GB Group — Update 22 February 2016

GBG is a global specialist in identity data intelligence. Its products and services help organisations in both the public and private sectors make better decisions about their customers and employees. Among other things, its services are used to improve the quality of customer data and the on-boarding process, as well as helping organisations protect themselves against the large and growing problem of identity fraud. GBG is expanding the range of identity services it can offer, to an increasing number of clients in a widening geographic footprint. In addition to its organic product and market initiatives, it has an active acquisition strategy and over the last five years has made eight acquisitions. It is now one of the largest providers in the industry, able to verify c 4.3 billion consumers globally, with know your customer (KYC) and anti-money laundering (AML) standards reached in 40 markets. Its products and services are sold to over 6,000 customers across c 70 markets. Headquartered in Chester in the UK, GBG has over 550 staff, operating out of 18 offices spanning the UK, Asia Pacific and the US and generates 26% of its sales internationally.

Approximately 70% of GBG’s revenues can be considered recurring, providing good revenue visibility. Operating leverage is strong and FCF cash conversion at c 90% of EBITDA supports GBG’s buy-and-build strategy. Organic growth has increased steadily in each of the last three years (from 7% in FY13 to 18% in H116), and gross margins have expanded from 65.4% to 75.9% over the same period as GBG benefited from acquisitions, growing scale economies and the migration of its customers to its new platform.

The market for identity verification remains buoyant, particularly internationally where GBG is seeing its strongest growth; more individuals are transacting and interacting online, increasingly cross-border and the scope and financial impact of global identity fraud is increasing. We forecast strong revenue growth to continue and, while additional investment is likely to dampen the operating leverage over the next few years and the depletion of previous tax losses means a more normalised tax rate going forward, we still forecast strong earnings growth and a replenishing of cash reserves after the acquisition payments made in the current financial year. We forecast net cash of £3.8m at the end of FY16, increasing to £12.1m by FY17. We would expect much of this to be used for acquisitions.

An FY17e P/E of 28.3x and EV/EBITDA of 19.2x recognises the growth prospects – our reverse DCF implies that the shares are discounting revenue growth of approximately 10% for several years. However, investors should bear in mind the group’s excellent acquisition record, which appears to be feeding growth in other areas of the business, along with its own potential strategic value to other corporates in a consolidating sector.

1. GBG is dependent on acquiring data from third parties, which, if they considered GBG a threat, could choose to withhold it. 2. The market is dynamic, particularly with regard to the use of mobile and social media data. This presents new opportunities, but also results in additional competition. 3. The acquisition and integration of international businesses potentially adds new growth channels, but, for language or cultural reasons, also adds risk. 4. With 26% of business now generated internationally, GBG will be increasingly exposed to currency movements, although there is an element of natural hedging through the cost base and cash reserves.

GBG provides identity data intelligence services on a global basis. By combining data from c 169 partners and over 320 datasets with its proprietary technology, it enables rapid data capture and search across many third-party databases, some of which are exclusive to GBG, along with data analysis and database management services. Its products and services are offered on an on-premise, managed or hosted basis and help companies recognise and verify the relevant elements of an individual’s identity in a real-time, empowering more informed and faster business decisions. In terms of reach, it is one of the largest providers in the industry, being able to verify c 4.3 billion consumers globally, with AML standards reached in 40 markets. It has more than 6,000 customers across approximately 70 markets and its long list of reference clients include blue-chip names such as HSBC, Betfair and Stripe.

GBG was originally founded as GB Information Management in 1989, an online systems and services provider. The company evolved into a more general database and marketing services company in 2002, when it also changed its name to GB Group. In response to the growing incidence of identity fraud and new AML legislation and following the development in 2003 of its flagship product – URU in partnership with BT – GBG increasingly focused on identity data, expanding its suite of products, partners and markets to become the specialist identity group we know today. GBG listed in 1995, moving to AIM in 2010.

The group benefits from a stable and experienced board. CEO, Richard Law has been with the group for over 20 years, joining in 1995 as finance director (FD) and was appointed CEO in 2001, leading the group’s focus on identity management. Dave Wilson, CFO, joined GBG in March 2009, and was appointed group finance and operations director later that year; he has a broad range of prior operational and board-level experience. The chairman, David Rasche, has been with GBG since September 2010 and has over 30 years’ experience in leading and chairing technology companies.

In April 2015, management updated its ‘20/20 VOS’ (vision, objective and strategy), which underpins its goal to become “the leader in identity data intelligence, informing business decisions between people and organisations globally”. GBG’s strategy centres on investment in product and market development and internationalisation, with organic initiatives supported by strategic acquisitions.

Product and market development: GBG invests c 40% of sales a year in data and product development. Adding data sets and product features enables GBG to both increase its addressable market by targeting new industries, while also making the products stickier. For instance, in 2016 it expects to gain direct access to DVLA data, which will give the car hire market an easier way to verify customers. A new feature planned for its Trace and Investigate solution follows the integration of location data from social media sites to its database, which will help customers track potential witnesses to a crime in a certain region.

GBG also has a dedicated team working on new product development. It has been selected for the new GOV.UK Verify service, a project the government hopes will help it to save up to £6bn a year in administration costs by enabling users to be verified remotely for a host of services such as self-assessment tax submissions, driving licence applications, pensions and allowances etc. GBG will be offering the service directly via its own brand ‘CitizenSafe’ and it has also been chosen by the Royal Mail to be the ID partner on its service, meaning it will be powering two of the nine authorised services on offer. It has started marketing its service, which will launch in the coming months. Other initiatives include a new product to verify ID on the blockchain, the creation of fraud bureaus in a number of markets across Asia (the first is expected to go live in March 2016) and the ‘tailoring’ of its existing products to new sectors.

GBG’s 25 business development managers promote its services directly to customers, and the acquisition of Loqate in April 2015 has added new channel partnerships with IBM and Oracle and means GBG now also has relationships with all the major companies listed in Gartner’s Magic Quadrant for Data Quality Tools. Currently, only one customer takes all of its products, leaving considerable scope to cross-sell to end-customers.

International markets – large opportunity, faster growth: the UK market is now fairly mature with the fastest growth coming from international markets; GBG’s international verification business increased by 60% in H116. Furthermore, as the data quality in many emerging international markets is much poorer than in the UK, the validation and verification solutions are often sold together (whereas in the UK there is less need for validation services as verification is driven off already validated postcode data). The group has 18 business development and eight product sales staff selling three of its six product categories internationally (ID Verification, Registration and Fraud Management). It targets the addition of 10 new markets a year and management expects c 50% of revenues to be from international markets by 2020, double the current level. GBG is using the 2014 acquisition of DecTech, which has a strong presence in the Asia-Pacific region as a platform to enter new markets and to cross-promote services among its client base. For example, since the acquisition, DecTech has launched in 12 new markets and has widened its target market to include GBG’s pre-existing client base in the gaming market.

Acquisitions form a key part of GBG’s strategy: management is targeting companies that fill data gaps, bring new technology or product sets, enhance its market position or help it to develop internationally. It has made eight acquisitions over the last five years, most recently, in April 2015, the remaining 73.3% of Loqate, a global location intelligence platform that added geo-coding capabilities and key vendor relationships in the US, into which management is planning to cross-sell other services.

GBG has a good track record in integrating acquisitions. For example, since acquisition, DecTech’s revenue growth has multiplied from 5-10% to 20-30% and the ‘Employ and Comply’ division, which is now the market leader in the UK for Criminal Records Bureau (CRB) screening, was built by bringing together three acquisitions (TMG, CRD and Advanced Checking Solutions [ACS]). During 2015, GBG appointed a dedicated M&A team to explore new opportunities and management has indicated that due to the market’s fragmented nature, numerous prospects are being considered.

3.4 billion people1 around the world are ‘connected’ and as the convenience of getting online increases (faster, cheaper and better mobile technologies), we spend more time transacting and interacting online. New business models are being created, old ones disrupted and trade is increasingly cross-border. Companies embracing these opportunities are also having to be ever-more vigilant to the threat of identity fraud, most of which occurs online. Identity intelligence is integral to ensuring a frictionless online customer experience, while also minimising the risk of fraud. The addressable market is very wide; most countries and sectors, both public and private, will need identity capture and verification tools at some level.

E-commerce and globalisation: global B2C e-commerce accounted for c 7.3% of retail sales in 2015 ($1.7trn, eMarketer) and is forecast to double by 2019 (to a 12.8% share). At the same time, an increasing share of e-commerce transactions are cross-border: 15% of online sales in 2014, estimated to increase to 30% by 2020 according to a report from Accenture and AliResearch. Companies increasingly have to verify customers from other markets, where customers have a limited credit history and where reliance on one credit check is no longer sufficient. Identity data intelligence addresses this by combining things like geolocation (vital when no formal postcodes are available), an overview of previous activity or social network identities.

Risk management: while the digitisation of societies has created many business opportunities and efficiencies, it has come with increased risk. The UK government estimates the impact of fraud at
1-2% of GDP in 2013, the majority of which was identity related (41% according to Cifas, the UK’s fraud prevention service) with c 80% thought to be perpetrated online. In many industries, ‘know your customer’ (KYC) and AML regulations stipulate a minimum level of identity verification. For other industries, the use of identity solutions is motivated by business imperative and the desire to improve the customer’s journey.

Explosion of personal information available: increased activity online, in particular the use of social media where individuals freely share their likes and dislikes, has resulted in an explosion in the amount of personal data available. However, this data is unstructured, multilingual and fragmented. Companies look to identity-verification solutions that capture, synchronise and organise this data, enabling a better understanding of an individual across multiple channels and geographies.

GBG markets products across six categories, which for reporting purposes are grouped into two divisions: ID Solutions (IDS; 58% of revenues FY16e) and ID Proofing (IDP; 42% of revenues FY16e).

We outline some of the features of the largest products below and summarise product strategy and competitive positioning in Exhibit 5, page 9.

ID Proofing solutions validate that individuals are who they claim to be, helping companies combat identify fraud and ensure regulatory compliance. Product offerings are categorised as ID Verification, Fraud Management and ID Employ and Comply.

ID3global is the global version of the original eIDV (electronic identity verification) service that GBG developed in the UK in 2003 in partnership with BT (branded URU). The technology provides real-time data-matching capabilities to validate the identity of individuals by matching common personal details (such as name, address and age) against reference data (utility bills, UK and international passport, payment card details, location etc), at the point of registration, without the need for physical documents, and with as little friction as possible. It also provides a valuable audit trail demonstrating that the necessary checks have taken place, thereby helping companies comply with international legislation. No personal data is disclosed by the reference databases and, as a result, ID3global is compliant with data protection laws.

The service is mainly used to help organisations protect themselves from the growing global problem of identity theft and fraud, for money-laundering checks, or to restrict underage access to content (eg for gambling). Services are bespoke, enabling users to draw on as much or as little data as they wish, providing cost transparency and control in terms of when to run the checks and what data to draw on; a bank that wishes to check the photo identity of a customer can capture and check not just the information in the driving licence, but also its quality (font size, picture quality and even the device used to upload the photo) to highlight suspicious documents.

GBG claims the widest coverage in terms of data sets and markets in the industry. It can verify the identity (at the most basic level) of over 4.3 billion individuals globally, in 190 markets, while being able to perform in depth identity checks that meet AML standards in 40 markets (800 million citizens) around the world. GBG has many reference clients (http://www.gbgplc.com/uk/resources/) and the value proposition is clear. For example, Tempcover’s panel of motor insurers reported a 20-point drop in its loss rations after implementation of ID3, with a 20% reduction in claim values leading to a £1m saving overall.

GBG branched into risk management and fraud detection and prevention in 2014 with the acquisition of DecTech (May 2014). The majority of revenues come from GBG Activate, a customisable credit-scoring and management system used in on-boarding customers. It also has an expanding presence in the identity fraud prevention market with GBG Predator, which monitors customers' transactions to stay alert to abnormal behaviour and GBG Instinct, a fraud-management engine that checks customer data against globally available identity information: account numbers, previous applications, blacklists, criminal databases etc.

DecTech has a strong presence in the Asia Pacific region, particularly in the financial services industry, and is experiencing strong growth. One of the key differentiators of the service is that it can operate in multiple languages (rather than translating into one overriding language then translating back), which increases its accuracy and hit rate in identifying anomalies. It also enables greater configurability by customers, who can set and edit their own rules for pass or rejection rate criteria. This means any changes required can be accommodated quickly and easily, without lengthy or expensive change requests – a key differentiator in fraud management sector where fraud prevention needs to be reactive and iterative.

Through the group’s acquisitions of ACS (2011), TMG (2012) and CRD (2013), GBG is now the UK’s largest umbrella organisation for screening and verifying new employees. UK employers, or organisations looking after vulnerable adults and children, can outsource their entire employee DBS checks (Disclosure and Barring Service) and background screening to GBG, removing this operational burden while maintaining a rigorous approach to HR compliance.

Products in this division help clients improve customer understanding, for instance by ensuring a smooth customer registration or supporting retention and revenue generation by improving their knowledge of a customer. Services are built on GBG’s web-based data capture and matching capabilities, but may also involve constructing, managing and hosting client databases. Solutions in this division are categorised as ID Registration, ID Engagement and Trace and Investigate.

For organisations, the act of registering and verifying a customer’s details is the first step in a longer customer journey that will, hopefully, see the customer connect with the brand. Matchcode360 makes the customer registration process smoother, faster and more accurate by pre-populating online forms. Not only does this assure more accurate data, but it reduces considerably ‘cart abandonment’ by reducing the time it takes to fill out forms. Customers draw on a range of data suites – for instance, Moneysupermarket.com matches gas and electricity meters to postcode data, which enables instant account switching. Zurich Assurance draws on death and birth rates to assess failure scores.

Matchcode360 is a global solution that can draw on data across borders, using a single API. It is updated on a daily or real-time basis and claims to have access to the widest range of UK and global address and location data (postcodes, Land Registry information, Royal Mail data) and the broadest range of contact data checks (email, mobile phone numbers, addresses). It is also currently the only service that enables offline and online identity profiles to be synced by linking emails to over 130 social media networks.

Customers expect brands to recognise them and treat them consistently regardless of where or how they interact with an organisation. While there is now significantly more personal data available to support an organisation’s understanding of a customer, this data is unstructured and fragmented. GBG Marketing Services offers database creation, management and analysis to help develop an accurate single view of a customer and consequently the most appropriate digital marketing strategy. Unlike many of its competitors, GBG has access to social media feeds from 130 networks, can also now integrate the online profiles of many customers to help companies construct a targeted social media marketing strategy.

By combining GBG’s national identity register with real-time data from social networks and other consented data pools, Connexus helps customers locate and contact individuals. This product is popular with the debt recovery market and police forces (GBG contracts directly with 60% of the UK’s forces) to help trace individuals or identify potential associates, in the insurance market to spot potential fraud (eg by linking people in ‘crash for cash’ schemes), for reunifying financial assets (£15bn lies unclaimed in old UK bank accounts, pensions, life assurance and investments) and increasingly by the retail industry to help identify employee-linked stock theft.

GBG both buys services from and sells them to major credit rating agencies, which represent its main competitors. These include the largest, Experian (EXPN LN), along with smaller agencies, such as Callcredit Marketing Solutions (the marketing division of Callcredit Information Group, owned by US private equity company GTCR), Equifax (EFX US) and FICO (FICO US). For its UK-focused products (Trace and Investigate, Employ and Comply) it also competes against Lexis Nexis Risk Management and in digital marketing and database services against a host of competitors including IBM and Oracle.

GBG primarily differentiates with the breadth and depth of its data pools both within and outside the UK. While the credit rating agencies are considerably larger than GBG and have excellent e-IDV services, they are limited to their own credit data meaning that in some markets (eg Germany, Italy, France, China, Malaysia), they cannot compete. GBG consolidates a much wider range of range of data points (including from these companies) and across many more markets. This is particularly important in developing markets where customers often do not have a credit footprint and verifying identity can be difficult if restricted to one source. Management also points to the ease of integration of its products, which require a single API (most competing products require an API for each geography) and that its services are bespoke, using a SaaS business model with transparent pricing based on data use.

GBG’s strategy has been well executed. Over the last three years, organic revenue growth has ticked upwards to 18% in H116, supplemented by three significant acquisitions. Normalised EPS has tripled despite an £11m fund raising in April 2014 (Exhibits 6 and 7).

Products are sold on a subscription or multi-year licence basis. Product pricing typically comprises a one-off set up fee, followed by a DaaS (data as a service) single or batch pricing structure flexed for volumes, feature sets and the number of users. This is also the basis on which GBG acquires third-party data, so profitability can be managed. Customers stay on average for 10 years, and the more data, feature sets and training are added, the stickier products become, with client churn risk increasing when new systems are deployed. There is a high revenue visibility, with approximately 70% of revenues ‘secure’, stemming from renewals, long-term contracts or repeat business and customer concentration is low. GBG’s largest four customers account for less than 7.5% of group revenues.

Cost of sales relate mainly to the cost of acquiring and managing data. Gross margins have increased in recent periods (71.3% in FY15 from 65.4% in FY14) as the group benefited from scale economies in data acquisition, and the migration of its ID Verification customers over to its ID3 Global platform (BT’s was previously hosting this service). This migration is now complete and we expect gross margins to remain broadly flat moving forward, with scale benefits in mature markets being offset by lower margins in newer territories. Operating expenses are largely of a fixed nature (R&D, sales and administration). However, the operational gearing effects of a strong trop line are currently being offset in part by the group’s investment in additional growth.

We expect strong organic revenue growth to continue over the next few years and forecast 10-15%, supported in FY16 and FY17 by the impact of the recent acquisitions. Our current year revenue forecast looks firmly underpinned – at the end of September 2015, GBG reported deferred income of £10.9m, representing c 30% of our H216 revenue forecast. In FY17 and FY18 our organic growth forecast reflects the structural tailwind in the industry coupled with the group’s international roll-out plans, the potential to cross-sell products and, in the UK, the introduction of the new GOV.UK Verify service.

Operating margins, which have increased consistently over the last three years (from 15.2% in FY13 to 18.8% in FY15) are being affected by the investment in the GOV.UK Verify project, the consolidation of Loquate, which was loss making at the time of acquisition (£171k in the H116 – we expect break even in FY17) and investment in the international roll-out. H116 operating margins decreased by c 2pp, and we forecast FY16 operating margin of 15.9%, c 3pp below that of FY15. However, the GOV.UK Verify service launches in April 2016 and we expect Loqate to move to break even during FY17, and forecast a recovery of operating margins to 16.8% and 18.0% in FY17 and FY18 respectively.

In recent years, the group has benefited from the use of accumulated tax losses. These tax losses have now been largely depleted and, consequently, we expect the tax rate to revert to a normalised level, which we expect to gradually increase as a larger share of earnings is generated from the higher tax territories outside the UK.

Based on these assumptions, we introduce an FY18 forecast EPS of 10.3p (we make no material changes to our FY16 and FY17 estimates). Our forecasts are presented in Exhibit 9.

EBITDA to FCF was 93% and 131% in FY14 and FY15 respectively and we expect cash conversion to remain strong. The majority of R&D costs are expensed, and we forecast a run rate of total capital expenditure of around £2m over the next few years. The working capital profile has been slightly positive over the last few years. This has been partly a function of cut-off (particularly for governmental customers) and partly a function of the upfront invoicing for some of GBG’s CD-based products (evidence the growing deferred income balance).

After £13.1m of payments for Loqate (£8.3m) and the first tranche of the DecTech earnout (£4.8m), and £2.3m of dividend payments, GBG reported £1.2m of net cash at the end of September 2015, comprising £4.8m cash and a A$7.4m loan (£3.6m).

We forecast net cash of £3.8m at the FY16 year end. In FY17 a further £1m of deferred consideration is expected for DecTech, which is easily covered by operating cash, and we forecast net cash to increase to £12.1m. Management has also put in place a £50m revolving credit facility (incorporating a £20m accordion option), giving the necessary flexibility for bolt on acquisitions, although for larger targets additional funds may be required.

We look to a range of valuation tools to gauge GBG’s’s value.

Peer multiples: the shares trade on an FY17e (March year-end) P/E of 28.3x and an EV/EBITDA of c 19.2x, a considerable premium to peers (EV/EBITDA of 9.4x, P/E of 17.5x). Most of GBG’s peers (Exhibit 8) are considerably larger, few are pure-play identity data specialists, and, with the exception of (loss making) Intercede Group, all are forecast to deliver lower organic revenue growth. With this in mind, we consider GBG’s premium to sector peers is justified. It is likely that the shares are also reflecting an element of value from future acquisitions, given GBG’s strategy and past performance.

DCF valuation: our reverse DCF (using a WACC of 10.5% and assuming a growth rate of 3% in perpetuity after year 10) implies that the shares are discounting organic growth of c 10%, with EBITDA margins expanding accordingly.

M&A activity: GBG may also hold strategic value for other data management groups; the sector remains ripe for consolidation and, with strong growth rates, the pool of interest is wide, supporting high transaction valuations, for example:

While DCF and peer multiples suggest that the shares are already acknowledging good prospects, we believe the current share price is underpinned. Investors should bear in mind the following:

The major sensitivities for the group include:

The extent/timing of market take-up of electronic ID verification: while the market for electronic ID verification has continued to grow at a strong pace since its launch in 2007, in the UK it is fairly mature and, while growing, it is experiencing some pricing pressure. Much of GBG’s organic growth is coming from international markets, where the pace of uptake may be affected by the timing of GBG’s roll-out to new geographies, or major client wins.

Competition from the major established credit-checking players: GBG’s largest competitors grew out of credit checks for the financial services sector, where they have strong relationships with the major banks. They are broadening their offerings, and are significant current and potential competitors in the identity-checking market.

Competition from newer players in the social media sector: the market is dynamic and fragmented and new technologies and competitors could disrupt the market – for instance, the emergence of data exchanges, where companies can directly offer their customers data via public exchanges.

Changes in regulation/legislation in the ID verification market: increasingly, regulatory bodies such as the Financial Conduct Authority and gaming legislators are insisting on identity verification for a vast range of trading activities. Changes in regulation and legal requirements across a wide range of industries and market sectors can enhance or adversely affect operations.

Acquisition strategy: GBG has a good track record in integrating acquisitions from Asia. However, the businesses that it acquired here had their origins in English language markets, and acquisitions in emerging markets typically pose greater integration challenges.

Disruption to and/or changes in sourcing data from suppliers and partners: as well as its own data, GBG relies on data from external sources to maintain its databases. Disruption to and/or changes in access to some or all these, particularly the larger vendors (for instance if they felt that GBG was becoming a threat), could affect the group’s prospects.

Currency: 26% of revenues are derived internationally. GBG does not actively hedge its currency exposure, although there is an element of natural hedge via the operating cost bases in these international markets and via cash deposits.