You’re not exposed to your customer. You’re exposed to whoever pays them.

A builders’ merchant can have a clean file, pay you to terms, and still be one phone call from a problem you never underwrote. The phone call is a developer it supplies going into administration — a company you have no contract with, never scored, and possibly cannot name. That is second-order credit exposure: the risk you carry through the businesses that pay your customer. Legally, your exposure is only ever to the customer you invoiced. Economically, their ability to pay you can depend on companies you have never assessed. A clean customer can still carry dirty concentration.

A clean file can sit on top of trapped cash

Sector data is too blunt to price a single account — we have made that case before: two companies in the same sector can carry opposite risk, because risk lives in the account, not the category. Account-level data is the right unit. But it has its own blind edge. A credit file describes the company you invoiced. It does not describe where that company’s money comes from. And a business that pays you on time out of a single source of cash is only as stable as that source.

Concentration is the part a single-name check cannot see. If most of your customer’s revenue runs through one developer, one main contractor, or one large buyer, then your customer’s solvency is partly that other company’s solvency — a company you never underwrote and may not be able to name. The account can score clean while its cash is quietly trapped one or two links down a chain that is seizing up. Nothing in the file moves until the money stops.

What is second-order credit exposure?

Second-order credit exposure is the risk you carry through your customer’s customers. Your first-order exposure is to the business you sold to. Your second-order exposure is to the businesses that pay that business — because if one of them fails to pay, the shortfall can travel through the chain and land on you as a bad debt, even though you never had a contract with the company that caused it. You did not choose those companies. You inherit them the day you extend terms.

This matters most where cash is concentrated, and margins are thin, which describes much of the built economy right now.

The pressure is landing where the chains are shortest

The administrations recorded across UK construction and property supply chains this month sat exactly where cash chains are shortest and least diversified. Begbies Traynor’s Red Flag Alert has put construction among the sharpest risers in critical financial distress, and Grand’s latest UK B2B credit digest tracked the same clustering in real time. Grafton reported GB like-for-like sales down around 5% in its half-year results (14 July 2026), with builders’ merchant volumes running roughly 8% below last year.

Here is the part worth sitting with: the trade-credit insurers’ headline is calm. Coface’s UK insolvency forecast for 2026 is around +2% — a low, stable number resting on top of very concentrated sector pressure. A market-level forecast of +2% and a developer failing with three merchants on its ledger are not in conflict. One is an average; the other is where the loss actually lands. The aggregate forecast being modest is a fact. That the losses this cycle will cluster rather than spread evenly is an inference — but a reasonable one, because concentration is exactly what an average hides.

Trace the cash one link out

You cannot underwrite companies you have no relationship with. But you can stop treating each account as if it stands alone. Before setting or renewing a limit on a material customer, trace the cash one link out. Three questions:

1. Who pays them? Is their revenue spread across many buyers, or does most of it come from one or two names?
2. Can I see those names at all — through the sector they sell into, the projects they are on, the companies they file alongside?
3. If their largest payer stopped tomorrow, would my customer still be able to pay me?

Drawn on a whiteboard, it is a single line: your customer → their source of cash → your exposure when that source fails. The value is not precision about the third party; you will rarely have that. The value is knowing which of your accounts are single-threaded, so that when a developer or a main contractor shows distress, you already know which of your own customers sit downstream of it — and you look at those first. Continuous, account-level monitoring is what turns that map from a one-off exercise into something that updates when the chain moves.

What changes if you accept this

Accept that a clean customer can carry dirty concentration, and the credit file stops being the boundary of what you are responsible for. Your exposure does not end at the name on the invoice; it runs one link further out, to whoever funds that name. Most credit processes stop at the first line, because that is where the contract is. The loss does not respect the contract. It follows the cash. The teams that come through a concentrated downturn with the fewest write-offs will not be the ones with the cleanest customer files — they will be the ones who knew, before the money stopped, whose customers were really their customers’ customers.

See how Grand helps at heygrand.com.