Platform Risk
Platform risk is the risk that a business built on another company's platform — an app store, marketplace, API, cloud service, payment network or sponsor bank — is harmed when that platform changes its fees, rules, algorithms or access, starts competing with it, or fails. The dependent business carries the exposure but controls none of the decisions that create it.
- Also known as
- Platform dependency, Platform dependence risk, Gatekeeper risk
- Used at
- commercial due diligence and valuation of any company that reaches its customers, data or licences through a third party; board risk registers; investment memos for apps, marketplace sellers, API-built products and banking-as-a-service fintechs
- Forms
- pricing (a commission or API fee raised), policy (a category banned, terms rewritten), distribution (ranking or algorithm changes), access (an API closed or rate-limited), competition (the platform launches the same product) and failure (the platform or an intermediary collapses)
- Precedents
- Apple's App Store commission of 30%, cut to 15% for developers earning under $1m a year under a programme announced in December 2020; Reddit's 2023 API pricing, under which the Apollo app faced about $20m a year and closed on 30 June 2023; the bankruptcy of Synapse, a banking-as-a-service intermediary, in April 2024, which left tens of thousands of businesses and consumers using fintech apps without access to their money
- Binding
- nothing limits it by default; mitigation is contractual (notice periods, termination rights, price caps), regulatory (competition law, such as the EU's Digital Markets Act on designated gatekeepers) or architectural (a second provider)
- Measured by
- the share of revenue, traffic, data or funding that depends on one platform; the notice period in the contract; and the time and cost of moving elsewhere
How platform risk works in practice
The risk rarely shows in the numbers until it materialises. A business that wins most of its customers through one app store's search results, pays a platform 30% of its revenue, or holds its customers' money through one partner bank can show strong growth and margins for years; what it cannot show is that the platform will leave those terms alone. When Reddit began charging for its API in 2023, several third-party apps, Apollo among them, shut within weeks because the new fees exceeded anything they could earn.
In fintech the platform is often a regulated one. A banking-as-a-service fintech depends on its sponsor bank's licence, risk appetite and supervisor. When a sponsor bank comes under an enforcement action — as Evolve Bank & Trust did from the Federal Reserve in June 2024 — its partners can face paused onboarding, new controls or termination, whatever their own conduct. When the middleware between fintech and bank fails, as Synapse did, end customers can be locked out of their money.
For a buyer, platform risk belongs in the valuation, not in a footnote. Diligence measures concentration, reads the platform's terms and any negotiated contract, studies how the platform has changed terms before, and prices the cost of moving to a second provider. A business with two sponsor banks, direct traffic and its own customer relationships deserves a higher multiple than one with the same revenue earned on a single provider's terms.
Example
A consumer budgeting app earns $30m a year, 80% of it from subscriptions sold inside the two main mobile app stores, which keep 15–30% of each sale. A buyer offers $150m, five times revenue. Diligence finds that 60% of new users arrive through app-store search, that the app's bank-data connections run through one aggregator on a contract terminable on 90 days' notice, and that one of the app stores has just launched a free budgeting feature. The buyer models a case in which store-driven installs halve and the aggregator raises its prices by 40%: revenue growth falls from 25% to 8% a year. It cuts the offer to $120m and moves part of the price into an earn-out tied to subscriptions sold directly.
Common mistakes
- Treating a platform's current terms as a permanent cost structure. - Measuring revenue concentration but not traffic, data or licence concentration. - Signing a platform contract with no notice period for changes to price or policy. - Assuming a sponsor bank's enforcement problem stays with the bank. - Lining up a second provider only after the first has changed the terms.