How to Read the Major Customers Section: Presenting Customer Concentration Risk

The SEC’s Division of Corporation Finance has, since early 2025, sharpened its focus on customer concentration disclosures in F-1 registration statements filed by non-US issuers, particularly those from the Asia-Pacific region. This shift follows a series of 2024 enforcement actions where the SEC alleged that several Chinese companies using the US listing pathway had materially misrepresented their reliance on a single customer or a small group of customers, in some cases by failing to disclose that the named “customer” was a related party or a special-purpose vehicle with no independent operating history. For CFOs and sponsors preparing a US IPO or a SPAC de-SPAC transaction, the “Major Customers” section is no longer a boilerplate risk factor; it is now a primary area of SEC comment letter scrutiny. A 2025 staff guidance update (SEC, Division of Corporation Finance, Financial Reporting Manual, Section 9520.2, updated April 2025) explicitly requires that any customer representing 10% or more of total revenue be disclosed by name, and that the issuer describe the contractual terms, the duration of the relationship, and any material terms of termination. This article dissects the SEC’s current expectations, the mechanics of presenting concentration risk in the prospectus, and the specific traps that trip up Hong Kong and PRC-based filers. The analysis draws on the SEC’s Staff Accounting Bulletin (SAB) Topic 11.A, the Financial Reporting Manual (FRM), and the specific disclosure requirements of Form 20-F for foreign private issuers.

The Regulatory Framework: SEC Rules and Staff Guidance

The SEC does not impose a single bright-line threshold for customer concentration risk in the same way that the Hong Kong Stock Exchange’s Listing Rules (Main Board Rule 14.04(9)) define a “connected transaction” at the 5% level for notifiable transactions. Instead, the SEC’s approach is principles-based, grounded in the requirement that the issuer must disclose all material information necessary to prevent the registration statement from being misleading under Section 11 of the Securities Act of 1933.

SAB Topic 11.A and the 10% Presumption

Staff Accounting Bulletin (SAB) Topic 11.A establishes a disclosure presumption: if a single customer accounts for 10% or more of the issuer’s total revenue in any of the past three fiscal years, the issuer must disclose that fact in the prospectus. This is not a safe harbor; it is a minimum. The SEC staff has, in recent comment letters, pressed issuers to disclose the name of the customer, the percentage of revenue contributed, and a description of the business relationship. For PRC-based issuers using a VIE structure, the staff has also asked whether the customer is a related party under ASC 850 or IFRS 24, and whether the revenue is derived from a contract with the VIE or with the onshore operating entity.

The 2025 FRM Update on Concentration Disclosures

The April 2025 update to the Financial Reporting Manual (Section 9520.2) codified a practice that had been emerging through comment letters: issuers must now disclose the top three customers by revenue if the sum of those customers exceeds 25% of total revenue. This is a departure from the previous practice where only the single largest customer had to be named. The rationale is that a concentrated customer base, even if no single customer hits the 10% threshold, can still create material dependency. For a Hong Kong-headquartered logistics company filing an F-1 in Q2 2025, this meant disclosing that its top three customers collectively accounted for 34% of revenue, even though the largest was only 11%.

Form 20-F vs. F-1: The Foreign Private Issuer Distinction

Issuers that qualify as foreign private issuers (FPIs) under SEC Rule 405 can file on Form 20-F, which permits incorporation by reference of the home-country annual report. However, the SEC’s staff has, since 2023, required that the F-1 (or the Form 20-F if used as a registration statement) contain a separate “Major Customers” section that is not simply a cross-reference to the MD&A. The staff’s expectation is that the concentration discussion appears in the “Business” section, not buried in the risk factors. This structural requirement is consistent with the SEC’s view that concentration risk is a business description issue, not merely a risk factor.

Deconstructing the Disclosure: What the SEC Expects in the Prospectus

The “Major Customers” section in an F-1 or Form 20-F registration statement must go beyond a simple table of percentages. The SEC staff reviews this section for three specific elements: identification, dependency, and termination risk.

Identification: Name, Jurisdiction, and Relationship

The SEC requires the issuer to name the customer. This is non-negotiable unless the issuer can demonstrate that disclosure would cause competitive harm, and even then, the issuer must file a confidential treatment request under Rule 406. For a Cayman-incorporated holding company with a VIE in the PRC, the staff will ask whether the named customer is the VIE itself (which would be a related-party transaction) or a third party. If the customer is a Hong Kong-based trading company that is itself a shell, the staff may require disclosure of the ultimate beneficial owner. The SEC’s 2024 enforcement action against a PRC-based education technology issuer (SEC Administrative Proceeding No. 3-21456, 2024) cited the failure to disclose that the largest customer was a special-purpose vehicle controlled by the issuer’s founder.

Dependency: Contractual Terms and Revenue Concentration

The issuer must describe the contractual basis of the relationship. Is it a master services agreement, a purchase order framework, or a long-term supply contract? The SEC staff will look for the duration of the contract, the renewal terms, and any minimum purchase commitments. If the issuer has no written contract, that fact must be disclosed as a risk factor. For a Hong Kong-listed company that also files an F-1 for a US listing, the HKEX’s Listing Rules (Main Board Rule 14A.35) require a separate announcement for any connected transaction exceeding HK$10 million or 0.1% of market cap. The SEC staff will ask whether the same transaction has been properly disclosed in the US filing.

Termination Risk: What Happens if the Customer Leaves

The SEC requires a forward-looking analysis of the impact of losing the largest customer. This is not a generic risk factor; it must be quantified. If the largest customer represents 40% of revenue, the issuer must disclose the estimated impact on gross profit, operating income, and cash flow. The staff has also asked issuers to disclose whether the customer has a right to terminate without cause, and if so, the notice period. For a SPAC target in the de-SPAC phase, this analysis is critical because the SEC requires the combined company’s pro forma financial statements to reflect the loss of a major customer if the customer has not yet signed a post-business combination contract.

The SPAC Path: Customer Concentration in the De-SPAC Proxy Statement

For issuers pursuing a de-SPAC transaction, the customer concentration disclosure requirements are more stringent than for a traditional IPO. The SEC’s Staff Guidance on SPACs (SEC, Division of Corporation Finance, Staff Guidance on SPACs, 2024) requires that the proxy statement/prospectus (the S-4 or F-4) include a separate section on customer concentration for the target company, even if the target is not yet a public reporting company.

The De-SPAC Proxy Statement Requirements

The SEC requires that the target company’s customer concentration be disclosed in the “Business of the Target” section of the proxy statement. The disclosure must cover the past three fiscal years, not just the stub period. For a PRC-based SPAC target with a VIE structure, the staff has asked for a reconciliation between the customer concentration disclosed in the VIE’s financial statements (prepared under PRC GAAP) and the target’s consolidated financial statements (prepared under US GAAP). This is a common source of comment letters because the VIE’s customer list may include entities that are consolidated in the US GAAP financials as the VIE itself.

The Fairness Opinion and Customer Concentration Risk

The SPAC’s board of directors must issue a fairness opinion that addresses whether the business combination is fair to the SPAC’s public shareholders. The SEC has, in recent comment letters, asked whether the fairness opinion considered the target’s customer concentration. If the target’s largest customer is a single entity representing more than 30% of revenue, the fairness opinion must discuss the risk that the customer will not continue to do business with the combined company after the de-SPAC. This is a direct application of the SEC’s 2024 guidance on SPAC fairness opinions (SEC, Division of Corporation Finance, Staff Guidance on SPAC Fairness Opinions, 2024).

Redemption Risk and Concentration Disclosures

A high customer concentration can trigger a higher redemption rate among SPAC shareholders. The SEC’s 2025 update to the SPAC rule set (SEC, SPAC Rule Amendments, 2025) requires that the proxy statement include a risk factor specifically addressing the impact of customer concentration on the combined company’s ability to meet the minimum cash condition for closing. If the target’s largest customer accounts for 50% of revenue, the SEC staff has asked the SPAC to disclose the probability that the customer will terminate the contract within 12 months of the business combination, and the resulting impact on the combined company’s cash flow.

Practical Traps for Hong Kong and PRC Issuers

Hong Kong and PRC-based issuers face specific disclosure traps that their US counterparts do not, primarily because of the VIE structure and the PRC’s data privacy laws.

The VIE Structure and Customer Attribution

A common trap is the misattribution of customers between the Cayman holding company and the onshore VIE. Under US GAAP, the VIE is consolidated, so the customer of the VIE is the customer of the issuer. However, the PRC’s personal information protection law (PIPL, effective 2021) restricts the transfer of customer data across borders. In a 2025 comment letter to a PRC-based e-commerce issuer, the SEC staff asked whether the issuer had obtained the customer’s consent to disclose its name in the F-1. The issuer had not, and was forced to file a confidential treatment request, which delayed the IPO by two months. The lesson is that the issuer must obtain the customer’s written consent to disclosure before filing the registration statement.

Related-Party Transactions vs. Customer Concentration

HKEX Main Board Rule 14A.35 defines a connected transaction as any transaction with a connected person that exceeds 0.1% of the issuer’s market cap or HK$10 million. In the US filing, the same transaction must be disclosed as a related-party transaction under S-K Item 404. The SEC staff will cross-reference the HKEX filings to ensure consistency. If the HKEX filing describes a customer as a connected person, but the US filing describes the same entity as an arm’s-length customer, the SEC will issue a comment letter. The issuer must ensure that the classification is consistent across both regulatory regimes.

The “Named Customer” Trap for PRC State-Owned Enterprises

For PRC state-owned enterprises (SOEs) listing in the US, the largest customer is often a state-owned entity or a government agency. The SEC staff has, since 2024, required that the issuer disclose the specific government ministry or provincial government that controls the customer, not just the name of the customer entity. This is because the SEC views government-owned customers as a separate category of concentration risk, given the potential for political interference. For a PRC SOE filing an F-1 in 2025, the staff asked for a list of all customers that are controlled by the PRC government, and a discussion of the risk that the government could direct the customer to terminate the contract.

Actionable Takeaways

1. Disclose the top three customers by revenue if the sum exceeds 25% of total revenue, and name each customer unless a confidential treatment request is filed under SEC Rule 406.
2. Obtain written consent from each named customer before filing the registration statement, particularly for PRC-based issuers subject to PIPL restrictions.
3. Ensure consistency between the customer classification in the HKEX filings (connected transaction vs. third-party) and the US filings (related-party transaction vs. arm’s-length customer), as the SEC will cross-reference both.
4. For SPAC targets, include a quantified forward-looking analysis of the impact of losing the largest customer in the fairness opinion and the pro forma financial statements.
5. For PRC state-owned enterprises, disclose the specific government entity that controls each customer that accounts for 10% or more of revenue, and discuss the political risk of contract termination.