SVB’s depositors learned their bank was an unassessed supplier

The week

For most of the companies that banked with Silicon Valley Bank, the week began like any other. Payroll was scheduled, invoices were going out, and the cash that kept the business alive sat where it always had. By the weekend, many of their leaders were asking a question they had never seriously considered: can we actually get our money?

The trouble had been building for two years. During the venture funding boom of 2020 and 2021, SVB’s deposits grew far faster than its lending. The bank put much of the surplus into long-dated Treasury and agency mortgage-backed securities. A large share were classified as held to maturity, an accounting label that kept their falling market value out of reported capital.

When the Federal Reserve began raising interest rates in March 2022, the market value of those bonds dropped. Venture funding slowed at the same time, so SVB’s startup clients began spending down their balances to cover their costs. Deposits were leaving just as the assets behind them were worth less than their face value. By early March 2023 the Fed’s target rate range stood at 4.50 to 4.75 percent, and on March 7 the Fed chair told Congress that rates were likely to rise further than previously expected.

On March 8, 2023, SVB Financial Group said it had sold securities at a loss and planned to raise capital. It reported selling about $21 billion of securities at an after-tax loss of about $1.8 billion, and announced a plan to raise about $2.25 billion in new capital. The bank had taken a loss on investments it had bought with depositors’ money and needed fresh funds to shore itself up. The same day, Silvergate Capital, a bank holding company that served cryptocurrency firms, said it would wind down its bank and liquidate. That announcement landed with an unusually tight-knit group of customers. SVB’s depositors were concentrated among venture-backed technology and life sciences companies and the investors who funded them, people who talk to each other constantly and act quickly.

They acted very quickly. According to the California regulator’s closing order, customers initiated withdrawals of about $42 billion on March 9. That is what a modern bank run looks like: no lines around the block, just thousands of online transfer requests in a matter of hours.

The Federal Reserve’s later review reported that SVB expected roughly $100 billion more to be withdrawn on March 10. SVB’s share price fell sharply on March 9, and the planned capital raise could not be completed. No bank that had tied up its funding in long-dated securities could meet withdrawals on that scale in a day.

On March 10 the state closed Silicon Valley Bank and appointed the FDIC as receiver. The FDIC, the Federal Deposit Insurance Corporation, is the federal agency that insures bank deposits and, when a bank fails, steps in to take control of it and sort out who gets paid. It was the largest US bank failure since 2008. At the end of 2022, SVB had reported roughly $209 billion in total assets, making it one of the twenty largest banks in the country.

The FDIC moved insured deposits into a new entity, the Deposit Insurance National Bank of Santa Clara, and said insured depositors would have access to their money by Monday morning. Uninsured depositors were told they would receive an advance dividend, a partial early payout, plus a receivership certificate for the rest. How much that certificate would eventually be worth depended on what the FDIC could recover from selling the bank’s assets.

Then came an anxious weekend. Deposit insurance covers up to $250,000 per depositor, per bank, per ownership category. Many SVB customers held far more than that, often millions, in operating accounts. For a couple of days, many companies did not know whether they could reach their deposits above the $250,000 insurance limit or make payroll the following week.

Some of that exposure became public within hours. Roku, the streaming company, disclosed in a securities filing that about $487 million of its cash was held at SVB. Circle, which issues the USDC stablecoin, said about $3.3 billion of the reserves backing its token were held there, and USDC briefly traded well below its one-dollar target over the weekend. Founders, investors and treasurers spent Saturday and Sunday trying to open accounts elsewhere.

On March 12 the Treasury, the Federal Reserve and the FDIC said all depositors of SVB and of Signature Bank, which was closed that day, would be protected. The Fed also created a new lending facility for banks, a way for other banks to borrow against their holdings so they would not have to sell investments at a loss to meet withdrawals. The new Bank Term Funding Program lent for up to a year against Treasury and agency securities valued at par, their face value, rather than their depressed market price.

Protecting every depositor required a formal systemic risk exception. That step needs supermajority votes of the Fed and FDIC boards and a determination by the Treasury Secretary after consulting the President. Without it, the FDIC must resolve a failed bank at the least cost to the insurance fund. On Monday, March 13, SVB’s deposits moved into a bridge bank run by the FDIC, and customers could reach their money. In London, HSBC bought SVB’s UK subsidiary that same morning.

The money was safe in the end. But the weekend had exposed how much ordinary business activity depended on a single institution that few companies had ever examined the way they examine their other critical suppliers.

Most commentary on SVB focused on the bank itself: its interest rate risk, its concentrated and largely uninsured deposits, and how supervisors responded. Those are important stories, and they belong to bankers and regulators. For the organizations that banked there, the experience was different, and arguably more useful to study.

Between Friday and Sunday, finance chiefs, founders and boards faced a question most had never asked out loud. What happens to our operations if the bank holding our money stops working? That is not really a banking question. It is a supplier question, the same kind a manufacturer asks about the only factory that makes a critical part. It divides into three exposures that treasury, finance and technology teams share: cash, payment flows and dependent services.

The pattern reached well past startups. Consider a health system whose bond covenants are measured in days of cash on hand, or a county treasurer holding tax receipts. A broker-dealer keeping customer reserve funds at a bank and a fintech holding its users’ balances belong on the same list. All face versions of the same three exposures. The rules that shape their answers differ, and the sections below note where.

The three exposures run in order of visibility. Cash appears on the balance sheet. Payment flows appear in daily operations. Dependent services appear only when something breaks. Before taking each in turn, it pays to look at why banks were left out of supplier discipline in the first place.

A bank is a supplier with a vault

A company’s bank does more than keep money safe. A business bank provides at least three distinct services. It holds cash, the deposit balance that shows up on the balance sheet. It moves money, sending payroll, paying vendors and receiving customer payments. And it underpins other services the company relies on, such as payroll providers or payment processors that themselves bank somewhere.

Most organizations already know how to think about critical suppliers. They identify which vendors could halt the business if they failed. They check those vendors’ financial health. They keep a backup supplier ready, and they test that the backup actually works. Procurement teams call this third-party risk management. It is routine for a cloud provider, a logistics firm or a key component maker.

Banks were rarely held to the same standard. A bank was seen as infrastructure rather than as a counterparty, a business that owes you something and might not be able to pay. SVB showed the cost of that assumption. A company with one bank and months of runway in it had concentrated its survival in one counterparty without ever making that decision on purpose.

Why banks escaped the vendor process

Ownership explains much of it. Third-party risk programs usually live in procurement, security or compliance, and they are triggered by a contract and an invoice. A bank relationship rarely produces either in the usual form. Its terms are in account agreements and treasury services schedules signed by the finance team. Its fees are often netted against balances on a monthly account analysis statement rather than paid through accounts payable.

So the bank never enters the vendor inventory. It gets no risk tier, no annual review and no exit plan. Treasury, meanwhile, judges the bank on pricing, credit appetite and service quality, and seldom on the chance that the bank itself fails. Each function assumes the other has it covered.

Lending ties make the relationship stickier. A company that borrows from its bank, including through venture debt, often accepts covenants requiring it to keep most or all of its deposits there. The deposit decision is then made inside a financing negotiation, by people focused on the loan terms rather than on operating resilience.

What a counterparty review of a bank can examine

A company cannot audit its bank, but it can read what is public. US banks file quarterly Call Reports with their regulators, and listed holding companies also file with the SEC. Those filings show the mix of deposits, the amount estimated to be uninsured, the size of securities portfolios and the unrealized losses on them, and capital ratios. Credit ratings and share prices add an outside view.

The aim is calibration. A treasury team that sees a highly concentrated depositor base, a large share of uninsured deposits and large unrealized losses can lower its exposure limit for that bank without forecasting a failure. The same logic applies to any supplier whose financial statements show stress.

Most mid-sized companies have no analyst to do this. A short annual review, recorded in the same system as other critical vendors, still changes behavior. It forces someone to name the bank as a dependency, record who owns the relationship and write down what would happen if it stopped working.

Take a mid-sized software company with 300 employees. Its entire operating balance is held at one bank. Its payroll provider pulls funds from that account every two weeks. Its customers pay invoices into it. Its corporate cards are issued by the same bank. If that bank closes on a Friday, the company has four problems rather than one, all arriving at once, and its finance team of six people has to solve them over a weekend.

Each of those problems also has a different owner. Payroll belongs to HR and its payroll vendor. Collections belong to accounts receivable. Cards belong to finance operations. The cash belongs to the CFO. Under pressure, those owners discover that they have never sat down together to discuss the bank as a single dependency.

The first exposure: cash

The first exposure was the balance itself. Deposit insurance, provided by the FDIC, guarantees deposits up to $250,000 per depositor at each insured bank. For a household, that limit covers most needs. For a business that holds months of operating expenses, it covers almost nothing. Anything above the limit is an uninsured deposit, which in a failure becomes a claim against what is left of the bank.

Many SVB clients held operating cash far above the insurance limit at a single bank. Sometimes the bank had required it as a condition of lending: a company borrowing from the bank agreed to keep all its deposits there. Sometimes the relationship began when the company was small, when one bank was perfectly sensible, and it was never revisited as the balance grew from thousands to tens of millions.

How the limit applies to different depositors

The $250,000 figure applies per depositor, per insured bank and per ownership category. A company’s deposits fall into the category for corporations, partnerships and unincorporated associations. Opening several accounts at the same bank does not multiply coverage, because they all belong to the same depositor in the same category. Separately incorporated subsidiaries can qualify for their own coverage, but FDIC rules require each one to be engaged in an independent activity.

Public bodies work differently. Many states require banks to pledge collateral, usually government securities, against public deposits above the insured amount. A county or school district therefore carries a different risk: whether the collateral is adequate, correctly valued and actually pledged. That is a monitoring task for the treasurer’s office, and it needs records that can be checked quickly if a bank weakens.

Credit unions follow the same arithmetic under a different insurer. Deposits at a federally insured credit union are covered to the same $250,000 standard by the National Credit Union Share Insurance Fund, which the NCUA administers. A business or municipality that banks with a credit union faces the same concentration question.

Broker-dealers meet a regulatory version of the problem. The SEC’s customer protection rule, Rule 15c3-3, requires a special reserve bank account for the exclusive benefit of customers. Cash deposited at an affiliated bank does not count toward that reserve, and cash at any one unaffiliated bank counts only up to a limit tied to that bank’s capital. The rule forces diversification of customer reserves, though it says nothing about the firm’s own operating cash.

Health systems usually have the opposite profile from a startup. Their cash is large but governed by investment policies, and their bond covenants already track days of cash on hand. Their sharper exposure is in the accounts that receive insurer payments and patient collections, which belongs under payment flows below.

Three ways to reduce the exposure

Procurement discipline offers a template. Organizations require backup suppliers for critical components and monitor the financial health of key vendors. The corrective steps for cash are plain:

• Spread operating cash across more than one institution. Two or three banks, each holding a portion of operating funds, means a single failure is a disruption rather than an existential threat.
• Use insured sweep or reciprocal deposit arrangements where they fit. These are services in which a bank spreads a large deposit across many partner banks in amounts below the insurance limit, so that the whole balance is insured while the company still deals with one relationship.
• Hold reserves in Treasury bills or government money market funds rather than in uninsured deposits. A Treasury bill is short-term lending to the US government. A government money market fund is a fund that holds such securities. Neither depends on the health of a single bank.

What each instrument gives up

Reciprocal deposit and insured sweep networks place slices of a large balance at partner banks, each slice below the limit. The company keeps one relationship and one statement. The catch is operational. Funds may move only on set schedules, rates are set by the bank and the network, and the protection depends on the network’s records being accurate. Since a 2018 change in federal law, banks can treat a capped amount of reciprocal deposits as not brokered, which has made the product widely available.

Government money market funds hold Treasury securities and repurchase agreements backed by them. They usually offer same-day or next-day liquidity. A fund share is not a deposit, and its value could in principle fall, although government funds have a long record of holding a stable price. In July 2023 the SEC adopted money market reforms that, among other things, removed the provisions that had let funds suspend redemptions temporarily.

Treasury bills held directly are claims on the US government. What protects them from a bank failure is custody. Securities held in a custody account belong to the client and are not part of the custodian bank’s own balance sheet. A failure leads to their transfer rather than to a claim in receivership. Buying, selling and maturing bills still takes settlement time, so they suit reserves rather than next week’s payroll.

Each choice costs some yield or convenience, and no choice requires predicting which bank will fail. The aim for a board is to make sure no single failure can stop the company paying its people, rather than to pick winners in the banking industry.

A treasury policy can make this concrete. A treasury policy is the written rulebook for how a company holds and moves its money. It can set a maximum uninsured balance per bank, expressed in days of operating cash rather than dollars, so that it scales as the business grows. It can set a minimum number of banking relationships with live access. And it can set a counterparty review cycle that includes public financial indicators, the same kind of periodic health check applied to any important vendor. Credit agreements that require all deposits at the lender deserve negotiation at the next renewal.

The choice of metric matters. Days of operating cash per bank answers the operational question directly. A dollar cap set when the company was small becomes meaningless after two funding rounds. A percentage cap can still leave a very large uninsured balance when total cash is large.

Board reporting closes the loop. A one-page view of balances by bank, insured and uninsured, with days of runway at each, takes little effort to produce monthly. It turns an abstract concentration into a number directors can question. “We have 90 days of operating cash, and 80 of them sit uninsured at one bank” is a sentence that prompts action in a way that a general reassurance about liquidity does not.

The second exposure: payment flows

The second exposure was the plumbing. Even companies with modest balances at SVB had payroll, vendor payments and customer collections routed through it. This is where the technology comes in, and where many leaders discovered how little they knew about how money actually moves through their organization.

When a company runs payroll, its finance system or payroll provider typically produces a payment file, a structured list of who gets paid how much, and sends it to the bank through a secure connection. The bank then pushes those payments out through national payment networks. Customer payments work in reverse: customers are told to send money to specific account details, and the bank credits them as they arrive. Corporate cards and merchant settlement, the process by which card payments from customers end up in a business’s account, also run through specific banks.

When SVB closed, every one of those pipes was affected. A payroll file sent on Thursday might not settle. Customer payments directed to SVB accounts were stranded. Card programs and merchant settlement tied to the bank were disrupted.

Mapping where the money moves

Most organizations cannot draw this map on demand. A useful inventory lists every inbound and outbound flow, the account behind it, the channel it uses and the system that starts it. Outbound flows include payroll, vendor payments, tax remittances, loan payments and refunds. Inbound flows include customer payments, card settlements, lockbox receipts, government reimbursements and investment income.

Each line should also record who else holds the instructions. Customers keep your account details in their own vendor records. Payroll providers hold your debit authorization. Card processors hold your settlement account. Tax authorities may hold an account for electronic payments. Changing banks means updating every one of those records, and most of them are outside your control.

Sector shapes the map. A health system receives most of its revenue from insurers and government programs by electronic funds transfer to accounts registered with each payer. For Medicare, changing the receiving account means filing a new electronic funds transfer authorization with the provider’s Medicare administrative contractor, and commercial payers have their own enrollment steps. A county collects property taxes through lockbox and online portals, and its disbursement accounts may be designated by ordinance or board resolution. A fintech routes customer funds through partner banks under program agreements that take months to replace.

Moving a balance is quick. Moving payment flows is slow. It requires new account details with customers and payers, new connections with payroll providers and updated vendor instructions. Larger firms must also re-establish file transmission, authentication and approval workflows with a new bank. Authentication here means the digital credentials that prove a payment instruction really comes from the company. Approval workflows are the rules about who must sign off on which payments. Building all of that from scratch normally takes weeks.

What onboarding a second bank involves

Opening a commercial operating account with payment capability is a project with distinct steps. The bank must complete know-your-customer checks, including identifying the company’s beneficial owners. It must underwrite ACH origination, because a bank that sends payments for a client takes the risk that the client cannot cover them. It then sets exposure limits that cap how much the client can send.

On the company side, someone signs a treasury services agreement and sets up file transmission or an API connection. Users get credentials and security tokens. Approval rules are configured, along with fraud controls such as positive pay, a service in which the bank checks presented checks or debits against a list the company has issued. Then the whole path is tested.

Each step exists for a reason and has a lead time. A company that completed this work in a calm month, and kept it alive afterward, had a structural advantage over one that started on a Saturday in March 2023.

Companies that already had a second operating bank with live payment capability could redirect payroll within a day. Companies that had to open an account and build payments from scratch did so in a weekend when thousands of others were trying the same thing. Banks receiving those requests were overwhelmed, and onboarding checks that exist for good reasons could not be skipped.

Ownership should be explicit. Treasury owns the bank relationships. Accounts payable and payroll own payment instructions and approval chains. Information security owns credentials, connection security and verification procedures. Procurement or third-party risk owns the inventory and the annual review. A named executive, usually the CFO or treasurer, owns the overall plan and its test schedule.

Configurability is the real safeguard

The technology point is configurability. Payment integrations hard-wired to one bank’s file formats and credentials are a single point of failure. A treasury management system gives a finance team one view of cash and payments across banks. A payment hub routes payment instructions to whichever bank is chosen. Either can be set up to work with more than one bank. With backup credentials and approval chains already in place, a crisis becomes a configuration change rather than a construction project.

Testing matters here. Running a real payroll cycle through the second bank once or twice a year proves the path works. Holding an account that has never moved money proves nothing. A backup that has never been used is a hypothesis, and a weekend crisis is a poor time to test it.

Auditors and boards can reasonably ask for evidence. Useful evidence includes the date of the last live payroll through the backup bank, the list of active users and approvers at each bank, and confirmation that credentials and tokens are current. Those items belong in the same continuity testing record used for system disaster recovery, so they are reviewed on the same cycle.

Fraud follows disruption

Fraud risk rises during these switches. Changing bank details is exactly what payment fraudsters impersonate. A common scam involves a criminal emailing a company’s customers, posing as the company, to say “our bank details have changed, please pay this new account.” Firms redirecting collections after SVB had to send genuine new instructions to customers who were being told by their own security teams to distrust such messages.

The FBI calls this business email compromise, and its Internet Crime Complaint Center has for years ranked it among the costliest categories of crime reported to it. A bank failure hands fraudsters a ready-made story. Genuine notices and fraudulent ones look alike, and accounts payable teams are under pressure to process changes quickly.

Two controls do most of the work. Any change to a supplier’s or customer’s bank details should require verification through a separate channel with a known contact, whoever asks for it. And new bank details should trigger a hold or a small test payment before large amounts move. Both slow a switch slightly, and both cost far less than one misdirected payroll.

A pre-agreed verification method, such as a callback to a known contact on a number already on file, keeps the switch from becoming an opening. The best time to agree that method with major customers and suppliers is before anyone needs it.

The third exposure: dependent services

The third exposure was the least visible. Many organizations did not bank with SVB directly but used services that did. A payroll provider, a payment processor, a lending platform or a fintech partner might hold client funds or settle transactions through it. A fintech, short for financial technology company, is a firm that offers financial services through software, often relying on a traditional bank behind the scenes to hold the money. Their clients learned about this dependency when their own payments stalled.

This is sometimes called fourth-party risk: the risk of your supplier’s supplier failing. It is hard to see because it does not appear in your contracts or your bank statements. It appears only when something breaks.

Where hidden bank exposure turned up

The SVB weekend produced public examples. Circle’s disclosure about the reserves behind USDC showed how a financial product could depend on a bank its users had never chosen. Rippling, a payroll and HR platform, said some customer payroll payments routed through SVB were delayed, and moved its payment processing to another bank. Customers of payroll, expense, card and marketplace platforms asked the same question that weekend: where does our money go between us and the people we pay?

Exposure of this kind hides in predictable places. It lives with payroll providers and professional employer organizations that debit a client account and pay employees from their own accounts. It lives with payment processors that settle card receipts before passing them on. It lives with marketplaces that hold seller proceeds, and with expense and card platforms that fund cards from pooled accounts. Each holds money in transit at a bank the client rarely knows.

For fintechs and broker-dealers this is a core diligence question rather than a footnote. A broker-dealer is a firm that buys and sells securities for clients and often holds client cash while it does so. Any organization choosing such vendors should ask four things:

• Which banks hold the vendor’s settlement and client funds.
• How those funds are titled, meaning whose name is legally on the account, and in what capacity.
• What the vendor’s contingency plan is if that bank fails.
• Whether client funds sit in accounts that would be insured for the end customer, and whether the vendor’s records are good enough for that coverage to work in practice.

The last point needs a brief explanation. When a platform holds many customers’ money in one pooled account at a bank, deposit insurance can in some cases “pass through” to each individual customer, as long as the records clearly show who owns what. If the records are poor, that protection may not work as intended. Vendors that could not answer these questions quickly were showing something about their own treasury discipline.

Reading the answers

Titling is the most technical of the four questions and the most important. Funds held “for the benefit of” customers, usually called FBO accounts, are pooled custodial accounts. FDIC rules allow pass-through coverage to each underlying customer only under conditions. The bank’s account records must disclose the custodial relationship, and the owners and their interests must be identifiable from records kept by the bank or the custodian.

A vendor should be able to say who keeps those records, how often they are reconciled against the bank’s balance, and how quickly they could be produced to a receiver. Pass-through coverage protects against the failure of the bank. It does not protect against the failure of the vendor. If the fintech or middleware provider fails while the bank survives, the customer’s position depends on the quality of the ledger and on bankruptcy law. Counsel should review how a given arrangement would be treated.

A good answer names the banks, describes the titling, gives a reconciliation frequency and points to a tested contingency plan. A weak answer refers to “our banking partners” in general terms. The gap between the two tells a buyer a good deal about a vendor’s operational maturity.

Broker-dealers and fintechs that hold client money also sit on the other side of this question. Their customers, and their regulators, will ask where client funds are held and what happens if that bank fails. A clear, tested answer is now part of the product. It should cover how quickly funds could be moved and whether the records would support pass-through insurance claims.

Regulated vendors carry extra obligations that buyers can use. Banks that partner with fintechs are expected by their regulators to oversee those partners as third parties. Broker-dealers must meet the customer protection rule’s segregation requirements and are examined on them. A procurement team buying from either kind of firm can ask for a summary of the evidence those firms give their own examiners, which is usually more informative than a marketing answer.

What it costs, and why it is worth paying

Every one of these steps has a cost, and they should be decided as procurement trade-offs rather than as reflexive reactions to a frightening weekend. A second operating bank adds fees, reconciliation work and integration effort. Reconciliation is the routine work of matching bank records against the company’s own books, and every extra account adds to it. Insured sweep networks and Treasury holdings give up some yield and add operational steps. Contingency testing takes staff time.

How banks price the relationship

Business banking is often paid for with balances. Many banks give an earnings credit on operating balances that offsets service fees shown on the monthly analysis statement. Move balances away, and fees that were invisible become cash charges. Lenders also price loans partly on the deposits they expect to hold. A company that diversifies may see a modest rise in fees or loan pricing, and it should ask for that cost explicitly at the outset.

Set against those costs is the value of continuing to pay staff and suppliers when a bank fails. For most firms the insurance is cheap relative to that outcome. Missing a payroll does lasting damage: employees lose trust, some leave, and in many places there are legal consequences for late wages. Missing supplier payments can interrupt operations. Stranded customer receipts can create a cash squeeze even when the business is fundamentally healthy.

The strongest objections

Three objections deserve a serious answer. The first is that the government will step in. In March 2023 it did, but only after a systemic risk exception that required formal votes and a Treasury decision, over a weekend nobody could plan around. Without that exception, the FDIC is bound to resolve a failed bank at the least cost to the insurance fund, which can leave uninsured depositors with losses. A treasury policy that counts on a rescue depends on a political judgment made under pressure.

The second objection is that relationship banking works. A bank that knows a company well may lend when others will not, and may look after a loyal client in a crunch. There is truth in that, and it argues for keeping a primary relationship. It does not argue for keeping all operating cash and every payment flow there. Banks are used to clients holding a second operating account.

The third objection is cost for small firms. A company with balances near the insured limit has little to gain from spreading cash across several banks. For it, a tested backup payment path matters more than diversified balances. The approach scales: the larger the uninsured balance and the more complex the payment flows, the more of it applies.

Treasurers should present this to the board as a priced resilience choice. That means putting a number on what the extra bank, the sweep arrangement and the annual test cost, and setting it beside what a week without access to operating cash would mean. Framed that way, it stops being an abstract worry and becomes a decision directors can make with open eyes.

The same software company, a year later

Now suppose the same software company after a year of sensible work. Its treasury policy caps the uninsured balance at any one bank at a set number of days of operating cash, and someone tracks balances against that limit. Concentration therefore does not creep back as the business grows or as lending relationships pull deposits back to one bank. It has two operating banks, both with live payroll and collection capability, and it runs one real payroll cycle through the second bank each spring. A second account that is opened, given a small balance and never used fails when needed: credentials have expired, approvers have left and nobody remembers the process.

Reserves beyond near-term needs sit in government money market funds. Its treasury management system can route payments to either bank. Its largest customers have agreed a callback procedure for any change in payment instructions, because a contingency plan that changes payment details at speed with no verification step invites the very scams it should prevent. Its payroll provider has disclosed which banks hold its client funds, so diversifying its own banking has not left a vendor running everything through a single bank nobody has asked about. The board sees a one-page bank exposure report every month.

The company also tracks a short set of measures. They are uninsured days of cash at each bank, the date of the last live payment test, the number of active approvers at each bank, and how many critical vendors have disclosed where they hold client funds. Each takes minutes to update each month, and together they show whether the arrangement is holding up or decaying.

The company already applies this discipline to its cloud hosting and its key software vendors. It has simply extended it to the institution that holds its money, and kept it up after the memory of the weekend faded.

Cash, payroll, covenants and platforms on the finance committee agenda

Probing this well needs no knowledge of payment file formats. Each of the questions below maps to one of the exposures: the first and third concern cash, the second concerns payment flows, the fourth concerns dependent services and the fifth concerns cost. Good answers come with evidence, such as a dated exposure report, a test record, a covenant schedule or vendor responses on file.

1. How many days of operating cash do we hold at each bank, and how much of it is above the insurance limit?
2. If our main bank closed on a Friday, could we run payroll the following week, and when did we last move real money through our second bank?
3. Do any of our loan agreements require us to keep all our deposits with the lender, and when can we renegotiate that?
4. Which banks do our payroll provider, payment processors and other financial platforms use, and how are our funds titled with them?
5. What does this resilience cost us each year, and what would a week without access to operating cash cost us?

SVB will be remembered, rightly, as a story about interest rates, deposit concentration and supervision. For everyone else, its most practical legacy is simpler. The institution that holds a company’s money is a supplier. It deserves the same scrutiny, the same backup plan and the same testing as any other supplier the business cannot run without.

With hindsight

SVB turned out to be the first of several shocks rather than a one-off. Signature Bank was closed that same weekend, and First Republic followed in May 2023. In nominal terms, 2023 produced three of the four largest bank failures in US history, behind only Washington Mutual in 2008. First Citizens BancShares agreed in late March 2023 to buy SVB’s deposits and loans from the FDIC, and SVB’s former parent company filed for bankruptcy protection.

The official post-mortems were unusually blunt. The Federal Reserve’s own review, published in April 2023, criticized both the bank’s management and its supervisors, an uncommon admission that the referees had missed things too. The FDIC published its own review of Signature Bank’s supervision the same day. In November 2023 the FDIC finalized a special assessment on larger banks to recover the cost of protecting uninsured depositors. It estimated the cost at about $16.3 billion, to be collected over eight quarters from banks with large uninsured balances. The wider banking industry, in effect, was asked to pay for the decision to make every SVB and Signature depositor whole.

Liquidity policy moved too. In July 2023 the banking agencies updated their interagency policy statement on funding and liquidity risk, stressing contingency funding plans and readiness to borrow from the Federal Reserve’s discount window. The Bank Term Funding Program stopped making new loans in March 2024, a year after it opened, as its original terms had envisaged. Debate about how liquidity rules should account for runs that move at the speed of a phone app carried on well beyond that.

Policy on deposit insurance itself moved more slowly. The FDIC’s May 2023 review of options favored targeted higher coverage for business payment accounts over unlimited coverage. Congress did not enact the deposit insurance changes the FDIC laid out that May, and bills to raise coverage for business payment accounts were still pending in 2026. The implication for businesses is straightforward: the $250,000 limit still applies, and nobody should plan around the assumption that every future failure will end with a weekend rescue.

Corporate treasury practice changed more quickly than the law. Companies built more multi-bank relationships and made greater use of reciprocal deposit networks and money market funds. Those are the tools described above, and they moved from niche to normal for many mid-sized firms. Money market fund assets reached record levels in 2023 and kept climbing, according to Investment Company Institute data, helped also by the higher short-term rates that had undone SVB.

The dependent-services point came back from another direction in 2024. The bankruptcy of Synapse, a banking-as-a-service middleware provider, left end users unable to reach their money for months. Banking-as-a-service middleware is the software layer that sits between consumer-facing fintech apps and the banks that actually hold the money. When it failed, the question of who held which customer’s funds, and whether the records could prove it, stopped being theoretical.

Regulators responded on several fronts. In June 2023 the federal banking agencies finalized joint guidance on how banks should manage third-party relationships, including fintech partners. In 2024 the Federal Reserve took an enforcement action against Evolve Bank & Trust, one of the banks in the Synapse arrangement, over its fintech partnerships. In September 2024 the FDIC proposed a recordkeeping rule for custodial deposit accounts with transactional features, aimed squarely at the pooled accounts that fintech customers rely on.

Some fears from that spring did not come true. Commentators worried about a long chain of regional bank failures. After First Republic, failures returned to a low rate and none approached SVB’s size. The lasting change was in how depositors behaved rather than in how many banks failed.

The pattern across both events is consistent. Firms that treated banking as a supply chain with backups weathered both events best. In practice that means asking where the money sits, how it moves and who else stands between the company and its cash, and making sure the answers are tested rather than assumed.