We develop a framework to analyse the credit default swap (CDS) market as a network of risk transfers among counterparties. From a theoretical perspective, we introduce the notion of flow-of-risk and provide sufficient conditions for a bow-tie network architecture to endogenously emerge as a result of intermediation. This architecture shows three distinct sets of counterparties: (i) Ultimate Risk Sellers (URS), (ii) Dealers (indirectly connected to each other), (iii) Ultimate Risk Buyers (URB). We show that the probability of widespread distress due to counterparty risk is higher in a bow-tie architecture than in more fragmented network structures. Empirically, we analyse a unique global dataset of bilateral CDS exposures on major sovereign and financial reference entities in 2011–2014. We find the presence of a bow-tie network architecture consistently across both reference entities and time, and that the flow-of-risk originates from a large number of URSs (e.g. hedge funds) and ends up in a few leading URBs, most of which are non-banks (in particular asset managers). Finally, the analysis of the CDS portfolio composition of the URBs shows a high level of concentration: in particular, the top URBs often show large exposures to potentially correlated reference entities.