When the Anchor Customer Stops Buying

For five weeks at the back end of 2025, a large slice of West Midlands manufacturing simply stopped. The Jaguar Land Rover cyber incident has been picked over from every angle since, and the prevailing framing has settled on "cyber risk in manufacturing." That framing is correct, but it is incomplete. For the roughly five thousand businesses sitting behind JLR in its supply chain, the lived experience was not really about cyber at all. It was about what happens when an anchor customer, for any reason, stops buying.

That experience is worth examining carefully, because the risk it exposed is not specific to JLR, not specific to automotive, and not specific to cyber events. It is structural, and it lives in the customer book of a large number of mid-market UK manufacturers.

‍

The shape of the problem

Speak to a tier two or tier three supplier in the West Midlands and the story of September and October 2025 sounds remarkably consistent. Production lines that had been geared, over a decade or more, to deliver on JLR's just-in-time schedule were suddenly producing nothing. Component stock was sitting in racking. Finished work-in-progress was sitting on pallets, paid for and not invoiced. Skilled people were either on enforced leave or moved on to make-work tasks. Some businesses laid people off within weeks. One reported in the press let go of nearly half its workforce.

The financial mechanics behind that picture are familiar to anyone who has worked closely with manufacturing accounts. Working capital tied up in inventory and WIP does not unwind quickly when the customer that would normally pull it through the system pauses. Receivables stretch as customers themselves come under cashflow pressure. Banking covenants drawn around steady EBITDA and orderly working capital cycles start to look stressed. Suppliers' suppliers, further down the chain, start asking nervous questions about their own positions. The longer the shutdown lasts, the more of this risk crystallises into something permanent: lost contracts, lost staff, lost confidence.

What the JLR situation made unusually visible was how many businesses had, over time and without ever consciously choosing it, become extensions of a single customer.

‍

How does customer concentration build up without anyone noticing?

Concentration is rarely the result of a strategic decision. It is almost always the result of a series of perfectly rational ones.

A long-standing relationship with a major customer is, by every short-term measure, a good thing. Margins are reasonable. Volumes are predictable. The cost of serving that customer falls over time as systems align. Engineering and quality teams build deep understanding of that customer's specifications and become more valuable to them, which in turn brings more work. Investments in tooling, line layout, even shift patterns get optimised for that customer's drumbeat. None of this is a mistake. It is, in many ways, what good manufacturing relationships look like.

The problem is that the same dynamics make diversification progressively harder. Capacity is committed. Engineering attention is absorbed. The sales function, if it still exists in any meaningful form, has often been gradually de-resourced, because the business does not feel like it needs to win new customers. Tooling investments tie the supplier to that customer's product cycle. Contract terms quietly migrate towards exclusivity for the specific application, even when the underlying capability could serve other markets.

Most concentrated supply businesses do not realise quite how concentrated they have become until something forces the question. The JLR shutdown was that question for a very large number of Midlands manufacturers, and the answer in many cases was uncomfortable. Where a single customer accounts for sixty, seventy, eighty per cent of revenue, the business has, in effect, ceased to be a standalone enterprise. It has become a captive division of its largest buyer, with all the operational dependency of a captive but none of the financial protection.

‍

The covenant conversation no one wants to have

There is a specific moment in a disruption of this kind that owners tend not to plan for, and which can prove decisive. It is the conversation with the bank.

When an anchor customer pauses, the impact on the management accounts is not subtle. Revenue falls off a cliff. Working capital balloons. EBITDA, depending on how fixed-cost-heavy the business is, can turn negative within weeks. None of these movements are the result of underlying business deterioration. They are the mechanical consequence of a single line in the income statement going dark for a period.

The challenge is that covenant tests, particularly those drawn around rolling twelve-month EBITDA or net debt to EBITDA, do not distinguish between a structural decline and a short-term shock. A four to six week disruption can pull a covenant test into breach territory months later, long after the immediate operational issue has resolved. By that point the bank is looking at a deteriorated set of figures and the borrower is trying to explain history.

The businesses that came through the JLR period most cleanly tended to be the ones that picked up the phone to their bank in week one rather than week five. Lenders are far more comfortable having a forward-looking conversation about a known disruption than a backward-looking one about a covenant breach. The optionality on amendments, waivers, and bridging facilities is much wider before the figures are baked in. By the time the year-end accounts hit the relationship manager's desk, the conversation is a different one altogether.

‍

Why business interruption cover is not the safety net most owners assume

Many manufacturers carry business interruption insurance and assume, broadly, that they are protected against an event of this kind. In a meaningful number of cases, they are not.

Standard business interruption policies respond to physical damage at the insured's own premises. They typically do not respond to a cyber event upstream at a customer. Contingent business interruption cover, which sits over the standard policy and can respond to disruption at a named customer or supplier, exists, but it is bought by a minority of mid-market manufacturers, the cover limits are usually modest relative to the exposure, and policy wordings on cyber-triggered events are still inconsistent across the market.

The right time to read your own BI wording, in detail, is not after an event. It is now. A surprising number of owners discover, in the cold light of a claim, that the cover they thought they had does not align with the exposure they actually carry.

‍

What if diversification is not realistic?

It is worth taking the counter-argument seriously. For some manufacturers, the standard advice to "diversify the customer book" is not really actionable. A business that has built itself around producing a specific part that only goes into one OEM's product cannot meaningfully serve a different market with out re-engineering its entire proposition. Forcing diversification in that situation often means accepting lower-quality work at lower margins, and weakening the very relationship that has sustained the business.

For these businesses, the right response is not diversification for its own sake. It is liquidity, scenario planning, and contractual hygiene. That means holding more cash than feels comfortable. It means modelling, in advance, what a six, eight, and twelve week pause in the anchor customer's demand actually does to the management accounts, the covenants, and the workforce. It means looking hard at payment terms, retention clauses, and the position the business would be in ift he anchor customer were itself under financial pressure. It also means using the strength of the relationship while there is no crisis to negotiate the kind of protections, on tooling ownership, on minimum volumes, on notice periods, that look quite different once the relationship is under stress.

There is also a case for keeping a small but real second customer relationship alive even where it is not commercially compelling on its own terms. Twenty per cent of revenue from a second customer is a poor return on the sales effort while everything is calm. It is invaluable the day the anchor customer goes dark, because it keeps the lights on, keeps a core team working, and keeps the business credible with lenders and insurers.

‍

So who actually owns this in the business?

The unsatisfying answer to the concentration question, in most mid-market manufacturers, is that nobody really owns it. Sales owns the customer relationships. Operations owns the production response. Finance owns the working capital. The board, often dominated by people who have grown up inside the anchor customer relationship, tends to view concentration as a sign of commercial success rather than a risk.

Treating customer concentration as a board-level risk, with the same seriousness usually given to health and safety or compliance, is the change that actually matters. It puts the question of how exposed the business is, and what the plan is if the exposure crystallises, onto an agenda where it is harder to ignore. It also creates a natural home for the work that follows: scenario modelling, contingency planning, the difficult conversations with banks, insurers, and customers, and the slow, patient work of building genuine optionality into the customer book.

The JLR shutdown was, for the supply base, a story about cyber risk only in the most superficial sense. Underneath, it was a story about how much of a business can sit behind a single name in the ledger, and how quickly that can stop being an asset and start being a liability. The next disruption may come from a cyber event, a tariff, a shift in OEM strategy, or simply a customer deciding to change suppliers. The form is hard to predict. The exposure is not.

‍

This article has been prepared for information purposes only. Formal professional advice is strongly recommended before making decisions on the topics discussed in this release. No responsibility for any loss to any person acting, or not acting, as a result of this release can be accepted by us, or any person affiliated with us.

‍