A limit that is always passed
Every wealth firm has a concentration policy, and almost every portfolio passes it. No single issuer above 10%. No single fund above 15%. No more than a fifth of the portfolio in illiquid assets. The checks run before every trade and again every night, client by client, and the exceptions report is short.
That policy rests on a premise so obvious that nobody writes it down: risk is a property of a portfolio. If each portfolio is diversified, the firm is diversified. If no client is concentrated, nothing is.
The premise is wrong in a way that only shows up once, and then all at once. A firm is not a collection of independent portfolios. It is one book, assembled by the same investment committee, built from the same model portfolios, recommended by advisers who read the same research and sold the same products. The clients may be diversified. The decisions behind their portfolios are not.
The question the policy answers is: how much of this client's money is exposed? The question that decides whether a firm has a bad quarter or a bad decade is a different one: how many of our clients does a single event reach, on the same day?
The note in 360 portfolios
A multi-family office with $3 billion under management and 400 client relationships. An average relationship of $7.5 million, an average fee of 80 basis points, $24 million of revenue a year.
Three years ago the investment committee added a yield-enhancement sleeve to its model portfolios: structured notes paying an attractive coupon, issued by a large bank, with capital protection at maturity under the product's terms, subject to the issuer's credit. Sensible, popular, easy to explain. Advisers rolled it out across the book, sized carefully: never more than 5% of any portfolio. Because the notes sit in the core models, assume the 360 relationships that end up holding them account for 90% of the firm's revenue.
| Check | Limit | Result |
|---|---|---|
| Largest single-issuer exposure in any portfolio | 10% | 5% · pass |
| Portfolios in breach | 0 | 0 · pass |
| Issuer exposure, firm-wide | none set | $120 m · 4% of AUM |
Every portfolio passes. The firm-wide line, where anyone looks at it, says 4%. No committee would call 4% a concentration.
Now the same position seen from the other side:
| Measure | Value |
|---|---|
| Clients holding the issuer | 360 of 400 · 90% |
| Total revenue of the relationships holding the notes | $21.6 m of $24 m · 90% (fees on the notes alone: $0.96 m · 4%) |
| Advisers with at least one affected client | 12 of 12 |
| Clients who would need a call in the same week | 360 |
Suppose the issuer runs into trouble. The notes do not need to go to zero for this to matter; a downgrade, a frozen secondary market or a write-down rumour is enough. The direct loss on the notes is at most 4% of the book, and the fees earned on the notes are a rounding error. But the relationships that hold them produce nine-tenths of the firm's revenue, and none of those clients will judge the event by the size of the position. On the same morning, 360 families open the same headline, recognise the same name in their portfolio and call their adviser. Every adviser in the firm spends the week on the same conversation. Every one of those conversations ends with the same question: who decided to put this in my portfolio?
The answer is the firm. Not 360 separate suitability judgements, but one committee decision, executed 360 times. The direct loss is small. The event is not. (Other channels to the same bank, discussed below, can add to the financial impact.)
Four ways to measure the same exposure
The example works because firm-level concentration has more than one dimension, and the standard report measures only one of them.
| Measure | Question it answers | In the example |
|---|---|---|
| Depth | How much of the firm's AUM is exposed? | 4% |
| Breadth | How many clients hold it? | 90% |
| Simultaneity | How many clients does one event reach in the same window, across every instrument that shares the risk? | 90% or more, many through several channels |
| Revenue exposure | How much of the firm's revenue comes from the potentially affected relationships? | 90% |
Depth is what risk systems already compute when they aggregate at all. It measures the financial loss, and for a firm that is rarely the binding constraint. A 4% drawdown in one sleeve is a bad month, not a crisis.
Breadth measures something else: how far the event travels through the client base. It is the number that predicts the volume of calls, complaints, suitability reviews and redemption requests, all of which arrive together.
Simultaneity is where breadth stops being enough. Breadth counts the holders of one instrument. Simultaneity counts the clients reached by one risk driver, through every instrument that carries it. The bank that issued the notes held by 360 clients may also be a bond in the fixed income sleeve of 100 of them, a top-ten holding in an equity fund used in 150 portfolios, the counterparty to the currency hedges and the custodian of 80 accounts. Each line is small and each sits in a different report. When the bank is downgraded, all of them move on the same day, and many clients are hit through three or four channels at once. Simultaneity is breadth measured on the risk driver rather than on the security.
Revenue exposure turns all of this into the firm's own economics. It is not the fee on the 4%, which in the example is under $1 million. It is the revenue of every relationship the event touches, because a client who loses trust over a 4% position does not move 4% of their money. This is exposure, not expected loss: nobody expects nine-tenths of the revenue to leave. It measures how much of the firm's income now depends on how one conversation goes. Revenue at risk, in the strict sense, belongs to a later step: a scenario with explicit assumptions about retention and client losses. That is the same drain the retention article described: clients rarely leave over a number, they leave over a moment.
The four measures can tell completely different stories. A concentrated bet held by three large clients is deep and narrow: a real financial risk, a contained relationship risk. A small product in every portfolio is shallow and broad: a trivial financial risk, a firm-wide relationship risk. Policies written around depth protect against the first and are blind to the second.
Where the firm's concentration hides
Structured notes are a convenient example, but the pattern has many forms. Each of them looks diversified in the client report and concentrated in the firm's.
The issuer, seen through every wrapper. A name can enter a portfolio directly, through a fund, through a note's issuer, through a note's underlying, through a derivative. Portfolio systems with look-through into funds catch some of it. In many firms, few catch the issuer of a note separately from its underlying, and fewer still catch synthetic exposure, which has to be traced outwards to the reference issuer. Without all of these, the firm's exposure to a name is not a number anyone has.
The product and the manager. One evergreen private credit fund in 140 portfolios, 7% of AUM. Quarterly liquidity, capped at a small share of the fund. When redemptions exceed the cap, the fund gates, and it gates for everyone at once. A hundred and forty families discover in the same letter that part of their money is less liquid than they thought. Each of them was told about the terms. Few were told that their neighbours had the same ones.
The counterparty. A single custodian holding 80% of the book. A single private bank providing lombard lending to most of the clients who borrow, with the same haircut policy, revised on the same day. Counterparty concentration travels through several channels: changed terms, an outage, tighter onboarding or a deterioration in credit. Whichever it is, the whole firm feels it in the same week.
The adviser. The firm's best adviser manages relationships that produce a quarter of its revenue. Those clients chose the person before they chose the firm. If he leaves, part of that revenue may leave with him. Key-person risk is concentration on a dimension most firms never put on a dashboard.
The model portfolio. This is the root of most of the others. Models are how firms deliver consistent advice at scale, and they work. But a model is a single decision replicated across hundreds of accounts, which is the definition of breadth. The efficiency and the concentration are the same thing seen from two sides.
The portfolio nobody manages
There is one more book in the firm, and it is the most concentrated of all: the firm's own income statement.
A fee charged as a percentage of assets makes the firm an investor in its clients' portfolios. When the book rises, revenue rises. When it falls, revenue falls. And unlike the clients, the firm carries that exposure with leverage, because most of its costs (people, systems, offices) do not move with the market.
Take the same firm through a bad year. Assume the book is 55% equities, 30% fixed income, 10% alternatives and 5% cash, and that equities fall 25%, bonds 4% and alternatives 10%.
| Before | After the shock | Change | |
|---|---|---|---|
| AUM | 3,000 | 2,520 | −16% |
| Revenue at 80 bps | 24.0 | 20.2 | −16% |
| Operating costs | 18.0 | 18.0 | 0% |
| Operating profit | 6.0 | 2.2 | −64% |
A 16% fall in assets becomes a 64% fall in profit. The clients lost a sixth of their wealth; the firm lost nearly two thirds of its margin. (The figures are illustrative and capture only the mechanical effect: revenue proportional to AUM, costs flat. Redemptions, lost clients and the extra cost of handling the event would come on top.)
And the timing makes it worse. The quarter in which revenue drops is the quarter in which every client calls, every review is brought forward and every adviser works longest. The firm's costs do not fall when its income does. In the short run, they rise.
None of this is news to a firm's partners in the abstract. What is unusual is to see it in the same system and the same scenario as the clients' portfolios. Most firms stress client portfolios in the risk system and the firm's budget in a spreadsheet, with different assumptions, at different times, by different people. The two are the same exposure. A firm that runs one scenario across both sees, in one place, which events would hurt its clients and its own margin at the same time, which are exactly the events it can least afford to handle badly.
How the limit builds the concentration
The uncomfortable part is that per-client limits do not merely miss breadth. They encourage it.
Suppose the committee wants $120 million in the notes. A per-client limit of 5% makes it impossible to place that amount with a few clients. Given that target, that product and that limit, the way to reach it within policy is to spread it: a little in every portfolio. The limit is satisfied by maximising the number of clients exposed. That is the paradox: strict compliance with the per-client policy can be the very mechanism that builds the firm's concentration. What looks like prudence at the level of each account is, at the level of the firm, the most efficient possible way to turn a product decision into a firm-wide event.
Model portfolios, rebalancing engines and central product approval work the same way. Each is good practice. Together they produce a book in which the clients are diverse and the exposures are not.
None of this argues against models, central approval or per-client limits. It argues for a second set of limits, written at the level where the risk actually lives:
| Per-client limit | Firm-level limit |
|---|---|
| No issuer above 10% of a portfolio | No single non-diversified issuer in more than half of the firm's portfolios |
| No fund above 15% of a portfolio | No semi-liquid product above a set share of the firm's AUM, or held by more than a set share of clients who may need liquidity in the same year |
| Illiquid assets below 20% of a portfolio | Firm-wide redemption capacity checked against products that can gate |
| Suitability per client | Breadth reviewed by the committee before a product is rolled into a model |
The exact thresholds are a matter of judgement and will differ by firm. What matters is that the second column exists, and that the system can measure it as reliably as the first.
Why the firm cannot see its own book
If the firm's book is one portfolio, why is it so rarely looked at as one? The answer, again, is lineage: each system involved was built around a different unit.
Compliance engines were built around the mandate. Rules attach to an account or a model and breaches are reported per account, which is exactly right for protecting each client from an unsuitable portfolio. The design evaluates the individual mandate; it was not built to treat the firm as a holder.
Portfolio systems were built around the client. They consolidate everything one family owns and report it well. Aggregating across families is possible, but in many firms it is a quarterly export into a BI tool, joined by hand, with whatever identifiers survived the trip. The same note can arrive under an ISIN from one custodian, an internal code from another and a free-text description from a third. By the time the firm-level number exists, it is a quarter old and approximate.
Look-through stops early. Funds are looked through to their holdings when the data is available. Structured notes are usually classified by underlying, not by issuer, so the credit exposure to the bank that wrote them vanishes into an equity or index bucket. Derivatives are often classified by their market value, which says little about what they expose the client to.
The billing engine in most architectures knows the fee per account, not per position. It can say what a client pays. It cannot say how much revenue depends on a given product, manager or issuer, unless it can recompute fees from positions on demand, and few billing engines were built to do that.
The CRM knows which adviser owns which relationship and when they last spoke. It does not know what the client holds, so it cannot answer the one question that matters on the morning of an event: which clients do we need to call, in what order, and what do we tell them?
| System | Built around | What it typically cannot see |
|---|---|---|
| Compliance engine | The mandate | The firm as a holder |
| Portfolio system | The family | Exposure across families, except via a quarterly export |
| Look-through | The fund | The issuer of a note, the reference entity of a derivative |
| Billing engine | The account | Which positions the revenue depends on |
| CRM | The relationship | What the client holds, on the morning of an event |
Each system answers its own question well. The firm-level question sits in the gap between all five.
What a system would have to do
None of this needs new risk theory. It needs the firm to be treated as a holder in its own right, with the same rigour applied to each client. Seven requirements:
- The book is a portfolio. One view across every client, entity and custodian, refreshed as often as the client views, built from the same reconciled data rather than from an export.
- Look-through reaches the risk driver. Every position resolves to the drivers that can move it: issuer, underlying, manager, counterparty, custodian and lender. A structured note carries both its underlying and its issuer; a fund carries its holdings and its manager; a derivative carries its reference entity and its counterparty.
- Four measures for every driver. Depth, breadth, simultaneity and revenue exposure, computed together, so that a shallow, broad exposure is as visible as a deep, narrow one.
- Firm-level limits sit next to client limits. Breadth and simultaneity thresholds are written into policy and checked by the same engine, including before a product is added to a model portfolio, which is the moment breadth is decided.
- Revenue can be traced to the positions behind it. When the question needs it, the system applies each client's fee schedule to the holdings and computes, on the fly, how much income depends on a given product, manager or issuer. Nothing has to be stored per asset; it has to be computable.
- One scenario runs on both books. The same shock moves client portfolios and the firm's own income statement: AUM, revenue, margin, clients whose plans fall off track, clients facing margin calls or gates.
- Exposure leads to action. For any driver, the system produces the list of affected clients, their advisers, their exposure and the right message, as a workflow the firm can start the same morning, not a report it reads the following quarter.
None of these is exotic. All of them are things a system built around "risk is a property of the portfolio" will not do by accident.
This is where Pivolt changes the picture. Positions, look-through, fee schedules, advisers and client relationships already sit in the same data model, so the firm-level view is not a separate project: it is the same reconciled data cut along a different dimension. A CIO can ask which issuers appear in more than half of the firm's portfolios, through any instrument, and how much revenue comes from the relationships that hold them, and get the answer in minutes rather than at the next quarterly export. Fees are computed on the fly from each client's schedule when the question requires it, and the result can be broken down by adviser, model, custodian or client segment. The list of affected clients that comes out of that query is the same list the advisers work from when the calls have to be made.
The risk that reaches everyone
Go back to the risk report. Four hundred portfolios, zero breaches, a largest single exposure of 5%. It is a correct report, and it describes a firm in which one headline would reach nine clients in ten, every adviser and nine-tenths of the revenue in the same week.
Most firms cannot say this week which issuers, products, managers and counterparties appear in most of their portfolios, or how much revenue sits with the clients who hold them. Starting with that list does not require new limits on day one. It gives the investment committee a way to decide, product by product, how much breadth it is willing to accept, before an event makes that decision for it.
