insurer asks who my main customers are must I disclose that
Customer concentration is a risk assessment question, not a secret
Yes, in practice this is usually shared, but mostly in a form that does not contain names. An insurer asking this — for example with trade credit insurance, commercial property insurance or a liability policy — wants to know how dependent your business is on a small number of customers. This is called customer concentration risk: if one customer represents 60% of your turnover and that customer leaves or does not pay, that is more relevant to the insurer than with a customer with a hundred small customers. So the question is rarely about who your customers are, but about how concentrated your turnover is.
In practice you can often answer this with a percentage or a range — "largest customer is less than 20% of turnover" — without naming names. Some portals explicitly ask for the identity of the largest customers, for example with trade credit insurance where the insurer assesses debtor risk per customer. Then a name is part of the question. If you are unsure whether a name is necessary or whether a percentage is sufficient, that is a question for the customer who issues the list, not something we make a statement about. Note that this is different from the company's annual turnover providing: turnover is a total figure, customer concentration is a distribution.
Where this comes from: no legal obligation, but market practice
There is no law that requires an insurer to ask about customer concentration, and there is no law that requires you to share names — this goes through the policy conditions and the insurer's own acceptance procedure. What is fixed are the basic data of your business, as registered under the Trade Register Act 2007: name, registration number and sector. Customer concentration is not listed there — that is additional information that the insurer requests separately for risk assessment. If you are unsure what a specific portal exactly means by "main customers", the question formulation of that insurer itself is the first place to look.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.