before deciding how to weight it:

1. Is the customer in a more cyclical industry than the company itself? A semiconductor company selling to autos inherits auto-cycle exposure. A packaging company selling to consumer staples inherits much less. The concentration matters less than the cycle it imports.

2. How sticky is the relationship? Qualified component on a long product cycle (think aerospace, medical devices, auto platforms) is structurally stickier than a commodity input. Check for design-win language, qualification timelines, and switching costs. A 25% customer on a 7-year platform is very different from a 25% customer who rebids annually.

3. Is the customer also a competitor or a potential vertical integrator? This is the Apple-modem situation, or Amazon building its own chips. When the customer has the scale and capability to in-source, the concentration risk has a terminal-value dimension, not just a cyclical one.

4. What is the contribution margin on that customer? Not disclosed, but estimable. If the 20% customer is the marginal volume that fills the factory, losing them is catastrophic. If they're priced thin and you'd reallocate the capacity, the headline percent overstates the economic risk. Management commentary on "customer mix" benefits in good quarters is the tell.

Where concentration shows up by sector

A few patterns worth keeping in mind:

Semiconductor supply chain: Concentration is the norm, not the exception. Apple, Samsung, and the hyperscalers each routinely show up as 10%+ customers across dozens of suppliers. Treat this as a sector feature.
Defense and aerospace: The U.S. government is often a substantial percentage of revenue at primes and tier-one suppliers. Cyclicality here is political (budget cycles, CRs, shutdowns), not economic.
Contract manufacturing and EMS: Flex, Jabil, Celestica routinely run with large customer concentrations. Margins are thin, so the operating leverage on a customer loss is severe.
Specialty chemicals and industrial gases: Long-term take-or-pay contracts can mask concentration risk on the income statement but create real exposure if the counterparty defaults.
Consumer staples and broadline retail suppliers: Walmart, Costco, and Amazon as 10%+ customers is common. Pricing pressure is the dominant risk, not volume.

What to watch next

Pull the segment footnote and risk factors section of your top three holdings' most recent 10-K. Note any customer above 10% and what industry they're in.
For each concentrated relationship, identify whether the customer's own end-market is now early-cycle, mid-cycle, or late-cycle. That's your near-term risk read.
Track the disclosure year over year. A customer moving from 18% to 24% is worth a flag; one dropping from 14% to below 10% (and therefore disappearing from the filing) often signals a quiet loss.
On earnings calls, listen for the phrase "customer mix" or "a large customer." Management uses these euphemisms when they don't want to name names — but the financial impact is usually disclosed within a quarter or two.