There's a lot to like about Upstart Holdings (UPST 3.90%). The company is widening the options available to borrowers with low credit or no credit by using less traditional factors -- and proprietary artificial intelligence -- to determine an individual's creditworthiness in the blink of an eye. It aims to be more accurate and more inclusive than FICO.

Because access to credit can be key to major life goals like buying a home or going to college, that's a great thing for people from segments of society that have historically been priced out. Right now, Upstart is focused on smaller, personal loans, but that could change over time.

Beyond that, Upstart has been a great stock to own. Since its first day of trading last year, shares have almost quintupled in value. All in all, it makes for a feel-good story.

But there's a not-so-obvious risk that deserves attention. And while it may end up being nothing to worry about, it's one that every shareholder should be aware of.

A potential borrower reviews his credit options.

Image source: Getty Images.

Concentration risk

That risk is called "concentration risk." In short, this is when a company relies on a few customers for the bulk of sales. This is so dangerous because a single decision, made by a small group of people, for any reason, could bring that company to its knees.

If you don't believe me, just ask the cadre of companies that relied on Apple as their main customer, only to have the company hitch a ride somewhere else. When that happens, you don't want to be holding shares.

You might think the fact that Cross River Bank in Fort Lee, N.J., accounted for 63% of Upstart's revenue (via loan issuing) might be the concentration I'm talking about. But while that shouldn't be ignored, I actually don't think it's that big a deal. Upstart needs someone to issue loans. Right now, Cross River is more than happy to oblige. But if Upstart's artificial intelligence can do what it says it can do -- consider multiple variables that allow for higher rates of loan acceptance at lower rates for borrowers and lower loss ratios for lenders -- then I don't think it will have any trouble pulling banks into its ecosystem.

Instead, Upstart's concentration risk comes from Credit Karma, the site that, among other things, analyzes your credit history for free, and without dinging your credit history, for an "official check" of your score. It turns out that over half of the traffic to Upstart comes from referrals via Credit Karma.

In plain English, that means that if someone is using Credit Karma to get a sense of their finances and look at loan options, Credit Karma can send that person over to Upstart. While details aren't available, Credit Karma likely gets an affiliate fee for that referral.

Trending in a bad direction?

Here's the key: That concentration is only getting to be a bigger issue. In 2019, 38% of Upstart's traffic came from Credit Karma. By the end of 2020, it was up to 52%. And Credit Karma can nix the partnership whenever it pleases.

Don't expect that concentration to change too quickly. In Upstart's fourth-quarter conference call, CEO and co-founder Dave Girouard said: "We have no desire to reduce the scale of the partnership we have with Credit Karma. In fact, we want to keep building it."

Here's the key piece of information we haven't discussed yet: Credit Karma was recently acquired by Intuit, the parent company of QuickBooks, Mint.com, and TurboTax. I only mention those different brands because if there were one company that had lots of financial data it could use to develop a competing algorithm to determine creditworthiness, Intuit would be on the short list.

Does that mean you should stay away?

To be clear, this doesn't mean Upstart isn't a worthy investment. A look at Intuit's most recent earnings shows that revenue from Credit Karma increased an astounding 120% in just one quarter. It's impossible to know how much of that Upstart accounted for, but it corresponds nicely to Upstart's transaction volume more than doubling year-over-year during the first quarter.

It might be that Upstart is providing a ton of cash to Credit Karma, and Intuit just wants to keep the peace and keep collecting money for funneling customers over. Or it might be that Intuit sees the booming business at Upstart and wants to begin spending its cash hoard on developing its own proprietary algorithm. Once perfected, it could divert all those customers from Upstart to its own in-house solution.

There's risk for both sides, and I don't think Intuit would ever really consider this option unless it was sure it could pull it off. It might be frustrating to accept, but there's really no way to know -- unless you're intimately familiar with Upstart's algorithm -- if that would happen.

If it does, it could bring Upstart to its knees. But if it doesn't, Upstart may continue its stellar run. Like I said: This doesn't mean Upstart's dead in the water, just that you should size your investment in the company according to this risk.