The Concentration Risk Institutions Are Measuring the Wrong Way

“Don’t put all your eggs in one basket” has become one of the defining principles of digital asset infrastructure. Institutions are warned against becoming dependent on a single provider, so the instinctive response is to diversify: add another custody provider, split infrastructure across multiple vendors, introduce redundancy wherever possible. On paper, this looks prudent but in practice, many institutions are reducing one form of concentration risk while creating another that is far harder to see.

The problem is that concentration risk has gradually become shorthand for vendor concentration. The assumption is that the fewer providers an institution relies upon, the greater the operational risk it carries. But that was never the point of concentration risk. The real issue has always been dependency, not arithmetic.

An institution can work with ten different vendors and still be critically exposed if it cannot recover control when one of them fails. Equally, it can rely heavily on a single infrastructure provider while carrying relatively little concentration risk if it retains ownership of the things that matter. Control is what actually determines resilience.

More vendors do not necessarily mean less risk

The belief that diversification automatically creates resilience is understandable because it has worked well in other areas of financial services. Multiple cloud regions, multiple telecommunications providers and diversified counterparties all reduce exposure to single points of failure. Yet, digital assets are different.

Every additional provider introduces another integration, a new governance framework, a different operational process or security model and another contractual relationship. Instead of reducing complexity, institutions often multiply it. The result is an operating model filled with potential failure points that nobody intended to create.

Each provider maintains its own interfaces. Each introduces different upgrade cycles. Each has its own recovery procedures, security assumptions and operational controls. As the number of providers grows, so does the number of dependencies between them, and those dependencies quickly become harder to understand than the individual services themselves. Ironically, many institutions discover they have built an infrastructure that is less resilient precisely because they were trying to avoid concentration risk.

The real test comes when something goes wrong. If one provider changes commercial terms, experiences prolonged downtime or exits the market altogether, can the institution actually move to another vendor? For many organisations, the answer is no. Their data is now deeply integrated into proprietary workflows. Their operational processes have been designed around that provider’s architecture. Their governance models assume specific technologies or security controls. Migration becomes a major transformation programme rather than an operational decision. From the institution’s perspective, having multiple vendors has changed very little.

Digital assets raise the stakes

This matters in every area of technology but digital assets introduce a much sharper edge. Unlike conventional infrastructure, where outages can often be recovered through backups or service restoration, digital assets depend on control over cryptographic keys, signing environments and transaction authority. Lose access to those and the consequences are fundamentally different.

This is why digital asset operating models deserve far greater scrutiny than technology stacks alone. The critical question is not simply where infrastructure runs. It is who ultimately controls the assets, the signing processes and the operational environment. If a provider controls those elements, an institution’s ability to recover may depend entirely on that provider continuing to operate as expected. That is not simply operational risk but a question of sovereignty.

This is also why fragmented architectures can become surprisingly fragile. Institutions may believe they have diversified by spreading custody, orchestration, governance and connectivity across several specialist providers, yet discover that none of those relationships can be unwound quickly because each depends on assumptions embedded elsewhere in the operating model. While architecture appears diversified, the dependency remains absolute.

The question institutions should really be asking

Reducing concentration risk is not about avoiding every single-provider relationship. Instead, it is about ensuring no provider becomes impossible to leave. That shifts the conversation away from procurement and towards architecture.

The most resilient digital asset operating models are not necessarily those with the largest number of technology partners. They are the ones that deliberately keep their strategic assets under institutional control. That means retaining ownership of cryptographic keys wherever possible, controlling the operating environment, ensuring governance remains portable and designing infrastructure so providers can be substituted without rebuilding the business around them. In other words, resilience comes from preserving optionality.

This changes the questions institutions should ask prospective providers. Instead of asking, “Are you the only provider in this part of the stack?”, they should be asking, “If this relationship ended tomorrow, what would we still control?” Would the institution still hold its own keys? Could it move its workloads without redesigning governance? Would operational processes continue to function while a replacement provider was introduced? Could the institution leave on its own timetable rather than the provider’s? Those questions reveal far more about concentration risk than a vendor count ever will.

As digital asset infrastructure matures, boards will continue to demand evidence that concentration risk has been addressed. Too often, the answer will be a reassuring-looking diagram containing more boxes, more vendors and more integration lines.

The institutions that will be best positioned over the next decade will not be those with the most diversified supplier lists. They will be the ones that understood a simple but easily overlooked principle: concentration risk is not about how many providers you have. It’s about how much control you keep when one of them disappears.