Skip to content
RiskTemplates · The Daily Brief Friday, July 10, 2026
Wire CFPB's New Enforcement Principles: What the Bilt Case Tells You About How the Bureau Intends to Police Consumer Finance JUN 22

Feature Operational Risk

Cash Burn KRIs for Fintechs: Runway, Reserve Coverage, and Funding Dependency

Cash burn metrics are finance reporting. Cash burn KRIs are risk management. Here's how to build the six indicators that turn your runway and reserve data into early warnings your risk program can actually act on.

By Rebecca Leung · June 2, 2026 ·
Table of Contents

Most fintechs track burn rate. Very few have turned it into a KRI.

The distinction matters more than it sounds. A burn rate on a dashboard tells you how fast the company spent money last month. A burn KRI tells you whether that rate has crossed a threshold that requires a specific risk response — today, with a named owner and a documented action. One is finance reporting. The other is risk management.

This distinction is what separates fintechs that get ahead of liquidity problems from those that discover them during a board meeting, a sponsor bank RFI, or a failed funding round.

TL;DR

  • Cash burn metrics become KRIs when they have thresholds, owners, escalation paths, and connections to contingency actions — not before.
  • Six KRIs matter most: net burn rate, runway in months, unrestricted cash ratio, funding commitment coverage, revenue concentration, and burn multiple.
  • Unrestricted cash is not the same as total cash — pledged collateral, reserve requirements, and sponsor bank holds reduce what you actually control.
  • Revenue concentration above 30% for a single customer is a risk exposure your bank partner will ask about, even if your finance team treats it as a growth milestone.
  • Burn KRI thresholds should connect directly to contingency plan triggers — if they don’t, the dashboard is theater.

The Finance Reporting Gap

Fintechs typically produce clean monthly finance reporting. Burn rate, cash position, runway — these numbers appear in investor updates, board decks, and treasury reports. The problem is that having the number is not the same as managing the risk.

The Federal Reserve’s post-mortem on Silicon Valley Bank made this point sharply in the bank context: concentration and liquidity data existed and was visible to management. The failure wasn’t in the data. It was in the translation of that data into risk thresholds with escalation mechanisms — the work of converting a metric into a KRI.

Fintechs face the same gap. Most burn rate conversations happen with investors or the CFO, framed around fundraising timelines. They don’t happen at the risk level, where the question is: at what point does our burn rate represent a risk that changes how we operate?

That’s the question a cash burn KRI is designed to answer.

The Six Cash Burn KRIs for Fintechs

1. Net Monthly Cash Burn Rate

What it measures: Average net cash outflow per month — total cash out minus total cash in, averaged over a rolling 3-month period.

Why 3-month average matters: Monthly burn fluctuates with one-time payments, prepaid contracts, and timing of receipts. A single-month figure creates false precision. A rolling 3-month average smooths noise while still capturing trend direction.

Thresholds to consider:

  • Green: Burn rate tracking within 10% of budget
  • Amber: Burn rate 10–25% above budget for two consecutive months
  • Red: Burn rate 25%+ above budget, or two sequential months of acceleration without an approved plan

Owner: CFO, with Risk and Board as escalation path at amber/red.

Data source: Monthly cash flow statement, reconciled to bank statements.

2. Runway in Months

What it measures: Current unrestricted cash balance divided by trailing 3-month average burn rate.

This is the most-watched metric — and the one most subject to false precision. A fintech with 18 months of runway on paper but 40% of its cash restricted by pledged collateral or sponsor bank reserve requirements has materially less runway than the number suggests. Runway must be calculated on unrestricted cash.

Thresholds to consider:

  • Green: 18+ months of runway
  • Amber: 12–18 months — active fundraising or cost reduction discussions should be in motion
  • Red: Below 12 months — board-level contingency plan must be active

Why 12 months is the minimum floor: Most fintechs pursuing Series A or B funding need 6–9 months from first pitch to cash in the bank under normal market conditions. Banking charter applicants should budget 12+ months for regulatory approval before revenue generation begins. Twelve months of runway at amber/red thresholds means the contingency window is already closing.

Owner: CFO, with weekly updates to Risk when at amber.

3. Unrestricted Cash as a Percentage of Total Cash

What it measures: Cash that is freely available for operations versus total cash held across all accounts.

This KRI exists because the total cash number visible on most treasury dashboards overstates actual liquidity. Common sources of restricted cash at fintechs:

  • Collateral pledged against a venture debt facility or working capital line
  • Sponsor bank reserve requirements under banking-as-a-service agreements
  • Regulatory minimum capital or reserve deposits
  • Customer funds held in trust or custodial accounts (not yours, but in your accounts)
  • Escrow balances from M&A or partnership agreements

Thresholds to consider:

  • Green: Unrestricted cash is 80%+ of total cash
  • Amber: 60–80% — document why the restricted portion exists and when it releases
  • Red: Below 60% — escalate to board and begin review of collateral release triggers

Owner: Treasurer or Head of Finance, with Risk review at amber/red.

4. Funding Commitment Coverage Ratio

What it measures: Confirmed and available funding commitments (signed term sheets, committed credit facilities, signed investment agreements) as a multiple of next 6-month burn.

Why this matters: Many fintechs count unconfirmed funding discussions in their runway projections. Soft commitments from investors who “intend to participate” in the next round are not commitments. This KRI forces the distinction.

Thresholds to consider:

  • Green: Confirmed commitments cover 12+ months at current burn
  • Amber: Confirmed commitments cover 6–12 months
  • Red: Confirmed commitments cover less than 6 months of burn — contingency plan activation required

Owner: CFO and CEO jointly, with board notification at red.

Data source: Signed term sheets, credit agreements, board-approved investment commitments only.

5. Revenue Concentration (Top Customer Dependency)

What it measures: Revenue or cash receipts from the top 1, 3, and 5 customers as a percentage of total.

This KRI belongs in a cash burn program because revenue concentration creates a direct funding dependency. A fintech generating 50% of revenue from a single enterprise partner faces a runway risk that cannot be captured by burn rate alone. If that partner delays payment, renegotiates pricing, or churns, the operating cash flow assumption underlying the runway calculation collapses.

Thresholds to consider:

  • Green: Largest single customer represents less than 20% of revenue
  • Amber: Largest customer is 20–35% of revenue — document customer health and contract terms
  • Red: Largest customer exceeds 35% of revenue — escalate to risk committee and board

Why your bank partner cares: Sponsor banks reviewing fintech partner financial health increasingly ask about revenue concentration. A fintech heavily dependent on a single distribution partner is a concentration risk for the bank, not just for the fintech. This KRI will surface in bank partner due diligence conversations.

See Deposit Concentration KRIs: Measuring Customer, Sector, and Platform Dependency for how the same concentration framework applies on the funding side.

Owner: Chief Revenue Officer or Head of Finance, with Risk review at amber/red.

6. Burn Multiple (Trend)

What it measures: Net cash burn divided by net new annual recurring revenue — how much cash is being consumed to generate each dollar of new revenue.

Investors expect seed-stage companies to show a burn multiple around 3.2x and Series B companies around 1.4x as rough efficiency benchmarks. For risk purposes, the absolute number matters less than the trend direction.

A burn multiple that is worsening — more cash consumed per dollar of new ARR — is a forward-looking signal that the runway calculation will deteriorate even if absolute burn stays flat. A flat or improving burn multiple signals that the business is becoming more capital-efficient as it scales.

Thresholds to consider:

  • Green: Burn multiple stable or improving quarter-over-quarter
  • Amber: Burn multiple deteriorating for two consecutive quarters without an approved explanation (e.g., deliberate growth investment)
  • Red: Burn multiple worsening significantly with no approved investment thesis behind it

Owner: CFO, with quarterly review by Risk and board.


KRI Summary Table

KRIGreenAmberRedOwnerFrequency
Net burn rateWithin 10% of budget10–25% above budget25%+ above budgetCFOMonthly
Runway (months)18+ months12–18 months<12 monthsCFOMonthly
Unrestricted cash ratio80%+ of total cash60–80%<60%TreasurerMonthly
Funding commitment coverage12+ months covered6–12 months covered<6 months coveredCFO/CEOQuarterly
Revenue concentration (top customer)<20% of revenue20–35%>35%CRO/FinanceQuarterly
Burn multiple (trend)Stable/improvingDeteriorating 2 qtrsDeteriorating, no planCFOQuarterly

When Finance Metrics Become Risk Triggers

The thresholds above are starting points, not universal rules. The right calibration depends on your business model, funding environment, and regulatory context.

Three situations change the thresholds materially:

1. Regulatory licensing in progress. If your fintech is pursuing a banking charter, money transmitter license, or other regulatory approval, build an additional 12–18 months of runway into your amber threshold. Regulatory timelines slip. Applications get suspended and restarted. Examiners ask for additional documentation. A fintech that hits the amber runway threshold while waiting on regulatory approval has effectively entered crisis management mode because it cannot monetize the product while approval is pending.

2. Venture debt obligations. Many fintechs draw venture debt and carry monthly repayment obligations. This changes the effective burn rate when the debt service is large relative to operating expenses. The burn rate KRI should be calculated on a total-cash-out basis including debt service, not just operating expenses. A startup with $200K/month in operating burn and $80K/month in debt service has an effective burn rate of $280K — and the contingency plan needs to account for whether debt service accelerates in an event of default.

3. Sponsor bank reserve requirements. Under most BaaS arrangements, fintech partners are required to maintain minimum cash reserves with or for the sponsor bank. These reserves can represent 3–12 months of transaction volume and may not be accessible during a liquidity stress event. The unrestricted cash KRI should explicitly track what is and is not available for operations independent of sponsor bank requirements.

For the broader framework on how liquidity KRIs should connect to contingency planning, see Liquidity KRIs for Fintech and Banking Teams: Early Warnings Before the Funding Problem Becomes Obvious and Early Warning Indicators vs KRIs: How Liquidity Teams Should Use Both.

The Calibration Conversation Most Fintechs Avoid

Setting thresholds is the step most teams skip. They track the metrics, run the KPI dashboard, and declare the risk management function operational. Then when the 8-month runway number appears, it’s treated as a new development rather than a threshold breach that should have triggered action months earlier.

Calibration requires a documented answer to: what is the minimum runway required to execute our contingency plan? That answer determines the red threshold. Work backward from there for amber.

According to post-SVB regulatory analysis, the most common failure mode is that thresholds are set but never enforced — the number turns amber, nobody escalates, and six months later the same metric has turned red. The escalation path must be pre-committed: when the metric hits amber, a specific individual is notified within a specific timeframe and a specific conversation is mandatory.

The threshold means nothing without the escalation design.

So What? Turning These KRIs Into a Usable Program

If you’re starting from scratch, the minimum viable cash burn KRI program for a fintech is three metrics tracked monthly:

  1. Runway in months (on unrestricted cash)
  2. Net burn rate versus budget
  3. Revenue concentration (top customer percentage)

Set amber and red thresholds for each before the end of this quarter. Write down who gets notified when a threshold is breached. Put those thresholds in your risk appetite statement or risk committee charter so they’re documented commitments, not informal guidelines.

From there, add the funding commitment coverage ratio as your quarterly contingency planning check, and burn multiple as your investor-conversation-aligned growth efficiency signal.

The goal isn’t to generate more dashboards. It’s to create the organizational commitment that when one of these numbers turns amber, a conversation happens before it turns red.

If you’re building a broader KRI program across liquidity, operational, and compliance domains, the KRI Library (132 Key Risk Indicators) includes pre-calibrated financial risk KRIs with green/amber/red thresholds, owner assignments, and escalation triggers designed for fintech and financial services teams. You can get the KRI Library here.

◆ Need the working template?

Start with the source guide.

These answer-first guides summarize the required fields, evidence, and implementation steps behind the templates practitioners search for.

◆ Immaterial Findings · Weekly

Sharp risk & compliance insights. No fluff.

◆ FAQ

Frequently asked questions.

What is a cash burn KRI, and how is it different from a cash burn metric?
A cash burn metric tells you how much you spent last month. A cash burn KRI answers: is the rate of spending creating a risk that requires management action now? A KRI has a defined threshold (green/amber/red), an owner, an escalation path, and a connection to a decision — like revising hiring plans, accelerating a funding round, or activating a contingency plan. Without those elements, burn rate data is finance reporting, not risk management.
How much runway should a fintech maintain as a minimum risk threshold?
Twelve months of runway should be the absolute floor for most fintechs — and 18–24 months is the amber threshold where serious risk conversations should start. In 2026, with a more constrained funding environment than 2020–2021, investors and bank partners increasingly expect 24–30 months of runway at the point of a raise. Fintechs with regulatory licensing requirements face an additional complication: regulatory approval timelines regularly burn through 6–12 months of runway before a product generates revenue.
What is revenue concentration risk for fintechs and why does it belong in a KRI program?
Revenue concentration risk measures how dependent your fintech is on a small number of customers for the cash flows that fund your operations. A fintech generating 60% of revenue from three enterprise customers faces a qualitatively different liquidity risk than one with 300 SMB customers. If a single enterprise customer churns or delays payment, the runway impact is immediate. Monitoring revenue concentration as a KRI — with escalation when the top customer exceeds 30% of revenue — converts an invisible dependency into an actionable signal.
Should fintechs track burn rate separately from unrestricted cash?
Yes — they answer different questions. Burn rate tells you how fast money is leaving. Unrestricted cash tells you how much of what you have is actually available. Many fintechs discover too late that a significant portion of their cash balance is restricted — pledged as collateral for a credit facility, held in a sponsor bank reserve, or escrowed for a regulatory requirement. Unrestricted cash as a percentage of total cash is its own KRI because it measures how much liquidity you actually control.
How do burn rate KRIs connect to a contingency plan?
Burn rate KRIs should be explicitly mapped to contingency triggers. When runway drops below 12 months, the contingency plan should define what happens: who is notified, what expense reductions are mandatory, and when fundraising outreach must begin. When runway drops below 6 months, the board should be directly involved in the plan. Without a documented connection between KRI thresholds and response actions, the KRI is just a dashboard data point.
What is the burn multiple and why do investors and risk teams both care about it?
The burn multiple is net burn divided by net new ARR — it measures how much cash you're spending to generate each dollar of new recurring revenue. Seed-stage companies average around 3.2x; Series B companies average around 1.4x. A deteriorating burn multiple can precede a runway crisis because it signals that spending is growing faster than revenue, even when absolute runway numbers still look adequate. Risk teams should track the trend as a forward-looking KRI alongside absolute runway.
Rebecca Leung

Author

Rebecca Leung

Rebecca Leung has 8+ years of risk and compliance experience across first and second line roles at commercial banks, asset managers, and fintechs. Former management consultant advising financial institutions on risk strategy. Founder of RiskTemplates.

◆ Related framework

KRI Library (132 Key Risk Indicators)

132 KRIs with thresholds, data sources, and escalation triggers pre-built for financial services.

Immaterial Findings · Newsletter

The brief, in your inbox.

Enforcement of the week, a framework breakdown, and the prompts that are actually worth running. Delivered to your inbox. Free.