All Your Eggs in One Basket: Assessing the Risk of Using Just One Fund Company or Brokerage

As investors, we're well aware of the different kinds of risks we must face: from market risk to credit risk to interest-rate risk ... the list goes on and on.

But in addition to the risks inherent to owning specific investments are the risks inherent to investing itself. After all, the legacy of the 2008-09 financial crisis includes not only the fact that the markets tanked, but that the entire financial system--including many financial-services firms--seemed to be on the verge of collapse.

Fast forward to today and another major threat looms: that of a hacker attack or data breach that could wreak havoc on financial-services firms and their customers. The list of companies already victimized by hackers includes corporate heavyweights like

in Russia, China, the U.K., and elsewhere, proves that the ability to steal assets from financial institutions is not merely theoretical.

Perhaps that's why one of the most common reader questions we get here at Morningstar.com is whether it's safe for individual investors to keep all or most of their assets at one fund shop or brokerage. Given the modern-day dangers we've just described, it's understandable that some readers would have misgivings about putting their entire life savings under just one roof. But how risky is it, really?

To help answer this question, let's take a closer look at these more recent risk factors, plus one that's been around for a while: the risk of investing all of your assets with a fund shop that is a poor steward of investor assets and/or does not offer a selection of quality funds across asset classes.

Firm-Level Financial Risk The first question we'll examine is what happens if the fund company or brokerage experiences a financial disaster such as a bankruptcy or financial fraud. The answer requires that we consider each type of financial service provider separately.

Mutual Fund Accounts If the thought of a disgruntled fund-company employee stealing your assets keeps you up at night, you can probably rest easy. While mutual fund companies manage your money for you (and for a fee), they don't actually have possession of the securities owned by the fund and its shareholders. By law, that is done by a custodian, typically a bank. So, for example, while a mutual fund manager decides what stocks to buy and sell in the course of running the fund's portfolio, it's the custodian that actually holds the securities. This arrangement helps safeguard fund assets, and banks that act as custodians are, in turn, required to keep securities over which they have custody separate from other bank assets.

The custodian also may serve an administrative role for the fund, recording shareholder transactions, distributing dividends and capital gains, and mailing out account statements.

Bottom Line: It's important to remember that the fund company may manage your assets but it doesn't possess them. So, even if it runs into financial trouble or fraud, that shouldn't affect the value of your fund or its holdings.

What's less clear is what could happen if the custodian used by one of your funds were to experience financial trouble or fraud and what safeguards are in place to protect the fund's assets. Morningstar reached out to two of the largest custodian banks,

Brokerage Accounts With brokerage accounts, things work a little differently. For individual investors, the brokerage often acts as the custodian, maintaining possession of the securities owned by its customers but segregating them from assets owned by the brokerage itself. To ensure the safety of investor assets in case a brokerage gets into financial trouble or declares bankruptcy, most brokerages are required by law to be a member of the Securities Investor Protection Corporation, or SIPC. SIPC steps in when brokerages go out of business and provides $500,000 worth of insurance per account for any missing securities and up to $250,000 for missing cash. (SIPC is not to be confused with the FDIC, which insures bank deposits up to $250,000 per account owner but which does not cover brokerage cash accounts. Also, the FDIC insures that bank depositors won't lose any of their principal, whereas SIPC does not insure investors against investment losses.) Because SIPC coverage is configured by account and not by investor, someone with, say, an IRA and a taxable account at a SIPC-member brokerage would be covered up to a total of $1 million in securities and up to $500,000 in cash.

To cite one very high-profile example, SIPC has been involved in helping to pay debts stemming from the dissolution of stock broker Bernie Madoff's firm following the financial crisis. It's estimated that around $18 billion was found to be missing after Madoff's elaborate Ponzi scheme unraveled. As of the end of last month, about $7.2 billion had been returned to Madoff clients, of which $824 million came from SIPC. SIPC also pays for administrative costs associated with settling the firm's affairs.

According to SIPC's 2013 annual report, the agency has paid out more than 625,000 claims since it was created in 1970. But only 352 of those claims, worth a total of $47.3 million, exceeded the SIPC recovery limits. (For more on SIPC's history and operations, read "What Happens if My Broker Goes Bust?" and for more on the procedures involved in a SIPC liquidation, see this FINRA webpage.)

Bottom Line:

For most investors, the $500,000-per-account limit on SIPC coverage may be more than adequate in case their broker encounters financial problems. However, if you have individual accounts in excess of that amount, you may want to contact your brokerage and ask if it provides additional insurance above that amount.

. However, it's unclear whether these added coverages would be enough to compensate all brokerage customers in the event of a widespread theft of assets.

Hacking Risk As mentioned earlier, hacking and data breaches have become a serious threat to businesses worldwide, and financial firms are no exception. While individual investors can take their own steps to guard against online investment fraud--such as avoiding making transactions over public Wi-Fi connections and changing passwords periodically--it's also up to financial providers themselves to help protect investors' assets and information.

As you might expect, cybersecurity has become a major area of focus for financial-services firms, many of which have banded together to try to combat the problem. Kim Hillyer, communications director for TD Ameritrade, says the brokerage is part of a working group of financial-services firms that share real-time information about cyberthreats. "The 'bad guys' never stop, and this constant flow of communication among firms helps us learn about the changing threat landscape--and respond," Hillyer says.

Some financial-services firms offer guarantees against financial loss from cybercrime under certain conditions. For example, Vanguard's online fraud policy pledges to reimburse customers for any assets stolen via unauthorized online transactions, but only if the customer has taken certain safety measures, such as protecting his or her username and password and having up-to-date firewall and anti-spyware software on his or her computer. The protection covers both Vanguard mutual fund and brokerage clients. Fidelity offers a similar guarantee with similar requirements. Both firms' guarantees exclude some investment types, such as 529 college-savings plans and annuity products.

T. Rowe Price does not explicitly offer the same guarantee; however, company spokesperson Brian Lewbart said that if an unauthorized removal of funds from a customer's account does take place, the firm might replace the assets following an investigation to determine responsibility. "Based on this evaluation, the firm will then make a decision on whether to financially restore the account to its original status," he said.

Vanguard spokesperson Emily White said that if a custodian bank suffered a cyberattack that resulted in the loss of client assets, "the custodian would be expected to restore assets and would likely have insurance to cover part or all of those reimbursements." She said that Vanguard's fraud policy would still apply in such a case.

Among brokerages, TD Ameritrade, Charles Schwab, and E-Trade all offer guarantees against customer losses due to unauthorized account activity.

Bottom Line: Hacking is a very real threat to all investors, but is it a good reason to spread your assets out among multiple firms?

While having all of your assets with one provider arguably does increase your degree of vulnerability, spreading them out among various firms brings with it a host of inconveniences. For one, tracking your investments and your overall allocation becomes more onerous, as does moving assets between accounts. By having smaller balances at more firms, you also may be forgoing certain services--such as financial advice, access to lower-cost share classes, and lower trading fees--that some financial firms offer only to customers with assets above a given minimum balance.

Also, consider that by spreading your money around you may actually increase your odds of running into cyberthreats. After all, the more firms that have a chunk of your assets (and personal information), the more likely you are to be victimized--at least, in theory.

Whether you decide to keep your money all in one place or spread it around, be sure you understand your investment company's or brokerage's policies with regard to cybertheft. It's important to know what is protected and what your role is in the process. Also, be sure to familiarize yourself with safety measures you can take, such as only conducting businesses on secure websites and using identity safeguards. One example of an identity safeguard would be a two-factor login, in which you are asked a security question in addition to providing your username and password. (For more on cybersecurity and ways to protect yourself, read this Q&A with financial-industry experts.)

Stewardship and Fund-Selection Risks Of course, not all the risks associated with keeping your assets under one financial roof are new. Some have been around as long as mutual funds themselves.

One important risk to be mindful of involves fund-company stewardship. Poor stewardship can take many forms, such as overcharging investors for using the company's funds, providing managers who do not invest substantially in the funds they run, a corporate culture that does not encourage collaboration or retention of talent, and regulatory issues that could lead to fines. That's why if you are thinking about investing the bulk of your assets with one fund company, it is imperative to check the firm's Stewardship Grade. You can read about how the grade is computed and find a breakdown of grades for many major fund shops in the 2014 Morningstar U.S. Mutual Fund Industry Stewardship Survey here.

Likewise, if the fund company you choose for the bulk of your assets has a narrow lineup of funds, you may have trouble adequately diversifying your portfolio. For instance, a company may have a strong lineup of U.S. equity funds but weak international or fixed-income offerings. This is less likely to be a problem at larger fund shops with diverse mutual fund and ETF lineups, or if you're investing through a brokerage platform that allows you to pick and choose funds you like from various providers.

Last but hardly least is so-called key-person risk (formerly called key-man risk, but changed for obvious reasons). Look no further than last fall's PIMCO/Bill Gross saga for evidence of how disruptive the departure of a key individual can be to a fund shop. It remains to be seen how the departure of the firm's co-founder and longtime manager of flagship-fund

The risk of an important manager departing--willingly or not--is one reason why stewardship, and retention of talent in particular, is so important. Fund companies that can't hang on to top performers run the risk of having to turn to a weak bench if key managers walk out the door. For more on minimizing manager risk, read this article by Michelle Ward, an investment manager with Morningstar Investment Management.

Bottom Line: You might not pay as much attention to a fund's Stewardship Grade as you do to other key characteristics, such as its process, performance, and price; but if you ignore stewardship, you do so at your own risk. Owning funds from shops that practice good stewardship, with strong track records of talent retention and pro-investor cultures, is one way to tamp down on key-person risk (and quite possibly to boost your returns, as this Morningstar study found).

Another way is to simply avoid funds that are actively managed--that is, to use index funds. Without the need for a fund manager selecting individual securities and managing the fund's portfolio, index-fund investors needn't worry if the manager departs. In fact, they are unlikely even to notice.

The Big Picture To end, let's return to our primary question about keeping all of one's assets at a given fund company or brokerage. Are there risks? Sure there are, but do they outweigh the advantages? That's the question investors must ponder for themselves.

For those whose invested assets fall within the financial protections offered by SIPC or their brokerage, who adhere strictly to online-security guidelines, who invest only with fund companies with strong Stewardship Grades, and--perhaps most of all--who understand the policies of their financial-services firms with regard to these issues, there's no compelling reason not to keep all of one's assets under the same roof.

Of course, if it makes you more comfortable to hedge your bets by spreading your assets around, there's nothing wrong with that approach either. But even then, the same sort of due diligence is required. That means reading through any documentation your fund company or brokerage sends you about investor protections, or looking up the information online, if necessary. If you can't find it there, call them up and ask. The time to find out what protections are in place is now, before any potential crisis hits.