Credit risk in the case of a CDO (Collateralized Debt Obligation) is borne by:

Investors in CDOs bear credit risk. The SPV is merely a conduit that owns the underlying assets on which the sponsoring institution has bought protection. The investors have sold them this protection, and are on the hook for defaults or other credit events. The reference entity is relevant only to CDSs, not CDOs. Choice 'b' is the correct answer.