passthrough risk